openapi: 3.2.0
info:
  title: Mesh Policy Engine Authentication API
  version: 6.0.0
  x-provenance:
    method: harvested
    authored_by: Cisco Security Cloud Control
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
    provider_published: true
  x-evidence:
  - type: source
    url: https://github.com/CiscoDevNet/scc-public-api-docs/blob/main/specs/mesh-policy.yaml
  - type: raw
    url: https://raw.githubusercontent.com/CiscoDevNet/scc-public-api-docs/main/specs/mesh-policy.yaml
servers:
- url: https://api.security.cisco.com/pinacl/api
security:
- BearerJWT: []
tags:
- name: Authentication
paths:
  /security/authentication/decode_pinacltoken:
    post:
      description: 'Roles allowed: all'
      operationId: decodePinaclToken
      parameters:
      - in: header
        name: Authorization
        schema:
          type: string
      responses:
        '200':
          description: Ok
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal Server Error
      summary: Decode pinacl token
      tags:
      - Authentication
  /security/authentication/with_cdotoken:
    post:
      description: 'Roles allowed: all'
      operationId: cdoAuthToPinaclToken
      parameters:
      - in: header
        name: Authorization
        schema:
          type: string
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: Ok
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal Server Error
      summary: Get pinacl token from cdo token
      tags:
      - Authentication
  /security/authentication/with_clientcredentialtoken:
    post:
      description: 'Roles allowed: all'
      operationId: clientCredentialTokenToPinaclToken
      parameters:
      - in: header
        name: Authorization
        schema:
          type: string
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: Ok
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal Server Error
      summary: Get pinacl token from client credential token
      tags:
      - Authentication
  /security/authentication/with_idtoken:
    post:
      description: 'Roles allowed: all'
      operationId: idTokenToPinaclToken
      parameters:
      - in: header
        name: Authorization
        schema:
          type: string
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: Ok
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal Server Error
      summary: Get pinacl token from id token
      tags:
      - Authentication
  /security/authentication/with_piamtoken:
    post:
      description: 'Roles allowed: all'
      operationId: piamTokenToPinaclToken
      parameters:
      - in: header
        name: Authorization
        schema:
          type: string
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: Ok
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal Server Error
      summary: Get pinacl token from piam token
      tags:
      - Authentication
components:
  securitySchemes:
    BearerJWT:
      bearerFormat: jwt
      scheme: bearer
      type: http