openapi: 3.0.3
info:
  title: Mastercard Developer Hub for FDX APIs FDX Authorization Server Application Check Controller Non PAR Authorize API
  version: 1.0.0
  description: Dynamic Client Registration, Token, Introspection, Authorize API
  contact:
    name: API Support
    email: apisupport@mastercard.com
    url: https://developer.mastercard.com/support
servers:
- url: http://localhost:8080
  description: Localhost URL
tags:
- name: Non PAR Authorize
  description: '[https://datatracker.ietf.org/doc/html/rfc6749](https://datatracker.ietf.org/doc/html/rfc6749)'
paths:
  /oauth2/authorize:
    get:
      tags:
      - Non PAR Authorize
      summary: Mastercard Developer Hub for FDX APIs User Authorization Endpoint
      description: This endpoint allows users to authorize a client application to access their resources. It returns an authorization code or token based on the grant type and flow. (Don't hit copy the url from curl)
      operationId: parAuthorizeDonTHitCopyTheUrlFromCurl
      parameters:
      - $ref: '#/components/parameters/clientIdQuery'
      - $ref: '#/components/parameters/ResponseType'
      - $ref: '#/components/parameters/CodeChallenge'
      - $ref: '#/components/parameters/CodeChallengeMethod'
      - $ref: '#/components/parameters/RequestUri'
      - $ref: '#/components/parameters/Scope'
      - $ref: '#/components/parameters/RedirectUri'
      - $ref: '#/components/parameters/RequestJWT'
      - $ref: '#/components/parameters/State'
      responses:
        '200':
          $ref: '#/components/responses/AuthorizeURL'
components:
  parameters:
    State:
      name: state
      in: query
      schema:
        type: string
        example: state
      description: A client generated value used to maintain state between the request and callback to prevent CSRF attacks.
    RequestJWT:
      name: request
      in: query
      schema:
        type: string
        example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
      description: JWT request object for non par flow
    Scope:
      name: scope
      in: query
      schema:
        type: string
        example: fdx:transactions:read%20fdx:accountbasic:read%20openid%20fdx:customerpersonal:read%20fdx:accountdetailed:read%20fdx:investments:read%20fdx:paymentsupport:read%20fdx:accountpayments:read%20fdx:bills:read%20fdx:images:read%20fdx:rewards:read%20fdx:tax:read%20fdx:statements:read%20fdx:customercontact:read
      description: The scope of access requested by the client. For example, `read` or `write`.
    RedirectUri:
      name: redirect_uri
      in: query
      schema:
        type: string
        example: https://oauth.pstmn.io/v1/browser callback
      description: The URI to which the authorization server will redirect the user after granting or denying access.
    CodeChallengeMethod:
      name: code_challenge_method
      in: query
      schema:
        type: string
        example: S256
      description: The method used to generate the code challenge (e.g., `plain` or `S256`).
    CodeChallenge:
      name: code_challenge
      in: query
      schema:
        type: string
        example: nZYZ UOfWV7Nkkll19ALM6mrcC7eXVWUMPYpQQ
      description: A code challenge used in the PKCE (Proof Key for Code Exchange) flow, if applicable.
    RequestUri:
      name: request_uri
      in: query
      schema:
        type: string
        example: urn:ietf:params:oauth2:61fa4c96 3f76 422e 83b4 00e4bad98549
      description: The URI generated from PAR endpoint.
    clientIdQuery:
      name: client_id
      in: query
      schema:
        type: string
        example: dh fdx client registrar 2
      description: The client identifier issued to the client during the registration process.
    ResponseType:
      name: response_type
      in: query
      schema:
        type: string
        example: code
      description: The type of response requested. `code` for an authorization code or `token` for an implicit token.
  responses:
    AuthorizeURL:
      description: This url will be launched by client for user authentication. No response applicable.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer