openapi: 3.0.0
info:
  contact:
    name: Echo Global Logistics
    url: https://www.echo.com
    email: info@echo.com
  version: 1.0.0
  title: Echo Authorizer documents token API
  description: 'All API operations require an access token to be passed in the Authorization Header for each request. The token type is an OAuth 2.0 Bearer token. To get the token you have to call the /token operation of this API and provide **client_id** and **client_secret**.


    **`Access Token Lifecycle:`** When you recieve an Access Token, it is valid for defined amount of time. The expiration time for the token is returned in the response along with the bearer token.  Developers should implement the client application in a way that  token will be requested again only after it expires. During this time you don''t have to request new token per each request, but you can simply reuse the same token to access API resources, until the token expires. The invalid token or token expiration will be indicated by HTTP Status Code 401 Unauthorized, then your application has to request new Access token.


    **`Access Token Request Rate Limiting:`** The Access Token should be used for the lifetime of the token until it has expired. Partners requesting new tokens multiple times in an hour may be subject to rate limiting.


    **`API Request Rate Limiting:`** Please do not exceed more than 3 requests per second. Partners who exceed this limit may be subject to rate limiting.'
servers:
- description: SwaggerHub API Auto Mocking
  url: https://virtserver.swaggerhub.com/echogl/Echo_Authorizer_Public/1.0.0
- description: Production environment.
  url: https://auth.echo.com
tags:
- name: token
  description: Obtaining and using tokens
paths:
  /token:
    post:
      summary: Process to acquire a bearer token from Echo Global Logistics
      tags:
      - token
      description: Endpoint to obtain a token - either used for the Client Credentials Flow or as the second leg of the Authorization Code Flow w/ or w/out PKCE
      operationId: token
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  description: The supplied client ID generated for your application
                client_secret:
                  type: string
                  description: The supplied client secret generated for your application <p>**Required if grant_type is** ***client_credentials***</p>
                grant_type:
                  type: string
                  description: The type of grant you are using to obtain a token
                  enum:
                  - client_credentials
                scope:
                  type: string
                  description: The scope(s) being requested by the application <p>Scopes are space-delimited</p> <p>Scopes that are granted will be returned in the access token</p> <p>**Required if grant_type is** ***client_credentials***</p>
                  enum:
                  - quotes:create
                  - tender:action
                  - load_status:read
                  - invoice:read
                  - connect_api:action
                  - loads:read
                  - loads:action
              required:
              - client_id
              - client_secret
              - grant_type
              - scope
      responses:
        '200':
          $ref: '#/components/responses/TokenResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                invalid_client:
                  summary: Invalid client id
                  value:
                    error: invalid_request
                    error_desc: Resource not found
                invalid_grant:
                  summary: Grant has been used or has expired
                  value:
                    error: invalid_grant
                    error_desc: grant request is invalid
                missing_param:
                  summary: Missing required parameter
                  value:
                    error: invalid_request
                    error_desc: missing required parameter(s). (redirect_uri)
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                failed_auth:
                  summary: Failed authentication
                  value:
                    error: invalid_request
                    error_desc: Authentication Failed
                no_access:
                  summary: No access
                  value:
                    error: invalid_request
                    error_desc: Access is unauthorized
      security:
      - apiKey: []
components:
  responses:
    TokenResponse:
      description: Success
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Token'
          examples:
            grant_type_client_credentials:
              summary: Grant type as client_credentials
              value:
                access_token: NWE4Nzg2ZDEtNzQyMS00ZDViLThjMjctMGQwNjlmZjU5MWNkBGjFElT7CWzl0d....
                expires_in: 3600
                token_type: Bearer
                scope: quotes:create
  schemas:
    Token:
      type: object
      properties:
        access_token:
          type: string
          description: JSON Web Token (JWT) that represents a session generated for a client
        expires_in:
          type: integer
          description: Number of seconds until the session expires
        token_type:
          type: string
          description: Type of access token - always set to Bearer
        scope:
          type: string
          description: scope(s) approved with the token
    Error:
      type: object
      properties:
        error:
          type: string
          description: Short indicator of error type
        error_desc:
          type: string
          description: Description of error
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
    apiKey:
      type: apiKey
      name: x-api-key
      in: header