WSO2 API Manager & OAuth2 Protected Endpoint (with Registry Resource to store and retrieve the tokens)

oauth2-enhanced-sequence.xml

<?xml version="1.0" encoding="UTF-8"?>
<sequence name="oauth2-enhanced-sequence" xmlns="http://ws.apache.org/ns/synapse">
    <!-- retreiving the access token and the generated time if exists in the registry location -->
    <property name="stored-token" expression="get-property('registry', 'gov:/oauth_endpoint/access_token')" scope="default" type="STRING" />
    <property name="generated-time" expression="get-property('registry', 'gov:/oauth_endpoint/generated_time')" scope="default" type="LONG" />

    <!-- token generation to the oauth server's token endpoint -->
    <!-- add the base64 encoded credentials -->
    <property name="client-authorization-header" scope="default" type="STRING" value="MDZsZ3BTMnh0enRhOXBsaXZGUzliMnk4aEZFYTpmdE4yWTdLcnE2SWRsenBmZ1RuTVU1bkxjUFFh" />
    <property name="request-body" expression="json-eval($)" scope="default" type="STRING" />
    <property name="resource" expression="get-property('axis2', 'REST_URL_POSTFIX')" scope="default" type="STRING" />
    
    <!-- enhanced to perform subtract function -->
    <property name="CURRENT_SYSTEM_TIME" expression="get-property('SYSTEM_TIME')" type="STRING" />
    <property name="token_generated_time" expression="get-property('generated-time')" type="STRING" />
    
    <!-- filter and based on the validity condition make the token call -->
    <filter xpath="get-property('CURRENT_SYSTEM_TIME') - get-property('token_generated_time') > 3600000 or get-property('stored-token') = ''">
        <then>
            <!-- creating a request payload for client_credentials -->
            <payloadFactory media-type="xml">
                <format>
                    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
                        <soapenv:Body>
                            <root xmlns="">
                                <grant_type>client_credentials</grant_type>
                            </root>
                        </soapenv:Body>
                    </soapenv:Envelope>
                </format>
                <args></args>
            </payloadFactory>

            <!-- set related headers to call the token endpoint -->
            <header name="Authorization" expression="fn:concat('Basic ', get-property('client-authorization-header'))" scope="transport" />
            <header name="Content-Type" value="application/x-www-form-urlencoded" scope="transport" />
            <property name="messageType" value="application/x-www-form-urlencoded" scope="axis2" type="STRING" />
            <property name="REST_URL_POSTFIX" value="" scope="axis2" type="STRING" /> 
            
            <!-- change the token endpoint -->
            <call blocking="true">
                <endpoint>
                    <http method="POST" uri-template="https://localhost:9443/oauth2/token" />
                </endpoint>
            </call>

            <!-- extract the access token from the response -->
            <property name="bearer-token" expression="json-eval($.access_token)" scope="default" type="STRING" />

            <!-- store the generated token and the time -->
            <property name="gov:/oauth_endpoint/access_token" expression="get-property('bearer-token')" scope="registry" type="STRING" />
            <property name="gov:/oauth_endpoint/generated_time" expression="get-property('SYSTEM_TIME')" scope="registry" type="LONG" />

            <!-- append the acquired access token and make the call to the backend service -->
            <property name="REST_URL_POSTFIX" expression="get-property('resource')" scope="axis2" type="STRING" />
            <header name="Authorization" expression="fn:concat('Bearer ', get-property('bearer-token'))" scope="transport" />

            <payloadFactory media-type="json">
                <format>$1</format>
                <args>
                    <arg evaluator="xml" expression="get-property('request-body')" />
                </args>
            </payloadFactory>
        </then>
        <else>
            <!-- the stored access token is still active, so we will be using that to invoke the endpoint -->
            <header expression="fn:concat('Bearer ', get-property('stored-token'))" name="Authorization" scope="transport" />
        </else>
    </filter>
</sequence>