A resource named /item is protected by oAuth2 authentication.

When using OAuth2 authentication for accessing a protected resource via a REST API, the typical flow involves obtaining an access token which can then be used to authenticate subsequent API requests. The correct process is:

POST Call to /login: Make a POST request to the /login endpoint with the user credentials (username and password) in the request body. This call will authenticate the user and, if successful, return an access token.

Use the Token: Use the retrieved token by including it in the Authorization header (usually as a Bearer token) in the request to access the protected resource, in this case, the /item endpoint.

References:

OAuth 2.0 Authorization Framework - RFC 6749