openapi: 3.0.0
info:
  title: Kinde Management API Keys Connected Apps API
  version: '1'
  description: The Kinde Management API programmatically manages a Kinde business - users, organizations, roles, permissions, feature flags, applications, connections, APIs and scopes, subscribers, properties, webhooks, and billing. Base URL is subdomain-scoped to your business (https://{subdomain}.kinde.com/api/v1). Authenticated with a Bearer JWT access token obtained via the OAuth2 client_credentials flow from a machine-to-machine (M2M) application. This document is grounded in the official Kinde Management API specification (https://api-spec.kinde.com/kinde-management-api-spec.yaml).
  contact:
    name: Kinde Support Team
    email: support@kinde.com
    url: https://docs.kinde.com
  termsOfService: https://docs.kinde.com/trust-center/agreements/terms-of-service/
servers:
- url: https://{subdomain}.kinde.com
  variables:
    subdomain:
      default: your_kinde_subdomain
      description: The subdomain generated for your business on Kinde.
security:
- kindeBearerAuth: []
tags:
- name: Connected Apps
paths:
  /api/v1/connected_apps/auth_url:
    get:
      tags:
      - Connected Apps
      summary: Get Connected App URL
      operationId: GetConnectedAppAuthUrl
      description: "Get a URL that authenticates and authorizes a user to a third-party connected app.\n\n<div>\n  <code>read:connected_apps</code>\n</div>"
      parameters:
      - name: key_code_ref
        in: query
        required: true
        description: The unique key code reference of the connected app to authenticate against.
        schema:
          type: string
      - name: user_id
        in: query
        description: The id of the user that needs to authenticate to the third-party connected app.
        schema:
          type: string
      - name: org_code
        in: query
        description: The code of the Kinde organization that needs to authenticate to the third-party connected app.
        schema:
          type: string
      - name: override_callback_url
        in: query
        description: A URL that overrides the default callback URL setup in your connected app configuration
        schema:
          type: string
      responses:
        '200':
          description: OK
        '400':
          description: Bad request
        '403':
          description: Forbidden
        '429':
          description: Too many requests - rate limited
      security:
      - kindeBearerAuth: []
  /api/v1/connected_apps/token:
    get:
      tags:
      - Connected Apps
      summary: Get Connected App Token
      operationId: GetConnectedAppToken
      description: "Get an access token that can be used to call the third-party provider linked to the connected app.\n\n<div>\n  <code>read:connected_apps</code>\n</div>"
      parameters:
      - name: session_id
        in: query
        required: true
        description: The unique sesssion id representing the login session of a user.
        schema:
          type: string
      responses:
        '200':
          description: OK
        '400':
          description: Bad request
        '403':
          description: Forbidden
        '429':
          description: Too many requests - rate limited
      security:
      - kindeBearerAuth: []
  /api/v1/connected_apps/revoke:
    post:
      tags:
      - Connected Apps
      summary: Revoke Connected App Token
      operationId: RevokeConnectedAppToken
      description: "Revoke the tokens linked to the connected app session.\n\n<div>\n  <code>create:connected_apps</code>\n</div>"
      parameters:
      - name: session_id
        in: query
        required: true
        description: The unique sesssion id representing the login session of a user.
        schema:
          type: string
      responses:
        '200':
          description: OK
        '400':
          description: Bad request
        '403':
          description: Forbidden
        '429':
          description: Too many requests - rate limited
      security:
      - kindeBearerAuth: []
components:
  securitySchemes:
    kindeBearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Requires an access token obtained using the OAuth2 client_credentials flow from an authorized M2M application.