jwt-token-analysis-phase1.mdā¢5.22 kB
# JWT Token Analysis - Phase 1 Research
**Date**: June 27, 2025
**Research Phase**: 1.1 JWT Token Analysis
**Status**: In Progress
## JWT Token from Successful URL Generation
**Source**: EuConquisto Composer MCP server `get-composer-url` response
**Raw JWT**:
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImFkbWluLmRlc2Vudm9sdmltZW50b0BldWNvbnF1aXN0by5jb20iLCJuYW1lIjoiQWRtaW4gRGV2Iiwib2lkIjoiNWZiM2RlYzYtYzQ5NC1lYzExLWEyMmEtZGM5ODQwNDFjOTVkIiwiZGlyZWN0b3J5IjoiYjBmZWY4NjAtYzQ5NC1lYzExLWEyMmEtZGM5ODQwNDFjOTVkIiwiYXBpbSI6IkVFQzUzQTI0LUVDMEUtNDFCOS05NDA1LTg2QTE3NTAwREIzNCIsImRpcm4iOiJEZXNlbnZvbHZpbWVudG8iLCJyb2xlIjpbIlJldmlld0NvbnRyaWJ1dG9yIiwiQ29udHJpYnV0b3JHbG9iYWwiLCJBZG1pbmlzdHJhdG9yR2xvYmFsIl0sImRjbiI6WyJINHNJQUFBQUFBQUFBMkptWUdBd1pRQ0JaQXVqRkdNREM0dFYyMXRTRS1vZHA5NElpMnVVYTNqMXNxRXl6YWhrN3ZxWlN5MG5sLV94c3cyb0xEN05jT2ppRThWelhyZDBEamF3XzQyVW1fZmxrT1loZzlVN0ZKOGx5N1dWQVFBQUFQX18iLCJINHNJQUFBQUFBQUFBMkptWUdBd1pRQ0JaQXVqRkdNREM0c2xCWS0zTjB5WkU1S1NNSFhKTzhjcm0wNS1remgtYVBzTXhtMnZvOTBxYzhXTjktX08wRzRMbmo5dDRqb2R4bnZNdVkycHJEd1NrYlkyamJOMnpuNXJvemJmR3dBQUFQX18iLCJINHNJQUFBQUFBQUFBMkptWUdBd1pRQ0JaQXVqRkdNREM0dnpkMWU1SDFGTzVhenRyR1RuZXZ6emx0U0djM3VFT1IteHExWXZNVHF5NGstaThXR0gwd292cC1ka3FjNm82d2xSZkM0d3k5MVcxSHFqOFU4aEMtRWZMa0pSQUFBQUFQX18iLCJINHNJQUFBQUFBQUFBMkptWUdBd1pRQ0JaQXVqRkdNREM0dU5XMnUyS3A5dXZhUGhkOFNpOE9KNV8yTmRmZnNTSC0temZHTXVmX084Wm5GbXFXRE5qeE1ubnBWelRkVTBPVF9mUldtNVVhTkxlV2oyTjY5Y3JRS0x1SmJQQUFBQUFQX18iLCJINHNJQUFBQUFBQUFBMkptWUdBd1pRQ0JaQXVqRkdNREM0czY2NE5odVhwck52S3FiV1RuUEtGNTU2UzRycXdXNDJ1SnkzbjNGVkxFVjZ4VlljdU9kTnVrZXliMjdKbjRlOS1GaGNNdW1iOTZ1cUx0aEptSDJrX0h0U29MQUFBQUFQX18iLCJINHNJQUFBQUFBQUFBMkptWUdBd1pRQ0JaQXVqRkdNREN3dWpCWjhyQW81RUxEaHRvQ2ZUdmVQcTVET2hpd1dtM3A2eFktTDdIYkpTb2RFU2I2SUVWQ3BQcXpETTJ2WlR6VzlsMXBrWlBFb3Zkbl8tV3R2LWY0bkt3dmEtU0FBQUFBRF9fdyJdLCJzY3AiOlsiSDRzSUFBQUFBQUFBQTJKbVlHRHdZQUFCMDZRMDA5VFU1RlNKTmZzV1NKNDRWWGZBeHZYeDVEc3lzaFhPNmllVGk0cWVYbTZaVVN2QzZ2djNST0hNRDBkVHBDVHUzekFfVUMtWVVIOHIyMzNlS29mQ0hZR3UwWG83aWswWGROWVVxdmotV0hfclhiU3VVYnJZM1VZQUFBQUFfXzgiLCJINHNJQUFBQUFBQUFBd0RTQWkzOUF3QUFBck1BQUFBQUFHRTVaalF6TkRsa2E0TWozbjdQejY0dmpPSWl5LVlNb3dhRDdlMWpqcDZJakE2SVFZMi14TFNOTWFSZWNrTTdzWEJKamR2SkpoeUF5TnZJVHQ5aUFFWHcybVVzM3lIbGc2UHNtSld1Mm1EU2UwbXlrYnQ0OGl1NTlkYTIxMVBNdkxyRzdxOV9teDlhYWI0SjdZbWlNODg2OTVUclk3WFY1Nmlsb3UwdnQ4VmdBMWptbkdYd0paa0ZDTXhYaUlhcGl5S01TVGlfa3BnREdQdlRlYUNNdE5GSXlIU0gwUTZ3bTFwRkJBYzRMQ1dqRThMeWtnc1ZtbEJxRG9aek1oZTVnY21sZHl0VW1FVFltakIyakVaUHdvd0M2NFRZb1JudDJOWkpmRDdDZXg1T3FqY1ptVU5tNjMtVlRYOFh0UEtza1BpSnpIb3kzcHF5dXVycnVrTndZenducHpwak51OEdKZXQ4V2RoMl85ckNoVnpPUnR4N1N5UXEyb2prUmJfWEphenFtTnEwMEVTcTNSZUVSX0pQZmhGOGg4bGlxcGVWeE1FSG5RUGFmMXp2N3FVQ3JzTWtrVjc1TmxnRGVUZ1YvWGVyX0Rud3FkektCOFdtY1p0OXFjMXZpU0ROV1JHZVN0bHc3d250UzFSSXlBN205cS01YU9FLUx0ODB3bE1HTkxOTi1TVFN3OWVDN2dxVmQtSUZZWlhYQ2NZcWNfcWc1dDhodFdSLVJ2cUJsX3Fjbkt2N2xhaHk5elRTaHJfX1BTRWJqdTg0SkhDV3I5SXhGd2lzYVd1eVZiMUp0ZUQzcDk0WnpWZDhnTEJQRGFRVUJMZHc1SVEzWkJIc3daTXExRjJqVGdEcF92RDJLQzZzVnd1dVhaa3RzYWlrc3pMZW5NcTFUVjRUMmF5QUdyVHB3UlUzMFMwc3hfQ3pCRVlLREV0b2s4eDI5TGlnUnlHMnVfZDVpOHRyVEJ1WTNjVFdzSXVIdzRibXNVV1lkTXNwblRMMXpwNE1LWUFBQURfX3ciXSwibmJmIjoxNzQ4ODc2OTU1LCJleHAiOjE3NTE0Njg5NTUsImlhdCI6MTc0ODg3Njk1NSwiaXNzIjoiaHR0cHM6Ly9hcGkuZGlnaXRhbHBhZ2VzLmNvbS5iciIsImF1ZCI6IkV1Q29ucXVpc3RvIn0.iTUfl6-mwLwFaxYYPf6PufRSYbSJlw3tKejmbc5G42g
```
## JWT Header (Decoded)
```json
{
"alg": "HS256",
"typ": "JWT"
}
```
## JWT Payload (Decoded)
```json
{
"email": "admin.desenvolvimento@euconquisto.com",
"name": "Admin Dev",
"oid": "5fb3dec6-c494-ec11-a22a-dc984041c95d",
"directory": "b0fef860-c494-ec11-a22a-dc984041c95d",
"apim": "EEC53A24-EC0E-41B9-9405-86A17500DB34",
"dirn": "Desenvolvimento",
"role": ["ReviewContributor", "ContributorGlobal", "AdministratorGlobal"],
"dcn": ["[compressed_data_1]", "[compressed_data_2]", ...],
"scp": ["[compressed_scope_data_1]", "[compressed_scope_data_2]"],
"nbf": 1748876955,
"exp": 1751468955,
"iat": 1748876955,
"iss": "https://api.digitalpages.com.br",
"aud": "EuConquisto"
}
```
## Key Findings
### Authentication Details
- **User**: Admin Dev (admin.desenvolvimento@euconquisto.com)
- **Roles**: AdministratorGlobal, ContributorGlobal, ReviewContributor
- **Organization**: Desenvolvimento (Development)
- **API Manager ID**: EEC53A24-EC0E-41B9-9405-86A17500DB34
### API Infrastructure
- **Issuer**: https://api.digitalpages.com.br
- **Audience**: EuConquisto
- **Token Valid Until**: April 2025 (long-term token)
### Permissions Analysis
- **AdministratorGlobal**: Full admin access to system
- **ContributorGlobal**: Content creation permissions
- **DCN/SCP Fields**: Compressed permission data (requires decompression)
## Next Research Steps
1. **Test API Base URL**: `https://api.digitalpages.com.br`
2. **Explore endpoints**: `/api/v1/compositions`, `/api/v1/widgets`, etc.
3. **Test authentication**: Use JWT as Bearer token
4. **Manual composition creation**: Monitor network calls during UI usage
## Hypothesis
Based on the JWT structure and permissions, direct API access is **highly likely** available for:
- Composition CRUD operations
- Widget management
- Content creation
- Metadata editing
**Status**: Proceeding to Phase 1.2 - Manual composition flow analysis