generated: '2026-09-04'
method: derived
source: >-
  openapi/brick-brick-server-openapi.yml (components.securitySchemes + per-operation security) ;
  https://github.com/BrickSchema/brick-example-server (HTTP 200)
summary:
  types:
    - http
  scopes_published: false
  oauth2_metadata_published: false
schemes:
  - name: HTTPBearer
    type: http
    scheme: bearer
    bearerFormat: JWT
    sources:
      - openapi/brick-brick-server-openapi.yml
    applied_to: 12 of 19 operations
    note: >-
      The only securityScheme in the contract. There are no scopes, so a token that can read a
      building's telemetry can also actuate its equipment.
token_lifecycle:
  issue:
    operation: gen_token_brickapi_v1_auth_app_tokens_post
    path: POST /brickapi/v1/auth/app_tokens
    parameters:
      - name: app_name
        in: query
        required: false
        description: The name of an app the user needs to generate a token for
      - name: token_lifetime
        in: query
        required: false
        description: Expiration time of the requested token in seconds.
    returns: 'TokenResponse — token (JWT), name, exp (unix timestamp)'
  list:
    operation: get_tokens_brickapi_v1_auth_app_tokens_get
    path: GET /brickapi/v1/auth/app_tokens
  revoke:
    operation: del_token_brickapi_v1_auth_app_tokens__app_token__delete
    path: DELETE /brickapi/v1/auth/app_tokens/{app_token}
interactive_login:
  flow: google-redirect
  operations:
    - get_login_via_google_brickapi_v1_auth_login_get
    - get_authorize_brickapi_v1_auth_logincallback_get
    - get_is_registered_brickapi_v1_auth_is_registered_get
    - post_register_user_brickapi_v1_auth_register_get
  note: >-
    /brickapi/v1/auth/login is summarised "Get Login Via Google" and /auth/logincallback "Get
    Authorize" — a Google sign-in redirect. Despite that, the contract declares NO oauth2 or
    openIdConnect securityScheme, publishes no authorization-server metadata, and defines no scopes;
    every /.well-known/openid-configuration and /.well-known/oauth-authorization-server probe on the
    Brick hosts returned 404 on 2026-09-04. Recorded as http-bearer only.
unsecured_operations:
  - get_login_via_google_brickapi_v1_auth_login_get
  - get_is_registered_brickapi_v1_auth_is_registered_get
  - get_authorize_brickapi_v1_auth_logincallback_get
docs: https://github.com/BrickSchema/brick-example-server
gap: >-
  No dedicated authentication documentation page exists — the repository README and the contract are
  the whole of it. No 401 or 403 response is declared on any secured operation, so an agent cannot
  tell an auth failure from any other undocumented status.
maintainers:
  - FN: Kin Lane
    email: info@apievangelist.com