{
  "swagger": "2.0",
  "info": {
    "title": "Authorize & Token",
    "x-ibm-name": "authorize-token",
    "version": "2.0.2",
    "description": "Authorize is our implementation of the OAuth 2.0 framework. It lets you integrate the latest industry-standard secure authorization methods in your app.",
    "x-api-id": "1606b936-dd24-83e8-7013-fc77d3847278",
    "x-bmo-api-type": "general-api",
    "x-bmo-api-provider-id": 3384,
    "x-bmoservicedomain-name": "Issued Device Administration",
    "x-api-specification-compliant": false,
    "x-ibm-summary": ""
  },
  "schemes": [
    "https"
  ],
  "basePath": "/open-banking/commercial-sb",
  "produces": [
    "application/json"
  ],
  "securityDefinitions": {
    "clientIdHeader": {
      "type": "apiKey",
      "in": "header",
      "name": "X-IBM-Client-Id"
    }
  },
  "x-ibm-configuration": {
    "cors": {
      "enabled": true
    },
    "type": "rest",
    "phase": "realized",
    "enforced": true,
    "testable": true,
    "categories": [
      "techunit--obtps--sd--issueddeviceadministration--ent"
    ],
    "application-authentication": {
      "certificate": false
    },
    "servers": [
      {
        "url": "https://sandbox-open-api.bmo.com/open-banking/commercial-sb",
        "type": [
          "production",
          "development"
        ]
      }
    ]
  },
  "definitions": {
    "Payload": {
      "type": "object",
      "properties": {
        "iss": {
          "type": "string"
        },
        "sub": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "aud": {
          "type": "string"
        },
        "scope": {
          "type": "string"
        },
        "exp": {
          "type": "integer"
        },
        "iat": {
          "type": "integer"
        }
      }
    },
    "Token": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "token_type",
        "access_token",
        "expires_in"
      ],
      "properties": {
        "token_type": {
          "enum": [
            "bearer"
          ]
        },
        "access_token": {
          "type": "string"
        },
        "expires_in": {
          "type": "integer"
        },
        "scope": {
          "type": "string"
        },
        "refresh_token": {
          "type": "string"
        }
      }
    },
    "introspect_response": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "active",
        "client_id",
        "client_name",
        "username",
        "sub",
        "exp",
        "expstr",
        "iat",
        "nbf",
        "nbfstr",
        "scope"
      ],
      "properties": {
        "active": {
          "type": "boolean"
        },
        "client_id": {
          "type": "string"
        },
        "client_name": {
          "type": "string"
        },
        "username": {
          "type": "string"
        },
        "sub": {
          "type": "string"
        },
        "exp": {
          "type": "string"
        },
        "expstr": {
          "type": "string"
        },
        "iat": {
          "type": "string"
        },
        "nbf": {
          "type": "string"
        },
        "nbfstr": {
          "type": "string"
        },
        "scope": {
          "type": "string"
        },
        "miscinfo": {
          "type": "string"
        },
        "consented_on": {
          "type": "string"
        },
        "consented_on_str": {
          "type": "string"
        },
        "grant_type": {
          "type": "string"
        }
      }
    }
  },
  "paths": {
    "/oauth20/authorize": {
      "get": {
        "operationId": "Retrieve authorization code",
        "x-dataclassification-code": "Highly Sensitive",
        "summary": "Retrieve authorization code",
        "description": "Retrieve an authorization code to be used in exchange for an access token. \n",
        "parameters": [
          {
            "name": "client_id",
            "in": "query",
            "description": "Application client ID, can be provided in formData or using HTTP Basic Authentication",
            "type": "string",
            "required": true
          },
          {
            "name": "redirect_uri",
            "in": "query",
            "description": "required only if the redirect_uri parameter was included in the authorization request /oauth2/authorize; their values MUST be identical.",
            "required": true,
            "type": "string"
          },
          {
            "name": "state",
            "in": "query",
            "type": "string",
            "description": "The state value you create and will verify",
            "required": true
          },
          {
            "name": "scope",
            "in": "query",
            "description": "the scope value you create and will verify",
            "required": true,
            "type": "string"
          },
          {
            "name": "response_type",
            "in": "query",
            "description": "the response type",
            "required": true,
            "type": "string"
          }
        ],
        "responses": {
          "200": {
            "description": "This operation returns no content"
          },
          "400": {
            "description": "This operation returns no content"
          }
        }
      }
    },
    "/oauth20/token": {
      "post": {
        "operationId": "Request Access Tokens",
        "x-dataclassification-code": "Public",
        "consumes": [
          "application/x-www-form-urlencoded"
        ],
        "produces": [
          "application/json"
        ],
        "summary": "Request Access Tokens",
        "description": "Exchange the authorization code retrieved in the previous call  for an access token and a refresh token. \n\n1. Authorization Code<br>Get an access token and refresh token by calling our /token endpoint and passing through the authorization code from the previous call. <br>The access token will only be valid for the scope for which the consent has been provided. It will have an expiration of 24 hours in the sandbox environment and 15 minutes in production. You can then call our APIs by passing this token in the Authorization header.<br>The refresh token can be used to get a new access token if the original one expires.\n\n2. Refresh Token<br>If your access token has expired and your refresh token is still valid, you can exchange your refresh token for a new access token and a new refresh token.",
        "parameters": [
          {
            "name": "grant_type",
            "in": "formData",
            "description": "Type of grant",
            "type": "string",
            "required": true
          },
          {
            "name": "client_id",
            "in": "formData",
            "description": "Application client ID, can be provided in formData or using HTTP Basic Authentication",
            "required": false,
            "type": "string"
          },
          {
            "name": "client_secret",
            "in": "formData",
            "description": "Application client secret, can be provided in formData or using HTTP Basic Authentication",
            "required": false,
            "type": "string"
          },
          {
            "name": "code",
            "in": "formData",
            "description": "Authorization code provided by the /oauth2/authorize endpoint",
            "required": false,
            "type": "string"
          },
          {
            "name": "redirect_uri",
            "in": "formData",
            "description": "required only if the redirect_uri parameter was included in the authorization request /oauth2/authorize; their values MUST be identical.",
            "required": false,
            "type": "string"
          },
          {
            "name": "username",
            "in": "formData",
            "type": "string",
            "description": "Resource owner username",
            "required": false
          },
          {
            "name": "password",
            "in": "formData",
            "type": "string",
            "description": "Resource owner password",
            "required": false
          },
          {
            "name": "scope",
            "in": "formData",
            "type": "string",
            "description": "Scope being requested",
            "required": false
          },
          {
            "name": "refresh_token",
            "in": "formData",
            "type": "string",
            "description": "The refresh token that the client wants to exchange for a new access token (refresh_token grant_type)",
            "required": false
          }
        ],
        "responses": {
          "200": {
            "description": "json document containing token, etc.",
            "schema": {
              "$ref": "#/definitions/Token"
            }
          },
          "400": {
            "description": "json document that may contain additional details about the failure"
          }
        }
      }
    }
  },
  "host": "sandbox-open-api.bmo.com"
}