openapi: 3.0.0
info:
  title: Auth0 Authentication actions token-exchange-profiles API
  description: Auth0 Authentication API. Endpoints for authentication and authorization using OpenID Connect, OAuth 2.0, SAML, WS-Federation, and Passwordless flows.
  version: 1.0.0
servers:
- url: '{auth0_domain}'
  description: The Authentication API is served over HTTPS.
  variables:
    auth0_domain:
      description: Auth0 domain
      default: https://demo.us.auth0.com
tags:
- name: token-exchange-profiles
paths:
  /token-exchange-profiles:
    get:
      summary: Get Token Exchange Profiles
      description: 'Retrieve a list of all Token Exchange Profiles available in your tenant.


        By using this feature, you agree to the applicable Free Trial terms in <a href="https://www.okta.com/legal/">Okta’s Master Subscription Agreement</a>. It is your responsibility to securely validate the user’s subject_token. See <a href="https://auth0.com/docs/authenticate/custom-token-exchange">User Guide</a> for more details.


        This endpoint supports Checkpoint pagination. To search by checkpoint, use the following parameters:

        <ul>

        <li><code>from</code>: Optional id from which to start selection.</li>

        <li><code>take</code>: The total amount of entries to retrieve when using the from parameter. Defaults to 50.</li>

        </ul>


        <b>Note</b>: The first time you call this endpoint using checkpoint pagination, omit the <code>from</code> parameter. If there are more results, a <code>next</code> value is included in the response. You can use this for subsequent API calls. When <code>next</code> is no longer included in the response, no pages are remaining.

        '
      tags:
      - token-exchange-profiles
      parameters:
      - name: from
        in: query
        description: Optional Id from which to start selection.
        schema:
          type: string
      - name: take
        in: query
        description: Number of results per page. Defaults to 50.
        schema:
          type: integer
          minimum: 1
          maximum: 100
      responses:
        '200':
          description: Token Exchange Profile successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListTokenExchangeProfileResponseContent'
        '400':
          description: Invalid request query string. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
          x-description-2: Client is not global.
        '403':
          description: 'Insufficient scope; expected any of: read:token_exchange_profiles.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: get_token-exchange-profiles
      x-release-lifecycle: EA
      x-operation-name: list
      x-operation-group: tokenExchangeProfiles
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:token_exchange_profiles
    post:
      summary: Create a Token Exchange Profile
      description: 'Create a new Token Exchange Profile within your tenant.


        By using this feature, you agree to the applicable Free Trial terms in <a href="https://www.okta.com/legal/">Okta’s Master Subscription Agreement</a>. It is your responsibility to securely validate the user’s subject_token. See <a href="https://auth0.com/docs/authenticate/custom-token-exchange">User Guide</a> for more details.

        '
      tags:
      - token-exchange-profiles
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTokenExchangeProfileRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/CreateTokenExchangeProfileRequestContent'
      responses:
        '201':
          description: Token exchange profile successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateTokenExchangeProfileResponseContent'
        '400':
          description: Type field must be custom
          x-description-1: Action is not deployed
          x-description-2: 'Action must have supported_triggers: custom-token-exchange'
          x-description-3: Action not found
          x-description-0: Invalid request body. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
          x-description-2: Client is not global.
        '403':
          description: You reached the limit of entities of this type for this tenant.
          x-description-0: 'Insufficient scope; expected any of: create:token_exchange_profiles.'
        '409':
          description: subject_token_type already exists for tenant
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: post_token-exchange-profiles
      x-release-lifecycle: EA
      x-operation-name: create
      x-operation-group: tokenExchangeProfiles
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - create:token_exchange_profiles
  /token-exchange-profiles/{id}:
    get:
      summary: Get a Token Exchange Profile
      description: 'Retrieve details about a single Token Exchange Profile specified by ID.


        By using this feature, you agree to the applicable Free Trial terms in <a href="https://www.okta.com/legal/">Okta’s Master Subscription Agreement</a>. It is your responsibility to securely validate the user’s subject_token. See <a href="https://auth0.com/docs/authenticate/custom-token-exchange">User Guide</a> for more details.

        '
      tags:
      - token-exchange-profiles
      parameters:
      - name: id
        in: path
        description: ID of the Token Exchange Profile to retrieve.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Token Exchange Profile successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTokenExchangeProfileResponseContent'
        '400':
          description: Invalid request query string. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
          x-description-2: Client is not global.
        '403':
          description: 'Insufficient scope; expected any of: read:token_exchange_profiles.'
        '404':
          description: Token Exchange Profile not found.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: get_token-exchange-profiles_by_id
      x-release-lifecycle: EA
      x-operation-name: get
      x-operation-group: tokenExchangeProfiles
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:token_exchange_profiles
    delete:
      summary: Delete a Token Exchange Profile
      description: 'Delete a Token Exchange Profile within your tenant.


        By using this feature, you agree to the applicable Free Trial terms in <a href="https://www.okta.com/legal/">Okta''s Master Subscription Agreement</a>. It is your responsibility to securely validate the user''s subject_token. See <a href="https://auth0.com/docs/authenticate/custom-token-exchange">User Guide</a> for more details.


        '
      tags:
      - token-exchange-profiles
      parameters:
      - name: id
        in: path
        description: ID of the Token Exchange Profile to delete.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Token Exchange Profile successfully deleted.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
          x-description-2: Client is not global.
        '403':
          description: 'Insufficient scope; expected any of: delete:token_exchange_profiles.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: delete_token-exchange-profiles_by_id
      x-release-lifecycle: EA
      x-operation-name: delete
      x-operation-group: tokenExchangeProfiles
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - delete:token_exchange_profiles
    patch:
      summary: Update an Existing Token Exchange Profile
      description: 'Update a Token Exchange Profile within your tenant.


        By using this feature, you agree to the applicable Free Trial terms in <a href="https://www.okta.com/legal/">Okta''s Master Subscription Agreement</a>. It is your responsibility to securely validate the user''s subject_token. See <a href="https://auth0.com/docs/authenticate/custom-token-exchange">User Guide</a> for more details.


        '
      tags:
      - token-exchange-profiles
      parameters:
      - name: id
        in: path
        description: ID of the Token Exchange Profile to update.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTokenExchangeProfileRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/UpdateTokenExchangeProfileRequestContent'
      responses:
        '200':
          description: Token exchange profile successfully updated.
        '400':
          description: subject_token_type already exists for tenant
          x-description-1: Unable to update field.
          x-description-0: Invalid request body. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Invalid signature received for JSON Web Token validation.
          x-description-2: Client is not global.
        '403':
          description: 'Insufficient scope; expected any of: update:token_exchange_profiles.'
        '404':
          description: Token exchange profile not found.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: patch_token-exchange-profiles_by_id
      x-release-lifecycle: EA
      x-operation-name: update
      x-operation-group: tokenExchangeProfiles
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - update:token_exchange_profiles
components:
  schemas:
    CreateTokenExchangeProfileResponseContent:
      type: object
      additionalProperties: true
      properties:
        id:
          type: string
          description: The unique ID of the token exchange profile.
          format: token-exchange-profile-id
        name:
          type: string
          description: Friendly name of this profile.
          default: Token Exchange Profile 1
          minLength: 3
          maxLength: 50
        subject_token_type:
          type: string
          description: Subject token type for this profile. When receiving a token exchange request on the Authentication API, the corresponding token exchange profile with a matching subject_token_type will be executed. This must be a URI.
          minLength: 8
          maxLength: 100
          format: url
        action_id:
          type: string
          description: The ID of the Custom Token Exchange action to execute for this profile, in order to validate the subject_token. The action must use the custom-token-exchange trigger.
          minLength: 1
          maxLength: 36
        type:
          $ref: '#/components/schemas/TokenExchangeProfileTypeEnum'
        created_at:
          type: string
          description: The time when this profile was created.
          default: '2024-01-01T00:00:00.000Z'
          format: date-time
        updated_at:
          type: string
          description: The time when this profile was updated.
          default: '2024-01-01T00:00:00.000Z'
          format: date-time
    ListTokenExchangeProfileResponseContent:
      type: object
      additionalProperties: false
      properties:
        next:
          type: string
          description: Opaque identifier for use with the <i>from</i> query parameter for the next page of results.<br/>This identifier is valid for 24 hours.
        token_exchange_profiles:
          type: array
          items:
            $ref: '#/components/schemas/TokenExchangeProfileResponseContent'
    TokenExchangeProfileResponseContent:
      type: object
      additionalProperties: true
      properties:
        id:
          type: string
          description: The unique ID of the token exchange profile.
          format: token-exchange-profile-id
        name:
          type: string
          description: Friendly name of this profile.
          default: Token Exchange Profile 1
          minLength: 3
          maxLength: 50
        subject_token_type:
          type: string
          description: Subject token type for this profile. When receiving a token exchange request on the Authentication API, the corresponding token exchange profile with a matching subject_token_type will be executed. This must be a URI.
          minLength: 8
          maxLength: 100
          format: url
        action_id:
          type: string
          description: The ID of the Custom Token Exchange action to execute for this profile, in order to validate the subject_token. The action must use the custom-token-exchange trigger.
          minLength: 1
          maxLength: 36
        type:
          $ref: '#/components/schemas/TokenExchangeProfileTypeEnum'
        created_at:
          type: string
          description: The time when this profile was created.
          default: '2024-01-01T00:00:00.000Z'
          format: date-time
        updated_at:
          type: string
          description: The time when this profile was updated.
          default: '2024-01-01T00:00:00.000Z'
          format: date-time
    TokenExchangeProfileTypeEnum:
      type: string
      description: The type of the profile, which controls how the profile will be executed when receiving a token exchange request.
      minLength: 1
      maxLength: 21
      enum:
      - custom_authentication
    UpdateTokenExchangeProfileRequestContent:
      type: object
      additionalProperties: false
      minProperties: 1
      properties:
        name:
          type: string
          description: Friendly name of this profile.
          default: Token Exchange Profile 1
          minLength: 3
          maxLength: 50
        subject_token_type:
          type: string
          description: Subject token type for this profile. When receiving a token exchange request on the Authentication API, the corresponding token exchange profile with a matching subject_token_type will be executed. This must be a URI.
          minLength: 8
          maxLength: 100
          format: url
    CreateTokenExchangeProfileRequestContent:
      type: object
      additionalProperties: false
      required:
      - name
      - subject_token_type
      - action_id
      - type
      properties:
        name:
          type: string
          description: Friendly name of this profile.
          default: Token Exchange Profile 1
          minLength: 3
          maxLength: 50
        subject_token_type:
          type: string
          description: Subject token type for this profile. When receiving a token exchange request on the Authentication API, the corresponding token exchange profile with a matching subject_token_type will be executed. This must be a URI.
          minLength: 8
          maxLength: 100
          format: url
        action_id:
          type: string
          description: The ID of the Custom Token Exchange action to execute for this profile, in order to validate the subject_token. The action must use the custom-token-exchange trigger.
          minLength: 1
          maxLength: 36
        type:
          $ref: '#/components/schemas/TokenExchangeProfileTypeEnum'
    GetTokenExchangeProfileResponseContent:
      type: object
      additionalProperties: true
      properties:
        id:
          type: string
          description: The unique ID of the token exchange profile.
          format: token-exchange-profile-id
        name:
          type: string
          description: Friendly name of this profile.
          default: Token Exchange Profile 1
          minLength: 3
          maxLength: 50
        subject_token_type:
          type: string
          description: Subject token type for this profile. When receiving a token exchange request on the Authentication API, the corresponding token exchange profile with a matching subject_token_type will be executed. This must be a URI.
          minLength: 8
          maxLength: 100
          format: url
        action_id:
          type: string
          description: The ID of the Custom Token Exchange action to execute for this profile, in order to validate the subject_token. The action must use the custom-token-exchange trigger.
          minLength: 1
          maxLength: 36
        type:
          $ref: '#/components/schemas/TokenExchangeProfileTypeEnum'
        created_at:
          type: string
          description: The time when this profile was created.
          default: '2024-01-01T00:00:00.000Z'
          format: date-time
        updated_at:
          type: string
          description: The time when this profile was updated.
          default: '2024-01-01T00:00:00.000Z'
          format: date-time