# raw swagger spec link:
# https://raw.githubusercontent.com/GluuFederation/oxd/version_4.0/oxd-server/src/main/resources/swagger.yaml
# https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/GluuFederation/oxd/version_4.0/oxd-server/src/main/resources/swagger.yaml#/developers/setup-client
swagger: "2.0"
info:
  description: oxd-server
  version: "4.0"
  title: oxd-server
  contact:
    email: yuriyz@gluu.org

  license:
    name: License
    url: https://github.com/GluuFederation/oxd/blob/master/LICENSE

host: gluu.org
basePath: /
schemes:
 - https

# tags are used for organizing operations
tags:
- name: developers
  description: Operations available to regular developers

paths:

  /health-check:
    get:
      tags:
      - developers
      summary: Health Check
      operationId: health-check
      description: Health Check endpoint is for quick check whether oxd-server is alive.
      responses:
        200:
          description: OK

  /register-site:
    post:
      tags:
      - developers
      summary: Register Site
      operationId: register-site
      description: Registers site at oxd-server
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: body
          name: RegisterSiteParams
          schema:
            type: object
            required:
              - redirect_uris
            properties:
              redirect_uris:
                type: array
                items:
                  type: string
                example: ["https://client.example.org/cb"]
                description: Provide the list of redirection URIs. The first URL is where the user will be redirected after successful authorization at the OpenID Connect Provider (OP).
              op_host:
                type: string
                example: https://<ophostname>
                description: Provide the URL of OpenID Provider (OP). If missing, must be present in defaults.
              post_logout_redirect_uris:
                type: array
                items:
                  type: string
                example: ["https://client.example.org/logout/page1", "https://client.example.org/logout/page2", "https://client.example.org/logout/page3"]
                description: Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been performed.
              application_type:
                type: string
                example: web
              response_types:
                type: array
                items:
                  type: string
                example: ["code"]
                description: Provide a list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code response type.
              grant_types:
                type: array
                items:
                  type: string
                example: ["authorization_code", "client_credentials"]
                description: Provide a list of the OAuth 2.0 grant types that the Client is declaring that it will restrict itself to using.
              scope:
                type: array
                items:
                  type: string
                example:  ["openid"]
                description: Provide list of scope which are used during authentication to authorize access to resource.
              acr_values:
                type: array
                items:
                  type: string
                example: ["basic"]
                description: Provide Returns the Default requested Authentication Context Class Reference values.
              client_name:
                type: string
                description: oxd will generate its own non-human readable name by default if client_name is not specified
              client_jwks_uri:
                type: string
                description: Provide the URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests to the OP. The JWK Set may also contain the Client's encryption keys(s) that are used by the OP to encrypt the responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is required for all keys in the document to indicate each key's intended usage .
              client_token_endpoint_auth_method:
                type: string
                description: Provide the requested authentication method for the Token Endpoint. Valid values are none, client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, access_token, tls_client_auth, self_signed_tls_client_auth.
              client_token_endpoint_auth_signing_alg:
                type: string
                description: Provide the Requested Client Authentication method for the Token Endpoint. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.
              client_request_uris:
                type: array
                items:
                  type: string
                description: Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
              client_frontchannel_logout_uris:
                type: array
                items:
                  type: string
                description: Provide frontchannel logout uris.
              client_sector_identifier_uri:
                type: string
                description: Provide the URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.
              contacts:
                type: array
                items:
                  type: string
                example: ["foo_bar@spam.org"]
                description: Provide a list of e-mail addresses for people allowed to administer the information for this Client
              ui_locales:
                type: array
                items:
                  type: string
                description: Provide ui_locales, which can be used to pass the localization from the client application to the server application in the authorize request.
              claims_locales:
                type: array
                items:
                  type: string
                description: Provide claims_locales, which end-user's preferred languages and scripts for Claims being returned.
              claims_redirect_uri:
                type: array
                items:
                  type: string
              client_id:
                type: string
                description: client id of existing client, ignores all other parameters and skips new client registration forcing to use existing client (client_secret is required if this parameter is set).
              client_secret:
                type: string
                description: client secret of existing client, must be used together with client_id
              trusted_client:
                type: boolean
                description: specifies whether client is trusted. Default value is false.
              access_token_as_jwt:
                type: boolean
                description: specifies whether access_token should be return as JWT or not. Default value is false.
              access_token_signing_alg:
                type: string
                description: sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
              rpt_as_jwt:
                type: boolean
                description: specifies whether RPT should be return as JWT or not. Default value is false.
              logo_uri:
                type: string
                description: specifies an URL that references a logo for the Client application.
                example: "https://client.example.org/logo.png"
              client_uri:
                type: string
                description: specifies an URL of the home page of the Client.
                example: "https://client.example.org/page"
              policy_uri:
                type: string
                description: specifies an URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
                example: "https://client.example.org/page"
              front_channel_logout_session_required:
                type: boolean
                description: specifies if front channel logout session required.
                example: true
              tos_uri:
                type: string
                description: specifies an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms.
                example: "https://client.example.org/page"
              jwks:
                type: string
                description: Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it must not use jwks. One significant downside of jwks is that it does not enable key rotation. The jwks_uri and jwks parameters must not be used together.
                example: "{\"key1\": \"value1\", \"key2\": \"value2\"}"
              id_token_binding_cnf:
                type: string
                example: "4NRB1-0XZABZI9E6-5SM3R"
              tls_client_auth_subject_dn:
                type: string
                example: "www.test.com"
              run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims:
                type: boolean
                description: choose to run introspection script before access_token_as_jwt creation and include claims.
                example: true
              id_token_signed_response_alg:
                type: string
                description: choose the JWS alg algorithm (JWA) required for the ID Token issued to this client_id. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
              id_token_encrypted_response_alg:
                type: string
                description: choose the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id. Valid values are RSA1_5, RSA-OAEP, A128KW, A256KW
              id_token_encrypted_response_enc:
                type: string
                description: choose the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
              user_info_signed_response_alg:
                type: string
                description: choose the JWS alg algorithm (JWA) required for UserInfo responses. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
              user_info_encrypted_response_alg:
                type: string
                description: choose the JWE alg algorithm (JWA) required for encrypting UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
              user_info_encrypted_response_enc:
                type: string
                description: choose the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
              request_object_signing_alg:
                type: string
                description: choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
              request_object_encryption_alg:
                type: string
                description: choose the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
              request_object_encryption_enc:
                type: string
                description: choose the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
              default_max_age:
                type: integer
                description: specifies the Default Maximum Authentication Age.
                example: 1000000
              require_auth_time:
                type: boolean
                description: specifies the Boolean value specifying whether the auth_time claim in the id_token is required. It is required when the value is true. The auth_time claim request in the request object overrides this setting.
                example: true
              initiate_login_uri:
                type: string
                description: specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
                example: "https://client.example.org/authorization/page"
              authorized_origins:
                type: array
                description: specifies authorized JavaScript origins.
                items:
                  type: string
                  example: ["beem://www.test.com", "fb://app.local.url"]
              access_token_lifetime:
                type: integer
                description: specifies the Client-specific access token expiration.
                example: 100000000
              software_id:
                type: string
                description: specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.
                example: "4NRB1-0XZABZI9E6-5SM3R"
              software_version:
                type: string
                description: specifies a version identifier string for the client software identified by 'software_id'. The value of the 'software_version' should change on any update to the client software identified by the same 'software_id'.
                example: "2.1"
              software_statement:
                type: string
                description: specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.
              custom_attributes:
                type: object
                description: specifies custom attribute map copy.
                required:
                - param1
                - param2
                properties:
                  param1:
                    type: string
                  param2:
                    type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: RegisterSiteResponse
            required:
              - oxd_id
              - op_host
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              op_host:
                type: string
                example: https://<op-hostname>
              client_id:
                type: string
                example: "@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387"
              client_name:
                type: string
                example: "TestClientName"
              client_secret:
                type: string
                example: f436b936-03fc-433f-9772-53c2bc9e1c74
              client_registration_access_token:
                type: string
                example: d836df94-44b0-445a-848a-d43189839b17
              client_registration_client_uri:
                type: string
                example: https://<op-hostname>/oxauth/restv1/register?client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387
              client_id_issued_at:
                type: integer
                example: 1501854943
              client_secret_expires_at:
                type: integer
                example: 1501941343
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /get-client-token:
    post:
      tags:
      - developers
      summary: Get Client Token
      operationId: get-client-token
      description: Gets Client Token
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: body
          name: GetClientTokenParams
          schema:
            type: object
            required:
              - op_host
              - client_id
              - client_secret
            properties:
              op_host:
                type: string
                example: https://<op-hostname>
              op_discovery_path:
                type: string
              scope:
                type: array
                items:
                  type: string
                example: ["openid"]
              client_id:
                type: string
                example: '@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387'
              client_secret:
                type: string
                example: f436b936-03fc-433f-9772-53c2bc9e1c74
              authentication_method:
                type: string
                description: if value is missed then basic authentication is used. Otherwise it's possible to set `private_key_jwt` value for Private Key authentication.
              algorithm:
                type: string
                description: optional but is required if authentication_method=private_key_jwt. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512
              key_id:
                type: string
                description: optional but is required if authentication_method=private_key_jwt. It has to be valid key id from key store.
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetClientTokenResponse
            required:
              - scope
              - access_token
              - expires_in
              - refresh_token
            properties:
              scope:
                type: array
                items:
                  type: string
                example: ["openid","oxd"]
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
              expires_in:
                type: integer
                example: 299
              refresh_token:
                type: string
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /introspect-access-token:
    post:
      tags:
      - developers
      summary: Introspect Access Token
      operationId: introspect-access-token
      description: Introspect Access Token
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: IntrospectAccessTokenParams
          schema:
            type: object
            required:
              - oxd_id
              - access_token
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
      responses:
        200:
          description: OK
          schema:
            type: object
            title: IntrospectAccessTokenResponse
            required:
              - active
              - client_id
              - username
              - scope
              - token_type
              - sub
              - aud
              - iss
              - exp
              - iat
              - acr_values
              - extension_field
              - nbf
              - jti
            properties:
              active:
                type: boolean
                example: true
              client_id:
                type: string
                example: '@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387'
              username:
                type: string
                example: John Black
              scope:
                type: array
                items:
                  type: string
              token_type:
                type: string
                example: bearer
              sub:
                type: string
                example: jblack
              aud:
                type: string
                example: l238j323ds-23ij4
              iss:
                type: string
                example: https://as.gluu.org/
              exp:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when this token will expire
                example: 1535709072
              iat:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
                example: 1535709072
              nbf:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when the token not to be used before
                example: 1535709072
              jti:
                type: string
                description: a unique identifier for the JWT
              acr_values:
                type: array
                items:
                  type: string
                example: ["basic"]
              extension_field:
                type: string
                example: twenty-seven
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /update-site:
    post:
      tags:
      - developers
      summary: Update Site
      operationId: update-site
      description: Updates site at oxd-server. If something changes in a pre-registered client, you can use this API to update your client in the OP.
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UpdateSiteParams
          schema:
            type: object
            required:
              - oxd_id
            properties:
              oxd_id:
                type: string
                example: 6F9619FF-8B86-D011-B42D-00CF4FC964FF
              redirect_uris:
                type: array
                items:
                  type: string
                example: ["https://client.example.org/cb"]
                description: Provide the list of redirection URIs. The first URL is where the user will be redirected after successful authorization at the OpenID Connect Provider (OP).
              post_logout_redirect_uris:
                type: array
                items:
                  type: string
                example: ["https://client.example.org/logout/page1", "https://client.example.org/logout/page2", "https://client.example.org/logout/page3"]
              response_types:
                type: array
                items:
                  type: string
                example: ["code"]
              grant_types:
                type: array
                items:
                  type: string
                example: ["authorization_code", "client_credentials"]
              scope:
                type: array
                items:
                  type: string
                example:  ["openid"]
              acr_values:
                type: array
                items:
                  type: string
                example: ["basic"]
              client_jwks_uri:
                type: string
              client_token_endpoint_auth_method:
                type: string
              client_request_uris:
                type: array
                items:
                  type: string
              client_sector_identifier_uri:
                type: string
              contacts:
                type: array
                items:
                  type: string
                example: ["foo_bar@spam.org"]
              ui_locales:
                type: array
                items:
                  type: string
              claims_locales:
                type: array
                items:
                  type: string
              access_token_as_jwt:
                type: boolean
                description: specifies whether access_token should be return as JWT or not. Default value is false.
              access_token_signing_alg:
                type: string
                description: sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512
              rpt_as_jwt:
                type: boolean
                description: specifies whether RPT should be return as JWT or not. Default value is false.

      responses:
        200:
          description: OK
          schema:
            type: object
            title: UpdateSiteResponse
            required:
              - oxd_id
            properties:
              oxd_id:
                $ref: "#/definitions/oxd_id"
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /remove-site:
    post:
      tags:
      - developers
      summary: Remove Site
      operationId: remove-site
      description: Removes site from oxd-server
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: RemoveSiteParams
          schema:
            type: object
            required:
              - oxd_id
            properties:
              oxd_id:
                type: string
                example: 6F9619FF-8B86-D011-B42D-00CF4FC964FF
      responses:
        200:
          description: OK
          schema:
            type: object
            title: RemoveSiteResponse
            required:
              - oxd_id
            properties:
              oxd_id:
                $ref: "#/definitions/oxd_id"
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /get-authorization-url:
    post:
      tags:
      - developers
      summary: Get Authorization Url
      operationId: get-authorization-url
      description: Gets authorization url
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetAuthorizationUrlParams
          schema:
            type: object
            required:
              - oxd_id
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              scope:
                type: array
                items:
                  type: string
                example: ["openid"]
              acr_values:
                type: array
                items:
                  type: string
                example: ["basic"]
              prompt:
                type: string
              state:
                type: string
              redirect_uri:
                type: string
                example: https://client.example.org/cb
              custom_parameters:
                type: object
                additionalProperties:
                  type: string
              params:
                type: object
                additionalProperties:
                  type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetAuthorizationUrlResponse
            required:
              - authorization_url
            properties:
              authorization_url:
                type: string
                example: https://<op-hostname>/oxauth/restv1/authorize?response_type=code&client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!8A36.24E1.97DE.F4EF&redirect_uri=https://192.168.200.95/&scope=openid+profile+email+uma_protection+uma_authorization&state=473ot4nuqb4ubeokc139raur13&nonce=lbrdgorr974q66q6q9g454iccm
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /get-tokens-by-code:
    post:
      tags:
      - developers
      summary: Get Tokens By Code
      operationId: get-tokens-by-code
      description: Get tokens by code
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetTokensByCodeParams
          schema:
            type: object
            required:
              - oxd_id
              - code
              - state
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              code:
                type: string
                example: 0b9f1518-15aa-47b2-9477-d4c607447e18
              state:
                type: string
                example: 6q1ec90hn6ui4ipigv91hrbodj
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetTokensByCodeResponse
            required:
              - access_token
              - expires_in
              - id_token
              - refresh_token
              - id_token_claims
            properties:
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
              expires_in:
                type: integer
                example: 299
              id_token:
                type: string
                example: eyJraWQiOiI5MTUyNTU1Ni04YmIwLTQ2MzYtYTFhYy05ZGVlNjlhMDBmYWUiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJp
              refresh_token:
                type: string
                example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446
              id_token_claims:
                type: object
                additionalProperties: true
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /get-user-info:
    post:
      tags:
      - developers
      summary: Get User Info
      operationId: get-user-info
      description: Get User Info
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetUserInfoParams
          schema:
            type: object
            required:
              - oxd_id
              - access_token
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              access_token:
                type: string
                example: 88bba7f5-961c-4b71-8053-9ab35f1ad395
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetUserInfoResponse
            additionalProperties:
                type: object
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /get-logout-uri:
    post:
      tags:
      - developers
      summary: Get Logout URL
      operationId: get-logout-uri
      description: Get Logout URL
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetLogoutUriParams
          schema:
            type: object
            required:
              - oxd_id
              - id_token_hint
              - post_logout_redirect_uri
              - state
              - session_state
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              id_token_hint:
                type: string
                example: "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso"
              post_logout_redirect_uri:
                type: string
                example: https://client.example.org/cb
              state:
                type: string
              session_state:
                type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetLogoutUriResponse
            required:
              - uri
            properties:
              uri:
                type: string
                example: https://<op-hostname>/oxauth/seam/resource/restv1/oxauth/end_session?id_token_hint=eyJraWQiOiI1YmM2ZGM3MS0xYjA1LTQ5YzMtYWU3MC0zYTg4Y2ZiMjQwN2QiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL2NlLWRldi5nbHV1Lm9yZyIsImF1ZCI6IkAhNUE1OC5BRTBELkQzODMuMUU0NiEwMDAxIUUzOEIuN0RCRSEwMDA4IUE3MTkuOTU4QS41QjdGLkVBQkMiLCJleHAiOjE0OTAwMTk5MjEsImlhdCI6MTQ5MDAxNjMyMSwibm9uY2UiOiJkNGdsbmtndHAxYWlqZ3JnY3V2cGp1N2k3cCIsImF1dGhfdGltZSI6MTQ5MDAxNjI3MiwiYXRfaGFzaCI6Im1Xa2NXQzZ6NC1qN0ZNX0ctX0tYMWciLCJveFZhbGlkYXRpb25VUkkiOiJodHRwczovL2NlLWRldi5nbHV1Lm9yZy9veGF1dGgvb3BpZnJhbWUiLCJveE9wZW5JRENvbm5lY3RWZXJzaW9uIjoib3BlbmlkY29ubmVjdC0xLjAiLCJzdWIiOiJONHRLRncyLVpDWTVWN0FhQmdpMnNHRWdDR0t0Tlg2LS01M2FQbmZFYk5zIn0.PvCdzPnMwqPNUw1bzd8tvzpJqYu-P2iCTnELr85ZaJTG8_Fdj3EruLgUBa-emeum3j29cFgdjFPx6WplfCV1GnehOieXjDiAAE85fy-stxXwII3xrva5ZjG0FnTYnJLoRmy0BWMjFC2IdCoISJI9imcfvmQmlvNmU0EjLS02cJf3JAaqEaM-FJWdQv8end9-Sq2bcp6ME3voRjV30ps_7jcDdlM_hW3M_e3RdrXYCDifbl_1jaNip5tb6_bLpgTADDoLT3fTvACRN057e2GCkSYdxvVhIjfDsjnOhk5n3TDcWedriu99H8-sNXyI_aBr3HAXd37CsgmdfIJcgUNJJw
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /get-access-token-by-refresh-token:
    post:
      tags:
      - developers
      summary: Get Access Token By Refresh Token
      operationId: get-access-token-by-refresh-token
      description: Get Access Token By Refresh Token
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetAccessTokenByRefreshTokenParams
          schema:
            type: object
            required:
              - oxd_id
              - refresh_token
              - scope
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              refresh_token:
                type: string
                example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446
              scope:
                type: array
                items:
                  type: string
                example: ["openid"]
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetAccessTokenByRefreshTokenResponse
            required:
              - scope
              - access_token
              - expires_in
              - refresh_token
            properties:
              scope:
                type: array
                items:
                  type: string
                example: ["openid", "profile", "uma_protection", "email"]
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
              expires_in:
                type: integer
                example: 299
              refresh_token:
                type: string
                example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /uma-rs-protect:
    post:
      tags:
      - developers
      summary: UMA RS Protect Resources
      operationId: uma-rs-protect
      description: UMA RS Protect Resources. It's important to have a single HTTP method, mentioned only once within a given path in JSON, otherwise, the operation will fail.
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UmaRsProtectParams
          schema:
            type: object
            required:
              - oxd_id
              - overwrite
              - resources
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              overwrite:
                type: boolean
              resources:
                type: array
                items:
                  $ref: "#/definitions/RsResource"
      responses:
        200:
          description: OK
          schema:
            type: object
            title: UmaRsProtectResponse
            required:
              - oxd_id
            properties:
              oxd_id:
                type: string
                example: "bcad760f-91ba-46e1-a020-05e4281d91b6"
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /uma-rs-check-access:
    post:
      tags:
      - developers
      summary: UMA RS Check Access
      operationId: uma-rs-check-access
      description: UMA RS Check Access
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UmaRsCheckAccessParams
          schema:
            type: object
            required:
              - oxd_id
              - rpt
              - path
              - http_method
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              rpt:
                type: string
              path:
                type: string
              http_method:
                type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: UmaRsCheckAccessResponse
            required:
              - access
              - ticket
            properties:
              access:
                type: string
                example: granted
                description: Possible values are granted, denied
              ticket:
                type: string
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /introspect-rpt:
    post:
      tags:
      - developers
      summary: Introspect RPT
      operationId: introspect-rpt
      description: Introspect RPT
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: IntrospectRptParams
          schema:
            type: object
            required:
              - oxd_id
              - rpt
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              rpt:
                type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: IntrospectRptResponse
            required:
              - active
              - exp
              - iat
              - nbf
              - client_id
              - aud
              - iss
              - permissions
            properties:
              active:
                type: boolean
                example: true
              exp:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when this token will expire
                example: 1535709072
              iat:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
                example: 1535709072
              nbf:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when the token not to be used before
                example: 1535709072
              client_id:
                type: string
                example: "@!DBE5.84F8.631A.9172!0001!CD07.49BE!0008!0ED4.C61D.6FA7.8F42"
              sub:
                type: string
              aud:
                type: string
                example: "@!DBE5.84F8.631A.9172!0001!CD07.49BE!0008!0ED4.C61D.6FA7.8F42"
              iss:
                type: string
                example: http://as.com
              jti:
                type: string
              permissions:
                type: array
                items:
                  type: object
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'
  /uma-rp-get-rpt:
    post:
      tags:
      - developers
      summary: UMA RP Get RPT
      operationId: uma-rp-get-rpt
      description: UMA RP Get RPT
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UmaRpGetRptParams
          schema:
            type: object
            required:
              - oxd_id
              - ticket
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              ticket:
                type: string
              claim_token:
                type: string
              claim_token_format:
                type: string
              pct:
                type: string
              rpt:
                type: string
              scope:
                type: array
                items:
                  type: string
                example: ["openid"]
              state:
                type: string
              params:
                type: object
                additionalProperties:
                  type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: UmaRpGetRptResponse
            required:
              - pct
              - updated
              - access_token
              - token_type
            properties:
              pct:
                type: string
              updated:
                type: boolean
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
              token_type:
                type: string
                example: bearer
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'

  /uma-rp-get-claims-gathering-url:
    post:
      tags:
      - developers
      summary: UMA RP Get Claims Gathering URL
      operationId: uma-rp-get-claims-gathering-url
      description: UMA RP Get Claims Gathering URL
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UmaRpGetClaimsGatheringUrlParams
          schema:
            type: object
            required:
              - oxd_id
              - ticket
              - claims_redirect_uri
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              ticket:
                type: string
                example: fba00191-59ab-4ed6-ac99-a786a88a9f40
              state:
                type: string
              claims_redirect_uri:
                type: string
                example: https://client.example.com/cb
      responses:
        200:
          description: OK
          schema:
            type: object
            title: UmaRpGetClaimsGatheringUrlResponse
            required:
              - url
              - state
            properties:
              url:
                type: string
                example: https://<op-hostname>/oxauth/restv1/uma/gather_claims?client_id@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!4508.BF20.9B81.E904&ticket=fba00191-59ab-4ed6-ac99-a786a88a9f40&claims_redirect_uri=https://client.example.com/cb&state=d871gpie16np0f5kfv936sc33k
              state:
                type: string
                example: d871gpie16np0f5kfv936sc33k
        400:            
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'
  /get-jwks:
    post:
      tags:
      - developers
      summary: Get JSON Web Key Set
      operationId: get-json-web-key-set
      description: Get JSON Web Key Set
      consumes:
      - application/json
      produces:
      - application/json
      parameters:
      - in: header
        name: Authorization
        type: string
      - in: body
        name: GetJwksParams
        schema:
          type: object
          required:
          - op_host
          properties:
            op_host:
              type: string
              example: https://<ophostname>
            op_discovery_path:
              type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetJwksResponse
            required:
              - keys
            properties:
              keys:
                type: array
                items:
                  $ref: "#/definitions/JsonWebKey"
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'
  /get-discovery:
    post:
      tags:
      - developers
      summary: Get OP Discovery Configuration
      operationId: get-discovery
      description: Get OP Discovery Configuration
      consumes:
      - application/json
      produces:
      - application/json
      parameters:
      - in: body
        name: GetDiscoveryParams
        schema:
          type: object
          required:
          - op_host
          properties:
            op_host:
              type: string
              example: https://<ophostname>
            op_discovery_path:
              type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetDiscoveryResponse
            properties:
              issuer:
                type: string
                example: https://<ophostname>
              authorization_endpoint:
                type: string
                example: https://<ophostname>/oxauth/restv1/authorize
              token_endpoint:
                type: string
                example: https://<ophostname>/oxauth/restv1/token
              token_revocation_endpoint:
                type: string
                example: https://<ophostname>/oxauth/restv1/token/v1
              user_info_endpoint:
                type: string
                example: https://<ophostname>/oxauth/restv1/userinfo
              client_info_endpoint:
                type: string
                example: https://<ophostname>/oxauth/restv1/clientinfo
              check_session_iframe:
                type: string
                example: https://<ophostname>/oxauth/opiframe.htm
              end_session_endpoint:
                type: string
                example: https://<ophostname>/oxauth/restv1/end_session
              jwks_uri:
                type: string
                example: https://<ophostname>/oxauth/restv1/jwks
              registration_endpoint:
                type: string
                example: https://<ophostname>/oxauth/restv1/register
              id_generation_endpoint:
                type: string
                example: https://<ophostname>/oxauth/restv1/id
              introspection_endpoint:
                type: string
                example: https://<ophostname>/oxauth/restv1/introspection
              scopes_supported:
                type: array
                items:
                  type: string
                example: ["owner", "casa", "address", "clientinfo", "user_name", "openid", "profile", "uma_protection", "admin", "permission", "manage", "phone", "mobile_phone", "name", "oxd", "email" ]
              response_types_supported:
                type: array
                items:
                  type: string
                example: ["token id_token", "token code id_token", "token", "token code", "code", "code id_token", "id_token"]
              grant_types_supported:
                type: array
                items:
                  type: string
                example: ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:uma-ticket", "password", "implicit", "client_credentials"]
              acr_values_supported:
                type: array
                items:
                  type: string
                example: ["u2f", "super_gluu", "otp", "auth_ldap_server"]
              subject_types_supported:
                type: array
                items:
                  type: string
                example: ["public", "pairwise"]
              user_info_signing_alg_values_supported:
                type: array
                items:
                  type: string
                example: [ "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512" ]
              user_info_encryption_alg_values_supported:
                type: array
                items:
                  type: string
                example: [ "RSA1_5", "RSA-OAEP", "A128KW", "A256KW" ]
              user_info_encryption_enc_values_supported:
                type: array
                items:
                  type: string
                example: [ "RSA1_5", "RSA-OAEP", "A128KW", "A256KW" ]
              id_token_signing_alg_values_supported:
                type: array
                items:
                  type: string
                example: [ "none", "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512" ]
              id_token_encryption_alg_values_supported:
                type: array
                items:
                  type: string
                example: [ "RSA1_5", "RSA-OAEP", "A128KW", "A256KW" ]
              id_token_encryption_enc_values_supported:
                type: array
                items:
                  type: string
                example: [ "A128CBC+HS256", "A256CBC+HS512", "A128GCM", "A256GCM" ]
              request_object_signing_alg_values_supported:
                type: array
                items:
                  type: string
                example: [ "none", "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512" ]
              request_object_encryption_alg_values_supported:
                type: array
                items:
                  type: string
                example: [ "RSA1_5", "RSA-OAEP", "A128KW", "A256KW" ]
              request_object_encryption_enc_values_supported:
                type: array
                items:
                  type: string
                example: [ "A128CBC+HS256", "A256CBC+HS512", "A128GCM", "A256GCM" ]
              token_endpoint_auth_methods_supported:
                type: array
                items:
                  type: string
                example: [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt" ]
              token_endpoint_auth_signing_alg_values_supported:
                type: array
                items:
                  type: string
                example: [ "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512" ]
              display_values_supported:
                type: array
                items:
                  type: string
                example: [ "page", "popup" ]
              claim_types_supported:
                type: array
                items:
                  type: string
                example: ["normal"]
              claims_supported:
                type: array
                items:
                  type: string
                example: [ "street_address", "country", "zoneinfo", "birthdate", "role", "gender", "formatted", "user_name", "phone_mobile_number", "preferred_username", "locale", "inum", "updated_at", "nickname", "email", "website", "email_verified", "profile", "locality", "phone_number_verified", "given_name", "middle_name", "picture", "name", "phone_number", "postal_code", "region", "family_name" ]
              id_token_token_binding_cnf_values_supported:
                type: array
                items:
                  type: string
                example: ["tbh"]
              service_documentation:
                type: string
                items:
                  type: string
                example: http://<op_docs>
              claims_locales_supported:
                type: array
                items:
                  type: string
                example: ["en"]
              ui_locales_supported:
                type: array
                items:
                  type: string
                example: [ "en", "es" ]
              claims_parameter_supported:
                type: boolean
                example: true
              request_parameter_supported:
                type: boolean
                example: true
              request_uri_parameter_supported:
                type: boolean
                example: true
              require_request_uri_registration:
                type: boolean
                example: true
              tls_client_certificate_bound_access_tokens:
                type: boolean
                example: true
              front_channel_logout_supported:
                type: boolean
                example: true
              front_channel_logout_session_supported:
                type: boolean
                example: true
              op_policy_uri:
                type: string
                example: http://<policy_uri>
              op_tos_uri:
                type: string
                example: http://<tos_uri>
              scope_to_claims_mapping:
                type: object
                example: [ {"address": [ "formatted", "postal_code", "street_address", "locality", "country", "region" ]}, {"owner": []}, {"manage": []}, {"profile": [ "name", "family_name", "given_name", "middle_name", "nickname", "preferred_username", "profile", "picture", "website", "gender", "birthdate", "zoneinfo", "locale", "updated_at" ]}, {"mobile_phone": ["phone_mobile_number"]}, {"phone": [ "phone_number_verified", "phone_number" ]}, {"clientinfo": [ "name", "inum" ]}, {"permission": ["role"]}, {"oxd": []}, {"email": [ "email_verified", "email" ]}, {"casa": ["email"]}, {"user_name": ["user_name"]}, {"name": []}, {"openid": []}, {"uma_protection": []}, {"admin": []} ]
        400:
          description: Invalid parameters are provided to endpoint.
          schema:
            $ref: '#/definitions/ErrorResponse'
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
          schema:
            $ref: '#/definitions/ErrorResponse'
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
          schema:
            $ref: '#/definitions/ErrorResponse'


definitions:
  # List of reusable properties
  oxd_id:
    type: string
    example: bcad760f-91ba-46e1-a020-05e4281d91b6

  # List of reusable objects
  Condition:
    type: object
    required:
      - httpMethods
      - scopes
      - scope_expression
      - ticketScopes
    properties:
     httpMethods:
       type: array
       items:
         type: string
     scopes:
       type: array
       items:
         type: string
     scope_expression:
       type: array
       items:
         type: string
     ticketScopes:
       type: array
       items:
        type: string

  RsResource:
    type: object
    required:
      - path
      - conditions
    properties:
      path:
        type: string
      conditions:
        type: array
        items:
          $ref: "#/definitions/Condition"

  JsonWebKey:
    type: object
    required:
      - kid
      - kty
      - use
      - key_ops
      - alg
      - exp
      - x5c
      - x5t
      - x5u
    properties:
      kid:
        type: string
      kty:
        type: string
      use:
        type: string
      key_ops:
        type: string
      alg:
        type: string
      exp:
        type: integer
        format: int64
        example: 1563964950485
      x5c:
        type: array
        items:
          type: string
      x5t:
        type: array
        items:
          type: string
      x5t#S256:
        type: string
      x5u:
        type: string

  ErrorResponse:
    type: object
    required:
      - error
      - error_description
    properties:
      error:
        type: string
      error_description:
        type: string
      details:
        type: string