openapi: 3.1.0
info:
  title: Autodesk ACC Account Admin Account Users Token API
  description: The ACC Account Admin API automates the creation and management of projects, assignment and management of project users, and management of member and partner company directories within Autodesk Construction Cloud. It supports bulk operations for enterprise-scale administration.
  version: 1.0.0
  termsOfService: https://www.autodesk.com/company/legal-notices-trademarks/terms-of-service-autodesk360-web-services/autodesk-web-services-api-terms-of-service
  contact:
    name: Autodesk Platform Services
    url: https://aps.autodesk.com
    email: aps.help@autodesk.com
  license:
    name: Autodesk API Terms of Service
    url: https://www.autodesk.com/company/legal-notices-trademarks/terms-of-service-autodesk360-web-services/autodesk-web-services-api-terms-of-service
servers:
- url: https://developer.api.autodesk.com
  description: Production
security:
- OAuth2ThreeLegged:
  - account:read
tags:
- name: Token
paths:
  /authentication/v2/token:
    post:
      operationId: getToken
      summary: Autodesk Get Token
      description: Returns an access token or refresh an existing token. Supports client_credentials (two-legged), authorization_code (three-legged), and refresh_token grant types.
      tags:
      - Token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - grant_type
              properties:
                grant_type:
                  type: string
                  description: The grant type for the token request.
                  enum:
                  - client_credentials
                  - authorization_code
                  - refresh_token
                client_id:
                  type: string
                  description: The Client ID of your application. Required if not using HTTP Basic authentication.
                client_secret:
                  type: string
                  description: The Client Secret of your application. Required for confidential clients if not using HTTP Basic authentication.
                code:
                  type: string
                  description: The authorization code received from the authorize endpoint. Required when grant_type is authorization_code.
                redirect_uri:
                  type: string
                  format: uri
                  description: The redirect URI used in the authorization request. Required when grant_type is authorization_code.
                scope:
                  type: string
                  description: Space-separated list of scopes. Required for client_credentials grant type.
                refresh_token:
                  type: string
                  description: The refresh token. Required when grant_type is refresh_token.
                code_verifier:
                  type: string
                  description: The PKCE code verifier. Required if a code_challenge was used in the authorize request.
      responses:
        '200':
          description: Successfully obtained access token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: Bad request - invalid grant type or missing parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized - invalid client credentials.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /authentication/v2/revoke:
    post:
      operationId: revokeToken
      summary: Autodesk Revoke Token
      description: Revokes an active access token or refresh token, rendering it invalid for further use.
      tags:
      - Token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - token
              - token_type_hint
              - client_id
              properties:
                token:
                  type: string
                  description: The token to revoke.
                token_type_hint:
                  type: string
                  description: The type of the token being revoked.
                  enum:
                  - access_token
                  - refresh_token
                client_id:
                  type: string
                  description: The Client ID of your application.
                client_secret:
                  type: string
                  description: The Client Secret of your application. Required for confidential clients.
      responses:
        '200':
          description: Token successfully revoked.
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /authentication/v2/introspect:
    post:
      operationId: introspectToken
      summary: Autodesk Introspect Token
      description: Returns metadata about a token, including whether it is active, the scopes it was granted, and its expiration time.
      tags:
      - Token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - token
              properties:
                token:
                  type: string
                  description: The token to introspect.
                client_id:
                  type: string
                  description: The Client ID of your application.
                client_secret:
                  type: string
                  description: The Client Secret of your application.
      responses:
        '200':
          description: Token introspection result.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntrospectionResponse'
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    IntrospectionResponse:
      type: object
      properties:
        active:
          type: boolean
          description: Whether the token is active.
        scope:
          type: string
          description: Space-separated list of scopes.
        client_id:
          type: string
          description: The client ID the token was issued to.
        exp:
          type: integer
          description: Token expiration time as a Unix timestamp.
        userid:
          type: string
          description: The user ID (for three-legged tokens).
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: The access token string.
        token_type:
          type: string
          description: The type of token, typically Bearer.
          example: Bearer
        expires_in:
          type: integer
          description: The token lifetime in seconds.
          example: 3600
        refresh_token:
          type: string
          description: The refresh token (only returned for three-legged authentication).
        scope:
          type: string
          description: Space-separated list of scopes granted.
    ErrorResponse:
      type: object
      properties:
        developerMessage:
          type: string
          description: A developer-facing error message.
        userMessage:
          type: string
          description: A user-facing error message.
        errorCode:
          type: string
          description: An error code.
        more info:
          type: string
          description: A link to more information about the error.
  securitySchemes:
    OAuth2ThreeLegged:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://developer.api.autodesk.com/authentication/v2/authorize
          tokenUrl: https://developer.api.autodesk.com/authentication/v2/token
          scopes:
            account:read: Read account data
            account:write: Write account data