openapi: 3.0.0
info:
  title: AI Service Actions Auth API
  version: 1.0.0
  contact:
    email: devel@keboola.com
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
  description: Authentication, account confirmation and MFA.
tags:
- name: Auth
  description: Authentication, account confirmation and MFA.
paths:
  /auth/signup:
    post:
      tags:
      - Auth
      summary: Create account
      description: 'Anyone can create an account but must belong to a vendor to manage apps.

        '
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              - email
              - password
              properties:
                name:
                  type: string
                email:
                  type: string
                  format: email
                password:
                  type: string
                  description: 'At least 8 characters with one lowercase, one uppercase and one number; no whitespace.

                    '
            example:
              name: John Doe
              email: john@keboola.com
              password: superSecret1
      responses:
        '201':
          description: Account created
  /auth/confirm/{email}/{code}:
    post:
      tags:
      - Auth
      summary: Confirm account
      description: 'Account needs to be confirmed by a code from the confirmation email sent to the user''s email address.

        '
      security: []
      parameters:
      - name: email
        in: path
        required: true
        schema:
          type: string
      - name: code
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Account confirmed
    get:
      tags:
      - Auth
      summary: Confirm account (browser)
      description: 'Confirmation link from the email for browser-based confirmation flows; returns an HTML page.

        '
      security: []
      parameters:
      - name: email
        in: path
        required: true
        schema:
          type: string
      - name: code
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: HTML confirmation page
          content:
            text/html:
              schema:
                type: string
  /auth/confirm:
    post:
      tags:
      - Auth
      summary: Resend confirmation code
      description: Resends the account confirmation email.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - email
              - password
              properties:
                email:
                  type: string
                  format: email
                password:
                  type: string
            example:
              email: john@keboola.com
              password: superSecret
      responses:
        '204':
          description: Confirmation code resent
  /auth/login:
    post:
      tags:
      - Auth
      summary: Login
      description: 'Login returns three different tokens: `token` (auth, 1 hour), `accessToken` (MFA / logout, 1 hour), and `refreshToken` (30 days). If your account has active MFA, first call returns `session` which is used in a second call along with the MFA code.

        '
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - email
              properties:
                email:
                  type: string
                  format: email
                password:
                  type: string
                  description: Use in the first step (before MFA).
                session:
                  type: string
                  description: Use in the second step (MFA).
                code:
                  type: string
                  description: MFA code, use in the second step.
                challenge:
                  type: string
                  enum:
                  - SMS_MFA
                  - SOFTWARE_TOKEN_MFA
                  default: SMS_MFA
                  description: MFA challenge type, use in the second step.
            examples:
              password_login:
                summary: Login with password
                value:
                  email: john@keboola.com
                  password: superSecret
              mfa_step2:
                summary: Login with MFA code
                value:
                  email: john@keboola.com
                  code: '123456'
                  session: '{session}'
      responses:
        '200':
          description: Login successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
                  accessToken:
                    type: string
                  refreshToken:
                    type: string
                  session:
                    type: string
                  expiresIn:
                    type: integer
  /auth/logout:
    post:
      tags:
      - Auth
      summary: Logout
      description: Invalidates all active access and refresh tokens.
      responses:
        '204':
          description: Logged out
  /auth/token:
    get:
      tags:
      - Auth
      summary: Refresh token
      description: 'Returns fresh auth token and access token in exchange for refresh token received on login.

        '
      responses:
        '200':
          description: Token refreshed
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
                  accessToken:
                    type: string
                  expiresIn:
                    type: integer
              example:
                token: '{your token}'
                accessToken: '{your token}'
                expiresIn: 3600
  /auth/profile:
    get:
      tags:
      - Auth
      summary: Get user profile
      description: 'Returns the current user''s profile. Note that `isMfaEnabled` is deprecated; use `mfa` instead. Property `mfa` can contain values `SOFTWARE_TOKEN_MFA`, `SMS_MFA` and `false`.

        '
      responses:
        '200':
          description: User profile
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
              example:
                email: john@keboola.com
                name: John Doe
                vendors:
                - keboola
                isAdmin: false
                isMfaEnabled: true
                mfa: SOFTWARE_TOKEN_MFA
  /auth/forgot/{email}:
    post:
      tags:
      - Auth
      summary: Reset password
      description: Sends email with confirmation code for password reset.
      security: []
      parameters:
      - name: email
        in: path
        required: true
        schema:
          type: string
          format: email
      responses:
        '204':
          description: Password reset email sent
  /auth/forgot/{email}/confirm:
    post:
      tags:
      - Auth
      summary: Forgot password confirmation
      description: Confirms password reset using the code from the email.
      security: []
      parameters:
      - name: email
        in: path
        required: true
        schema:
          type: string
          format: email
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - password
              - code
              properties:
                password:
                  type: string
                code:
                  type: string
            example:
              code: your code from email
              password: new password
      responses:
        '204':
          description: Password reset confirmed
  /auth/mfa:
    post:
      tags:
      - Auth
      summary: Enable Software MFA
      description: 'Enable login using TOTP software token MFA. Returns secret code to enter into a TOTP-generating app such as Google Authenticator.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                accessToken:
                  type: string
                  description: Access token from login call
            example:
              accessToken: xxxyyy
      responses:
        '200':
          description: MFA secret code
          content:
            application/json:
              schema:
                type: object
                properties:
                  secretCode:
                    type: string
              example:
                secretCode: xxx
  /auth/mfa/confirm:
    post:
      tags:
      - Auth
      summary: Confirm Software MFA
      description: Confirm multi-factor authentication using code from your TOTP app.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - accessToken
              - code
              properties:
                accessToken:
                  type: string
                  description: Access token from login call
                code:
                  type: string
                  description: Code from your TOTP app
            example:
              accessToken: xxxyyy
              code: '123456'
      responses:
        '200':
          description: MFA confirmed
components:
  schemas:
    User:
      type: object
      additionalProperties: true
      properties:
        name:
          type: string
        email:
          type: string
          format: email
        vendors:
          type: array
          items:
            type: string
        isAdmin:
          type: boolean
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-StorageApi-Token