Direct grant REST invocation. One stop call to obtain an access token.
If the client is a confidential client
you must include the client-id (application name or oauth client name) and secret in an Basic Auth Authorization header.
If the client is a public client, then you must include a "client_id" form parameter with the app's or oauth client's name.
The realm must be configured to allow these types of auth requests. (Direct Grant API in admin console Settings page)