{"openapi":"3.0.2","info":{"title":"Here Account v1 APIs","version":"1.1.x","description":"This specification describes the Here Account v1 APIs\n"},"externalDocs":{"description":"The developer guide and related API references are available here.","url":"https://www.here.com/docs/category/identity-and-access-management"},"servers":[{"url":"https://account.api.here.com"}],"tags":[{"name":"Authorization Information"},{"name":"Authorization Share"}],"security":[{"Bearer":[]}],"paths":{"/user/me/authorization":{"get":{"tags":["Authorization Information"],"summary":"Get my authorization details","operationId":"Here Account v1 APIs userAuthorizationDetails","description":"Get the authorization details of the user represented by the Authorization header. \nThe response includes all roles and permissions of the user.\n","responses":{"200":{"description":"Ok\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthorizationResponse"}}}},"404":{"description":"* 404600 - Authorization record is not found\n"},"default":{"description":"An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"parameters":[{"$ref":"#/components/parameters/includeAllPermissionsOrNoneParam"}]}},"/user/me/authorization/permissions":{"get":{"tags":["Authorization Information"],"summary":"Get my permissions","operationId":"Here Account v1 APIs getMyPermissions","description":"Get a pageable list of permissions assigned to you\n","parameters":[{"$ref":"#/components/parameters/countParam"},{"$ref":"#/components/parameters/pageTokenParam"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionsListPageToken"}}}},"400":{"description":"* 400001 - count must be Integer 0 or greater.\n* 400202 - Field 'pageToken' cannot be empty.\n* 400203 - Invalid characters for page token query string.\n"},"default":{"description":"An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/app/me/authorization":{"get":{"tags":["Authorization Information"],"summary":"Introspect application authorizations","operationId":"Here Account v1 APIs introspectApplicationAuthorization","description":"Retrieve the application authorization associated with the application.\n","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppAuthorizationResponse"}}}},"401":{"description":"* 404660 - No app exists with the given Id.\n"},"default":{"description":"An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"parameters":[{"$ref":"#/components/parameters/includeAllPermissionsOrNoneParam"}]}},"/app/me/authorization/permissions":{"get":{"tags":["Authorization Information"],"summary":"Get my app permissions","security":[{"clientToken":[]}],"operationId":"Here Account v1 APIs getMyAppPermissions","description":"Get a pageable list of permissions directly assigned to your application. Permissions assigned indirectly via group memberships or policy or plans are not returned in this response.\n","parameters":[{"$ref":"#/components/parameters/countParam"},{"$ref":"#/components/parameters/pageTokenParam"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PermissionsListPageToken"}}}},"400":{"description":"* 400001 - count must be Integer 0 or greater.\n* 400202 - Field 'pageToken' cannot be empty.\n* 400203 - Invalid characters for page token query string.\n* 404660 - No app exists with the given Id.\n"},"default":{"description":"An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/user/{userId}/authorization/share/permissions":{"post":{"tags":["Authorization Share"],"summary":"Share permissions to a user","operationId":"Here Account v1 APIs shareUserAuthorization","description":"Share permissions to a user.\n</br>\nThis API works only with tokens that are not scoped to a project.\n</br></br>\nAccess Control:\n* Requires the calling principal to have the following permission:\n  * action: share\n  * serviceId: authorization\n  * resource: {resourceHrn}\n","parameters":[{"$ref":"#/components/parameters/userId"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewPermissions"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthorizationResponse"}}}},"400":{"description":"* 400200 - Received invalid data. See 'errorFields' for more information.\n    * errorFields.errorCode 400240 - Invalid email\n    * errorFields.errorCode 400297 - Unsupported roles.name\n    * errorFields.errorCode 400203 - Invalid action\n    * errorFields.errorCode 400288 - Invalid resource. Invalid HERE Resource Name format\n    * errorFields.errorCode 400294 - Invalid effect. Valid values are allow and deny\n* 400322 - Not enough privileges for the requesting client to share the requested resources\n"},"401":{"description":"* 401420 - Not enough privileges for the requesting client to share the requested resources\n"},"403":{"description":"* 403102 - Sharing is not enabled\n* 403103 - This action cannot be shared\n"},"404":{"description":"* 404600 - Authorization record is not found\n"},"422":{"description":"A defined system limit would be violated if this action was\ncompleted.\n\nExample: 'MaxPermissionsPerEntity limit reached. Current value: 1000. Maximum value: 1000'\n\n* 422000 - LimitReached\n"},"default":{"description":"An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/app/{appId}/authorization/share/permissions":{"post":{"tags":["Authorization Share"],"summary":"Share permissions to an application","operationId":"Here Account v1 APIs shareAppAuthorization","description":"Share permissions to an application.\n</br>\nThis API works only with tokens that are not scoped to a project.\n</br></br>\nAccess Control:\n* Requires the calling principal to have the following permission:\n  * action: share\n  * serviceId: authorization\n  * resource: {resourceHrn}\n","parameters":[{"$ref":"#/components/parameters/appId"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewPermissions"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppAuthorizationResponse"}}}},"400":{"description":"* 400299 - Invalid permission format\n* 400322 - Not enough privileges for the requesting client to share the requested resources\n* 400409 - Service definition requires Contract Id to be provided\n* 404610 - No service descriptor record exists for given Id\n* 404700 - No contract exists with the given Id\n"},"401":{"description":"* 401420 - Not enough privileges for the requesting client to share the requested resources\n"},"403":{"description":"* 403102 - Sharing is not enabled\n* 403103 - This action cannot be shared\n"},"404":{"description":"* 404660 - No app exists with that given id\n"},"422":{"description":"A defined system limit would be violated if this action was\ncompleted.\n\nExample: 'MaxPermissionsPerEntity limit reached. Current value: 1000. Maximum value: 1000'\n\n* 422000 - LimitReached\n"},"default":{"description":"An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/group/{groupId}/authorization/share/permissions":{"post":{"tags":["Authorization Share"],"summary":"Share permissions to a group","operationId":"Here Account v1 APIs shareGroupAuthorization","description":"Share permissions to a group.\n</br>\nThis API works only with tokens that are not scoped to a project.\n</br></br>\nAccess Control:\n* Requires the calling principal to have the following permission:\n  * action: share\n  * serviceId: authorization\n  * resource: {resourceHrn}\n","parameters":[{"$ref":"#/components/parameters/groupId"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewPermissions"}}},"required":true},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupPermissions"}}}},"400":{"description":"* 400299: Invalid permission format.\n* 404610: No service descriptor record exists for given Id.\n* 400284: Contract of the requested permission does not belong to the customer of the group.\n* 400407: Permission request may only contain either contractId or serviceId, but not both.\n* 400294: Illegal effect. Valid values are allow and deny.\n* 400288: Invalid HERE Resource name format.\n* 400406: Permission does not comply with the rules in permission descriptor of the service of the contract.\n"},"401":{"description":"* 401420 - Not enough privileges to add or remove permissions.\n* 401415 - Not enough privileges to add or remove permissions.\n* 401420: Not enough privileges for the requesting client to share the requested resources.\n"},"403":{"description":"* 403102: Sharing is not enabled.\n* 403103: This action cannot be shared.\n"},"404":{"description":"An error has occurred.\n* 404780: No authorization group exists with the given Id.\n* 404700: No contract exists with the given Id.\n"},"422":{"description":"A defined system limit would be violated if this action was\ncompleted.\n\nExample: 'MaxPermissionsPerEntity limit reached. Current value: 1000. Maximum value: 1000'\n\n* 422000 - LimitReached\n"},"default":{"description":"An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/permissions":{"delete":{"operationId":"Here Account v1 APIs removePermissionsByResource","summary":"Removes all permissions identified by resource and id pair.","description":"Used to remove permissions from an user, app or group.\n\nThis API works only with tokens that are not scoped to a project.","tags":["Authorization Share"],"responses":{"204":{"description":"No Content"}},"parameters":[{"name":"hrn","required":true,"description":"Resource hrn","schema":{"type":"string"},"in":"query","x-example":"hrn:here:data::my-realm:example_catalog"},{"required":false,"description":"User ID","name":"userId","schema":{"type":"string"},"in":"query","x-example":"HERE-00000000-0000-0000-0000-000000000000"},{"required":false,"description":"Group ID","name":"groupId","schema":{"type":"string"},"in":"query","x-example":"GROUP-00000000-0000-0000-0000-000000000000"},{"required":false,"description":"App ID","name":"appId","schema":{"type":"string"},"in":"query"}]}}},"components":{"securitySchemes":{"Bearer":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Bearer Access Token issued to either the User or Application."}},"headers":{"XCorrelationId":{"schema":{"type":"string"},"required":false,"description":"The X-Correlation-ID for the request, used to track this request in the platform. X-Correlation-ID value is propagated throughout the platform."},"XRequestId":{"schema":{"type":"string"},"required":false,"description":"The unique id for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services."}},"schemas":{"ErrorResponse":{"type":"object","properties":{"errorId":{"type":"string","description":"Unique id for the error. This is searchable from HERE Account logs.","example":"ERROR-9d862c5a-4cfd-4780-8be4-2728b42849e1"},"httpStatus":{"type":"integer","description":"HTTP status code of the response","example":401},"errorCode":{"type":"integer","description":"Error code representing the specific error. If the 'errorFields' element is present, it will have precise error codes.\n","example":401300},"message":{"type":"string","description":"Descriptive message to help with development.  Note that the value of this field is **NOT** guaranteed to be consistent across releases and should **NOT** be coded against.\n","example":"Invalid client credentials."},"errorFields":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Name of the field that had an error. Will be blank in case the error was caused when comparing multiple fields.\n","example":"Received invalid data.  See json element 'errorFields' for more information."},"errorCode":{"type":"integer","description":"More detailed error code. Needs to be paired with 'errorFields.name' to get the exact error.\n","example":400201},"message":{"type":"string","description":"Descriptive message to help with development.  Note that the value of this field is **NOT** guaranteed to be consistent across releases and should **NOT** be coded against.\n","example":"This field is required."}}}}}},"ErrorMessage":{"type":"object","required":["title","status","code","cause","action","correlationId"],"example":{"title":"Input data failed validation","status":400,"code":"E110000","cause":"The input data in question does not meet validation rules","action":"Actionable instructions for the user.","correlationId":"6c1bce6d-d31f-4275-9d9f-6832d8ba2377"},"properties":{"title":{"type":"string","description":"Title of the error."},"status":{"type":"integer","minimum":0,"maximum":999,"description":"HTTP status code of error message."},"cause":{"type":"string","description":"The cause of the error."},"action":{"type":"string","description":"Actionable instructions for the user."},"correlationId":{"type":"string","description":"The Correlation ID for the request for tracking purposes."}}},"AuthorizationResponse":{"title":"AuthorizationResponse","type":"object","description":"User Information, including assigned roles and permissions.\n","properties":{"user":{"$ref":"#/components/schemas/User"},"roles":{"type":"array","items":{"$ref":"#/components/schemas/RoleResponse"}},"permissions":{"type":"array","items":{"$ref":"#/components/schemas/PermissionsResponse"}},"status":{"type":"string","description":"The status of this authorization.\n","enum":["created","invited","active","inactive"],"example":"active"},"creatorUserId":{"type":"string","description":"The unique identifier of the user that created the authorization.\n","example":"HERE-1fc4a1dc-0deb-11e5-a6c0-1697f925da21"},"creatorClientId":{"type":"string","description":"Client ID from which the authorization was created.\n","example":"bKmnBQVXCTxpP8A6Jp95a"},"createdTime":{"type":"integer","format":"int64","description":"Unix time (seconds) when the authorization was created.\n","example":1433142351},"updatedTime":{"type":"integer","format":"int64","description":"Unix time (seconds) when the authorization was last updated.\n","example":1433144884}}},"User":{"type":"object","properties":{"userId":{"type":"string","description":"The unique identifier of the user. Begins with AUTHINVITE if status is invited otherwise a HERE id.\n"},"realm":{"type":"string","description":"Realm of the user. Since v2.74.\n"},"email":{"type":"string","description":"Email address of the user. Present in all status states.\n"},"firstname":{"type":"string","description":"The first name of the user. Only present if status is active.\n"},"lastname":{"type":"string","description":"The last name of the user. Only present if status is active.\n"},"url":{"type":"string","description":"The url from the authorization invite for this user. Only present if status is invited.\n"},"clientData":{"type":"string","description":"The additional client data from the authorization invite for this user. Only present if status is invited.\n"},"hrn":{"type":"string","description":"HRN of the user.\n"}},"required":["userId","email"],"example":{"userId":"HERE-c184c17c-0deb-11e5-a6c0-1697f925ec7b","realm":"HERE","firstname":"Jack","lastname":"Sparrow","email":"jsparrow@example.com","url":"https://testUrl.com","clientdata":"Some Test Client Data","hrn":"hrn:here:account::HERE:user/HERE-c184c17c-0deb-11e5-a6c0-1697f925ec7b"}},"RoleResponse":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier of the role in the context of the user.  Begins with ROLE-\n"},"name":{"type":"string","description":"The Role the user has in EUM. Valid values are hereadmin, reseller, serviceseller, customermanager, contractmanager\n"},"value":{"type":"string","description":"For resellers, it's the customer ID of the customer they manage. For customer admins, it's the app ID of the app they administrate.\n"}},"required":["name"],"example":[{"id":"ROLE-3742ed97-e80f-4b80-9c2a-2f2ef02c7cce","name":"contractmanager","value":"CONTRACT-cfe1d66c-86fa-4212-8751-b5048e1489a0"},{"id":"ROLE-a16ecb4b-ad74-4636-9c3a-02f2925ac9e7","name":"reseller","value":"CUST-d4ffefb0-0e13-11e5-a6c0-169ec7b7f925"}]},"PermissionsResponse":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier of the permission in the context of the user.  Begins with PERM-\n"},"effect":{"type":"string","description":"Allow or Deny\n"},"action":{"type":"string","description":"The specific action identifier that this permission is controlling access to for the specific associated service.\n"},"resource":{"type":"string","description":"The resource identifier that this permission is controlling access to for the given action.  May identify multiple resources via wildcard syntax.\n"},"expiresAt":{"type":"string","format":"date-time","example":"2030-05-26T19:30:00Z","description":"The UTC time when the permission expires."},"serviceId":{"type":"string","description":"Identifies the service that this permission is associated with.\n"},"contractId":{"type":"string","description":"Identifies the contract, and therefore the customer and service that this permission is associated with.\n"},"customerId":{"type":"string","description":"Identifies the customer that this permission is associated with.\n"}},"example":[{"id":"PERM-5d595ef9-d081-4ea5-b404-4c7bd816aec6","effect":"allow","action":"share","resource":"hrn:here:datastore:::*","expiresAt":"2022-10-18T03:20:33.352Z","serviceId":"SERVICE-fe2fe02d-a16d-4dab-aacc-7605aa37294e","contractId":"CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b","customerId":"CUST-0e13ffb0-fd4e-1697-11e5-a6c0f925ec7b"},{"id":"PERM-a72ab4a6-09bf-4960-9617-186976256f77","effect":"allow","action":"create","serviceId":"SERVICE-fe2fe02d-a16d-4dab-aacc-7605aa37294e","contractId":"CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b","customerId":"CUST-0e13ffb0-fd4e-1697-11e5-a6c0f925ec7b"},{"id":"PERM-226aa70d-83f7-4c63-a9de-b99fa8bcb1a5","effect":"deny","action":"update","serviceId":"SERVICE-c425116a-03bf-40ce-9cef-7fa0ee122a65","contractId":"CONTRACT-77e05a82-f80b-4f85-ab03-69a8bb3830ce","customerId":"CUST-c34114a5-152f-4f82-b0ad-c90162471e95"}]},"NewPermissions":{"type":"object","required":["permissions"],"properties":{"permissions":{"type":"array","description":"List of permissions.","items":{"$ref":"#/components/schemas/NewPermission"}}}},"NewPermission":{"type":"object","properties":{"action":{"description":"The specific action identifier that this permission is controlling access to for the specific associated service.","type":"string","example":"read"},"effect":{"description":"One of \"allow\" or \"deny\"","type":"string","enum":["allow","deny"],"example":"allow"},"resource":{"description":"The resource identifier that this permission is controlling access to for the given action.  May identify multiple resources via regular expression syntax.","type":"string","example":"hrn:here:data::my-realm:service-catalog"},"serviceId":{"description":"Identifies the service that this permission is associated with. If \"share\" permission needs to be added, the service id should equal to \"authorization\".","type":"string"}},"required":["action","effect"]},"AppAuthorizationResponse":{"type":"object","description":"App authorization information.\n","properties":{"app":{"$ref":"#/components/schemas/App"},"permissions":{"type":"array","items":{"$ref":"#/components/schemas/PermissionsResponse"}},"policies":{"type":"array","items":{"$ref":"#/components/schemas/PolicyLink"},"example":[{"id":"POLICYLINK-8d4dc5c1-bc0d-4b67-b90d-3b88d46013e0","policyId":"POLICY-99b7c7d7-867a-4573-8730-4689be1718c9","contractId":"CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b"}]},"plans":{"type":"array","description":"Policy contracts for each policy in the plan\n","items":{"$ref":"#/components/schemas/PlanLink"}}}},"App":{"type":"object","properties":{"clientId":{"type":"string","description":"Identifier for the client/application. If provided, identifier should be present and active in Druid\n"},"name":{"type":"string","description":"Human readable name of the client.  This field is required unless a clientId is provided\n"},"description":{"type":"string","description":"Prose description of the client\n"},"status":{"type":"string","description":"Current status of the application.\n"},"hrn":{"type":"string","description":"HRN of the application.\n"},"realm":{"type":"string","description":"realm of the application.\n"}},"example":{"clientId":"DdcIHVVKuMvTQrdci1FW","name":"My Third Party App","description":"This is a longer description of My Third Party App.","status":"active","hrn":"hrn:here:account::HERE:app/DdcIHVVKuMvTQrdci1FW"}},"PolicyLink":{"type":"object","properties":{"id":{"type":"string"},"policyId":{"type":"string"},"contractId":{"type":"string"},"serviceId":{"type":"string"},"allowUpdates":{"type":"boolean"}}},"PlanLink":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier of the linked plan.\n","example":"PLANLINK-d5e0f0ca-d122-4810-88a5-08fcade9e2d9"},"planId":{"type":"string","description":"Identifies the plan that this attachment is associated with.\n","example":"PLAN-348e6490-8c6a-4528-83de-0a00692c4a7c"},"policies":{"type":"array","items":{"$ref":"#/components/schemas/Policy"},"description":"Policy contracts for each policy in the plan.\n"},"allowUpdates":{"type":"boolean","description":"Identifies if plan is mutable","example":true}},"required":["id","planId"]},"Policy":{"type":"object","properties":{"policyId":{"type":"string","example":null,"description":"Identifies the policy that is being attached to the client\n"},"contractId":{"type":"string","description":"Identifies the contract that the permissions from the policy will be associated with.  This is required if the policy is a service scoped policy for a service that requires contracts.\n"}},"required":["policyId"],"example":[{"policyId":"POLICY-e5e07c82-d6b5-417a-b180-076508a3a61d","contractId":"CONTRACT-f7d85359-3df9-47c2-8808-836cfb5ef258"},{"policyId":"POLICY-99b7c7d7-867a-4573-8730-4689be1718c9","contractId":"CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b"}]},"GroupPermissions":{"type":"object","properties":{"name":{"type":"string","description":"A user defined name for the group. \n\nThe following characters are not allowed in the group name: control characters, non-breaking space, and * / < > \\  |\n"},"customerId":{"type":"string","description":"Identifies the customer that this group is associated with."},"ownerId":{"type":"string","description":"Identifies the owner id for the group."},"scope":{"type":"string","description":"Identifies the scope of the group."},"permissions":{"type":"array","items":{"$ref":"#/components/schemas/Permission"}},"policies":{"type":"array","items":{"$ref":"#/components/schemas/PolicyLink"}},"description":{"type":"string","maxLength":500,"description":"An optional user defined description for the group. \n\nThe following characters are not allowed in the group name: control\\ncharacters, non-breaking space, and * / < > \\\\  |\n"}},"example":{"id":"GROUP-99b7c7d7-867a-4573-8730-4689be1718c9","name":"Power Users","customerId":"CUST-7afd7f8e-94eb-4844-ba45-38e259fbbd04","ownerId":"CUST-7afd7f8e-94eb-4844-ba45-38e259fbbd04","scope":"customer","permissions":[{"id":"PERM-5d595ef9-d081-4ea5-b404-4c7bd816aec6","effect":"allow","action":"share","resource":"hrn:here:datastore:::*","serviceId":"SERVICE-fe2fe02d-a16d-4dab-aacc-7605aa37294e","contractId":"CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b","customerId":"CUST-7afd7f8e-94eb-4844-ba45-38e259fbbd04"},{"id":"PERM-226aa70d-83f7-4c63-a9de-b99fa8bcb1a5","effect":"deny","action":"update","serviceId":"SERVICE-c425116a-03bf-40ce-9cef-7fa0ee122a65","contractId":"CONTRACT-77e05a82-f80b-4f85-ab03-69a8bb3830ce","customerId":"CUST-7afd7f8e-94eb-4844-ba45-38e259fbbd04"}],"policies":[{"id":"POLICYLINK-8d4dc5c1-bc0d-4b67-b90d-3b88d46013e0","policyId":"POLICY-99b7c7d7-867a-4573-8730-4689be1718c9","contractId":"CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b"}]}},"Permission":{"type":"object","properties":{"id":{"type":"string"},"serviceId":{"type":"string"},"contractId":{"type":"string"},"customerId":{"type":"string"},"resource":{"type":"string"},"action":{"type":"string"},"effect":{"type":"string"}}},"PermissionsListPageToken":{"type":"object","description":"Permissions list response.","properties":{"total":{"type":"integer","description":"The total number of records that match the search criteria.","example":10},"count":{"type":"integer","description":"The number of records returned.","example":3},"pageToken":{"type":"string","description":"The page token used for pagination.","example":"7afd7f8e94eb4844ba45"},"data":{"type":"array","description":"List of Permissions","items":{"$ref":"#/components/schemas/PermissionsResponse"}}}}},"parameters":{"userId":{"in":"path","name":"userId","required":true,"description":"The user identifier","schema":{"type":"string"}},"appId":{"in":"path","name":"appId","required":true,"description":"The app identifier","schema":{"type":"string"}},"groupId":{"in":"path","name":"groupId","required":true,"description":"The group identifier","schema":{"type":"string"}},"includeAllPermissionsOrNoneParam":{"name":"includeAllPermissions","required":false,"in":"query","description":"If true, include the permissions associated with the\nuser inline in the response.  Otherwise, omit the permissions\nattribute from the response.\n","schema":{"type":"boolean","default":true}},"countParam":{"in":"query","name":"count","schema":{"type":"integer"},"description":"The number of records to be returned. Defaults to 100."},"pageTokenParam":{"in":"query","name":"pageToken","schema":{"type":"string"},"description":"The pageToken to be used for search.  If omitted, the first\npage is returned.\n"}}}}