openapi: 3.2.0
info:
  title: Vault Authentication API
  version: 1.35.0
  x-logo:
    url: https://www.ledger.com/wp-content/themes/ledger-v2/public/images/ledger-logo-long.svg
  description: '

    # Authentication


    The Ledger Vault API offers several methods of authentication.

    Depending on your LAM configuration you''ll require several of the following headers

    to process API calls. Please refer to the

    [help center](https://help.vault.ledger.com/Content/api/api_overview.html) for more details.


    The `X-Ledger-API-User` header is required for all API calls to LAM

    (except when you register

    [API users on LAM](https://help.vault.ledger.com/Content/api/api_apiusers.html)).


    Note that the `X-Ledger-API-Key` authorization header can be used alongside the

    `X-Ledger-Store-Auth-Token` if both a LAM API key and HashiCorp Vault have

    been set up on your LAM.

    In this case, for every call made to LAM,

    you''ll need to pass all three headers

    `X-Ledger-API-User`, `X-Ledger-API-Key`, and `X-Ledger-Store-Auth-Token`.

    '
security:
- Ledger_API_User: []
- Ledger_API_User: []
  Ledger_API_Key: []
- Ledger_API_User: []
  Ledger_Store_Auth_Token: []
- Ledger_API_User: []
  Ledger_API_Key: []
  Ledger_Store_Auth_Token: []
tags:
- name: Authentication
paths:
  /auth/token:
    post:
      summary: Get JWT tokens
      tags:
      - Authentication
      description: Exchange API Key credentials for JWT tokens.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiAuthRequest'
        description: The authentication payload
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
          description: JWT tokens
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Unauthorized
  /auth/token/refresh:
    post:
      summary: Refresh JWT tokens
      tags:
      - Authentication
      description: Exchange refresh_token for JWT tokens.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RefreshJWTRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
          description: JWT tokens
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Unauthorized
components:
  schemas:
    Error:
      properties:
        message:
          type: string
        name:
          type: string
        status_code:
          type: integer
      required:
      - message
      - name
      - status_code
      type: object
    ApiAuthRequest:
      properties:
        api_key_id:
          description: The API Key ID of your API user
          example: 2khK02ZRc_TE9nYJyGIfIQ
          type: string
        api_key_secret:
          description: The API Key Secret of your API user
          example: jI0X2n55EHnNaZasmzfOL36wXx6b4D7Wmw-riZCeGWE
          type: string
      required:
      - api_key_id
      - api_key_secret
      type: object
    AuthResponse:
      properties:
        access_token:
          description: The JWT required to authenticate against our API
          type: string
        expires_in:
          description: The number of seconds this token is valid for
          example: 300
          type: integer
        refresh_token:
          description: The JWT used to get another access_token
          type: string
        session_state:
          description: The session ID related to this token
          type: string
        token_type:
          description: The type of authentication scheme
          example: Bearer
          type: string
      required:
      - access_token
      - expires_in
      - refresh_token
      - session_state
      - token_type
      type: object
    RefreshJWTRequest:
      properties:
        refresh_token:
          description: The refresh_token used to get new JWTs
          type: string
      required:
      - refresh_token
      type: object
  securitySchemes:
    Ledger_API_User:
      description: (**required**) Username of a registered API User
      in: header
      name: X-Ledger-API-User
      type: apiKey
    Ledger_API_Key:
      description: If you've set up your API Key when initializing your LAM, you'll need to include it as a header along with the api user header. For more details, [see step 5 of the get started documentation](https://help.vault.ledger.com/Content/api/api_getstarted.html).
      in: header
      name: X-Ledger-API-Key
      type: apiKey
    Ledger_Store_Auth_Token:
      description: If you've set up HashiCorp Vault as an authentication service, you'll need to pass the `X-Ledger-Store-Auth-Token` header along with the API user header. For more details see [how to set up HashiCorp Vault with the LAM](https://help.vault.ledger.com/Content/api/hashicorp_vault.html).
      in: header
      name: X-Ledger-Store-Auth-Token
      type: apiKey