openapi: 3.0.1
info:
  title: Cherre GraphQL Auth API
  description: HTTP modeling of Cherre's single GraphQL API for connected real-estate data (property, tax assessor, recorder/deeds, mortgages/liens, owners, parcel boundaries, demographics, and connected datasets). GraphQL operations are issued as HTTP POST of a query document to the /graphql endpoint. Access is authorized with an OAuth 2.0 client-credentials bearer token obtained from the /oauth/token endpoint. This document is a representative model; the production schema is provisioned per customer via Cherre's Developer Portal.
  termsOfService: https://cherre.com/terms-of-service/
  contact:
    name: Cherre
    url: https://www.cherre.com
  version: '1.0'
servers:
- url: https://api.cherre.com
  description: Cherre API (representative)
security:
- bearerAuth: []
tags:
- name: Auth
paths:
  /oauth/token:
    post:
      operationId: createAccessToken
      tags:
      - Auth
      summary: Obtain an OAuth 2.0 client-credentials access token.
      description: Exchange client credentials for a short-lived bearer access token used to authorize GraphQL requests.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
      responses:
        '200':
          description: Access token issued.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          description: Invalid client credentials.
components:
  schemas:
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
          example: Bearer
        expires_in:
          type: integer
          description: Token lifetime in seconds.
    TokenRequest:
      type: object
      required:
      - grant_type
      - client_id
      - client_secret
      properties:
        grant_type:
          type: string
          enum:
          - client_credentials
        client_id:
          type: string
        client_secret:
          type: string
        audience:
          type: string
          description: Optional API audience identifier.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT