openapi: 3.2.0 info: title: Here Account v1 Authorization Share API version: 1.1.x description: This specification describes the Here Account v1 APIs servers: - url: https://account.api.here.com security: - Bearer: [] tags: - name: Authorization Share paths: /user/{userId}/authorization/share/permissions: post: tags: - Authorization Share summary: Share permissions to a user operationId: Here Account v1 APIs shareUserAuthorization description: 'Share permissions to a user. This API works only with tokens that are not scoped to a project. Access Control: * Requires the calling principal to have the following permission: * action: share * serviceId: authorization * resource: {resourceHrn}' parameters: - $ref: '#/components/parameters/userId' requestBody: content: application/json: schema: $ref: '#/components/schemas/NewPermissions' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AuthorizationResponse' '400': description: "* 400200 - Received invalid data. See 'errorFields' for more information.\n * errorFields.errorCode 400240 - Invalid email\n * errorFields.errorCode 400297 - Unsupported roles.name\n * errorFields.errorCode 400203 - Invalid action\n * errorFields.errorCode 400288 - Invalid resource. Invalid HERE Resource Name format\n * errorFields.errorCode 400294 - Invalid effect. Valid values are allow and deny\n* 400322 - Not enough privileges for the requesting client to share the requested resources\n" '401': description: '* 401420 - Not enough privileges for the requesting client to share the requested resources ' '403': description: '* 403102 - Sharing is not enabled * 403103 - This action cannot be shared ' '404': description: '* 404600 - Authorization record is not found ' '422': description: 'A defined system limit would be violated if this action was completed. Example: ''MaxPermissionsPerEntity limit reached. Current value: 1000. Maximum value: 1000'' * 422000 - LimitReached ' default: description: "An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n" content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' /app/{appId}/authorization/share/permissions: post: tags: - Authorization Share summary: Share permissions to an application operationId: Here Account v1 APIs shareAppAuthorization description: 'Share permissions to an application. This API works only with tokens that are not scoped to a project. Access Control: * Requires the calling principal to have the following permission: * action: share * serviceId: authorization * resource: {resourceHrn}' parameters: - $ref: '#/components/parameters/appId' requestBody: content: application/json: schema: $ref: '#/components/schemas/NewPermissions' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AppAuthorizationResponse' '400': description: '* 400299 - Invalid permission format * 400322 - Not enough privileges for the requesting client to share the requested resources * 400409 - Service definition requires Contract Id to be provided * 404610 - No service descriptor record exists for given Id * 404700 - No contract exists with the given Id ' '401': description: '* 401420 - Not enough privileges for the requesting client to share the requested resources ' '403': description: '* 403102 - Sharing is not enabled * 403103 - This action cannot be shared ' '404': description: '* 404660 - No app exists with that given id ' '422': description: 'A defined system limit would be violated if this action was completed. Example: ''MaxPermissionsPerEntity limit reached. Current value: 1000. Maximum value: 1000'' * 422000 - LimitReached ' default: description: "An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n" content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' /group/{groupId}/authorization/share/permissions: post: tags: - Authorization Share summary: Share permissions to a group operationId: Here Account v1 APIs shareGroupAuthorization description: 'Share permissions to a group. This API works only with tokens that are not scoped to a project. Access Control: * Requires the calling principal to have the following permission: * action: share * serviceId: authorization * resource: {resourceHrn}' parameters: - $ref: '#/components/parameters/groupId' requestBody: content: application/json: schema: $ref: '#/components/schemas/NewPermissions' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/GroupPermissions' '400': description: '* 400299: Invalid permission format. * 404610: No service descriptor record exists for given Id. * 400284: Contract of the requested permission does not belong to the customer of the group. * 400407: Permission request may only contain either contractId or serviceId, but not both. * 400294: Illegal effect. Valid values are allow and deny. * 400288: Invalid HERE Resource name format. * 400406: Permission does not comply with the rules in permission descriptor of the service of the contract. ' '401': description: '* 401420 - Not enough privileges to add or remove permissions. * 401415 - Not enough privileges to add or remove permissions. * 401420: Not enough privileges for the requesting client to share the requested resources. ' '403': description: '* 403102: Sharing is not enabled. * 403103: This action cannot be shared. ' '404': description: 'An error has occurred. * 404780: No authorization group exists with the given Id. * 404700: No contract exists with the given Id. ' '422': description: 'A defined system limit would be violated if this action was completed. Example: ''MaxPermissionsPerEntity limit reached. Current value: 1000. Maximum value: 1000'' * 422000 - LimitReached ' default: description: "An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n" content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' /permissions: delete: operationId: Here Account v1 APIs removePermissionsByResource summary: Removes all permissions identified by resource and id pair description: 'Used to remove permissions from an user, app or group. This API works only with tokens that are not scoped to a project.' tags: - Authorization Share responses: '204': description: No Content parameters: - name: hrn required: true description: Resource hrn schema: type: string in: query x-example: hrn:here:data::my-realm:example_catalog - required: false description: User ID name: userId schema: type: string in: query x-example: HERE-00000000-0000-0000-0000-000000000000 - required: false description: Group ID name: groupId schema: type: string in: query x-example: GROUP-00000000-0000-0000-0000-000000000000 - required: false description: App ID name: appId schema: type: string in: query components: schemas: Policy: type: object properties: policyId: type: string example: null description: 'Identifies the policy that is being attached to the client ' contractId: type: string description: 'Identifies the contract that the permissions from the policy will be associated with. This is required if the policy is a service scoped policy for a service that requires contracts. ' required: - policyId example: - policyId: POLICY-e5e07c82-d6b5-417a-b180-076508a3a61d contractId: CONTRACT-f7d85359-3df9-47c2-8808-836cfb5ef258 - policyId: POLICY-99b7c7d7-867a-4573-8730-4689be1718c9 contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b PolicyLink: type: object properties: id: type: string policyId: type: string contractId: type: string serviceId: type: string allowUpdates: type: boolean App: type: object properties: clientId: type: string description: 'Identifier for the client/application. If provided, identifier should be present and active in Druid ' name: type: string description: 'Human readable name of the client. This field is required unless a clientId is provided ' description: type: string description: 'Prose description of the client ' status: type: string description: 'Current status of the application. ' hrn: type: string description: 'HRN of the application. ' realm: type: string description: 'realm of the application. ' example: clientId: DdcIHVVKuMvTQrdci1FW name: My Third Party App description: This is a longer description of My Third Party App. status: active hrn: hrn:here:account::HERE:app/DdcIHVVKuMvTQrdci1FW PlanLink: type: object properties: id: type: string description: 'The unique identifier of the linked plan. ' example: PLANLINK-d5e0f0ca-d122-4810-88a5-08fcade9e2d9 planId: type: string description: 'Identifies the plan that this attachment is associated with. ' example: PLAN-348e6490-8c6a-4528-83de-0a00692c4a7c policies: type: array items: $ref: '#/components/schemas/Policy' description: 'Policy contracts for each policy in the plan. ' allowUpdates: type: boolean description: Identifies if plan is mutable example: true required: - id - planId NewPermission: type: object properties: action: description: The specific action identifier that this permission is controlling access to for the specific associated service. type: string example: read effect: description: One of "allow" or "deny" type: string enum: - allow - deny example: allow resource: description: The resource identifier that this permission is controlling access to for the given action. May identify multiple resources via regular expression syntax. type: string example: hrn:here:data::my-realm:service-catalog serviceId: description: Identifies the service that this permission is associated with. If "share" permission needs to be added, the service id should equal to "authorization". type: string required: - action - effect RoleResponse: type: object properties: id: type: string description: 'The unique identifier of the role in the context of the user. Begins with ROLE- ' name: type: string description: 'The Role the user has in EUM. Valid values are hereadmin, reseller, serviceseller, customermanager, contractmanager ' value: type: string description: 'For resellers, it''s the customer ID of the customer they manage. For customer admins, it''s the app ID of the app they administrate. ' required: - name example: - id: ROLE-3742ed97-e80f-4b80-9c2a-2f2ef02c7cce name: contractmanager value: CONTRACT-cfe1d66c-86fa-4212-8751-b5048e1489a0 - id: ROLE-a16ecb4b-ad74-4636-9c3a-02f2925ac9e7 name: reseller value: CUST-d4ffefb0-0e13-11e5-a6c0-169ec7b7f925 AuthorizationResponse: title: AuthorizationResponse type: object description: 'User Information, including assigned roles and permissions. ' properties: user: $ref: '#/components/schemas/User' roles: type: array items: $ref: '#/components/schemas/RoleResponse' permissions: type: array items: $ref: '#/components/schemas/PermissionsResponse' status: type: string description: 'The status of this authorization. ' enum: - created - invited - active - inactive example: active creatorUserId: type: string description: 'The unique identifier of the user that created the authorization. ' example: HERE-1fc4a1dc-0deb-11e5-a6c0-1697f925da21 creatorClientId: type: string description: 'Client ID from which the authorization was created. ' example: bKmnBQVXCTxpP8A6Jp95a createdTime: type: integer format: int64 description: 'Unix time (seconds) when the authorization was created. ' example: 1433142351 updatedTime: type: integer format: int64 description: 'Unix time (seconds) when the authorization was last updated. ' example: 1433144884 Permission: type: object properties: id: type: string serviceId: type: string contractId: type: string customerId: type: string resource: type: string action: type: string effect: type: string User: type: object properties: userId: type: string description: 'The unique identifier of the user. Begins with AUTHINVITE if status is invited otherwise a HERE id. ' realm: type: string description: 'Realm of the user. Since v2.74. ' email: type: string description: 'Email address of the user. Present in all status states. ' firstname: type: string description: 'The first name of the user. Only present if status is active. ' lastname: type: string description: 'The last name of the user. Only present if status is active. ' url: type: string description: 'The url from the authorization invite for this user. Only present if status is invited. ' clientData: type: string description: 'The additional client data from the authorization invite for this user. Only present if status is invited. ' hrn: type: string description: 'HRN of the user. ' required: - userId - email example: userId: HERE-c184c17c-0deb-11e5-a6c0-1697f925ec7b realm: HERE firstname: Jack lastname: Sparrow email: jsparrow@example.com url: https://testUrl.com clientdata: Some Test Client Data hrn: hrn:here:account::HERE:user/HERE-c184c17c-0deb-11e5-a6c0-1697f925ec7b GroupPermissions: type: object properties: name: type: string description: "A user defined name for the group. \n\nThe following characters are not allowed in the group name: control characters, non-breaking space, and * / < > \\ |\n" customerId: type: string description: Identifies the customer that this group is associated with. ownerId: type: string description: Identifies the owner id for the group. scope: type: string description: Identifies the scope of the group. permissions: type: array items: $ref: '#/components/schemas/Permission' policies: type: array items: $ref: '#/components/schemas/PolicyLink' description: type: string maxLength: 500 description: "An optional user defined description for the group. \n\nThe following characters are not allowed in the group name: control\\ncharacters, non-breaking space, and * / < > \\\\ |\n" example: id: GROUP-99b7c7d7-867a-4573-8730-4689be1718c9 name: Power Users customerId: CUST-7afd7f8e-94eb-4844-ba45-38e259fbbd04 ownerId: CUST-7afd7f8e-94eb-4844-ba45-38e259fbbd04 scope: customer permissions: - id: PERM-5d595ef9-d081-4ea5-b404-4c7bd816aec6 effect: allow action: share resource: hrn:here:datastore:::* serviceId: SERVICE-fe2fe02d-a16d-4dab-aacc-7605aa37294e contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b customerId: CUST-7afd7f8e-94eb-4844-ba45-38e259fbbd04 - id: PERM-226aa70d-83f7-4c63-a9de-b99fa8bcb1a5 effect: deny action: update serviceId: SERVICE-c425116a-03bf-40ce-9cef-7fa0ee122a65 contractId: CONTRACT-77e05a82-f80b-4f85-ab03-69a8bb3830ce customerId: CUST-7afd7f8e-94eb-4844-ba45-38e259fbbd04 policies: - id: POLICYLINK-8d4dc5c1-bc0d-4b67-b90d-3b88d46013e0 policyId: POLICY-99b7c7d7-867a-4573-8730-4689be1718c9 contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b NewPermissions: type: object required: - permissions properties: permissions: type: array description: List of permissions. items: $ref: '#/components/schemas/NewPermission' PermissionsResponse: type: object properties: id: type: string description: 'The unique identifier of the permission in the context of the user. Begins with PERM- ' effect: type: string description: 'Allow or Deny ' action: type: string description: 'The specific action identifier that this permission is controlling access to for the specific associated service. ' resource: type: string description: 'The resource identifier that this permission is controlling access to for the given action. May identify multiple resources via wildcard syntax. ' expiresAt: type: string format: date-time example: '2030-05-26T19:30:00Z' description: The UTC time when the permission expires. serviceId: type: string description: 'Identifies the service that this permission is associated with. ' contractId: type: string description: 'Identifies the contract, and therefore the customer and service that this permission is associated with. ' customerId: type: string description: 'Identifies the customer that this permission is associated with. ' example: - id: PERM-5d595ef9-d081-4ea5-b404-4c7bd816aec6 effect: allow action: share resource: hrn:here:datastore:::* expiresAt: '2022-10-18T03:20:33.352Z' serviceId: SERVICE-fe2fe02d-a16d-4dab-aacc-7605aa37294e contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b customerId: CUST-0e13ffb0-fd4e-1697-11e5-a6c0f925ec7b - id: PERM-a72ab4a6-09bf-4960-9617-186976256f77 effect: allow action: create serviceId: SERVICE-fe2fe02d-a16d-4dab-aacc-7605aa37294e contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b customerId: CUST-0e13ffb0-fd4e-1697-11e5-a6c0f925ec7b - id: PERM-226aa70d-83f7-4c63-a9de-b99fa8bcb1a5 effect: deny action: update serviceId: SERVICE-c425116a-03bf-40ce-9cef-7fa0ee122a65 contractId: CONTRACT-77e05a82-f80b-4f85-ab03-69a8bb3830ce customerId: CUST-c34114a5-152f-4f82-b0ad-c90162471e95 ErrorResponse: type: object properties: errorId: type: string description: Unique id for the error. This is searchable from HERE Account logs. example: ERROR-9d862c5a-4cfd-4780-8be4-2728b42849e1 httpStatus: type: integer description: HTTP status code of the response example: 401 errorCode: type: integer description: 'Error code representing the specific error. If the ''errorFields'' element is present, it will have precise error codes. ' example: 401300 message: type: string description: 'Descriptive message to help with development. Note that the value of this field is **NOT** guaranteed to be consistent across releases and should **NOT** be coded against. ' example: Invalid client credentials. errorFields: type: array items: type: object properties: name: type: string description: 'Name of the field that had an error. Will be blank in case the error was caused when comparing multiple fields. ' example: Received invalid data. See json element 'errorFields' for more information. errorCode: type: integer description: 'More detailed error code. Needs to be paired with ''errorFields.name'' to get the exact error. ' example: 400201 message: type: string description: 'Descriptive message to help with development. Note that the value of this field is **NOT** guaranteed to be consistent across releases and should **NOT** be coded against. ' example: This field is required. AppAuthorizationResponse: type: object description: 'App authorization information. ' properties: app: $ref: '#/components/schemas/App' permissions: type: array items: $ref: '#/components/schemas/PermissionsResponse' policies: type: array items: $ref: '#/components/schemas/PolicyLink' example: - id: POLICYLINK-8d4dc5c1-bc0d-4b67-b90d-3b88d46013e0 policyId: POLICY-99b7c7d7-867a-4573-8730-4689be1718c9 contractId: CONTRACT-82d1957f-f2a4-4188-a8dd-d35afb4a710b plans: type: array description: 'Policy contracts for each policy in the plan ' items: $ref: '#/components/schemas/PlanLink' parameters: userId: in: path name: userId required: true description: The user identifier schema: type: string appId: in: path name: appId required: true description: The app identifier schema: type: string groupId: in: path name: groupId required: true description: The group identifier schema: type: string securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Bearer Access Token issued to either the User or Application. externalDocs: description: The developer guide and related API references are available here. url: https://www.here.com/docs/category/identity-and-access-management