{ "swagger": "2.0", "info": { "description": "DESCRIPTION", "version": "2.0", "title": "One Api" }, "host": "sp.auth.adobe.com", "basePath": "/api/v2", "schemes": [ "https" ], "tags": [ { "name": "decisions-controller", "description": "Decisions Controller" }, { "name": "sessions-controller", "description": "Sessions Controller" }, { "name": "profiles-controller", "description": "Profiles Controller" }, { "name": "logout-controller", "description": "Logout Controller" }, { "name": "partner-sso-controller", "description": "Partner SSO Controller" }, { "name": "configuration-controller", "description": "Configuration Controller" } ], "paths": { "/authenticate/{serviceProvider}/{code}": { "get": { "tags": [ "sessions-controller" ], "summary": "Start authentication session", "description": "Perform authentication in user agent", "operationId": "startAuthenticationUsingGET_1", "consumes": [ "application/json" ], "produces": [ "*/*" ], "parameters": [ { "name": "code", "in": "path", "description": "The registration code obtained after starting authentication on the primary device", "required": true, "type": "string" }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK" }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/configuration": { "get": { "tags": [ "configuration-controller" ], "summary": "Retrieve configuration for specific service provider", "description": "The Configuration API can be used to retrieve the configuration associated with a particular Service Provider.", "operationId": "handleRequestUsingGET_1", "consumes": [ "application/json" ], "produces": [ "application/json" ], "parameters": [ { "name": "profile", "in": "query", "description": "Provide profile id", "required": false, "type": "string" }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/ConfigurationResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/decisions/authorize/{mvpd}": { "post": { "tags": [ "decisions-controller" ], "summary": "Retrieve authorization decisions using specific MVPD", "description": "In order to perform the preauthorization flow, a valid authenticated profile must be found in the backend for the specified MVPD. If there is no authenticated profile found in the backend for the specified MVPD, then a validation error is returned in the response body, as described in Public APIs - Error codes.", "operationId": "retrieveAuthorizeDecisionsForMvpdUsingPOST_1", "consumes": [ "application/json" ], "produces": [ "application/json" ], "parameters": [ { "name": "mvpd", "in": "path", "description": "The internal unique identifier associated with an Identity Provider during on-boarding process.", "required": true, "type": "string" }, { "in": "body", "name": "resources", "description": "A list of resourceIds that identifies the content that might be accessible to a user and is recognized by MVPD authorization endpoints.", "required": true, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "Adobe-Subject-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Platform Identity method", "required": false, "type": "string" }, { "name": "AD-Service-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Service Token method", "required": false, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "AP-Subject-Token", "in": "header", "description": "The end-user platform identity as specified in Platform requirements for Adobe SSO.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "Content-Type", "in": "header", "description": "The media type accepted by the Adobe Primetime Authentication backend application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "AP-Partner-Framework-Status", "in": "header", "description": "The Base64-encoded payload containing the partner framework status.", "required": true, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/DecisionsResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/decisions/preauthorize/{mvpd}": { "post": { "tags": [ "decisions-controller" ], "summary": "Retrieve preauthorization decisions using specific MVPD", "description": "In order to perform the preauthorization flow, a valid authenticated profile must be found in the backend for the specified MVPD. If there is no authenticated profile found in the backend for the specified MVPD, then a validation error is returned in the response body, as described in Public APIs - Error codes.", "operationId": "retrievePreAuthorizeDecisionsForMvpdUsingPOST", "consumes": [ "application/json" ], "produces": [ "application/json" ], "parameters": [ { "name": "mvpd", "in": "path", "description": "The internal unique identifier associated with an Identity Provider during on-boarding process.", "required": true, "type": "string" }, { "in": "body", "name": "resources", "description": "A list of resourceIds that identifies the content that might be accessible to a user and is recognized by MVPD authorization endpoints.", "required": true, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "Adobe-Subject-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Platform Identity method", "required": false, "type": "string" }, { "name": "AD-Service-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Service Token method", "required": false, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "AP-Subject-Token", "in": "header", "description": "The end-user platform identity as specified in Platform requirements for Adobe SSO.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "Content-Type", "in": "header", "description": "The media type accepted by the Adobe Primetime Authentication backend application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "AP-Partner-Framework-Status", "in": "header", "description": "The Base64-encoded payload containing the partner framework status.", "required": true, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/DecisionsResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/logout/{mvpd}": { "get": { "tags": [ "logout-controller" ], "summary": "Initiate logout for all authenticated profiles of specific MVPD", "description": "The logout service performs the following: deletes the authenticated profiles found in the backend for the specific device, client application and specified MVPD returns a list of actions the client application must perform in order to finalize the logout flow for the authenticated profile with specified MVPD", "operationId": "getLogoutForMvpdUsingGET_1", "consumes": [ "application/json" ], "produces": [ "application/json" ], "parameters": [ { "name": "mvpd", "in": "path", "description": "The internal unique identifier associated with an Identity Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "redirectUrl", "in": "query", "description": "The final redirect url where the programmer application navigates to when the logout final is completed with the mvpd. This parameter needs to be included when the programmer application initiates the logout flow with the mvpd using the \"url\" attribute received in OneAPI logout response.", "required": false, "type": "string" }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "Adobe-Subject-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Platform Identity method", "required": false, "type": "string" }, { "name": "AD-Service-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Service Token method", "required": false, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/LogoutResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/profiles": { "get": { "tags": [ "profiles-controller" ], "summary": "Retrieve authenticated profiles", "description": "The profiles service performs the following: returns the authenticated profiles found in the Adobe Primetime Authentication backend for the respective device and application, each authenticated profile representing an authenticated user with a specific MVPD", "operationId": "getProfilesUsingGET", "consumes": [ "application/json" ], "produces": [ "application/json" ], "parameters": [ { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "Adobe-Subject-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Platform Identity method", "required": false, "type": "string" }, { "name": "AD-Service-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Service Token method", "required": false, "type": "string" }, { "name": "AP-Partner-Framework-Status", "in": "header", "description": "The Base64-encoded payload containing the partner framework status.", "required": true, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/ProfilesResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/profiles/sso/{partner}": { "post": { "tags": [ "partner-sso-controller" ], "summary": "Retrieve authenticated profile using partner authentication response", "description": "The partner SSO application sends the mvpd profile information and Pass server saves the profile information in order to use it for decisions calls.", "operationId": "createPartnerProfileUsingPOST_1", "consumes": [ "application/x-www-form-urlencoded" ], "produces": [ "application/json" ], "parameters": [ { "name": "partner", "in": "path", "description": "The name of the partner (e.g. Apple) providing the sso framework that is integrated with Pass flows.", "required": true, "type": "string" }, { "in": "body", "name": "SAMLResponse", "description": "The Platform SSO profile response containing the needed user metadata for creating a valid authentication token.", "required": true, "schema": { "type": "string" } }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "AP-Partner-Framework-Status", "in": "header", "description": "The Base64-encoded payload containing the partner framework status.", "required": true, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/ProfilesResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/profiles/{mvpd}": { "get": { "tags": [ "profiles-controller" ], "summary": "Retrieve authenticated profiles for specific MVPD", "description": "The profiles service performs the following: returns the authenticated profiles found in the Adobe Primetime Authentication backend for the respective device, application and specific MVPD provided as a path parameter.", "operationId": "getProfileForMvpdUsingGET_1", "consumes": [ "application/json" ], "produces": [ "application/json" ], "parameters": [ { "name": "mvpd", "in": "path", "description": "The internal unique identifier associated with an Identity Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "Adobe-Subject-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Platform Identity method", "required": false, "type": "string" }, { "name": "AD-Service-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Service Token method", "required": false, "type": "string" }, { "name": "AP-Partner-Framework-Status", "in": "header", "description": "The Base64-encoded payload containing the partner framework status.", "required": true, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" }, { "name": "AP-TempPass-Identity", "in": "header", "description": "The application user information as specified in Flexible Temporary Pass Identity.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/ProfilesResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/profiles/{mvpd}/{code}": { "get": { "tags": [ "profiles-controller" ], "summary": "Retrieve authenticated profiles for specific MVPD and specific code\n", "description": "The profiles service performs the following: returns the authenticated profiles found in the Adobe Primetime Authentication backend for the respective device, application, mvpd and specific registration code provided as a path parameter.", "operationId": "getProfileForMvpdAndForCodeUsingGET", "consumes": [ "application/json" ], "produces": [ "application/json" ], "parameters": [ { "name": "code", "in": "path", "description": "The registration code obtained after starting authentication on the primary device", "required": true, "type": "string" }, { "name": "mvpd", "in": "path", "description": "The internal unique identifier associated with an Identity Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "Adobe-Subject-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Platform Identity method", "required": false, "type": "string" }, { "name": "AD-Service-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Service Token method", "required": false, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/ProfilesResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/sessions": { "post": { "tags": [ "sessions-controller" ], "summary": "Create authentication session", "description": "In order to initiate the authentication session from a primary device only a valid serviceProvider parameter value must be provided, while the mvpd, domainName and redirectUrl parameter values may be provided in a later call.", "operationId": "createSessionUsingPOST_1", "consumes": [ "application/x-www-form-urlencoded" ], "produces": [ "application/json" ], "parameters": [ { "name": "mvpd", "in": "formData", "description": "The MVPD identifier associated with the end-user's subscription.If device platform has limitations in providing a value, then the application will have to resume the authentication session later on and provide a valid value.", "required": false, "type": "string" }, { "name": "domainName", "in": "formData", "description": "The originating domain of the application performing mvpd login.", "required": false, "type": "string" }, { "name": "redirectUrl", "in": "formData", "description": "The url where the client application is redirected to when authentication is completed. The value must be URL encoded.", "required": false, "type": "string" }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "Adobe-Subject-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Platform Identity method", "required": false, "type": "string" }, { "name": "AD-Service-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Service Token method", "required": false, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "AP-Subject-Token", "in": "header", "description": "The end-user platform identity as specified in Platform requirements for Adobe SSO.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "Content-Type", "in": "header", "description": "The media type accepted by the Adobe Primetime Authentication backend application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/SessionResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/sessions/sso/{partner}": { "post": { "tags": [ "partner-sso-controller" ], "summary": "Retrieve partner authentication request", "description": "This endpoint returns a verification code which is essentially the authentication request. The format should follow the general rules of the OneAPI endpoints so it is a json-formatted body. For degraded integrations, return a json response indicating that the integration is degraded and the next call should be the one in /decisions endpoint.", "operationId": "retrieveVerificationTokenUsingPOST_1", "consumes": [ "application/x-www-form-urlencoded" ], "produces": [ "application/json" ], "parameters": [ { "name": "partner", "in": "path", "description": "The name of the partner (e.g. Apple) providing the sso framework that is integrated with Pass flows.", "required": true, "type": "string" }, { "name": "domainName", "in": "formData", "description": "The originating domain of the application performing mvpd login.", "required": true, "type": "string" }, { "name": "redirectUrl", "in": "formData", "description": "The url where the client application is redirected to when authentication is completed. The value must be URL encoded.", "required": true, "type": "string" }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "AP-Partner-Framework-Status", "in": "header", "description": "The Base64-encoded payload containing the partner framework status.", "required": true, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "Content-Type", "in": "header", "description": "The media type accepted by the Adobe Primetime Authentication backend application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/PartnerSessionResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } }, "/{serviceProvider}/sessions/{code}": { "get": { "tags": [ "sessions-controller" ], "summary": "Retrieve authentication session using code", "description": "Retrieve information for existing authentication session using registration code", "operationId": "getSessionStatusUsingGET", "consumes": [ "application/json" ], "produces": [ "application/json" ], "parameters": [ { "name": "code", "in": "path", "description": "The registration code obtained after starting authentication on the primary device", "required": true, "type": "string" }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/SessionStatusResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } }, "post": { "tags": [ "sessions-controller" ], "summary": "Resume authentication session", "description": " Continue / update authentication for existing authentication session using registration code", "operationId": "resumeSessionUsingPOST_1", "consumes": [ "application/x-www-form-urlencoded" ], "produces": [ "application/json" ], "parameters": [ { "name": "code", "in": "path", "description": "The registration code obtained after starting authentication on the primary device", "required": true, "type": "string" }, { "name": "mvpd", "in": "formData", "description": "The MVPD identifier associated with the end-user's subscription.If device platform has limitations in providing a value, then the application will have to resume the authentication session later on and provide a valid value.", "required": false, "type": "string" }, { "name": "domainName", "in": "formData", "description": "The originating domain of the application performing mvpd login.", "required": false, "type": "string" }, { "name": "redirectUrl", "in": "formData", "description": "The url where the client application is redirected to when authentication is completed. The value must be URL encoded.", "required": false, "type": "string" }, { "name": "serviceProvider", "in": "path", "description": "The internal unique identifier associated with a Service Provider during on-boarding process.", "required": true, "type": "string" }, { "name": "Authorization", "in": "header", "description": "The authorization header containing OAuth2 access token obtained through dynamic client registration process.", "required": true, "type": "string" }, { "name": "AP-Device-Identifier", "in": "header", "description": "The application device identifier as described in AP-Device-Identifier.", "required": true, "type": "string" }, { "name": "X-Device-Info", "in": "header", "description": "Strongly recommended to use it always when the application's device platform allows to provide valid values explicitly.", "required": true, "type": "string" }, { "name": "X-Forwarded-For", "in": "header", "description": "The Streaming Device IP address. Must use it only for Server-to-Server implementations when the call is made by the Programmer Service and not the Streaming Device, while for Client-to-Server implementations, the Streaming Device IP address is implicitly sent.", "required": false, "type": "string" }, { "name": "Adobe-Subject-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Platform Identity method", "required": false, "type": "string" }, { "name": "AD-Service-Token", "in": "header", "description": "The Adobe Pass Authentication backend application can also make use of authenticated profiles obtained through Single Sign-On using Service Token method", "required": false, "type": "string" }, { "name": "AP-SDK-Identifier", "in": "header", "description": "The SDK identifier as specified in AP-SDK-Identifier. Must use it only by an Adobe Primetime Authentication SDK.", "required": false, "type": "string" }, { "name": "Accept", "in": "header", "description": "The media type accepted by the client application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "Content-Type", "in": "header", "description": "The media type accepted by the Adobe Primetime Authentication backend application. If specified it must always be application/json.", "required": false, "type": "string" }, { "name": "User-Agent", "in": "header", "description": "The user agent of the client application.", "required": false, "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/SessionResponse" } }, "302": { "description": "Redirect. The response contains a location redirect to continue the flow until reaching the MVPD login page." }, "400": { "description": "Bad request. The request was invalid. Check the JSON-based error information provided in the response body." }, "401": { "description": "Unauthorized. The access token is not valid, the client application needs to obtain a new one using the information from dynamic client registration process." }, "404": { "description": "Not found. There is no authentication session found on Adobe Primetime Authentication backend." }, "405": { "description": "Method not allowed.The client tried to use an HTTP methods that the specified resource doesn't allow." }, "500": { "description": "Internal Server Error. Something is broken on Adobe Primetime Authentication services side. The JSON-based error information provided in the response body will explain further." } } } } }, "definitions": { "MediaTokenResponse": { "type": "object", "properties": { "notAfter": { "type": "integer", "format": "int64" }, "notBefore": { "type": "integer", "format": "int64" }, "serializedToken": { "type": "string" } } }, "ProfilesResponse": { "type": "object", "properties": { "profiles": { "type": "object", "additionalProperties": { "$ref": "#/definitions/MvpdProfileResponse" } } } }, "ConfigurationResponse": { "type": "object", "properties": { "os": { "type": "string" }, "platform": { "type": "string" }, "platformCategory": { "type": "string" }, "requestor": { "$ref": "#/definitions/ProgrammerType" }, "sdkType": { "type": "string" } } }, "DecisionResponse": { "type": "object", "properties": { "authorized": { "type": "boolean" }, "error": { "$ref": "#/definitions/ErrorInformation" }, "mvpd": { "type": "string" }, "notAfter": { "type": "integer", "format": "int64" }, "notBefore": { "type": "integer", "format": "int64" }, "resource": { "type": "string" }, "serviceProvider": { "type": "string" }, "source": { "type": "string" }, "token": { "$ref": "#/definitions/MediaTokenResponse" } } }, "Message": { "type": "object" }, "LogoutResponse": { "type": "object", "properties": { "logouts": { "type": "object", "additionalProperties": { "$ref": "#/definitions/MvpdLogoutResponse" } } } }, "DecisionsResponse": { "type": "object", "properties": { "decisions": { "type": "array", "items": { "$ref": "#/definitions/DecisionResponse" } } } }, "SessionStatusResponse": { "type": "object", "properties": { "existing": { "type": "object", "additionalProperties": { "type": "string" } }, "missing": { "type": "array", "items": { "type": "string" } } } }, "MvpdLogoutResponse": { "type": "object", "properties": { "actionName": { "type": "string" }, "actionType": { "type": "string" }, "mvpd": { "type": "string" }, "url": { "type": "string" } } }, "ErrorInformation": { "type": "object", "properties": { "action": { "type": "string" }, "code": { "type": "string" }, "details": { "type": "string" }, "helpUrl": { "type": "string" }, "message": { "$ref": "#/definitions/Message" }, "status": { "type": "integer", "format": "int32" }, "trace": { "type": "string" } } }, "ProgrammerType": { "type": "object", "properties": { "channels": { "type": "string" }, "domains": { "type": "array", "items": { "$ref": "#/definitions/Domain" } }, "id": { "type": "string" }, "mvpds": { "type": "array", "items": { "$ref": "#/definitions/MvpdType" } }, "name": { "type": "string" } } }, "MvpdType": { "type": "object", "properties": { "authPerAggregator": { "type": "boolean" }, "authPerBrowserSession": { "type": "boolean" }, "boardingStatus": { "type": "string" }, "displayInPlatformPicker": { "type": "boolean" }, "displayName": { "type": "string" }, "enablePlatformServices": { "type": "boolean" }, "enforcePlatformPermissions": { "type": "boolean" }, "id": { "type": "string" }, "isProxy": { "type": "boolean" }, "isTempPass": { "type": "boolean" }, "logoUrl": { "type": "string" }, "passiveAuthnEnabled": { "type": "boolean" }, "platformMappingId": { "type": "string" } } }, "PartnerSessionResponse": { "type": "object", "properties": { "actionName": { "type": "string" }, "actionType": { "type": "string" }, "code": { "type": "string" }, "missingParameters": { "type": "array", "items": { "type": "string" } }, "mvpd": { "type": "string" }, "serviceProvider": { "type": "string" }, "sessionId": { "type": "string" }, "url": { "type": "string" } } }, "UserMetadataResponse": { "type": "object", "properties": { "error": { "type": "string", "enum": [ "missing_authentication_code", "authentication_session_invalidated", "authentication_session_missing", "preauthorization_authentication_session_missing", "authentication_session_expired", "preauthorization_authentication_session_expired", "authentication_session_issuer_mismatch", "unknown_integration", "invalid_device_id", "invalid_requestor", "invalid_redirect_url", "invalid_session", "missing_dcr_application", "missing_resource", "missing_resources", "invalid_device_info", "authorization_not_found", "authorization_expired", "malformed_authz_request", "authorization_denied_by_mvpd", "authorization_denied_by_degradation_rule", "authorization_denied_by_degradation_configuration_change", "authorization_denied_by_parental_controls", "authorization_denied_by_session_invalidated", "authorization_denied_by_hba_policies", "identity_not_recognized_by_mvpd", "network_received_error", "invalid_refresh_token", "preauthorization_denied_by_mvpd", "too_many_resources", "invalid_decision_resources", "invalid_mvpd", "network_connection_timeout", "maximum_execution_time_exceeded", "internal_error", "invalid_certificate", "need_to_reauthenticate", "temppass_invalid_identity", "temppass_expired", "temppass_max_resources_exceeded", "temppass_invalid_configuration", "registered_app_mismatch", "invalid_platformid", "invalid_platformtrait", "invalid_platformcategory_trait", "invalid_platform_configuration", "disabled_platform_services", "invalid_mvpd_platform_settings", "unsupported_mvpd_boarding_status", "invalid_profile_exchange_configuration", "invalid_sso_partner", "invalid_sso_partner_saml_response", "degraded_integration", "framework_permissions_not_present", "framework_permissions_not_determined", "framework_permissions_not_granted", "framework_mappingid_not_determined" ] }, "state": { "type": "string" }, "value": { "type": "object" } } }, "Domain": { "type": "object", "properties": { "mvpdInitiated": { "type": "boolean" }, "name": { "type": "string" } } }, "SessionResponse": { "type": "object", "properties": { "actionName": { "type": "string" }, "actionType": { "type": "string" }, "code": { "type": "string" }, "missingParameters": { "type": "array", "items": { "type": "string" } }, "mvpd": { "type": "string" }, "serviceProvider": { "type": "string" }, "sessionId": { "type": "string" }, "url": { "type": "string" } } }, "MvpdProfileResponse": { "type": "object", "properties": { "attributes": { "type": "object", "additionalProperties": { "$ref": "#/definitions/UserMetadataResponse" } }, "issuer": { "type": "string" }, "notAfter": { "type": "integer", "format": "int64" }, "notBefore": { "type": "integer", "format": "int64" }, "type": { "type": "string" } } } } }