openapi: 3.0.0
info:
  title: Construction.Account.Admin Account Management Exchange Token API
  version: '1.0'
  contact:
    name: Autodesk Plaform Services
    url: https://aps.autodesk.com/
    email: aps.help@autodesk.com
  termsOfService: https://www.autodesk.com/company/legal-notices-trademarks/terms-of-service-autodesk360-web-services/forge-platform-web-services-api-terms-of-service
  x-support: https://stackoverflow.com/questions/tagged/autodesk-platform-services
  description: 'The Account Admin API automates creating and managing projects, assigning and managing project users, and managing member and partner company directories. You can also synchronize data with external systems.

    '
servers:
- url: https://developer.api.autodesk.com
security:
- 2-legged: []
- 3-legged: []
tags:
- name: Exchange Token
paths:
  /authentication/v2/token:
    post:
      tags:
      - Exchange Token
      summary: Exchanging JWT assertion for token
      description: 'Returns a three-legged access token for the JWT assertion you provide in the request body. See the Developer''s Guide topic JWT Assertions for information on how to generate a JWT assertion for this operation.


        This operation is only for confidential clients. It requires Basic Authorization (client_id, client_secret). Authentication information (client_id, client_secret) can be included either in the header or the body, but not both simultaneously.'
      operationId: exchange-jwt-assertion
      parameters:
      - name: Authorization
        in: header
        description: Must be Basic <credentials>, where <credentials> is a base64 encoded string of client_id:client_secret. This parameter is required only if client_id and client_secret are not provided in the request body.
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              description: The request body for exchange JWT assertion
              required:
              - grant_type
              - assertion
              properties:
                grant_type:
                  $ref: '#/components/schemas/grant_type'
                  description: Must be "urn:ietf:params:oauth:grant-type:jwt-bearer".
                client_id:
                  type: string
                  description: This attribute is optional; it serves as an additional option where the client can either use the authorization header or opt to send this information in the body.
                client_secret:
                  type: string
                  description: This attribute is optional; it serves as an additional option where the client can either use the authorization header or opt to send this information in the body.
                assertion:
                  type: string
                  description: The value of the JWT assertion.
                scope:
                  type: array
                  items:
                    $ref: '#/components/schemas/scope'
                  description: This is a space-delimited list of scopes. The scope in the token endpoint request body should be a subset of or the same as the scope specified in the assertion. If the scope is not present, then the returned access token will have the same scope as the assertion.
            examples:
              Example:
                value:
                  grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
                  assertion: eyJraWQiOiI1ZGU5OTNmNC02MmIwLTQ5NWEtYTQzYS1iOTg5NmQ2ZTk1ODIiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJKbE85VEExempmSlFPR1hwSm1xOUpISlNJMEQ0VWtRNCIsInN1YiI6Ilo3NTJDVDVNS1cyUzlON0UiLCJhdWQiOiJodHRwczovL2RldmVsb3Blci5hcGkuYXV0b2Rlc2suY29tL2F1dGhlbnRpY2F0aW9uL3YyL3Rva2VuIiwiZXhwIjoxNzEwOTA3MTAwLCJzY29wZSI6WyJ1c2VyOnJlYWQiLCJkYXRhOnJlYWQiXX0.p9RNN28G38VCczbO6JgkTRfcb079_xDcDm2i4-HUqUdSZKre6jllx1IWhmwG0cm79EhC3OjJ0_zoPfKj2sP4lrPm27iXzd6x_SfD4LKS4zAJI2IERXjU05T9zWU4bfZWk0EinBysV0stvvEtZIBHczD_uAXCB5YLvyBX-O_kXqqkigNQupG9RsmE4GOjhG7pGLL_tdDYXkN46JAw-vMyXlhsdOntuZCjDOpcD4hsIueKwaqm6aLBKUTE1Htwpk0MUYmvl7AF03XDgWjhwRnJVOk_MkdF44bjSCAmsQ5uTYbWipUJjDqUy38b4xiRRRB0_qsg_kZ-DBOAFzUtYN6ilA
      responses:
        '200':
          description: Successful request; access token returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/exchange-jwt-token'
        '400':
          description: Invalid request or invalid grant; ``grant_type`` or ``assertion`` attribute may be missing or invalid; or the service account is not in an enabled state. Make sure the attributes are correct and the service account is enabled.
        '401':
          description: Invalid credentials; The client credentials are invalid. Make sure the correct client credentials are used.
        '403':
          description: Forbidden; The request was successfully validated but lacked the required permissions. Verify your credentials and permissions before you send this request again.
        '500':
          description: An unknown server-side error occurred. Please try again later. If the problem persists, please contact support.
      security:
      - basic-authorization: []
      x-stoplight:
        id: y6swq0s0v49xx
components:
  schemas:
    exchange-jwt-token:
      title: Exchange JWT Token
      type: object
      description: The response for exchange JWT
      properties:
        access_token:
          type: string
          description: access token value
        token_type:
          type: string
          description: type of token
          enum:
          - Bearer
        expires_in:
          type: integer
          description: access token expiry time in seconds
    grant_type:
      type: string
      description: Must be "urn:ietf:params:oauth:grant-type:jwt-bearer".
      enum:
      - urn:ietf:params:oauth:grant-type:jwt-bearer
    scope:
      title: Scope
      type: string
      enum:
      - user:read
      - user:write
      - user-profile:read
      - viewables:read
      - data:read
      - data:read:<URN_OF_RESOURCE>
      - data:write
      - data:create
      - data:search
      - bucket:create
      - bucket:read
      - bucket:update
      - bucket:delete
      - code:all
      - account:read
      - account:write
      - openid
      - application:service_account:write
      - application:service_account:read
      - application:service_account_key:write
      - application:service_account_key:read
  securitySchemes:
    2-legged:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: ''
          refreshUrl: ''
          scopes: {}
    3-legged-implicit:
      type: oauth2
      flows:
        implicit:
          authorizationUrl: ''
          refreshUrl: ''
          scopes: {}
    3-legged:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: ''
          tokenUrl: ''
          refreshUrl: ''
          scopes: {}
x-stoplight:
  id: zm6m3b30rcbon