openapi: 3.0.0
info:
  title: Alloy Identity Bank Accounts OAuth API
  version: 1.0.0
  description: The Alloy Identity API provides endpoints for creating and managing person and business entities, running evaluations through configurable risk workflows, managing journey applications, submitting events for ongoing monitoring, handling document verification, and managing investigations and case alerts. Authentication is via Basic HTTP credentials or OAuth 2.0 Client Credentials.
  contact:
    name: Alloy Support
    url: https://help.alloy.com/hc/en-us
  license:
    name: Proprietary
servers:
- url: https://sandbox.alloy.co/v1
  description: Sandbox environment
- url: https://alloy.co/v1
  description: Production environment
security:
- basic: []
- oauth2: []
tags:
- name: OAuth
  description: These endpoints allow the API to be used by OAuth clients. They convert (application token) + (application secret) credentials into OAuth bearer tokens that can be used with any other API endpoint.
paths:
  /oauth/bearer:
    post:
      tags:
      - OAuth
      summary: Generate a new OAuth bearer token from the given client credentials.
      description: 'Application token and application secret MUST be provided, either as properties in the JSON body, or in the Authorization header.


        The returned bearer token will allow the client all the same access permissions as the given application token and secret. Bearer tokens are sent in the `Authorization` header in the form `Bearer <bearer_token>`.


        All bearer tokens expire one hour from generation.

        '
      parameters:
      - in: header
        name: Authorization
        schema:
          type: string
          description: 'Basic authorization header per the OAuth Client Authorization Header standard.


            The format is `Basic <auth_string>`, where `<auth_string>` is the base64 encoding of the string `application_token:application_secret` (the application token and application secret, separated by a colon character).

            '
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                application_token:
                  type: string
                  pattern: ^[A-Za-z0-9]{32}$
                  description: Application token for the client. This is the application token for a particular workflow.
                application_secret:
                  type: string
                  pattern: ^[A-Za-z0-9]{32}$
                  description: Application secret for the client. This is the application secret for a particular workflow (and must match the application token).
                grant_type:
                  type: string
                  description: OAuth grant type. Only the "Client Credentials" grant type is supported.
                  enum:
                  - client_credentials
      responses:
        '200':
          x-summary: OK
          description: 'The generated OAuth bearer token.


            If credentials are sent in the Authorization header, the OAuth standard fields `access_token`, `token_type`, and `expires_in` are returned.


            If credentials are sent in the JSON body, fields `bearer_token` and `expires` are returned. This is for backwards-compatibility with the original version of this API.

            '
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                    pattern: ^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$
                    description: OAuth bearer token in JWT format.
                  bearer_token:
                    type: string
                    pattern: ^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$
                    description: OAuth bearer token.
                  token_type:
                    type: string
                    enum:
                    - bearer
                  expires_in:
                    type: number
                    description: Seconds until expiration.
                  expires:
                    type: number
                    description: Expiration time, in **milliseconds** past the epoch.
              example:
                access_token: IcR6p1pbUJjn58xCXewm8ni2U3c0pRCbyqTA5I0x
                token_type: bearer
                expires_in: 3600
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      minor_code:
                        type: number
                      type:
                        type: string
                      message:
                        type: string
                      details:
                        type: object
                    required:
                    - minor_code
                    - type
                    - message
                required:
                - error
              examples:
                HeaderValidationFailure:
                  value:
                    error:
                      minor_code: 4001
                      type: Header Validation Failure
                      message: Verify that your request headers comply with HTTP v1.1 standards.
                RequestBodyValiationFailure:
                  value:
                    error:
                      minor_code: 4002
                      type: Request Body Validation Failure
        '401':
          x-summary: Unauthorized
          description: Authorization failed / invalid credentials.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      minor_code:
                        type: number
                        enum:
                        - 4011
                      type:
                        type: string
                        enum:
                        - Unauthorized
                      message:
                        type: string
                      details:
                        type: object
                    required:
                    - minor_code
                    - type
                    - message
                required:
                - error
              example:
                error:
                  minor_code: 4011
                  type: Unauthorized
                  message: Unable to obtain a bearer token using specified application credentials. The application may be disabled?
components:
  securitySchemes:
    basic:
      type: http
      description: HTTP basic authorization using a workflow token and secret
      scheme: basic
    oauth2:
      type: oauth2
      description: OAuth2 using a workflow token and secret to generate a bearer token
      flows:
        clientCredentials:
          tokenUrl: /oauth/bearer
          scopes: {}