{ "openapi": "3.1.0", "info": { "title": "authreads API", "description": "", "license": { "name": "" }, "version": "0.1.0" }, "servers": [ { "url": "https://api.authreads.com" } ], "paths": { "/.well-known/openid-configuration": { "get": { "tags": [ "OIDC" ], "operationId": "oidc_discovery", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProviderMetadata" } } } } } } }, "/api/v1/audit": { "post": { "tags": [ "Audit" ], "summary": "Ingest one product-owned audit event.", "operationId": "ingest", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditIngestRequest" } } }, "required": true }, "responses": { "201": { "description": "Audit event recorded", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditIngestResponse" } } } }, "400": { "description": "Malformed or oversized event", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "401": { "description": "Missing or invalid machine token", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "Missing audit:write scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Per-client ingest limit exceeded", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/login/flow/back": { "post": { "tags": [ "Authentication" ], "operationId": "back", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowToken" } } }, "required": true }, "responses": { "204": { "description": "" }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/enrol/passkey/begin": { "post": { "tags": [ "Authentication" ], "operationId": "passkey_enrol_begin", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginPasskeyBegin" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginPasskeyStarted" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/enrol/passkey/finish": { "post": { "tags": [ "Authentication" ], "operationId": "passkey_enrol_finish", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginPasskeyEnrollmentFinish" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/enrol/totp/confirm": { "post": { "tags": [ "Authentication" ], "operationId": "totp_confirm", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowProof" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/enrol/totp/start": { "post": { "tags": [ "Authentication" ], "operationId": "totp_start", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowToken" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginAuthenticatorSetupStarted" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/passkey/begin": { "post": { "tags": [ "Authentication" ], "operationId": "passkey_begin", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginPasskeyBegin" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginPasskeyStarted" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/passkey/finish": { "post": { "tags": [ "Authentication" ], "operationId": "passkey_finish", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginPasskeyFinish" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/remind-later": { "post": { "tags": [ "Authentication" ], "operationId": "remind_later", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowToken" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/resend-email-code": { "post": { "tags": [ "Authentication" ], "operationId": "resend", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowToken" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/reverify": { "post": { "tags": [ "Authentication" ], "operationId": "reverify", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Reverify" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/second-step": { "post": { "tags": [ "Authentication" ], "operationId": "switch", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginSecondStep" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/verify-email-code": { "post": { "tags": [ "Authentication" ], "operationId": "email", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowProof" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/verify-recovery": { "post": { "tags": [ "Authentication" ], "operationId": "recovery", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowProof" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/flow/verify-totp": { "post": { "tags": [ "Authentication" ], "operationId": "totp", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowProof" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiLoginFlowResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/preflight": { "post": { "tags": [ "Authentication" ], "operationId": "login_preflight", "parameters": [ { "name": "Authreads-Login-Flow", "in": "header", "description": "Set 2 for the method flow; omit to retain the legacy email contract.", "required": false, "schema": { "type": [ "string", "null" ] } }, { "name": "Authreads-Passkey-Origin", "in": "header", "description": "Exact registered origin selector. Only signed WebAuthn clientData proves origin.", "required": false, "schema": { "type": [ "string", "null" ] } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LoginPreflightRequest" } } }, "required": true }, "responses": { "200": { "description": "Login preflight completed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LoginPreflightResult" } } } }, "401": { "description": "Credentials rejected without revealing whether the account exists", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Sign-in temporarily locked; `code` is `login_temporarily_locked`", "headers": { "Retry-After": { "schema": { "type": "string" }, "description": "Whole seconds until sign-in may be retried" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/login/verify-otp": { "post": { "tags": [ "Authentication" ], "operationId": "verify_login_otp", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyOtpRequest" } } }, "required": true }, "responses": { "200": { "description": "OTP verified and login grant issued", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GrantResponse" } } } }, "401": { "description": "Invalid or expired code; identical for missing accounts, missing or exhausted challenges, and account-only locks", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Source-wide authentication throttling", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/me": { "get": { "tags": [ "Authentication" ], "summary": "`GET /me` — session → identity + memberships + optional access resolution.", "description": "**Multi-org rules (decided 2026-06-10):**\n- Always returns the user's **full memberships list** (org id + name + role key).\n- If `?organization_id=` is given → resolve permissions/apps for that org.\n- If the user has exactly **one** membership → auto-resolve for that org.\n- Multiple memberships + no param → identity + memberships only, **no permission\n block** (explicit, never guessed).\n\n**BUG-6 fix:** All tenant-scoped table reads (users, memberships, roles, etc.)\nnow go through `app_db` with RLS set — never the owner `admin_db` connection.", "operationId": "get_me", "parameters": [ { "name": "organization_id", "in": "query", "description": "Optional: resolve permissions/apps for this specific organization.\nIf omitted and the user has exactly one membership, auto-resolves.\nIf omitted and the user has multiple memberships, returns identity + memberships only.", "required": false, "schema": { "type": "string", "format": "uuid" } }, { "name": "x-session-id", "in": "header", "description": "Opaque end-user session identifier", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "x-session-activity", "in": "header", "description": "API-signed browser activity state; required — the session is rejected without it", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Current end-user identity and absolute session expiry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MeResponse" } } } }, "401": { "description": "Invalid session; `code` is its typed invalidation reason", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/password/change": { "post": { "tags": [ "Authentication" ], "operationId": "change_password", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "Password changed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePasswordResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/password/change-expired": { "post": { "tags": [ "Authentication" ], "operationId": "change_expired_password", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExpiredPasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "Expired password replaced; all sessions, trusted devices, and refresh tokens were revoked", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangeExpiredPasswordResponse" } } } }, "400": { "description": "New password failed the published policy or history requirements", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "401": { "description": "Current credentials rejected without revealing whether the account exists", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "Scheduled expiry is not enforced or this password no longer requires replacement", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Credential verification temporarily locked; `Retry-After` is supplied", "headers": { "Retry-After": { "schema": { "type": "string" }, "description": "Whole seconds until credential verification may be retried" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/password/forgot": { "post": { "tags": [ "Authentication" ], "operationId": "forgot_password", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ForgotPasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "Password reset message accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MessageResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/password/policy": { "get": { "tags": [ "Authentication" ], "summary": "Public documentation endpoint for non-bundled clients. First-party UIs\ncompile the same JSON contract at build time and never depend on this route\nwhile a person is entering a credential.", "operationId": "password_policy", "responses": { "200": { "description": "Versioned password-policy contract", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordPolicyContract" } } } } } } }, "/api/v1/auth/password/reset": { "post": { "tags": [ "Authentication" ], "operationId": "reset_password", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResetPasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "Password reset completed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MessageResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/password/reset/status": { "post": { "tags": [ "Authentication" ], "summary": "`POST /password/reset/status` — is this reset token usable, without using it?", "description": "A tenant that hosts its own reset page receives the one-time token on a\nsingle click. Rendering the form by *attempting* the reset would spend that\nclick, so the clean-URL email exchange needs a check that consumes nothing.\nThe hosted and operator planes already had one; this is the direct/BFF\ncounterpart, and its absence left tenants unable to implement the exchange\nat all.\n\nScope is taken from the authenticated tenant context, never from the token,\nso this cannot be used to probe another tenant's tokens.", "operationId": "reset_password_status", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResetTokenRequest" } } }, "required": true }, "responses": { "200": { "description": "Reset token status; the token is not consumed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResetTokenStatus" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/session/activity": { "post": { "tags": [ "Authentication" ], "operationId": "refresh_session_activity", "parameters": [ { "name": "x-session-id", "in": "header", "description": "Opaque browser session identifier", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "x-session-activity", "in": "header", "description": "API-signed browser activity state", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Activity state refreshed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionActivityRefreshResponse" } } } }, "401": { "description": "Missing, invalid, idle, or expired activity state", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Per-session refresh limit exceeded", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/api/v1/auth/session/exchange": { "post": { "tags": [ "Authentication" ], "operationId": "exchange_grant", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExchangeRequest" } } }, "required": true }, "responses": { "200": { "description": "Login grant exchanged for a session", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExchangeResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "TenantIdHeader": [], "TenantSecretBearer": [] } ] } }, "/api/v1/auth/session/reverify": { "post": { "tags": [ "Authentication" ], "operationId": "reverify_session", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReverifySessionRequest" } } }, "required": true }, "responses": { "200": { "description": "Re-verification completed or OTP challenge issued", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReverifySessionResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/token": { "post": { "tags": [ "Authentication" ], "summary": "POST /api/v1/auth/token — mint a short-lived Ed25519 access JWT for an end-user + target app.", "operationId": "issue_token", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TokenRequest" } } }, "required": true }, "responses": { "200": { "description": "Audience-scoped end-user access token issued", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TokenResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/users/{user_id}/account-security/devices": { "get": { "tags": [ "Account security" ], "operationId": "list_account_devices", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevicesResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/users/{user_id}/account-security/devices/{device_id}/revoke": { "post": { "tags": [ "Account security" ], "operationId": "revoke_account_device", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "device_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevocationResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/users/{user_id}/account-security/policy": { "get": { "tags": [ "Account security" ], "operationId": "get_account_security_policy", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountSecurityPolicyResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/users/{user_id}/account-security/revoke-others-and-devices": { "post": { "tags": [ "Account security" ], "operationId": "revoke_other_account_sessions_and_devices", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RetainAccountSessionRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevokeAccountAccessResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/users/{user_id}/account-security/sessions": { "get": { "tags": [ "Account security" ], "operationId": "list_account_sessions", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionsResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/users/{user_id}/account-security/sessions/revoke-others": { "post": { "tags": [ "Account security" ], "operationId": "revoke_other_account_sessions", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RetainAccountSessionRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevocationResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/auth/users/{user_id}/account-security/sessions/{session_id}/revoke": { "post": { "tags": [ "Account security" ], "operationId": "revoke_account_session", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevocationResponse" } } } }, "default": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/enrolment/redeem": { "post": { "tags": [ "Enrolment" ], "operationId": "redeem", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RedeemEnrolment" } } }, "required": true }, "responses": { "200": { "description": "A key-bound installation was created or its original ticket retry recovered its current refresh credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InstallationEnrolled" } } } }, "400": { "description": "The public key or observation payload is invalid", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "The enrolment token is unknown", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "The enrolment token is not yet valid or exhausted, the active installation limit was reached, or the public key already identifies an installation", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "410": { "description": "The enrolment token is expired or revoked", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "The enrolment token is rate-limited", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/api/v1/installations/binding-invitations": { "post": { "tags": [ "Installations" ], "operationId": "issue_binding_invitation", "parameters": [ { "name": "DPoP", "in": "header", "description": "RFC 9449 ES256 proof bound to this request and access token", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BindingInvitationRequest" } } }, "required": true }, "responses": { "200": { "description": "Reveal-once, five-minute machine-local binding invitation", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssuedBindingInvitation" } } } }, "401": { "description": "Invalid token/proof or RFC 9449 resource nonce challenge", "headers": { "Cache-Control": { "schema": { "type": "string" } }, "DPoP-Nonce": { "schema": { "type": "string" } }, "WWW-Authenticate": { "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DpopResourceErrorResponse" } } } }, "409": { "description": "Directory sources require the future federation proof flow", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Invitation limit exceeded", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "InstallationDpop": [] } ] } }, "/api/v1/installations/heartbeat": { "post": { "tags": [ "Installations" ], "operationId": "heartbeat", "parameters": [ { "name": "DPoP", "in": "header", "description": "RFC 9449 ES256 proof bound to this request and access token", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Server-observed authenticated heartbeat receipt", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HeartbeatReceipt" } } } }, "401": { "description": "Invalid token/proof or RFC 9449 resource nonce challenge", "headers": { "Cache-Control": { "schema": { "type": "string" } }, "DPoP-Nonce": { "schema": { "type": "string" } }, "WWW-Authenticate": { "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DpopResourceErrorResponse" } } } }, "403": { "description": "Token lacks the installation heartbeat scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "InstallationDpop": [] } ] } }, "/api/v1/management/apps": { "get": { "tags": [ "Management" ], "operationId": "list_apps", "responses": { "200": { "description": "Apps listed", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagementApp" } } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/apps/{app_id}/installations/{installation_id}/revocation": { "put": { "tags": [ "Management" ], "summary": "Retire one physical installation. This is intentionally the only machine-\ncallable revocation primitive: a campaign is a rollout grouping, not proof\nthat every device in it has been retired. A user departure must disable the\nuser's binding instead and must not revoke the shared device.", "operationId": "revoke_machine_installation", "parameters": [ { "name": "app_id", "in": "path", "description": "Target application id", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "installation_id", "in": "path", "description": "Physical installation id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevokeMachineInstallationRequest" } } }, "required": true }, "responses": { "204": { "description": "Installation retired. Already-issued access tokens can remain valid for up to 15 minutes; re-enrolment requires physical access and this action has no undo." }, "400": { "description": "Audit reason is invalid", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "401": { "description": "Management credential is missing, invalid, or revoked", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "Credential lacks installations:revoke or its tenant is inactive", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "Installation was not found in the caller tenant and application", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/apps/{app_id}/machine-enrolment-tickets": { "post": { "tags": [ "Management" ], "operationId": "issue_machine_enrolment_ticket", "parameters": [ { "name": "app_id", "in": "path", "description": "Target application id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssueMachineEnrolmentTicketRequest" } } }, "required": true }, "responses": { "200": { "description": "Single-use machine enrolment ticket issued; the ticket is reveal-once", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssuedEnrolment" } } } }, "400": { "description": "Purpose or deployment campaign is invalid", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "401": { "description": "Management credential is missing, invalid, or revoked", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "Credential lacks enrolment:issue or its tenant is inactive", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "Active target application was not found", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "Application has no active machine token-renewal credential", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Tenant or credential issuance rate limit was exceeded", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/apps/{app_id}/package-policy": { "patch": { "tags": [ "Management" ], "operationId": "set_management_app_package_policy", "parameters": [ { "name": "app_id", "in": "path", "description": "Application id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetManagementAppPackagePolicyRequest" } } }, "required": true }, "responses": { "200": { "description": "Application package policy updated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagementApp" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/entitlement-policy": { "get": { "tags": [ "Management" ], "operationId": "get_management_entitlement_policy", "responses": { "200": { "description": "Tenant entitlement policy", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagementEntitlementPolicyResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "patch": { "tags": [ "Management" ], "operationId": "set_management_entitlement_policy", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetManagementEntitlementPolicyRequest" } } }, "required": true }, "responses": { "200": { "description": "Tenant entitlement policy updated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagementEntitlementPolicyResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/installations/{installation_id}/ownership": { "put": { "tags": [ "Management" ], "operationId": "management_change_owner", "parameters": [ { "name": "installation_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OwnershipChange" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Ownership" } } } }, "400": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "401": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/organizations": { "post": { "tags": [ "Management" ], "operationId": "create_organization", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateOrganizationRequest" } } }, "required": true }, "responses": { "200": { "description": "Organization created or reactivated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrganizationProvisioningResult" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/organizations/{organization_id}/disable": { "post": { "tags": [ "Management" ], "operationId": "disable_organization", "parameters": [ { "name": "organization_id", "in": "path", "description": "Organization id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Organization disabled", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrganizationProvisioningResult" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/organizations/{organization_id}/enable": { "post": { "tags": [ "Management" ], "operationId": "enable_organization", "parameters": [ { "name": "organization_id", "in": "path", "description": "Organization id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Organization enabled", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrganizationProvisioningResult" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/packages": { "get": { "tags": [ "Management" ], "operationId": "list_packages", "responses": { "200": { "description": "Packages listed", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/PackageListing" } } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "post": { "tags": [ "Management" ], "operationId": "create_package", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreatePackageRequest" } } }, "required": true }, "responses": { "200": { "description": "Package created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PackageListing" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/packages/{package_id}": { "delete": { "tags": [ "Management" ], "operationId": "delete_package", "parameters": [ { "name": "package_id", "in": "path", "description": "Package id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Package soft-deleted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PackageDeleteResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "patch": { "tags": [ "Management" ], "operationId": "update_package", "parameters": [ { "name": "package_id", "in": "path", "description": "Package id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdatePackageRequest" } } }, "required": true }, "responses": { "200": { "description": "Package updated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PackageListing" } } } }, "422": { "description": "Request body does not match the schema, including an unknown field such as `key` (code `invalid_request_body`)", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/packages/{package_id}/apps": { "post": { "tags": [ "Management" ], "operationId": "set_package_apps", "parameters": [ { "name": "package_id", "in": "path", "description": "Package id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetPackageAppsRequest" } } }, "required": true }, "responses": { "200": { "description": "Package app bindings replaced", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PackageAppsResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/person-installation-limit": { "get": { "tags": [ "Management" ], "operationId": "management_get_default", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PersonLimit" } } } }, "401": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "put": { "tags": [ "Management" ], "operationId": "management_set_default", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DefaultLimitChange" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PersonLimit" } } } }, "400": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "401": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/person-installation-limit/users/{user_id}": { "get": { "tags": [ "Management" ], "operationId": "management_get_exception", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PersonLimit" } } } }, "401": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "put": { "tags": [ "Management" ], "operationId": "management_set_exception", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExceptionChange" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PersonLimit" } } } }, "400": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "401": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/roles": { "get": { "tags": [ "Management" ], "operationId": "list_roles", "responses": { "200": { "description": "Roles listed", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/RoleSummary" } } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "post": { "tags": [ "Management" ], "operationId": "create_role", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateRoleRequest" } } }, "required": true }, "responses": { "200": { "description": "Role created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateRoleResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/roles/{role_id}": { "delete": { "tags": [ "Management" ], "operationId": "delete_role", "parameters": [ { "name": "role_id", "in": "path", "description": "Role id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Role deleted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResourceStatusResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "patch": { "tags": [ "Management" ], "operationId": "update_role", "parameters": [ { "name": "role_id", "in": "path", "description": "Role id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateRoleRequest" } } }, "required": true }, "responses": { "200": { "description": "Role updated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoleSummary" } } } }, "422": { "description": "Request body does not match the schema, including an unknown field such as `key` (code `invalid_request_body`)", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/roles/{role_id}/apps": { "get": { "tags": [ "Management" ], "operationId": "get_role_apps", "parameters": [ { "name": "role_id", "in": "path", "description": "Role id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Role app bindings listed", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/RoleApp" } } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "post": { "tags": [ "Management" ], "operationId": "set_role_apps", "parameters": [ { "name": "role_id", "in": "path", "description": "Role id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetRoleAppsRequest" } } }, "required": true }, "responses": { "200": { "description": "Role app bindings replaced", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResourceStatusResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/users": { "get": { "tags": [ "Management" ], "operationId": "list_users", "responses": { "200": { "description": "Users listed", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ManagementUser" } } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "post": { "tags": [ "Management" ], "operationId": "create_user", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateUserRequest" } } }, "required": true }, "responses": { "200": { "description": "User created or upserted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateUserResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/users/{user_id}": { "get": { "tags": [ "Management" ], "operationId": "get_user", "parameters": [ { "name": "user_id", "in": "path", "description": "User id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "User found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagementUser" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "delete": { "tags": [ "Management" ], "operationId": "delete_user", "parameters": [ { "name": "user_id", "in": "path", "description": "User id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "User deleted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteUserResponse" } } } }, "409": { "description": "user_owns_active_installations: release or transfer active machines first", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] }, "patch": { "tags": [ "Management" ], "operationId": "update_user", "parameters": [ { "name": "user_id", "in": "path", "description": "User id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateUserRequest" } } }, "required": true }, "responses": { "200": { "description": "User updated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResourceStatusResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/users/{user_id}/email-verification": { "patch": { "tags": [ "Management" ], "operationId": "set_user_email_verification", "parameters": [ { "name": "user_id", "in": "path", "description": "User id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetUserEmailVerificationRequest" } } }, "required": true }, "responses": { "200": { "description": "Tenant email-verification assertion applied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailVerificationResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/users/{user_id}/reactivate": { "post": { "tags": [ "Management" ], "operationId": "reactivate_user", "parameters": [ { "name": "user_id", "in": "path", "description": "User id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/MembershipTargetRequest" } ] } } } }, "responses": { "200": { "description": "User membership reactivated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResourceStatusResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/users/{user_id}/suspend": { "post": { "tags": [ "Management" ], "operationId": "suspend_user", "parameters": [ { "name": "user_id", "in": "path", "description": "User id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/MembershipTargetRequest" } ] } } } }, "responses": { "200": { "description": "User membership suspended", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserStatusResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/workspaces/{organization_id}/environment": { "post": { "tags": [ "Management" ], "operationId": "move_workspace_environment", "parameters": [ { "name": "organization_id", "in": "path", "description": "Workspace organization id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MoveEnvironmentRequest" } } }, "required": true }, "responses": { "200": { "description": "Workspace environment moved", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkspaceEnvironmentResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/workspaces/{organization_id}/organization-type": { "patch": { "tags": [ "Management" ], "operationId": "set_workspace_organization_type", "parameters": [ { "name": "organization_id", "in": "path", "description": "Workspace organization id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetWorkspaceOrganizationTypeRequest" } } }, "required": true }, "responses": { "200": { "description": "Workspace organization type assigned or cleared", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkspaceOrganizationTypeResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/api/v1/management/workspaces/{organization_id}/package": { "patch": { "tags": [ "Management" ], "operationId": "set_workspace_package", "parameters": [ { "name": "organization_id", "in": "path", "description": "Workspace organization id", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetWorkspacePackageRequest" } } }, "required": true }, "responses": { "200": { "description": "Workspace package updated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkspacePackageResponse" } } } }, "default": { "description": "Problem response", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "ManagementBearer": [] } ] } }, "/oauth/account/attribution-consent-options": { "get": { "tags": [ "Attribution" ], "operationId": "list_attribution_consent_options", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ConsentOption" } } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [ "account:attribution" ] } ] } }, "/oauth/account/attribution-consents": { "get": { "tags": [ "Attribution" ], "operationId": "list_attribution_consents", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserConsent" } } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [ "account:attribution" ] } ] } }, "/oauth/account/attribution-consents/accept": { "post": { "tags": [ "Attribution" ], "operationId": "accept_attribution_consent", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AcceptAttributionConsentRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserConsent" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "Fresh authentication or CSRF proof required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [ "account:attribution" ] } ] } }, "/oauth/account/attribution-consents/{consent_id}/withdraw": { "post": { "tags": [ "Attribution" ], "operationId": "withdraw_attribution_consent", "parameters": [ { "name": "consent_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Consent withdrawn" }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "CSRF proof required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [ "account:attribution" ] } ] } }, "/oauth/account/attribution-erasure": { "get": { "tags": [ "Attribution" ], "operationId": "get_attribution_erasure", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureStatus" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [ "account:attribution" ] } ] }, "post": { "tags": [ "Attribution" ], "operationId": "request_attribution_erasure", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureStatus" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "Fresh authentication or CSRF proof required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [ "account:attribution" ] } ] } }, "/oauth/account/binding-invitations/confirm": { "post": { "tags": [ "Attribution" ], "operationId": "confirm_binding_invitation", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BindingInvitationCodeRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConfirmedBinding" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "Fresh authentication or CSRF proof required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [ "account:attribution" ] } ] } }, "/oauth/account/binding-invitations/preview": { "post": { "tags": [ "Attribution" ], "operationId": "preview_binding_invitation", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BindingInvitationCodeRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BindingInvitationPreview" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [ "account:attribution" ] } ] } }, "/oauth/account/devices": { "get": { "tags": [ "Hosted account" ], "operationId": "list_devices", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevicesResponse" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [] } ] } }, "/oauth/account/devices/{device_id}/revoke": { "post": { "tags": [ "Hosted account" ], "operationId": "revoke_device", "parameters": [ { "name": "device_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevocationResponse" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [] } ] } }, "/oauth/account/identities": { "get": { "tags": [ "Attribution" ], "operationId": "list_external_identities", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserExternalIdentity" } } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [ "account:attribution" ] } ] } }, "/oauth/account/me": { "get": { "tags": [ "Hosted account" ], "operationId": "account_me", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedAccountIdentity" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/account/methods": { "get": { "tags": [ "Hosted account" ], "operationId": "account_methods", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Status" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/account/passkeys": { "get": { "tags": [ "Hosted account" ], "operationId": "list", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Inventory" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/passkeys/add/finish": { "post": { "tags": [ "Hosted account" ], "operationId": "finish", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Finish" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Added" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "503": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/passkeys/add/start": { "post": { "tags": [ "Hosted account" ], "operationId": "start", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedPasskeyRegistrationStarted" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/passkeys/{id}": { "delete": { "tags": [ "Hosted account" ], "operationId": "remove", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "204": { "description": "" }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "503": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } }, "patch": { "tags": [ "Hosted account" ], "operationId": "rename", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rename" } } }, "required": true }, "responses": { "204": { "description": "" }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/password": { "get": { "tags": [ "Hosted account" ], "operationId": "password_status", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedPasswordStatus" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } }, "post": { "tags": [ "Hosted account" ], "operationId": "change_password", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedChangePasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedChangePasswordResponse" } } } }, "400": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/password/forgot": { "post": { "tags": [ "Hosted account" ], "operationId": "request_password_reset", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedForgotPasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedAccountMessage" } } } }, "400": { "description": "Invalid continuation", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Request limited", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/password/reset": { "post": { "tags": [ "Hosted account" ], "operationId": "complete_password_reset", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedResetPasswordRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedAccountMessage" } } } }, "400": { "description": "Invalid, expired, used token or password", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Request limited", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/password/reset/resend": { "post": { "tags": [ "Hosted account" ], "operationId": "resend_password_reset", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedResetTokenRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedAccountMessage" } } } } } } }, "/oauth/account/password/reset/status": { "post": { "tags": [ "Hosted account" ], "operationId": "password_reset_status", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedResetTokenRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResetTokenStatus" } } } } } } }, "/oauth/account/recovery-codes": { "get": { "tags": [ "Hosted account" ], "operationId": "status", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedRecoveryCodeStatus" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/account/recovery-codes/generate": { "post": { "tags": [ "Hosted account" ], "operationId": "generate", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedGeneratedRecoveryCodes" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/account/recovery-codes/regenerate": { "post": { "tags": [ "Hosted account" ], "operationId": "regenerate", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedGeneratedRecoveryCodes" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/account/reverify": { "post": { "tags": [ "Hosted account" ], "summary": "Re-verify the current hosted session without leaving the pending account\naction. This deliberately reuses the same audited, rate-limited step-up\nservice as the management API; the browser never supplies a tenant, user,\nor session identifier.", "operationId": "reverify_hosted_session", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedReverifyRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedReverifyResponse" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/reverify/passkey/availability": { "post": { "tags": [ "Hosted account" ], "operationId": "availability", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Availability" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/reverify/passkey/finish": { "post": { "tags": [ "Hosted account" ], "operationId": "finish", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Finish" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Verified" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/reverify/passkey/start": { "post": { "tags": [ "Hosted account" ], "operationId": "start", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedPasskeyVerificationStarted" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/oauth/account/reverify/recovery-code": { "post": { "tags": [ "Hosted account" ], "operationId": "reverify", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedRecoveryCodeInput" } } }, "required": true }, "responses": { "204": { "description": "" }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/account/reverify/totp": { "post": { "tags": [ "Hosted account" ], "operationId": "reverify", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Code" } } }, "required": true }, "responses": { "204": { "description": "" }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/account/security/revoke-others-and-devices": { "post": { "tags": [ "Hosted account" ], "operationId": "revoke_other_sessions_and_devices", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevokeAccountAccessResponse" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [] } ] } }, "/oauth/account/sessions": { "get": { "tags": [ "Hosted account" ], "operationId": "list_sessions", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionsResponse" } } } }, "401": { "description": "Invalid or revoked bearer session", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [] } ] } }, "/oauth/account/sessions/revoke-others": { "post": { "tags": [ "Hosted account" ], "operationId": "revoke_other_sessions", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevocationResponse" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "CSRF protection failed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [] } ] } }, "/oauth/account/sessions/{session_id}/revoke": { "post": { "tags": [ "Hosted account" ], "operationId": "revoke_session", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevocationResponse" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "403": { "description": "CSRF protection failed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "Caller does not own the session", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "OidcBearer": [] } ] } }, "/oauth/account/totp": { "get": { "tags": [ "Hosted account" ], "operationId": "status", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Status" } } } }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] }, "delete": { "tags": [ "Hosted account" ], "operationId": "remove", "responses": { "204": { "description": "" }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/account/totp/enrol/confirm": { "post": { "tags": [ "Hosted account" ], "operationId": "confirm", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Code" } } }, "required": true }, "responses": { "204": { "description": "" }, "401": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/account/totp/enrol/start": { "post": { "tags": [ "Hosted account" ], "operationId": "start", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedAuthenticatorSetupStarted" } } } }, "403": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "404": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ { "HostedSessionActivityCookie": [], "HostedSessionCookie": [] } ] } }, "/oauth/authorize": { "get": { "tags": [ "OIDC" ], "operationId": "oidc_authorize", "responses": { "200": { "description": "Body-only form handoff to the assigned auth host" }, "302": { "description": "Relying-party error redirect" }, "400": { "description": "OAuth error" } } } }, "/oauth/login/back": { "post": { "tags": [ "OIDC" ], "operationId": "back", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BackRequest" } } }, "required": true }, "responses": { "200": { "description": "Pending verification invalidated" }, "400": { "description": "Invalid sign-in request" } } } }, "/oauth/login/change-expired-password": { "post": { "tags": [ "OIDC" ], "summary": "Blueprint 3.2 expired-password recovery. Documented on the public spec for\nthe same reason as its two sibling `/oauth/login/*` routes: it is part of the\nhosted sign-in exchange an integrator's users traverse, so an undocumented\nendpoint here is a gap a relying party discovers only when a user's password\nexpires mid-integration.", "operationId": "change_expired_password", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedExpiredPasswordChangeRequest" } } }, "required": true }, "responses": { "200": { "description": "Password replaced; a fresh login continuation is returned so the interrupted sign-in can resume", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedExpiredPasswordChangeResponse" } } } }, "400": { "description": "Invalid hosted-login request, continuation, or new password" }, "429": { "description": "Hosted-login request rate limited" } } } }, "/oauth/login/methods": { "post": { "tags": [ "OIDC" ], "operationId": "methods", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MethodsRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MethodsResponse" } } } }, "400": { "description": "Invalid continuation" }, "404": { "description": "Passwordless sign-in unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthErrorResponse" } } } } } } }, "/oauth/login/passkey/begin": { "post": { "tags": [ "OIDC" ], "operationId": "begin", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BeginRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedPasskeyStarted" } } } }, "400": { "description": "Invalid sign-in request" }, "404": { "description": "Passwordless sign-in unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthErrorResponse" } } } }, "429": { "description": "Please wait" } } } }, "/oauth/login/passkey/finish": { "post": { "tags": [ "OIDC" ], "operationId": "finish", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FinishRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginSessionResponse" } } } }, "400": { "description": "Invalid sign-in request" }, "404": { "description": "Passwordless sign-in unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthErrorResponse" } } } }, "429": { "description": "Please wait" } } } }, "/oauth/login/preflight": { "post": { "tags": [ "OIDC" ], "operationId": "preflight", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginPreflightRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginPreflightResponse" } } } }, "400": { "description": "OAuth `invalid_grant`; credential failures use the non-enumerating `invalid credentials` description", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthErrorResponse" } } } }, "403": { "description": "Password-proven account has no available sign-in method", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthErrorResponse" } } } }, "429": { "description": "OAuth `temporarily_unavailable`; sign-in is temporarily locked", "headers": { "Retry-After": { "schema": { "type": "string" }, "description": "Whole seconds until sign-in may be retried" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthErrorResponse" } } } } } } }, "/oauth/login/resend-otp": { "post": { "tags": [ "OIDC" ], "operationId": "resend_otp", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginResendOtpRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginResendOtpResponse" } } } }, "400": { "description": "Invalid or expired hosted-login request" }, "429": { "description": "Code resend is not available yet", "headers": { "Retry-After": { "schema": { "type": "string" }, "description": "Whole seconds until another code may be requested" } } } } } }, "/oauth/login/second-step": { "post": { "tags": [ "OIDC" ], "operationId": "select", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SelectRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SelectResponse" } } } }, "400": { "description": "Invalid sign-in request" }, "429": { "description": "Please wait", "headers": { "Retry-After": { "schema": { "type": "string" } } } } } } }, "/oauth/login/verify-otp": { "post": { "tags": [ "OIDC" ], "operationId": "verify_otp", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginVerifyOtpRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginSessionResponse" } } } }, "400": { "description": "Invalid or expired hosted-login request" }, "429": { "description": "Hosted-login request rate limited" } } } }, "/oauth/login/verify-recovery": { "post": { "tags": [ "OIDC" ], "operationId": "verify_recovery", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginVerifyOtpRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginSessionResponse" } } } }, "400": { "description": "Invalid sign-in request" }, "429": { "description": "Please wait", "headers": { "Retry-After": { "schema": { "type": "string" } } } } } } }, "/oauth/login/verify-totp": { "post": { "tags": [ "OIDC" ], "operationId": "verify_totp", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginVerifyOtpRequest" } } }, "required": true }, "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostedLoginSessionResponse" } } } }, "400": { "description": "Invalid sign-in request" }, "429": { "description": "Please wait", "headers": { "Retry-After": { "schema": { "type": "string" } } } } } } }, "/oauth/logout": { "get": { "tags": [ "OIDC" ], "operationId": "oidc_logout", "responses": { "200": { "description": "Body-only form handoff to the session-owning auth host" }, "400": { "description": "Invalid logout request" } } } }, "/oauth/revoke": { "post": { "tags": [ "OIDC" ], "operationId": "oidc_revoke", "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "type": "string" } } }, "required": true }, "responses": { "200": { "description": "Revocation accepted" }, "401": { "description": "Client authentication failed" } } } }, "/oauth/token": { "post": { "tags": [ "OIDC" ], "description": "OAuth token endpoint. The HTTP 200 schema is an `anyOf`; select the grant-specific member for the request that was sent. Token exchange does not accept an OAuth `scope` parameter because workspace authority is expressed as product-token claims. The attribution grant (`urn:authreads:params:oauth:grant-type:attribution`) requires a public client, an installation actor token, an RFC 9449 ES256 proof bound to that actor token, identity_source_id, external_subject, observation_id, RFC 3339 collected_at, observation_method=source_session, the fixed scope attribution:write, and an exact registered HTTPS resource URI. It returns a five-minute DPoP token whose audience is exactly that resource and whose authority is bounded by a verified identity binding plus active person consent. Unknown scopes and unregistered resources are rejected; attribution authority is never derived from the person's interactive permissions.", "operationId": "oidc_token", "parameters": [ { "name": "DPoP", "in": "header", "description": "RFC 9449 proof JWT; required for installation refresh credentials", "required": false, "schema": { "type": [ "string", "null" ] } } ], "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "type": "string" } } }, "required": true }, "responses": { "200": { "description": "Grant-specific OAuth token response", "content": { "application/json": { "schema": { "anyOf": [ { "type": "object", "required": [ "access_token", "token_type", "expires_in", "scope" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "id_token": { "type": [ "string", "null" ] }, "refresh_token": { "type": [ "string", "null" ] }, "scope": { "type": "string" }, "token_type": { "type": "string" } } }, { "type": "object", "required": [ "access_token", "token_type", "expires_in", "scope" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "scope": { "type": "string" }, "token_type": { "type": "string" } } }, { "type": "object", "required": [ "access_token", "issued_token_type", "token_type", "expires_in" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "issued_token_type": { "type": "string" }, "token_type": { "type": "string" } } }, { "type": "object", "required": [ "access_token", "issued_token_type", "token_type", "expires_in", "scope" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "issued_token_type": { "type": "string" }, "scope": { "type": "string" }, "token_type": { "type": "string" } } }, { "type": "object", "required": [ "access_token", "token_type", "expires_in", "refresh_token", "refresh_token_expires_at", "scope" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "refresh_token": { "type": "string" }, "refresh_token_expires_at": { "type": "string", "format": "date-time" }, "scope": { "type": "string" }, "token_type": { "$ref": "#/components/schemas/InstallationAccessTokenType" } } } ] } } } }, "400": { "description": "OAuth error. Installation clients must handle `use_dpop_nonce`, `invalid_dpop_proof`, and `invalid_grant` distinctly.", "headers": { "Cache-Control": { "schema": { "type": "string" }, "description": "Always `no-store` for OAuth errors" }, "DPoP-Nonce": { "schema": { "type": "string" }, "description": "Fresh opaque nonce when error is `use_dpop_nonce`" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthErrorResponse" } } } }, "401": { "description": "Client authentication failed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthErrorResponse" } } } }, "429": { "description": "Fleet admission control; retry with backoff and jitter", "headers": { "Retry-After": { "schema": { "type": "string" }, "description": "Whole seconds before retry" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OAuthErrorResponse" } } } } } } }, "/oauth/userinfo": { "get": { "tags": [ "OIDC" ], "operationId": "oidc_userinfo", "responses": { "200": { "description": "", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserInfo" } } } }, "401": { "description": "Invalid bearer token" } } } } }, "components": { "schemas": { "AcceptAttributionConsentRequest": { "type": "object", "required": [ "binding_id", "resource_id", "disclosure_id" ], "properties": { "binding_id": { "type": "string", "format": "uuid" }, "disclosure_id": { "type": "string", "format": "uuid" }, "resource_id": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "AccessClaims": { "type": "object", "required": [ "sub", "email", "tenant_id", "tenant", "app", "app_grants", "user_pool", "workspace_id", "role", "iss", "aud", "iat", "exp" ], "properties": { "acr": { "$ref": "#/components/schemas/Acr", "description": "End-user context only; operator tokens omit this claim." }, "amr": { "type": "array", "items": { "type": "string" }, "description": "OIDC Authentication Methods References for that authentication event." }, "app": { "type": "string" }, "app_grants": { "type": "array", "items": { "type": "string" } }, "aud": { "type": "string" }, "auth_time": { "type": "integer", "description": "OIDC NumericDate of the latest successful human authentication on this session.", "minimum": 0 }, "email": { "type": "string" }, "environment": { "type": "string", "description": "Informational tenant-configured environment. It is not an authorization gate." }, "exp": { "type": "integer", "minimum": 0 }, "iat": { "type": "integer", "minimum": 0 }, "iss": { "type": "string" }, "module_grants": { "type": "array", "items": { "type": "string" } }, "org_type": { "type": "string", "description": "Tenant-configured organization-type key. Absent when the workspace has no type assigned." }, "permissions": { "type": "array", "items": { "type": "string" } }, "role": { "type": "string" }, "sub": { "type": "string" }, "tenant": { "type": "string" }, "tenant_id": { "type": "string" }, "user_pool": { "type": "string" }, "workspace_id": { "type": "string" } } }, "AccountDevice": { "type": "object", "required": [ "id", "first_seen_ip_source", "last_used_ip_source", "created_at", "expires_at", "current", "active_session_count" ], "properties": { "active_session_count": { "type": "integer", "format": "int64" }, "browser_family": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "current": { "type": "boolean" }, "expires_at": { "type": "string", "format": "date-time" }, "first_seen_ip": { "type": [ "string", "null" ] }, "first_seen_ip_source": { "$ref": "#/components/schemas/NetworkAddressSource" }, "id": { "type": "string", "format": "uuid" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_used_ip": { "type": [ "string", "null" ] }, "last_used_ip_source": { "$ref": "#/components/schemas/NetworkAddressSource" }, "platform": { "type": [ "string", "null" ] } } }, "AccountSecurityPolicyResponse": { "type": "object", "required": [ "trusted_device_window_days" ], "properties": { "trusted_device_window_days": { "type": "integer", "format": "int32", "minimum": 0 } } }, "AccountSession": { "type": "object", "required": [ "id", "ip_source", "application_id", "created_at", "expires_at", "current" ], "properties": { "app_name": { "type": [ "string", "null" ] }, "application_id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "current": { "type": "boolean" }, "expires_at": { "type": "string", "format": "date-time" }, "id": { "type": "string", "format": "uuid", "description": "Opaque management handle; never a session bearer or database primary key." }, "ip": { "type": [ "string", "null" ] }, "ip_source": { "$ref": "#/components/schemas/NetworkAddressSource" }, "last_activity_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When this session last reported activity.\n\n`null` means it has never reported any — which is *unknown* liveness,\nnot idle-dead. Not every plane sends heartbeats, and idle is not\nenforced on those planes either, so a tenant UI must not render `null`\nas \"inactive\". Every session in this list is live by both clocks; this\nfield lets a UI say \"last active 4 minutes ago\" for the ones that can." }, "linked_device": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/LinkedTrustedDevice" } ] }, "user_agent": { "type": [ "string", "null" ] } } }, "Acr": { "type": "string", "enum": [ "urn:authreads:acr:single", "urn:authreads:acr:pwd", "urn:authreads:acr:2fa", "urn:authreads:acr:mfa", "urn:authreads:acr:phr" ] }, "Added": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "format": "uuid" } } }, "ApiLoginAuthenticatorSetupStarted": { "allOf": [ { "$ref": "#/components/schemas/HostedAuthenticatorSetupStarted" }, { "type": "object", "required": [ "flow_token" ], "properties": { "flow_token": { "type": "string" } } } ] }, "ApiLoginFlowProof": { "type": "object", "required": [ "flow_token", "code" ], "properties": { "code": { "type": "string" }, "flow_token": { "type": "string" }, "remember_device": { "type": "boolean" } }, "additionalProperties": false }, "ApiLoginFlowResponse": { "allOf": [ { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/Assurance" } ] }, { "type": "object", "required": [ "alternatives", "expires_at", "password_change_required", "strong_method" ], "properties": { "alternatives": { "type": "array", "items": { "$ref": "#/components/schemas/SecondStep" } }, "device_token": { "type": [ "string", "null" ] }, "expires_at": { "type": "string", "format": "date-time" }, "flow_token": { "type": [ "string", "null" ] }, "grant": { "type": [ "string", "null" ] }, "next_method": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/SecondStep" } ] }, "password_change_required": { "type": "boolean" }, "session_reverified": { "type": "boolean" }, "strong_method": { "$ref": "#/components/schemas/ApiLoginStrongMethodRequirement" } } } ] }, "ApiLoginFlowToken": { "type": "object", "required": [ "flow_token" ], "properties": { "flow_token": { "type": "string" } }, "additionalProperties": false }, "ApiLoginPasskeyBegin": { "type": "object", "required": [ "flow_token", "origin" ], "properties": { "flow_token": { "type": "string" }, "origin": { "type": "string" } }, "additionalProperties": false }, "ApiLoginPasskeyEnrollmentFinish": { "type": "object", "required": [ "flow_token", "ceremony_id", "credential", "name" ], "properties": { "ceremony_id": { "type": "string", "format": "uuid" }, "credential": {}, "flow_token": { "type": "string" }, "name": { "type": "string" } }, "additionalProperties": false }, "ApiLoginPasskeyFinish": { "type": "object", "required": [ "flow_token", "ceremony_id", "credential" ], "properties": { "ceremony_id": { "type": "string", "format": "uuid" }, "credential": {}, "flow_token": { "type": "string" }, "remember_device": { "type": "boolean" } }, "additionalProperties": false }, "ApiLoginPasskeyStarted": { "type": "object", "required": [ "flow_token", "ceremony_id", "options", "expires_at" ], "properties": { "ceremony_id": { "type": "string", "format": "uuid" }, "expires_at": { "type": "string", "format": "date-time" }, "flow_token": { "type": "string" }, "options": {} } }, "ApiLoginSecondStep": { "type": "object", "required": [ "flow_token", "method" ], "properties": { "flow_token": { "type": "string" }, "method": { "$ref": "#/components/schemas/SecondStep" } }, "additionalProperties": false }, "ApiLoginStrongMethodRequirement": { "oneOf": [ { "type": "object", "required": [ "state" ], "properties": { "state": { "type": "string", "enum": [ "none" ] } } }, { "type": "object", "required": [ "deadline", "methods", "state" ], "properties": { "deadline": { "type": "string", "format": "date" }, "methods": { "type": "array", "items": { "$ref": "#/components/schemas/SecondStep" } }, "state": { "type": "string", "enum": [ "ask" ] } } }, { "type": "object", "required": [ "methods", "state" ], "properties": { "methods": { "type": "array", "items": { "$ref": "#/components/schemas/SecondStep" } }, "state": { "type": "string", "enum": [ "required" ] } } } ] }, "Assurance": { "type": "object", "required": [ "acr", "auth_time", "amr" ], "properties": { "acr": { "$ref": "#/components/schemas/Acr" }, "amr": { "type": "array", "items": { "type": "string" } }, "auth_time": { "type": "integer", "format": "int64", "description": "NumericDate of the proof supporting this context. A later password\ncannot freshen an older authenticator/passkey proof." } } }, "AttributionTokenResponse": { "type": "object", "required": [ "access_token", "issued_token_type", "token_type", "expires_in", "scope" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "issued_token_type": { "type": "string" }, "scope": { "type": "string" }, "token_type": { "type": "string" } } }, "AuditActorInput": { "type": "object", "required": [ "kind", "id" ], "properties": { "id": { "type": "string", "description": "Product-side stable identifier. Never send credentials or tokens.", "maxLength": 256 }, "kind": { "type": "string", "description": "Stable actor class, for example `user` or `service`.", "maxLength": 64 } }, "additionalProperties": false }, "AuditCategory": { "type": "string", "description": "Matches the `audit_category` ENUM in PostgreSQL", "enum": [ "authentication", "authorization", "account", "admin", "security", "config" ] }, "AuditIngestRequest": { "type": "object", "required": [ "actor", "action", "category", "outcome", "occurred_at" ], "properties": { "action": { "type": "string", "maxLength": 128 }, "actor": { "$ref": "#/components/schemas/AuditActorInput" }, "app_id": { "type": [ "string", "null" ], "format": "uuid" }, "category": { "$ref": "#/components/schemas/AuditCategory" }, "metadata": { "description": "Bounded structured context. Secret-bearing keys are rejected." }, "occurred_at": { "type": "string", "format": "date-time" }, "outcome": { "$ref": "#/components/schemas/AuditOutcomeInput" }, "security_event": { "type": "boolean" }, "severity": { "$ref": "#/components/schemas/AuditSeverity" }, "target_id": { "type": [ "string", "null" ], "maxLength": 256 }, "target_type": { "type": [ "string", "null" ], "maxLength": 64 } }, "additionalProperties": false }, "AuditIngestResponse": { "type": "object", "required": [ "id", "occurred_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "occurred_at": { "type": "string", "format": "date-time" } } }, "AuditOutcomeInput": { "type": "string", "enum": [ "success", "failure", "denied" ] }, "AuditSeverity": { "type": "string", "description": "Matches the `audit_severity` ENUM in PostgreSQL", "enum": [ "info", "warning", "critical" ] }, "Availability": { "type": "object", "required": [ "available" ], "properties": { "available": { "type": "boolean" } } }, "BackRequest": { "type": "object", "required": [ "continuation" ], "properties": { "continuation": { "type": "string" } }, "additionalProperties": false }, "BeginRequest": { "type": "object", "required": [ "continuation", "email" ], "properties": { "continuation": { "type": "string" }, "email": { "type": "string" }, "flow_token": { "type": [ "string", "null" ] } }, "additionalProperties": false }, "BindingInvitationCodeRequest": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string" } }, "additionalProperties": false }, "BindingInvitationPreview": { "type": "object", "required": [ "installation_id", "identity_source_id", "source_issuer", "external_subject", "tenant_name", "app_id", "app_name", "expires_at" ], "properties": { "app_id": { "type": "string", "format": "uuid" }, "app_name": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" }, "external_subject": { "type": "string" }, "identity_source_id": { "type": "string", "format": "uuid" }, "installation_id": { "type": "string", "format": "uuid" }, "source_display_name": { "type": [ "string", "null" ] }, "source_issuer": { "type": "string" }, "tenant_name": { "type": "string" } } }, "BindingInvitationRequest": { "type": "object", "required": [ "identity_source_id", "external_subject" ], "properties": { "external_subject": { "type": "string" }, "identity_source_id": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "BindingState": { "type": "string", "enum": [ "pending", "verified", "disabled" ] }, "BrowserSessionPolicy": { "type": "object", "required": [ "tenant_id", "version", "idle_timeout_minutes", "issued_at", "expires_at" ], "properties": { "expires_at": { "type": "string", "format": "date-time" }, "idle_timeout_minutes": { "type": "integer", "format": "int32", "minimum": 0 }, "issued_at": { "type": "string", "format": "date-time" }, "tenant_id": { "type": "string", "format": "uuid" }, "version": { "type": "string" } } }, "CampaignRevocation": { "type": "object", "required": [ "deployment_campaign", "revoked_installations" ], "properties": { "deployment_campaign": { "type": "string" }, "revoked_installations": { "type": "integer", "format": "int64", "minimum": 0 } } }, "ChangeExpiredPasswordRequest": { "type": "object", "required": [ "email", "current_password", "new_password" ], "properties": { "current_password": { "type": "string" }, "email": { "type": "string" }, "new_password": { "type": "string" } }, "additionalProperties": false }, "ChangeExpiredPasswordResponse": { "type": "object", "required": [ "ok" ], "properties": { "ok": { "type": "boolean" } } }, "ChangePasswordRequest": { "type": "object", "required": [ "session_id", "old_password", "new_password" ], "properties": { "new_password": { "type": "string" }, "old_password": { "type": "string" }, "session_id": { "type": "string", "format": "uuid" } } }, "ChangePasswordResponse": { "type": "object", "required": [ "status", "session_id", "session_expires_at", "session_reissued", "revoked_other_sessions" ], "properties": { "revoked_other_sessions": { "type": "integer", "format": "int64", "description": "Sessions belonging to this user *other* than the caller's, revoked by this\ncall. The caller's own session is rotated rather than counted here, so this\nnumber means the same thing it always did.", "minimum": 0 }, "session_expires_at": { "type": "string", "format": "date-time", "description": "Expiry of the replacement session, so a client storing a cookie can set\nits lifetime without a second round trip." }, "session_id": { "type": "string", "format": "uuid", "description": "The caller's **replacement** session bearer. The session presented\nin the request is revoked by this call, so the client must swap to this\nvalue — cookie, header, or wherever it holds the session — before its next\nrequest. Returned once and never retrievable again, exactly like login." }, "session_reissued": { "type": "boolean", "description": "`true` whenever the caller's session was rotated. Present so a client can\nassert the behaviour rather than infer it from a changed value." }, "status": { "type": "string" } } }, "ClientCredentialsRequest": { "type": "object", "required": [ "grant_type", "client_id", "client_secret" ], "properties": { "client_id": { "type": "string" }, "client_secret": { "type": "string" }, "grant_type": { "type": "string" }, "scope": { "type": [ "string", "null" ], "description": "Optional RFC 6749 space-delimited subset of scopes assigned to this\ncredential. Omit it to request every assigned scope.", "maxLength": 2048 } } }, "ClientCredentialsResponse": { "type": "object", "required": [ "access_token", "token_type", "expires_in", "scope" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "scope": { "type": "string" }, "token_type": { "type": "string" } } }, "Code": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string" } }, "additionalProperties": false }, "ConfirmedBinding": { "type": "object", "required": [ "binding_id" ], "properties": { "binding_id": { "type": "string", "format": "uuid" } } }, "ConsentOption": { "type": "object", "required": [ "binding_id", "external_subject", "identity_source_id", "resource_id", "resource_uri", "resource_display_name", "disclosure_id", "disclosure_version", "document", "document_sha256" ], "properties": { "binding_id": { "type": "string", "format": "uuid" }, "disclosure_id": { "type": "string", "format": "uuid" }, "disclosure_version": { "type": "integer", "format": "int32" }, "document": { "$ref": "#/components/schemas/DisclosureDocument" }, "document_sha256": { "type": "string" }, "external_subject": { "type": "string" }, "identity_source_id": { "type": "string", "format": "uuid" }, "resource_display_name": { "type": "string" }, "resource_id": { "type": "string", "format": "uuid" }, "resource_uri": { "type": "string" } } }, "CreateOrganizationRequest": { "type": "object", "required": [ "name" ], "properties": { "environment": { "type": [ "string", "null" ] }, "external_ref": { "type": [ "string", "null" ] }, "name": { "type": "string" }, "org_type_key": { "type": [ "string", "null" ] }, "package_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "CreatePackageRequest": { "type": "object", "required": [ "key", "name" ], "properties": { "app_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "description": { "type": [ "string", "null" ] }, "key": { "type": "string" }, "name": { "type": "string" } } }, "CreateRoleRequest": { "type": "object", "required": [ "key", "name" ], "properties": { "app_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "client_id": { "type": [ "string", "null" ], "format": "uuid" }, "description": { "type": [ "string", "null" ] }, "key": { "type": "string" }, "name": { "type": "string" }, "permission_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "CreateRoleResponse": { "type": "object", "required": [ "id", "key", "name", "status" ], "properties": { "id": { "type": "string", "format": "uuid" }, "key": { "type": "string" }, "name": { "type": "string" }, "status": { "type": "string" } } }, "CreateUserRequest": { "type": "object", "required": [ "email" ], "properties": { "display_name": { "type": [ "string", "null" ] }, "email": { "type": "string" }, "email_verified": { "type": [ "boolean", "null" ], "description": "Explicit tenant assertion. Omission asserts nothing and new users remain\nunverified until authreads proves mailbox possession." }, "organization_id": { "type": [ "string", "null" ], "format": "uuid" }, "password": { "type": [ "string", "null" ] }, "role_id": { "type": [ "string", "null" ], "format": "uuid" }, "user_pool_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "CreateUserResponse": { "type": "object", "required": [ "id", "email", "status", "email_verified" ], "properties": { "email": { "type": "string" }, "email_verified": { "type": "boolean" }, "id": { "type": "string", "format": "uuid" }, "organization_id": { "type": [ "string", "null" ], "format": "uuid" }, "role_id": { "type": [ "string", "null" ], "format": "uuid" }, "set_password": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/SetPasswordLink" } ] }, "status": { "type": "string" } } }, "DefaultLimitChange": { "type": "object", "required": [ "limit", "reason" ], "properties": { "limit": { "type": [ "integer", "null" ], "format": "int32", "description": "Required JSON null means explicitly unlimited; omission is refused." }, "reason": { "type": "string" } }, "additionalProperties": false }, "DeleteUserResponse": { "type": "object", "required": [ "id", "status", "sessions_revoked" ], "properties": { "id": { "type": "string", "format": "uuid" }, "sessions_revoked": { "type": "integer", "format": "int64", "minimum": 0 }, "status": { "type": "string" } } }, "DevicesResponse": { "type": "object", "required": [ "devices" ], "properties": { "devices": { "type": "array", "items": { "$ref": "#/components/schemas/AccountDevice" } } } }, "DisclosureDocument": { "type": "object", "required": [ "controller_identity", "purpose", "data_categories", "installation_coverage", "retention", "resource_identity", "contact", "locale" ], "properties": { "contact": { "type": "string" }, "controller_identity": { "type": "string" }, "data_categories": { "type": "array", "items": { "type": "string" } }, "installation_coverage": { "type": "string" }, "locale": { "type": "string" }, "purpose": { "type": "string" }, "resource_identity": { "type": "string" }, "retention": { "type": "string" } }, "additionalProperties": false }, "DpopResourceErrorResponse": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } } }, "EmailVerificationResponse": { "type": "object", "required": [ "id", "email_verified" ], "properties": { "email_verified": { "type": "boolean" }, "email_verified_at": { "type": [ "string", "null" ], "format": "date-time" }, "email_verified_method": { "type": [ "string", "null" ] }, "id": { "type": "string", "format": "uuid" } } }, "EntitlementMode": { "type": "string", "enum": [ "role_only", "role_and_package" ] }, "ErasureResourceStatus": { "type": "object", "required": [ "resource_id", "resource", "status", "attempts" ], "properties": { "acknowledged_at": { "type": [ "string", "null" ], "format": "date-time" }, "attempts": { "type": "integer", "format": "int32" }, "last_error": { "type": [ "string", "null" ] }, "resource": { "type": "string" }, "resource_id": { "type": "string", "format": "uuid" }, "status": { "type": "string" } } }, "ErasureStatus": { "type": "object", "required": [ "request_id", "status", "requested_at", "summary", "resources" ], "properties": { "request_id": { "type": "string", "format": "uuid" }, "requested_at": { "type": "string", "format": "date-time" }, "resources": { "type": "array", "items": { "$ref": "#/components/schemas/ErasureResourceStatus" } }, "status": { "type": "string" }, "summary": { "type": "string" } } }, "ExceptionChange": { "oneOf": [ { "type": "object", "required": [ "limit", "reason", "mode" ], "properties": { "limit": { "type": [ "integer", "null" ], "format": "int32" }, "mode": { "type": "string", "enum": [ "override" ] }, "reason": { "type": "string" } } }, { "type": "object", "required": [ "reason", "mode" ], "properties": { "mode": { "type": "string", "enum": [ "inherit" ] }, "reason": { "type": "string" } } } ] }, "ExchangeRequest": { "type": "object", "required": [ "grant" ], "properties": { "grant": { "type": "string" } } }, "ExchangeResponse": { "allOf": [ { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/Assurance" } ] }, { "type": "object", "required": [ "user", "session_id", "account_session_id", "session_policy", "session_activity_token" ], "properties": { "account_session_id": { "type": "string", "format": "uuid", "description": "Opaque non-credential handle used by account-security operations." }, "kind": { "type": [ "string", "null" ] }, "session_activity_token": { "type": "string" }, "session_id": { "type": "string", "format": "uuid" }, "session_policy": { "$ref": "#/components/schemas/BrowserSessionPolicy" }, "user": { "$ref": "#/components/schemas/SessionUser" } } } ] }, "ExpiredPasswordRequest": { "oneOf": [ { "$ref": "#/components/schemas/ChangeExpiredPasswordRequest" }, { "$ref": "#/components/schemas/FlowExpiredPasswordRequest" } ] }, "Factor": { "type": "object", "required": [ "id", "name", "added_at" ], "properties": { "added_at": { "type": "string", "format": "date-time" }, "id": { "type": "string", "format": "uuid" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "name": { "type": "string" } } }, "Finish": { "type": "object", "required": [ "ceremony_id", "credential" ], "properties": { "ceremony_id": { "type": "string", "format": "uuid" }, "credential": {} }, "additionalProperties": false }, "FinishRequest": { "type": "object", "required": [ "continuation", "email", "ceremony_id", "credential" ], "properties": { "ceremony_id": { "type": "string", "format": "uuid" }, "continuation": { "type": "string" }, "credential": {}, "current_session_token": { "type": [ "string", "null" ], "format": "uuid" }, "email": { "type": "string" }, "flow_token": { "type": [ "string", "null" ] } }, "additionalProperties": false }, "FlowExpiredPasswordRequest": { "type": "object", "required": [ "flow_token", "new_password" ], "properties": { "flow_token": { "type": "string" }, "new_password": { "type": "string" } }, "additionalProperties": false }, "ForgotPasswordRequest": { "type": "object", "required": [ "email" ], "properties": { "email": { "type": "string" } } }, "GrantResponse": { "type": "object", "required": [ "grant", "trusted_device_window_days" ], "properties": { "device_token": { "type": [ "string", "null" ] }, "grant": { "type": "string" }, "trusted_device_window_days": { "type": "integer", "format": "int32", "minimum": 0 } } }, "HeartbeatReceipt": { "type": "object", "required": [ "installation_id", "last_authenticated_heartbeat_at" ], "properties": { "installation_id": { "type": "string", "format": "uuid" }, "last_authenticated_heartbeat_at": { "type": "string", "format": "date-time" } } }, "HostedAccountIdentity": { "type": "object", "required": [ "email" ], "properties": { "display_name": { "type": [ "string", "null" ] }, "email": { "type": "string" }, "preferred_sign_in_method": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/SecondStep" } ] } } }, "HostedAccountMessage": { "type": "object", "required": [ "message" ], "properties": { "message": { "type": "string" } } }, "HostedAuthenticatorSetupStarted": { "type": "object", "required": [ "qr_svg", "key", "otpauth_uri", "expires_at" ], "properties": { "expires_at": { "type": "string", "format": "date-time" }, "key": { "type": "string" }, "otpauth_uri": { "type": "string" }, "qr_svg": { "type": "string" } } }, "HostedChangePasswordRequest": { "type": "object", "required": [ "current_password", "new_password" ], "properties": { "current_password": { "type": "string" }, "new_password": { "type": "string" } }, "additionalProperties": false }, "HostedChangePasswordResponse": { "type": "object", "required": [ "status", "session_id", "session_expires_at", "session_activity_token", "session_reissued", "revoked_other_sessions" ], "properties": { "revoked_other_sessions": { "type": "integer", "format": "int64", "minimum": 0 }, "session_activity_token": { "type": "string" }, "session_expires_at": { "type": "string", "format": "date-time" }, "session_id": { "type": "string", "format": "uuid" }, "session_reissued": { "type": "boolean" }, "status": { "type": "string" } } }, "HostedExpiredPasswordChangeRequest": { "type": "object", "required": [ "continuation", "flow_token", "new_password" ], "properties": { "continuation": { "type": "string" }, "flow_token": { "type": "string" }, "new_password": { "type": "string" } } }, "HostedExpiredPasswordChangeResponse": { "type": "object", "required": [ "continuation" ], "properties": { "continuation": { "type": "string" } } }, "HostedForgotPasswordRequest": { "type": "object", "required": [ "continuation", "email" ], "properties": { "continuation": { "type": "string" }, "email": { "type": "string" } }, "additionalProperties": false }, "HostedGeneratedRecoveryCodes": { "type": "object", "required": [ "codes", "issued_at" ], "properties": { "codes": { "type": "array", "items": { "type": "string" } }, "issued_at": { "type": "string", "format": "date-time" } } }, "HostedLoginPreflightRequest": { "type": "object", "required": [ "continuation", "email", "password" ], "properties": { "continuation": { "type": "string" }, "current_session_token": { "type": [ "string", "null" ], "format": "uuid" }, "device_token": { "type": [ "string", "null" ] }, "email": { "type": "string" }, "password": { "type": "string" } } }, "HostedLoginPreflightResponse": { "type": "object", "required": [ "otp_required", "password_change_required", "trusted_device_window_days", "trusted_device_available" ], "properties": { "flow_token": { "type": [ "string", "null" ] }, "handoff": { "type": [ "string", "null" ] }, "otp_required": { "type": "boolean" }, "password_change_required": { "type": "boolean" }, "session_activity_token": { "type": [ "string", "null" ] }, "session_id": { "type": [ "string", "null" ], "format": "uuid" }, "session_policy": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/BrowserSessionPolicy" } ] }, "trusted_device_available": { "type": "boolean" }, "trusted_device_window_days": { "type": "integer", "format": "int32", "minimum": 0 } } }, "HostedLoginResendOtpRequest": { "type": "object", "required": [ "continuation", "flow_token" ], "properties": { "continuation": { "type": "string" }, "flow_token": { "type": "string" } } }, "HostedLoginResendOtpResponse": { "type": "object", "required": [ "flow_token", "retry_after_seconds" ], "properties": { "flow_token": { "type": "string" }, "retry_after_seconds": { "type": "integer", "format": "int64", "minimum": 0 } } }, "HostedLoginSessionResponse": { "type": "object", "required": [ "session_id", "session_policy", "session_activity_token", "handoff", "trusted_device_window_days" ], "properties": { "device_token": { "type": [ "string", "null" ] }, "handoff": { "type": "string" }, "session_activity_token": { "type": "string" }, "session_id": { "type": "string", "format": "uuid" }, "session_policy": { "$ref": "#/components/schemas/BrowserSessionPolicy" }, "trusted_device_window_days": { "type": "integer", "format": "int32", "minimum": 0 } } }, "HostedLoginVerifyOtpRequest": { "type": "object", "required": [ "continuation", "flow_token", "code" ], "properties": { "code": { "type": "string" }, "continuation": { "type": "string" }, "current_session_token": { "type": [ "string", "null" ], "format": "uuid" }, "device_token": { "type": [ "string", "null" ] }, "flow_token": { "type": "string" }, "remember_device": { "type": "boolean" } } }, "HostedPasskeyRegistrationStarted": { "type": "object", "required": [ "ceremony_id", "options" ], "properties": { "ceremony_id": { "type": "string", "format": "uuid" }, "options": {}, "suggested_name": { "type": [ "string", "null" ] } } }, "HostedPasskeyStarted": { "type": "object", "required": [ "ceremony_id", "options" ], "properties": { "ceremony_id": { "type": "string", "format": "uuid" }, "options": {} } }, "HostedPasskeyVerificationStarted": { "type": "object", "required": [ "ceremony_id", "options" ], "properties": { "ceremony_id": { "type": "string", "format": "uuid" }, "options": {} } }, "HostedPasswordStatus": { "type": "object", "properties": { "password_changed_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "HostedRecoveryCodeInput": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string" } }, "additionalProperties": false }, "HostedRecoveryCodeStatus": { "type": "object", "required": [ "recovery", "eligible", "methods", "email", "tenant_slug", "recovery_sign_in" ], "properties": { "eligible": { "type": "boolean" }, "email": { "type": "string" }, "methods": { "$ref": "#/components/schemas/Status" }, "recovery": { "$ref": "#/components/schemas/UserRecoveryCodeMetadata" }, "recovery_sign_in": { "type": "boolean" }, "reset_at": { "type": [ "string", "null" ], "format": "date-time" }, "tenant_slug": { "type": "string" } } }, "HostedResetPasswordRequest": { "type": "object", "required": [ "token", "new_password" ], "properties": { "new_password": { "type": "string" }, "token": { "type": "string" } }, "additionalProperties": false }, "HostedResetTokenRequest": { "type": "object", "required": [ "token" ], "properties": { "token": { "type": "string" } }, "additionalProperties": false }, "HostedReverifyRequest": { "oneOf": [ { "type": "object", "required": [ "password", "action" ], "properties": { "action": { "type": "string", "enum": [ "password" ] }, "password": { "type": "string" } } }, { "type": "object", "required": [ "action" ], "properties": { "action": { "type": "string", "enum": [ "email_otp_request" ] } } }, { "type": "object", "required": [ "code", "action" ], "properties": { "action": { "type": "string", "enum": [ "email_otp_verify" ] }, "code": { "type": "string" } } } ] }, "HostedReverifyResponse": { "type": "object", "required": [ "status" ], "properties": { "amr": { "type": "array", "items": { "type": "string" } }, "authenticated_at": { "type": "string", "format": "date-time" }, "status": { "type": "string" } } }, "IdentitySourceType": { "type": "string", "enum": [ "directory", "machine_local" ] }, "InstallationAccessTokenType": { "type": "string", "description": "Published protocol-v1 values consumed by software that Authreads cannot\nupdate after installation. They are source constants rather than runtime\npolicy: changing one is a coordinated protocol release, not tuning.", "enum": [ "DPoP" ] }, "InstallationCreated": { "type": "object", "required": [ "installation_id", "suspected_duplicate", "app_id", "public_key_sha256" ], "properties": { "app_id": { "type": "string", "format": "uuid" }, "installation_id": { "type": "string", "format": "uuid" }, "public_key_sha256": { "type": "string" }, "suspected_duplicate": { "type": "boolean" } } }, "InstallationEnrolled": { "type": "object", "required": [ "installation_id", "suspected_duplicate", "refresh_token", "refresh_token_expires_at", "enrolment_receipt" ], "properties": { "enrolment_receipt": { "type": "string", "description": "Five-minute EdDSA JWT (`typ=enrolment-receipt+jwt`). `sub` is the stable\ninstallation UUID across exact retries; `jti` is unique per minted JWT.\nVerify issuer, app audience, tenant, app, time, and the digest of the\ncanonical public key. Claim semantics: docs/INSTALLATION_PROTOCOL.md." }, "installation_id": { "type": "string", "format": "uuid" }, "refresh_token": { "type": "string", "description": "DPoP-bound credential used with the standard OAuth `refresh_token`\ngrant. The original ticket can recover it after a lost response." }, "refresh_token_expires_at": { "type": "string", "format": "date-time" }, "suspected_duplicate": { "type": "boolean" } } }, "InstallationPage": { "type": "object", "required": [ "items", "total", "limit", "offset" ], "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/InstallationSummary" } }, "limit": { "type": "integer", "format": "int64" }, "offset": { "type": "integer", "format": "int64" }, "total": { "type": "integer", "format": "int64" } } }, "InstallationRecoveryAction": { "type": "string", "enum": [ "reenrol" ] }, "InstallationSummary": { "type": "object", "required": [ "id", "status", "key_storage_assurance", "deployment_campaign", "created_at", "last_connected_at", "last_connected_signal" ], "properties": { "created_at": { "type": "string", "format": "date-time" }, "deployment_campaign": { "type": "string" }, "id": { "type": "string", "format": "uuid" }, "key_storage_assurance": { "type": "string" }, "last_authenticated_heartbeat_at": { "type": [ "string", "null" ], "format": "date-time", "description": "Server receipt time of the latest successfully authenticated heartbeat." }, "last_connected_at": { "type": "string", "format": "date-time" }, "last_connected_signal": { "type": "string" }, "revocation_kind": { "type": [ "string", "null" ] }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" }, "status": { "type": "string" } } }, "InstallationTokenResponse": { "type": "object", "required": [ "access_token", "token_type", "expires_in", "refresh_token", "refresh_token_expires_at", "scope" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "refresh_token": { "type": "string" }, "refresh_token_expires_at": { "type": "string", "format": "date-time" }, "scope": { "type": "string" }, "token_type": { "$ref": "#/components/schemas/InstallationAccessTokenType" } } }, "Inventory": { "type": "object", "required": [ "items", "max_active", "requires_passkey", "fresh_proof_available", "required_strength", "current_site", "sign_in_allowed" ], "properties": { "current_site": { "type": "string" }, "fresh_proof_available": { "type": "boolean" }, "items": { "type": "array", "items": { "$ref": "#/components/schemas/Item" } }, "max_active": { "type": "integer", "minimum": 0 }, "required_strength": { "$ref": "#/components/schemas/Strength" }, "requires_passkey": { "type": "boolean" }, "sign_in_allowed": { "type": "boolean" } } }, "IssueMachineEnrolmentTicketRequest": { "type": "object", "required": [ "purpose", "deployment_campaign" ], "properties": { "deployment_campaign": { "type": "string", "description": "Customer deployment/run identifier used for audit and lifecycle review." }, "purpose": { "type": "string", "description": "Human-readable reason for this installation." } }, "additionalProperties": false }, "IssuedBindingInvitation": { "type": "object", "required": [ "code", "expires_at" ], "properties": { "code": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" } } }, "IssuedEnrolment": { "type": "object", "required": [ "id", "token", "not_before", "expires_at", "max_uses" ], "properties": { "expires_at": { "type": "string", "format": "date-time" }, "id": { "type": "string", "format": "uuid" }, "max_uses": { "type": "integer", "format": "int32" }, "not_before": { "type": "string", "format": "date-time" }, "token": { "type": "string" } } }, "Item": { "type": "object", "required": [ "id", "friendly_name", "created_at", "works_on", "current_host" ], "properties": { "backed_up": { "type": [ "boolean", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "current_host": { "type": "boolean" }, "friendly_name": { "type": "string" }, "id": { "type": "string", "format": "uuid" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "works_on": { "type": "string" } } }, "KeyStorageAssurance": { "type": "string", "enum": [ "software_protected", "hardware_backed" ] }, "LinkedTrustedDevice": { "type": "object", "required": [ "id", "trusted_at", "status", "other_active_session_count" ], "properties": { "browser_family": { "type": [ "string", "null" ] }, "id": { "type": "string", "format": "uuid" }, "other_active_session_count": { "type": "integer", "format": "int64", "description": "Other currently active sessions linked to this device. The current\nsession row is deliberately excluded." }, "platform": { "type": [ "string", "null" ] }, "status": { "$ref": "#/components/schemas/LinkedTrustedDeviceStatus" }, "trusted_at": { "type": "string", "format": "date-time" } } }, "LinkedTrustedDeviceStatus": { "type": "string", "description": "Lifecycle of a trusted device linked to a session.", "enum": [ "active", "revoked", "expired" ] }, "LoginErrorCode": { "type": "string", "description": "Stable, integrator-actionable login denial vocabulary shared by the direct\nand hosted/OIDC planes. Adding a variant requires an explicit wire value and\nis therefore a compile-time public-contract decision.", "enum": [ "invalid_credentials", "rate_limited", "login_temporarily_locked", "user_passkey_unavailable", "user_authentication_method_unavailable", "no_sign_in_method" ] }, "LoginPreflightRequest": { "type": "object", "required": [ "email", "password" ], "properties": { "device_token": { "type": [ "string", "null" ] }, "email": { "type": "string" }, "min_acr": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/Acr" } ] }, "password": { "type": "string" } }, "additionalProperties": false }, "LoginPreflightResponse": { "type": "object", "required": [ "otp_required", "password_change_required", "trusted_device_window_days", "trusted_device_available" ], "properties": { "grant": { "type": [ "string", "null" ] }, "otp_required": { "type": "boolean" }, "password_change_required": { "type": "boolean" }, "trusted_device_available": { "type": "boolean" }, "trusted_device_window_days": { "type": "integer", "format": "int32", "minimum": 0 } } }, "LoginPreflightResult": { "oneOf": [ { "$ref": "#/components/schemas/LoginPreflightResponse" }, { "$ref": "#/components/schemas/ApiLoginFlowResponse" } ] }, "ManagementApp": { "type": "object", "required": [ "id", "key", "name", "package_gated" ], "properties": { "id": { "type": "string", "format": "uuid" }, "key": { "type": "string" }, "name": { "type": "string" }, "package_gated": { "type": "boolean" } } }, "ManagementEntitlementPolicyResponse": { "type": "object", "required": [ "entitlement_mode", "active_organizations_without_package" ], "properties": { "active_organizations_without_package": { "type": "integer", "format": "int64" }, "entitlement_mode": { "$ref": "#/components/schemas/EntitlementMode" } } }, "ManagementUser": { "type": "object", "required": [ "id", "email", "status", "email_verified" ], "properties": { "display_name": { "type": [ "string", "null" ] }, "email": { "type": "string" }, "email_verified": { "type": "boolean" }, "email_verified_at": { "type": [ "string", "null" ], "format": "date-time" }, "email_verified_method": { "type": [ "string", "null" ] }, "id": { "type": "string", "format": "uuid" }, "organization_id": { "type": [ "string", "null" ], "format": "uuid" }, "organization_name": { "type": [ "string", "null" ] }, "role_id": { "type": [ "string", "null" ], "format": "uuid" }, "role_key": { "type": [ "string", "null" ] }, "status": { "type": "string" } } }, "MeResponse": { "type": "object", "required": [ "id", "email", "tenant_id", "expires_at", "memberships" ], "properties": { "accessible_apps": { "type": [ "array", "null" ], "items": { "type": "string" }, "description": "App keys — only present when an org context is resolved." }, "email": { "type": "string" }, "environment": { "type": [ "string", "null" ], "description": "The organization type's tenant-configured environment. Present only when configured.\nClients interpret this informational value through their public integration configuration." }, "expires_at": { "type": "string", "format": "date-time", "description": "Absolute server-side session expiry, serialized as RFC 3339 UTC." }, "id": { "type": "string", "format": "uuid" }, "memberships": { "type": "array", "items": { "$ref": "#/components/schemas/MembershipInfo" }, "description": "All organizations the user is a member of (always returned)." }, "org_type": { "type": [ "string", "null" ], "description": "The resolved organization's tenant-configured type key. Present when an organization is resolved.\nClients interpret this value through their public integration configuration." }, "organization_id": { "type": [ "string", "null" ], "format": "uuid", "description": "Set when an org context was resolved (explicit param, or auto for single-org users)." }, "permissions": { "type": [ "array", "null" ], "items": { "type": "string" }, "description": "Permission keys — only present when an org context is resolved." }, "role": { "type": [ "string", "null" ] }, "tenant_id": { "type": "string", "format": "uuid" } } }, "MembershipInfo": { "type": "object", "description": "Slim membership descriptor returned in the `/me` response.\n\nLists every organization the user belongs to, along with the role assigned\nin that membership (if any). The frontend uses this to build an org-switcher\nand to decide whether an explicit `organization_id` param is needed.", "required": [ "organization_id", "organization_name" ], "properties": { "organization_id": { "type": "string", "format": "uuid" }, "organization_name": { "type": "string" }, "role_key": { "type": [ "string", "null" ] } } }, "MembershipTargetRequest": { "type": "object", "properties": { "organization_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "MessageResponse": { "type": "object", "required": [ "message" ], "properties": { "message": { "type": "string" } } }, "Method": { "type": "string", "enum": [ "passkey", "totp", "password", "email_code" ] }, "MethodsRequest": { "type": "object", "required": [ "continuation" ], "properties": { "continuation": { "type": "string" } }, "additionalProperties": false }, "MethodsResponse": { "type": "object", "required": [ "passkey_enabled" ], "properties": { "passkey_enabled": { "type": "boolean" } } }, "MoveEnvironmentRequest": { "type": "object", "required": [ "environment" ], "properties": { "environment": { "type": "string" } } }, "NetworkAddressSource": { "type": "string", "description": "Human-facing network address provenance for session/device inventory.", "enum": [ "observed_client_ip", "asserted_browser_ip", "hidden_local_address", "not_recorded" ] }, "OAuthErrorResponse": { "type": "object", "required": [ "error", "error_description" ], "properties": { "attempts_remaining": { "type": [ "integer", "null" ], "format": "int32", "minimum": 0 }, "error": { "type": "string" }, "error_code": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/LoginErrorCode", "description": "Stable Authreads extension for login denials that OAuth's standard\nvocabulary cannot distinguish. Branch on this value, never prose." } ] }, "error_description": { "type": "string" }, "installation_recovery_action": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/InstallationRecoveryAction" } ] } } }, "OidcAccessClaims": { "type": "object", "description": "Identity/app-scoped bearer used by OIDC protocol endpoints and RFC 8693\nexchange. Workspace authorization is deliberately absent.", "required": [ "sub", "tenant", "aud", "user_pool", "scope", "iss", "iat", "exp" ], "properties": { "acr": { "$ref": "#/components/schemas/Acr" }, "aud": { "type": "string" }, "auth_time": { "type": "integer", "minimum": 0 }, "email": { "type": "string" }, "exp": { "type": "integer", "minimum": 0 }, "iat": { "type": "integer", "minimum": 0 }, "iss": { "type": "string" }, "scope": { "type": "array", "items": { "type": "string" } }, "sid": { "type": "string", "description": "Opaque session binding used for immediate revocation checks. Tokens\nminted before this additive claim remain deserializable, but consumers\nrequiring live-session authority must reject its absence." }, "sub": { "type": "string" }, "tenant": { "type": "string" }, "user_pool": { "type": "string" } } }, "OidcTokenResponse": { "type": "object", "required": [ "access_token", "token_type", "expires_in", "scope" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "id_token": { "type": [ "string", "null" ] }, "refresh_token": { "type": [ "string", "null" ] }, "scope": { "type": "string" }, "token_type": { "type": "string" } } }, "OrganizationProvisioningResult": { "type": "object", "required": [ "id", "name", "status" ], "properties": { "environment": { "type": [ "string", "null" ] }, "external_ref": { "type": [ "string", "null" ] }, "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "org_type_key": { "type": [ "string", "null" ] }, "package_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" } } }, "OrganizationTypeReference": { "type": "object", "description": "Tenant-authored organization classification exposed in resolution errors.\n`environment` is deliberately serialized as `null` when no environment was\nrequested/configured so API clients do not have to infer its meaning.", "required": [ "key" ], "properties": { "environment": { "type": [ "string", "null" ] }, "key": { "type": "string" } } }, "Ownership": { "type": "object", "required": [ "is_shared" ], "properties": { "is_shared": { "type": "boolean" }, "owner_user_id": { "type": [ "string", "null" ], "format": "uuid" } }, "additionalProperties": false }, "OwnershipChange": { "oneOf": [ { "type": "object", "required": [ "user_id", "reason", "mode" ], "properties": { "mode": { "type": "string", "enum": [ "owner" ] }, "reason": { "type": "string" }, "user_id": { "type": "string", "format": "uuid" } } }, { "type": "object", "required": [ "reason", "mode" ], "properties": { "mode": { "type": "string", "enum": [ "shared" ] }, "reason": { "type": "string" } } }, { "type": "object", "required": [ "reason", "mode" ], "properties": { "mode": { "type": "string", "enum": [ "unowned" ] }, "reason": { "type": "string" } } } ] }, "PackageAppsResponse": { "type": "object", "required": [ "id", "status", "app_ids" ], "properties": { "app_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "id": { "type": "string", "format": "uuid" }, "status": { "type": "string" } } }, "PackageDeleteResponse": { "type": "object", "required": [ "id", "status" ], "properties": { "id": { "type": "string", "format": "uuid" }, "status": { "type": "string" } } }, "PackageListing": { "type": "object", "required": [ "id", "key", "name", "app_ids", "assigned_organization_count" ], "properties": { "app_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "assigned_organization_count": { "type": "integer", "format": "int64" }, "description": { "type": [ "string", "null" ] }, "id": { "type": "string", "format": "uuid" }, "key": { "type": "string" }, "name": { "type": "string" } } }, "PasswordPolicyContract": { "type": "object", "required": [ "version", "length_unit", "minimum_length", "maximum_length", "requires_alphabetic", "requires_non_alphabetic", "rejected_unicode_general_categories", "errors" ], "properties": { "errors": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/PasswordPolicyFailureContract" }, "propertyNames": { "type": "string" } }, "length_unit": { "type": "string" }, "maximum_length": { "type": "integer", "minimum": 0 }, "minimum_length": { "type": "integer", "minimum": 0 }, "rejected_unicode_general_categories": { "type": "array", "items": { "type": "string" } }, "requires_alphabetic": { "type": "boolean" }, "requires_non_alphabetic": { "type": "boolean" }, "version": { "type": "integer", "format": "int64", "minimum": 0 } } }, "PasswordPolicyFailureContract": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string" }, "message": { "type": "string" } } }, "PersonLimit": { "type": "object", "properties": { "tenant_default": { "type": [ "integer", "null" ], "format": "int32" }, "user_exception": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/PersonLimitException" } ] } } }, "PersonLimitException": { "type": "object", "required": [ "user_id", "reason" ], "properties": { "limit_value": { "type": [ "integer", "null" ], "format": "int32" }, "reason": { "type": "string" }, "user_id": { "type": "string", "format": "uuid" } } }, "ProblemDetails": { "type": "object", "description": "RFC 7807 \"problem details\" body.", "required": [ "status", "title" ], "properties": { "action_id": { "type": "string", "description": "Privileged operator action that requires a fresh, action-bound proof." }, "available": { "type": "array", "items": { "$ref": "#/components/schemas/OrganizationTypeReference" }, "description": "Deterministically ordered, bounded tenant configuration snapshot." }, "available_total": { "type": "integer", "format": "int64", "description": "Total available pairs before response-size bounding. Compare this with\n`available.length` to determine whether the list was truncated.", "minimum": 0 }, "code": { "type": "string", "description": "Stable RFC 7807 extension member for an integrator-actionable condition.\nIts absence is intentional: generic errors must be handled by status,\nand human-readable title/detail values are not machine contracts." }, "current_count": { "type": "integer", "format": "int64" }, "detail": { "type": "string" }, "installation_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "limit": { "type": "integer", "format": "int32" }, "requested": { "$ref": "#/components/schemas/OrganizationTypeReference", "description": "Exact organization-type selector that could not be resolved." }, "status": { "type": "integer", "format": "int32", "minimum": 0 }, "title": { "type": "string" } } }, "ProviderMetadata": { "type": "object", "required": [ "issuer", "authorization_endpoint", "token_endpoint", "userinfo_endpoint", "revocation_endpoint", "end_session_endpoint", "jwks_uri", "response_types_supported", "response_modes_supported", "grant_types_supported", "subject_types_supported", "id_token_signing_alg_values_supported", "token_endpoint_auth_methods_supported", "code_challenge_methods_supported", "scopes_supported", "prompt_values_supported", "acr_values_supported", "claims_parameter_supported", "claims_supported", "request_parameter_supported", "request_uri_parameter_supported", "backchannel_logout_supported", "backchannel_logout_session_supported" ], "properties": { "acr_values_supported": { "type": "array", "items": { "type": "string" } }, "authorization_endpoint": { "type": "string" }, "backchannel_logout_session_supported": { "type": "boolean", "description": "Logout Tokens include `sid`, allowing a relying party to target one\nlocal session when it maintains mutable server-side session state." }, "backchannel_logout_supported": { "type": "boolean", "description": "The provider can send OIDC Back-Channel Logout requests. This capability\ndoes not assert that a relying party terminated its local session." }, "claims_parameter_supported": { "type": "boolean" }, "claims_supported": { "type": "array", "items": { "type": "string" } }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string" } }, "end_session_endpoint": { "type": "string" }, "grant_types_supported": { "type": "array", "items": { "type": "string" } }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string" } }, "issuer": { "type": "string" }, "jwks_uri": { "type": "string" }, "prompt_values_supported": { "type": "array", "items": { "type": "string" } }, "request_parameter_supported": { "type": "boolean", "description": "Request objects are deliberately not accepted by the strict authorize\nquery parser. Advertising this avoids the Discovery default being read\nas support for a `request` parameter that would fail closed." }, "request_uri_parameter_supported": { "type": "boolean", "description": "Discovery otherwise defaults this capability to true. Authreads does\nnot dereference request URIs, so state that contract explicitly." }, "response_modes_supported": { "type": "array", "items": { "type": "string" } }, "response_types_supported": { "type": "array", "items": { "type": "string" } }, "revocation_endpoint": { "type": "string" }, "scopes_supported": { "type": "array", "items": { "type": "string" } }, "subject_types_supported": { "type": "array", "items": { "type": "string" } }, "token_endpoint": { "type": "string" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string" } }, "userinfo_endpoint": { "type": "string" } } }, "RedeemEnrolment": { "type": "object", "required": [ "token", "public_key_algorithm", "public_key", "key_storage_assurance" ], "properties": { "hardware_facts": { "type": "object", "additionalProperties": { "type": "string" }, "propertyNames": { "type": "string" } }, "key_storage_assurance": { "$ref": "#/components/schemas/KeyStorageAssurance" }, "public_key": { "type": "string" }, "public_key_algorithm": { "type": "string" }, "token": { "type": "string" } } }, "Rename": { "type": "object", "required": [ "friendly_name" ], "properties": { "friendly_name": { "type": "string" } }, "additionalProperties": false }, "ResetPasswordRequest": { "type": "object", "required": [ "token", "password" ], "properties": { "password": { "type": "string" }, "token": { "type": "string" } } }, "ResetTokenRequest": { "type": "object", "required": [ "token" ], "properties": { "token": { "type": "string" } }, "additionalProperties": false }, "ResetTokenStatus": { "type": "object", "required": [ "valid", "status" ], "properties": { "expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "status": { "$ref": "#/components/schemas/ResetTokenStatusKind" }, "valid": { "type": "boolean" } } }, "ResetTokenStatusKind": { "type": "string", "enum": [ "valid", "used", "expired", "invalid" ] }, "ResourceStatusResponse": { "type": "object", "required": [ "id", "status" ], "properties": { "id": { "type": "string", "format": "uuid" }, "status": { "type": "string" } } }, "RetainAccountSessionRequest": { "type": "object", "required": [ "current_session_id" ], "properties": { "current_session_id": { "type": "string", "format": "uuid", "description": "Opaque `account_session_id` returned at exchange, not a session bearer." } }, "additionalProperties": false }, "Reverify": { "type": "object", "required": [ "session_id", "min_acr" ], "properties": { "min_acr": { "$ref": "#/components/schemas/Acr" }, "session_id": { "type": "string", "format": "uuid" } }, "additionalProperties": false }, "ReverifySessionRequest": { "oneOf": [ { "type": "object", "required": [ "session_id", "password", "action" ], "properties": { "action": { "type": "string", "enum": [ "password" ] }, "password": { "type": "string" }, "session_id": { "type": "string", "format": "uuid" } } }, { "type": "object", "required": [ "session_id", "action" ], "properties": { "action": { "type": "string", "enum": [ "email_otp_request" ] }, "session_id": { "type": "string", "format": "uuid" } } }, { "type": "object", "required": [ "session_id", "code", "action" ], "properties": { "action": { "type": "string", "enum": [ "email_otp_verify" ] }, "code": { "type": "string" }, "session_id": { "type": "string", "format": "uuid" } } } ] }, "ReverifySessionResponse": { "allOf": [ { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/Assurance" } ] }, { "type": "object", "required": [ "status" ], "properties": { "authenticated_at": { "type": "string", "format": "date-time" }, "status": { "type": "string" } } } ] }, "RevocationResponse": { "type": "object", "required": [ "revoked" ], "properties": { "revoked": { "type": "integer", "format": "int64", "minimum": 0 } } }, "RevokeAccountAccessResponse": { "type": "object", "required": [ "sessions_revoked", "devices_revoked" ], "properties": { "devices_revoked": { "type": "integer", "format": "int64", "minimum": 0 }, "sessions_revoked": { "type": "integer", "format": "int64", "minimum": 0 } } }, "RevokeMachineInstallationRequest": { "type": "object", "required": [ "reason" ], "properties": { "reason": { "type": "string", "description": "Human-readable operational reason, 12–512 trimmed characters." } }, "additionalProperties": false }, "RoleApp": { "type": "object", "required": [ "id", "key", "name", "bound" ], "properties": { "bound": { "type": "boolean" }, "id": { "type": "string", "format": "uuid" }, "key": { "type": "string" }, "name": { "type": "string" } } }, "RoleSummary": { "type": "object", "required": [ "id", "key", "name" ], "properties": { "client_id": { "type": [ "string", "null" ], "format": "uuid" }, "description": { "type": [ "string", "null" ] }, "id": { "type": "string", "format": "uuid" }, "key": { "type": "string" }, "name": { "type": "string" } } }, "SecondStep": { "type": "string", "enum": [ "passkey", "totp", "email_code", "recovery_code" ] }, "SelectRequest": { "type": "object", "required": [ "continuation", "flow_token", "method" ], "properties": { "continuation": { "type": "string" }, "flow_token": { "type": "string" }, "method": { "$ref": "#/components/schemas/SecondStep" } }, "additionalProperties": false }, "SelectResponse": { "type": "object", "required": [ "flow_token", "second_step", "alternatives" ], "properties": { "alternatives": { "type": "array", "items": { "$ref": "#/components/schemas/SecondStep" } }, "flow_token": { "type": "string" }, "second_step": { "$ref": "#/components/schemas/SecondStep" } } }, "SessionActivityRefreshResponse": { "type": "object", "required": [ "activity_token", "expires_at" ], "properties": { "activity_token": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" } } }, "SessionUser": { "type": "object", "required": [ "id", "email" ], "properties": { "email": { "type": "string" }, "id": { "type": "string", "format": "uuid" } } }, "SessionsResponse": { "type": "object", "required": [ "sessions" ], "properties": { "sessions": { "type": "array", "items": { "$ref": "#/components/schemas/AccountSession" } } } }, "SetManagementAppPackagePolicyRequest": { "type": "object", "required": [ "package_gated", "reason" ], "properties": { "package_gated": { "type": "boolean" }, "reason": { "type": "string" } } }, "SetManagementEntitlementPolicyRequest": { "type": "object", "required": [ "entitlement_mode", "reason" ], "properties": { "entitlement_mode": { "$ref": "#/components/schemas/EntitlementMode" }, "reason": { "type": "string" } } }, "SetPackageAppsRequest": { "type": "object", "required": [ "app_ids" ], "properties": { "app_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "SetPasswordLink": { "type": "object", "required": [ "token", "link" ], "properties": { "link": { "type": "string" }, "token": { "type": "string" } } }, "SetRoleAppsRequest": { "type": "object", "required": [ "app_ids" ], "properties": { "app_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "SetUserEmailVerificationRequest": { "type": "object", "required": [ "email_verified" ], "properties": { "email_verified": { "type": "boolean" } } }, "SetWorkspaceOrganizationTypeRequest": { "type": "object", "properties": { "organization_type_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "SetWorkspacePackageRequest": { "type": "object", "properties": { "package_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "Status": { "type": "object", "required": [ "methods", "required_strength", "fresh_proof_available", "recovery_available", "email_code_sign_in_allowed" ], "properties": { "email_code_sign_in_allowed": { "type": "boolean" }, "fresh_proof_available": { "type": "boolean" }, "methods": { "type": "array", "items": { "$ref": "#/components/schemas/Method" } }, "recovery_available": { "type": "boolean" }, "required_strength": { "$ref": "#/components/schemas/Strength" } } }, "Strength": { "type": "string", "enum": [ "password_email", "totp", "passkey" ] }, "TokenExchangeResponse": { "type": "object", "required": [ "access_token", "issued_token_type", "token_type", "expires_in" ], "properties": { "access_token": { "type": "string" }, "expires_in": { "type": "integer", "format": "int64", "minimum": 0 }, "issued_token_type": { "type": "string" }, "token_type": { "type": "string" } } }, "TokenRequest": { "type": "object", "required": [ "session_id", "app" ], "properties": { "app": { "type": "string" }, "session_id": { "type": "string", "format": "uuid" }, "workspace_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "TokenResponse": { "type": "object", "required": [ "access_token", "token_type", "expires_in" ], "properties": { "access_token": { "type": "string", "description": "Ed25519 JWT whose decoded payload conforms to `AccessClaims`." }, "expires_in": { "type": "integer", "format": "int64" }, "token_type": { "type": "string" } } }, "UpdatePackageRequest": { "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string" } }, "additionalProperties": false }, "UpdateRoleRequest": { "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string" } }, "additionalProperties": false }, "UpdateUserRequest": { "type": "object", "required": [ "organization_id" ], "properties": { "display_name": { "type": [ "string", "null" ] }, "organization_id": { "type": "string", "format": "uuid" }, "role_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "UserConsent": { "type": "object", "required": [ "id", "binding_id", "app_id", "resource_id", "resource_uri", "resource_display_name", "resource_status", "disclosure_id", "disclosure_version", "document_sha256", "status", "authentication_time", "authentication_methods", "accepted_at" ], "properties": { "accepted_at": { "type": "string", "format": "date-time" }, "app_id": { "type": "string", "format": "uuid" }, "authentication_methods": { "type": "array", "items": { "type": "string" } }, "authentication_time": { "type": "string", "format": "date-time" }, "binding_id": { "type": "string", "format": "uuid" }, "disclosure_id": { "type": "string", "format": "uuid" }, "disclosure_version": { "type": "integer", "format": "int32" }, "document_sha256": { "type": "string" }, "id": { "type": "string", "format": "uuid" }, "resource_display_name": { "type": "string" }, "resource_id": { "type": "string", "format": "uuid" }, "resource_status": { "type": "string" }, "resource_uri": { "type": "string" }, "status": { "type": "string" }, "withdrawn_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "UserExternalIdentity": { "type": "object", "required": [ "identity_source_id", "source_type", "issuer", "external_principal_id", "subject", "binding_id", "binding_state", "transition_method", "state_changed_at" ], "properties": { "binding_id": { "type": "string", "format": "uuid" }, "binding_state": { "$ref": "#/components/schemas/BindingState" }, "display_name": { "type": [ "string", "null" ] }, "external_principal_id": { "type": "string", "format": "uuid" }, "identity_source_id": { "type": "string", "format": "uuid" }, "issuer": { "type": "string" }, "principal_name": { "type": [ "string", "null" ] }, "source_type": { "$ref": "#/components/schemas/IdentitySourceType" }, "state_changed_at": { "type": "string", "format": "date-time" }, "subject": { "type": "string" }, "transition_method": { "type": "string" } } }, "UserInfo": { "type": "object", "required": [ "acr", "auth_time", "amr", "sub" ], "properties": { "acr": { "$ref": "#/components/schemas/Acr" }, "amr": { "type": "array", "items": { "type": "string" } }, "auth_time": { "type": "integer", "format": "int64" }, "email": { "type": [ "string", "null" ] }, "email_verified": { "type": [ "boolean", "null" ], "description": "Travels with `email`, in the same `email` scope, per OIDC Core §5.1 and §5.3.2.\nA relying party may read claims from **either** the ID token or this endpoint —\nsome libraries only call userinfo — so omitting it here would leave those\nclients seeing no change at all, which is the exact failure this work fixes." }, "memberships": { "type": [ "array", "null" ], "items": { "$ref": "#/components/schemas/MembershipInfo" } }, "name": { "type": [ "string", "null" ] }, "picture": { "type": [ "string", "null" ] }, "sub": { "type": "string" } } }, "UserRecoveryCodeMetadata": { "type": "object", "required": [ "remaining", "total" ], "properties": { "generated_at": { "type": [ "string", "null" ], "format": "date-time" }, "remaining": { "type": "integer", "format": "int64" }, "total": { "type": "integer", "minimum": 0 } } }, "UserStatusResponse": { "type": "object", "required": [ "id", "status", "sessions_revoked" ], "properties": { "id": { "type": "string", "format": "uuid" }, "sessions_revoked": { "type": "integer", "format": "int64", "minimum": 0 }, "status": { "type": "string" } } }, "Verified": { "type": "object", "required": [ "status", "authenticated_at" ], "properties": { "authenticated_at": { "type": "string", "format": "date-time" }, "status": { "type": "string" } } }, "VerifyOtpRequest": { "type": "object", "required": [ "email", "code" ], "properties": { "code": { "type": "string" }, "email": { "type": "string" }, "remember_device": { "type": "boolean" } } }, "WorkspaceEnvironmentResponse": { "type": "object", "required": [ "id", "environment", "status" ], "properties": { "environment": { "type": "string" }, "id": { "type": "string", "format": "uuid" }, "organization_type_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" } } }, "WorkspaceOrganizationTypeResponse": { "type": "object", "required": [ "id", "status" ], "properties": { "id": { "type": "string", "format": "uuid" }, "organization_type_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" } } }, "WorkspacePackageResponse": { "type": "object", "required": [ "id", "status" ], "properties": { "id": { "type": "string", "format": "uuid" }, "package_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" } } } }, "securitySchemes": { "HostedSessionActivityCookie": { "type": "apiKey", "in": "cookie", "name": "__Host-authreads-session-activity" }, "HostedSessionCookie": { "type": "apiKey", "in": "cookie", "name": "__Host-authreads-session" }, "InstallationDpop": { "type": "apiKey", "in": "header", "name": "Authorization", "description": "RFC 9449 credentials in the form `DPoP `; a token-bound proof is also required in the `DPoP` header." }, "ManagementBearer": { "type": "http", "scheme": "bearer" }, "OidcBearer": { "type": "http", "scheme": "bearer" }, "TenantIdHeader": { "type": "apiKey", "in": "header", "name": "X-Tenant-Id" }, "TenantSecretBearer": { "type": "http", "scheme": "bearer" } } }, "tags": [ { "name": "Authentication", "description": "Tenant-facing end-user authentication flows" }, { "name": "Account security", "description": "M2M-authenticated end-user session, trusted-device, and display-policy self-service" }, { "name": "Enrolment", "description": "Single-purpose installation bootstrap" }, { "name": "Installations", "description": "Authenticated installation liveness and machine-local identity ceremonies" }, { "name": "Attribution", "description": "Consent-bound external identity and exact-resource attribution flows" }, { "name": "Management", "description": "Tenant-scoped machine-to-machine management API" }, { "name": "OAuth", "description": "Client credentials token issuance for the Management API" }, { "name": "Audit", "description": "Tenant-scoped product audit ingestion" }, { "name": "Hosted account", "description": "Hosted end-user recovery and session management" } ] }