Например: App Access Token получается в обмен на client_id и client_secret.
GET /certificates?query=viator.com&access_token=client_id|client_secret&fields=cert_hash_sha256,domains,issuer_name,subject_name HTTP/2
Host: graph.facebook.com
User-Agent: IkeMurami
Accept: application/json
Accept-Encoding: gzip, deflate