# raw swagger spec link:
# https://raw.githubusercontent.com/GluuFederation/oxd/version_4.0.beta/oxd-server/src/main/resources/swagger.yaml
# https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/GluuFederation/oxd/version_4.0.beta/oxd-server/src/main/resources/swagger.yaml#/developers/setup-client
swagger: "2.0"
info:
  description: oxd-server
  version: "4.0.beta"
  title: oxd-server
  contact:
    email: yuriyz@gluu.org

  license:
    name: License
    url: https://github.com/GluuFederation/oxd/blob/master/LICENSE

host: gluu.org
basePath: /
schemes:
 - https

# tags are used for organizing operations
tags:
- name: developers
  description: Operations available to regular developers

paths:

  /health-check:
    get:
      tags:
      - developers
      summary: Health Check
      operationId: health-check
      description: Health Check endpoint is for quick check whether oxd-server is alive.
      responses:
        200:
          description: OK

  /register-site:
    post:
      tags:
      - developers
      summary: Register Site
      operationId: register-site
      description: Registers site at oxd-server
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: body
          name: RegisterSiteParams
          schema:
            type: object
            required:
              - authorization_redirect_uri
            properties:
              authorization_redirect_uri:
                type: string
                example: https://client.example.org/cb
              op_host:
                type: string
                example: https://<ophostname>
                description: If missing, must be present in defaults
              post_logout_redirect_uri:
                type: string
                example: https://client.example.org/cb
              application_type:
                type: string
                example: web
              response_types:
                type: array
                items:
                  type: string
                example: ["code"]
              grant_types:
                type: array
                items:
                  type: string
                example: ["authorization_code", "client_credentials"]
              scope:
                type: array
                items:
                  type: string
                example:  ["openid"]
              acr_values:
                type: array
                items:
                  type: string
                example: ["basic"]
              client_name:
                type: string
                description: oxd will generate its own non-human readable name by default if client_name is not specified
              client_jwks_uri:
                type: string
              client_token_endpoint_auth_method:
                type: string
              client_request_uris:
                type: array
                items:
                  type: string
              client_frontchannel_logout_uris:
                type: array
                items:
                  type: string
              client_sector_identifier_uri:
                type: string
              contacts:
                type: array
                items:
                  type: string
                example: ["foo_bar@spam.org"]
              redirect_uris:
                type: array
                items:
                  type: string
                example: ["https://client.example.org/cb"]
              ui_locales:
                type: array
                items:
                  type: string
              claims_locales:
                type: array
                items:
                  type: string
              claims_redirect_uri:
                type: array
                items:
                  type: string
              client_id:
                type: string
                description: client id of existing client, ignores all other parameters and skips new client registration forcing to use existing client (client_secret is required if this parameter is set)
              client_secret:
                type: string
                description: client secret of existing client, must be used together with client_id
              trusted_client:
                type: boolean
                description: specifies whether client is trusted. Default value is false.
              access_token_as_jwt:
                type: boolean
                description: specifies whether access_token should be return as JWT or not. Default value is false.
              access_token_signing_alg:
                type: string
                description: sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512

      responses:
        200:
          description: OK
          schema:
            type: object
            title: RegisterSiteResponse
            required:
              - oxd_id
              - op_host
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              op_host:
                type: string
                example: https://<op-hostname>
              client_id:
                type: string
                example: "@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387"
              client_secret:
                type: string
                example: f436b936-03fc-433f-9772-53c2bc9e1c74
              client_registration_access_token:
                type: string
                example: d836df94-44b0-445a-848a-d43189839b17
              client_registration_client_uri:
                type: string
                example: https://<op-hostname>/oxauth/restv1/register?client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387
              client_id_issued_at:
                type: integer
                example: 1501854943
              client_secret_expires_at:
                type: integer
                example: 1501941343
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).


  /get-client-token:
    post:
      tags:
      - developers
      summary: Get Client Token
      operationId: get-client-token
      description: Gets Client Token
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: body
          name: GetClientTokenParams
          schema:
            type: object
            required:
              - op_host
              - client_id
              - client_secret
            properties:
              op_host:
                type: string
                example: https://<op-hostname>
              op_discovery_path:
                type: string
              scope:
                type: array
                items:
                  type: string
                example: ["openid"]
              client_id:
                type: string
                example: '@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387'
              client_secret:
                type: string
                example: f436b936-03fc-433f-9772-53c2bc9e1c74
              authentication_method:
                type: string
                description: if value is missed then basic authentication is used. Otherwise it's possible to set `private_key_jwt` value for Private Key authentication.
              algorithm:
                type: string
                description: optional but is required if authentication_method=private_key_jwt. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512
              key_id:
                type: string
                description: optional but is required if authentication_method=private_key_jwt. It has to be valid key id from key store.
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetClientTokenResponse
            required:
              - scope
              - access_token
              - expires_in
              - refresh_token
            properties:
              scope:
                type: array
                items:
                  type: string
                example: ["openid","oxd"]
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
              expires_in:
                type: integer
                example: 299
              refresh_token:
                type: string
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /introspect-access-token:
    post:
      tags:
      - developers
      summary: Introspect Access Token
      operationId: introspect-access-token
      description: Introspect Access Token
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: IntrospectAccessTokenParams
          schema:
            type: object
            required:
              - oxd_id
              - access_token
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
      responses:
        200:
          description: OK
          schema:
            type: object
            title: IntrospectAccessTokenResponse
            required:
              - active
              - client_id
              - username
              - scope
              - token_type
              - sub
              - aud
              - iss
              - exp
              - iat
              - acr_values
              - extension_field
              - nbf
              - jti
            properties:
              active:
                type: boolean
                example: true
              client_id:
                type: string
                example: '@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387'
              username:
                type: string
                example: John Black
              scope:
                type: array
                items:
                  type: string
              token_type:
                type: string
                example: bearer
              sub:
                type: string
                example: jblack
              aud:
                type: string
                example: l238j323ds-23ij4
              iss:
                type: string
                example: https://as.gluu.org/
              exp:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when this token will expire
                example: 1535709072
              iat:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
                example: 1535709072
              nbf:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when the token not to be used before
                example: 1535709072
              jti:
                type: string
                description: a unique identifier for the JWT
              acr_values:
                type: array
                items:
                  type: string
                example: ["basic"]
              extension_field:
                type: string
                example: twenty-seven
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /update-site:
    post:
      tags:
      - developers
      summary: Update Site
      operationId: update-site
      description: Updates site at oxd-server. If something changes in a pre-registered client, you can use this API to update your client in the OP.
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UpdateSiteParams
          schema:
            type: object
            required:
              - oxd_id
            properties:
              oxd_id:
                type: string
                example: 6F9619FF-8B86-D011-B42D-00CF4FC964FF
              authorization_redirect_uri:
                type: string
                example: https://client.example.org/cb
              post_logout_redirect_uri:
                type: string
                example: https://client.example.org/cb
              response_types:
                type: array
                items:
                  type: string
                example: ["code"]
              grant_types:
                type: array
                items:
                  type: string
                example: ["authorization_code", "client_credentials"]
              scope:
                type: array
                items:
                  type: string
                example:  ["openid"]
              acr_values:
                type: array
                items:
                  type: string
                example: ["basic"]
              client_jwks_uri:
                type: string
              client_token_endpoint_auth_method:
                type: string
              client_request_uris:
                type: array
                items:
                  type: string
              client_sector_identifier_uri:
                type: string
              contacts:
                type: array
                items:
                  type: string
                example: ["foo_bar@spam.org"]
              ui_locales:
                type: array
                items:
                  type: string
              claims_locales:
                type: array
                items:
                  type: string
              access_token_as_jwt:
                type: boolean
                description: specifies whether access_token should be return as JWT or not. Default value is false.
              access_token_signing_alg:
                type: string
                description: sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512

      responses:
        200:
          description: OK
          schema:
            type: object
            title: UpdateSiteResponse
            required:
              - oxd_id
            properties:
              oxd_id:
                $ref: "#/definitions/oxd_id"
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /remove-site:
    post:
      tags:
      - developers
      summary: Remove Site
      operationId: remove-site
      description: Removes site from oxd-server
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: RemoveSiteParams
          schema:
            type: object
            required:
              - oxd_id
            properties:
              oxd_id:
                type: string
                example: 6F9619FF-8B86-D011-B42D-00CF4FC964FF
      responses:
        200:
          description: OK
          schema:
            type: object
            title: RemoveSiteResponse
            required:
              - oxd_id
            properties:
              oxd_id:
                $ref: "#/definitions/oxd_id"
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /get-authorization-url:
    post:
      tags:
      - developers
      summary: Get Authorization Url
      operationId: get-authorization-url
      description: Gets authorization url
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetAuthorizationUrlParams
          schema:
            type: object
            required:
              - oxd_id
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              scope:
                type: array
                items:
                  type: string
                example: ["openid"]
              acr_values:
                type: array
                items:
                  type: string
                example: ["basic"]
              prompt:
                type: string
              custom_parameters:
                type: object
                required:
                  - param1
                  - param2
                properties:
                  param1:
                    type: string
                  param2:
                    type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetAuthorizationUrlResponse
            required:
              - authorization_url
            properties:
              authorization_url:
                type: string
                example: https://<op-hostname>/oxauth/restv1/authorize?response_type=code&client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!8A36.24E1.97DE.F4EF&redirect_uri=https://192.168.200.95/&scope=openid+profile+email+uma_protection+uma_authorization&state=473ot4nuqb4ubeokc139raur13&nonce=lbrdgorr974q66q6q9g454iccm
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /get-tokens-by-code:
    post:
      tags:
      - developers
      summary: Get Tokens By Code
      operationId: get-tokens-by-code
      description: Get tokens by code
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetTokensByCodeParams
          schema:
            type: object
            required:
              - oxd_id
              - code
              - state
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              code:
                type: string
                example: 0b9f1518-15aa-47b2-9477-d4c607447e18
              state:
                type: string
                example: 6q1ec90hn6ui4ipigv91hrbodj
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetTokensByCodeResponse
            required:
              - access_token
              - expires_in
              - id_token
              - refresh_token
              - id_token_claims
            properties:
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
              expires_in:
                type: integer
                example: 299
              id_token:
                type: string
                example: eyJraWQiOiI5MTUyNTU1Ni04YmIwLTQ2MzYtYTFhYy05ZGVlNjlhMDBmYWUiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJp
              refresh_token:
                type: string
                example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446
              id_token_claims:
                type: object
                required:
                  - at_hash
                  - aud
                  - sub
                  - auth_time
                  - iss
                  - exp
                  - iat
                  - nonce
                  - oxOpenIDConnectVersion
                properties:
                  at_hash:
                    type: array
                    items:
                      type: string
                    example: ["Cx2dz5Wvw_kBXAcTs3mFA"]
                  aud:
                    type: array
                    items:
                      type: string
                    example: ["l238j323ds-23ij4"]
                  sub:
                    type: array
                    items:
                      type: string
                    example: ["jblack"]
                  auth_time:
                    type: array
                    items:
                      type: string
                  iss:
                    type: array
                    items:
                      type: string
                    example: ["https://as.gluu.org/"]
                  exp:
                    type: array
                    items:
                      type: string
                  iat:
                    type: array
                    items:
                      type: string
                  nonce:
                    type: array
                    items:
                      type: string
                  oxOpenIDConnectVersion:
                    type: array
                    items:
                      type: string
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /get-user-info:
    post:
      tags:
      - developers
      summary: Get User Info
      operationId: get-user-info
      description: Get User Info
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetUserInfoParams
          schema:
            type: object
            required:
              - oxd_id
              - access_token
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              access_token:
                type: string
                example: 88bba7f5-961c-4b71-8053-9ab35f1ad395
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetUserInfoResponse
            required:
              - claims
            properties:
              claims:
                type: object
                additionalProperties:
                  type: array
                  items:
                    type: string
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /get-logout-uri:
    post:
      tags:
      - developers
      summary: Get Logout URL
      operationId: get-logout-uri
      description: Get Logout URL
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetLogoutUriParams
          schema:
            type: object
            required:
              - oxd_id
              - id_token_hint
              - post_logout_redirect_uri
              - state
              - session_state
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              id_token_hint:
                type: string
                example: "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso"
              post_logout_redirect_uri:
                type: string
                example: https://client.example.org/cb
              state:
                type: string
              session_state:
                type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetLogoutUriResponse
            required:
              - uri
            properties:
              uri:
                type: string
                example: https://<op-hostname>/oxauth/seam/resource/restv1/oxauth/end_session?id_token_hint=eyJraWQiOiI1YmM2ZGM3MS0xYjA1LTQ5YzMtYWU3MC0zYTg4Y2ZiMjQwN2QiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL2NlLWRldi5nbHV1Lm9yZyIsImF1ZCI6IkAhNUE1OC5BRTBELkQzODMuMUU0NiEwMDAxIUUzOEIuN0RCRSEwMDA4IUE3MTkuOTU4QS41QjdGLkVBQkMiLCJleHAiOjE0OTAwMTk5MjEsImlhdCI6MTQ5MDAxNjMyMSwibm9uY2UiOiJkNGdsbmtndHAxYWlqZ3JnY3V2cGp1N2k3cCIsImF1dGhfdGltZSI6MTQ5MDAxNjI3MiwiYXRfaGFzaCI6Im1Xa2NXQzZ6NC1qN0ZNX0ctX0tYMWciLCJveFZhbGlkYXRpb25VUkkiOiJodHRwczovL2NlLWRldi5nbHV1Lm9yZy9veGF1dGgvb3BpZnJhbWUiLCJveE9wZW5JRENvbm5lY3RWZXJzaW9uIjoib3BlbmlkY29ubmVjdC0xLjAiLCJzdWIiOiJONHRLRncyLVpDWTVWN0FhQmdpMnNHRWdDR0t0Tlg2LS01M2FQbmZFYk5zIn0.PvCdzPnMwqPNUw1bzd8tvzpJqYu-P2iCTnELr85ZaJTG8_Fdj3EruLgUBa-emeum3j29cFgdjFPx6WplfCV1GnehOieXjDiAAE85fy-stxXwII3xrva5ZjG0FnTYnJLoRmy0BWMjFC2IdCoISJI9imcfvmQmlvNmU0EjLS02cJf3JAaqEaM-FJWdQv8end9-Sq2bcp6ME3voRjV30ps_7jcDdlM_hW3M_e3RdrXYCDifbl_1jaNip5tb6_bLpgTADDoLT3fTvACRN057e2GCkSYdxvVhIjfDsjnOhk5n3TDcWedriu99H8-sNXyI_aBr3HAXd37CsgmdfIJcgUNJJw
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /get-access-token-by-refresh-token:
    post:
      tags:
      - developers
      summary: Get Access Token By Refresh Token
      operationId: get-access-token-by-refresh-token
      description: Get Access Token By Refresh Token
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: GetAccessTokenByRefreshTokenParams
          schema:
            type: object
            required:
              - oxd_id
              - refresh_token
              - scope
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              refresh_token:
                type: string
                example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446
              scope:
                type: array
                items:
                  type: string
                example: ["openid"]
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetAccessTokenByRefreshTokenResponse
            required:
              - scope
              - access_token
              - expires_in
              - refresh_token
            properties:
              scope:
                type: array
                items:
                  type: string
                example: ["openid", "profile", "uma_protection", "email"]
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
              expires_in:
                type: integer
                example: 299
              refresh_token:
                type: string
                example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /uma-rs-protect:
    post:
      tags:
      - developers
      summary: UMA RS Protect Resources
      operationId: uma-rs-protect
      description: UMA RS Protect Resources. It's important to have a single HTTP method, mentioned only once within a given path in JSON, otherwise, the operation will fail.
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UmaRsProtectParams
          schema:
            type: object
            required:
              - oxd_id
              - overwrite
              - resources
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              overwrite:
                type: boolean
              resources:
                type: array
                items:
                  $ref: "#/definitions/RsResource"
      responses:
        200:
          description: OK
          schema:
            type: object
            title: UmaRsProtectResponse
            required:
              - oxd_id
            properties:
              oxd_id:
                type: string
                example: "bcad760f-91ba-46e1-a020-05e4281d91b6"
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /uma-rs-check-access:
    post:
      tags:
      - developers
      summary: UMA RS Check Access
      operationId: uma-rs-check-access
      description: UMA RS Check Access
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UmaRsCheckAccessParams
          schema:
            type: object
            required:
              - oxd_id
              - rpt
              - path
              - http_method
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              rpt:
                type: string
              path:
                type: string
              http_method:
                type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: UmaRsCheckAccessResponse
            required:
              - access
              - ticket
            properties:
              access:
                type: string
                example: granted
                description: Possible values are granted, denied
              ticket:
                type: string
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /introspect-rpt:
    post:
      tags:
      - developers
      summary: Introspect RPT
      operationId: introspect-rpt
      description: Introspect RPT
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: IntrospectRptParams
          schema:
            type: object
            required:
              - oxd_id
              - rpt
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              rpt:
                type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: IntrospectRptResponse
            required:
              - active
              - exp
              - iat
              - nbf
              - client_id
              - aud
              - iss
              - permissions
            properties:
              active:
                type: boolean
                example: true
              exp:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when this token will expire
                example: 1535709072
              iat:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
                example: 1535709072
              nbf:
                type: integer
                format: int64
                description: number of seconds since January 1 1970 UTC, indicating when the token not to be used before
                example: 1535709072
              client_id:
                type: string
                example: "@!DBE5.84F8.631A.9172!0001!CD07.49BE!0008!0ED4.C61D.6FA7.8F42"
              sub:
                type: string
              aud:
                type: string
                example: "@!DBE5.84F8.631A.9172!0001!CD07.49BE!0008!0ED4.C61D.6FA7.8F42"
              iss:
                type: string
                example: http://as.com
              jti:
                type: string
              permissions:
                type: array
                items:
                  type: object
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
  /uma-rp-get-rpt:
    post:
      tags:
      - developers
      summary: UMA RP Get RPT
      operationId: uma-rp-get-rpt
      description: UMA RP Get RPT
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UmaRpGetRptParams
          schema:
            type: object
            required:
              - oxd_id
              - ticket
              - claim_token
              - claim_token_format
              - pct
              - rpt
              - scope
              - state
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              ticket:
                type: string
              claim_token:
                type: string
              claim_token_format:
                type: string
              pct:
                type: string
              rpt:
                type: string
              scope:
                type: array
                items:
                  type: string
                example: ["openid"]
              state:
                type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: UmaRpGetRptResponse
            required:
              - pct
              - updated
              - access_token
              - token_type
            properties:
              pct:
                type: string
              updated:
                type: boolean
              access_token:
                type: string
                example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
              token_type:
                type: string
                example: bearer
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

  /uma-rp-get-claims-gathering-url:
    post:
      tags:
      - developers
      summary: UMA RP Get Claims Gathering URL
      operationId: uma-rp-get-claims-gathering-url
      description: UMA RP Get Claims Gathering URL
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          type: string
        - in: body
          name: UmaRpGetClaimsGatheringUrlParams
          schema:
            type: object
            required:
              - oxd_id
              - ticket
              - claims_redirect_uri
            properties:
              oxd_id:
                type: string
                example: bcad760f-91ba-46e1-a020-05e4281d91b6
              ticket:
                type: string
                example: fba00191-59ab-4ed6-ac99-a786a88a9f40
              claims_redirect_uri:
                type: string
                example: https://client.example.com/cb
      responses:
        200:
          description: OK
          schema:
            type: object
            title: UmaRpGetClaimsGatheringUrlResponse
            required:
              - url
              - state
            properties:
              url:
                type: string
                example: https://<op-hostname>/oxauth/restv1/uma/gather_claims?client_id@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!4508.BF20.9B81.E904&ticket=fba00191-59ab-4ed6-ac99-a786a88a9f40&claims_redirect_uri=https://client.example.com/cb&state=d871gpie16np0f5kfv936sc33k
              state:
                type: string
                example: d871gpie16np0f5kfv936sc33k
        400:            
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).
  /get-jwks:
    post:
      tags:
      - developers
      summary: Get JSON Web Key Set
      operationId: get-json-web-key-set
      description: Get JSON Web Key Set
      consumes:
      - application/json
      produces:
      - application/json
      parameters:
      - in: header
        name: Authorization
        type: string
      - in: body
        name: GetJwksParams
        schema:
          type: object
          required:
          - op_host
          properties:
            op_host:
              type: string
              example: https://<ophostname>
            op_discovery_path:
              type: string
      responses:
        200:
          description: OK
          schema:
            type: object
            title: GetJwksResponse
            required:
            - jwks
            properties:
              jwks:
                type: string
        400:
          description: Invalid parameters are provided to endpoint.
        403:
          description: Forbidden. Invalid access token provided in Authorization header.
        500:
          description: Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

definitions:
  # List of reusable properties
  oxd_id:
    type: string
    example: bcad760f-91ba-46e1-a020-05e4281d91b6

  # List of reusable objects
  Condition:
    type: object
    required:
      - httpMethods
      - scopes
      - scope_expression
      - ticketScopes
    properties:
     httpMethods:
       type: array
       items:
         type: string
     scopes:
       type: array
       items:
         type: string
     scope_expression:
       type: array
       items:
         type: string
     ticketScopes:
       type: array
       items:
        type: string

  RsResource:
    type: object
    required:
      - path
      - conditions
    properties:
      path:
        type: string
      conditions:
        type: array
        items:
          $ref: "#/definitions/Condition"