openapi: 3.1.0
info:
  title: Incognia Authentication API
  version: v2
  description: 'Incognia is a location identity and device fingerprinting platform for fraud prevention. The API returns real-time risk assessments (low_risk, high_risk, unknown_risk) for onboarding signups and authentication transactions (login and payment), and accepts feedback events used to continuously tune the risk model. Assessments combine device recognition signals, location behavior analysis, and tamper detection. Authentication uses OAuth 2.0 client credentials: a client_id and client_secret are exchanged at the token endpoint for a short-lived bearer access token.'
  contact:
    name: Incognia Developer Support
    url: https://developer.incognia.com/
  x-source: Faithfully reconstructed from the official Incognia Go client library (github.com/inloco/incognia-go) endpoints, request and response types. Not a provider-published OpenAPI.
servers:
- url: https://api.incognia.com/api
  description: Production
security:
- bearerAuth: []
tags:
- name: Authentication
  description: OAuth 2.0 client-credentials token exchange
paths:
  /v2/token:
    post:
      operationId: createToken
      tags:
      - Authentication
      summary: Create an access token
      description: Exchange client_id and client_secret (sent via HTTP Basic auth) for a short-lived OAuth 2.0 bearer access token using the client_credentials grant. Send Content-Type application/x-www-form-urlencoded.
      security:
      - basicAuth: []
      requestBody:
        required: false
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  example: client_credentials
      responses:
        '200':
          description: Access token issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessToken'
        '400':
          description: Missing credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Invalid credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Error:
      type: object
      description: Incognia error envelope.
      properties:
        message:
          type: string
          example: missing credentials
    AccessToken:
      type: object
      properties:
        access_token:
          type: string
        expires_in:
          type: string
          description: Token lifetime in seconds (string-encoded).
          example: '600'
        token_type:
          type: string
          example: Bearer
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: client_id and client_secret sent as HTTP Basic credentials to the token endpoint.
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 bearer access token obtained from POST /v2/token.
    oauth2:
      type: oauth2
      description: OAuth 2.0 client-credentials grant. No scopes are defined; access is scoped by the credential's tenant.
      flows:
        clientCredentials:
          tokenUrl: https://api.incognia.com/api/v2/token
          scopes: {}