openapi: 3.2.0
info:
  title: EB SUITE OAUTH AUTHENTICATION Tokens API
  description: APIs to work with authentication and authorization with OAuth
  version: '1.0'
servers:
- url: https://api.everbridge.net/authorization/v1
tags:
- name: Tokens
  description: Work with oAuth token.
paths:
  /tokens:
    post:
      tags:
      - Tokens
      operationId: Generate Token
      summary: Generate Token
      description: 'Generate a new oAuth token which must be supplied to all subsequent API calls.  Grab _id_token_ from the response and pass it as header <br />_Authorization_: Bearer <id_token>, <br /><b>Note: </b>Use the copy icon from the response to quickly copy id_token.'
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - grant_type
              - client_id
              - client_secret
              - scope
              properties:
                grant_type:
                  type: string
                  description: Grant Type
                  default: password
                  enum:
                  - password
                  - client_credentials
                client_id:
                  description: Client Id
                  type: string
                client_secret:
                  description: Client Secret
                  type: string
                username:
                  description: Username from Manager Portal
                  type: string
                password:
                  description: Manager portal password
                  type: string
                  format: password
                roleId:
                  description: 'When the user has access to multiple roles, one of the roleIds can be passed in here.  <br /><b>Note</b>: This id is not validated during token generation and is required for cross org client credential service accounts.'
                  type: string
                  example: '1234567890'
                proxyForOrgId:
                  description: When sending request on behalf of another org, use this field.  Account must have access to the proxy org ID.
                  type: string
                proxyForUserId:
                  description: 'When sending request on behalf of another org, use this field. Used when a service account needs to run as different use during runtime (say for  '
                  type: string
                scope:
                  description: Scope for the token generated
                  type: string
            examples:
              Password Grant Type:
                summary: Password Grant Type
                value:
                  grant_type: password
                  client_id: yourid
                  client_secret: '******'
                  username: youruser
                  password: '******'
                  scope: openid user-profile role
              Client Credential:
                summary: Client Credentials
                value:
                  grant_type: client_credentials
                  client_id: yourid
                  client_secret: '******'
                  scope: openid user-profile role service-profile
              Cross Org:
                summary: Cross Org
                value:
                  grant_type: client_credentials
                  client_id: yourid
                  client_secret: '******'
                  roleId: '1234567890'
                  scope: openid user-profile role service-profile
              User Proxy:
                summary: Proxy for User
                value:
                  grant_type: client_credentials
                  client_id: yourid
                  client_secret: '******'
                  proxyForUserId: yourProxyUserid
                  scope: openid user-profile role service-profile
      responses:
        '200':
          description: 200 response
          content:
            application/json:
              examples:
                Success:
                  summary: Token Generated
                  value:
                    access_token: AT-1209-****-********
                    id_token: '****'
                    refresh_token: RT-1204-****-********
                    token_type: bearer
                    expires_in: 28800
                    scope: service-profile role user-profile openid
        '401':
          description: Unauthorized
          content:
            application/json:
              examples:
                Failed authentication:
                  summary: Authentication Failed
                  value:
                    timestamp: '2022-12-16T18:47:56.858+00:00'
                    status: '401'
                    error: Unauthorized
                    message: ''
                    path: /cas/oidc/token
      security: []
      x-amazon-apigateway-integration:
        type: http_proxy
        httpMethod: POST
        uri: https://authentication.everbridge.net/cas/oidc/token
        responses:
          4\d{2}:
            statusCode: '401'
          2\d{2}:
            statusCode: '200'
        passthroughBehavior: when_no_match
x-readme:
  explorer-enabled: true
  proxy-enabled: true