swagger: '2.0'
info:
  title: Mastercard Bill Payment Validator Account Opening Share A  User  Identity API
  description: This service is provided on behalf of the Mastercard Remote Payment and Presentment (RPPS) Bill Payment Processing Network, which supports consumer to business "push" bill payments (i.e. those which are not funded by debit/credit card transactions) in the U.S.
  version: '1.0'
  x-artifactId: billpay-api
  contact:
    name: Bill Pay Development Support
    email: Bill_Pay_Development_Support@mastercard.com
host: sandbox.api.mastercard.com
basePath: /billpayAPI/v1
schemes:
- https
consumes:
- application/json
produces:
- application/json
tags:
- name: Share A  User  Identity
paths:
  /claims/scopes/{arid}:
    get:
      summary: Share an Identity with an External RP - Retrieve details of the scope request being made by an RP.
      tags:
      - Share A  User  Identity
      responses:
        '200':
          $ref: '#/components/responses/RPScopesSuccessResponse'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          $ref: '#/components/responses/NotFoundError'
      description: "Used to retrieve the scopes and RP details associated with the ARID. Does not require a minimum authentication standard.   \n**This API is mandatory.**\n"
      operationId: retrieveCSScopes
      parameters:
      - $ref: '#/components/parameters/AridParameter'
  /claims/user-consents:
    post:
      tags:
      - Share A  User  Identity
      responses:
        '200':
          $ref: '#/components/responses/UserConsentResponse'
        '400':
          $ref: '#/components/responses/BadRequestErrorClaimSharing'
        '404':
          $ref: '#/components/responses/NotFoundErrorClaimSharing'
      description: "Inform the Trust Party about the user consent. If the consent is given,\nthe identity attributes will be shared with Relying Party. Does not require a minimum authentication standard. \n**This API is mandatory.**\n"
      summary: Share an Identity with an External RP - Provide consent to share the identity attributes which satisfy an RPs scope request.
      operationId: getUserConsentStatus
      requestBody:
        $ref: '#/components/requestBodies/UserConsentRequest'
components:
  schemas:
    Locale:
      type: string
      description: IETF BCP 47 code which identifies the language to be used in any dialogs being shown to the user during the flow.  The default value is "en-US".
      pattern: ^[a-z]{2}-[a-zA-Z]{2}$
      example: en-US
    TpAuditMetadata:
      required:
      - sessionId
      - transactionGroupId
      type: object
      description: Object containing metadata related to the request.
      properties:
        sessionId:
          type: string
          description: UUID which uniquely identifies a set of transactions being executed within the same authentication session.
          pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
          minLength: 36
          maxLength: 36
          example: be3ad617-04ad-43e1-a438-79425b6511b6
        transactionGroupId:
          type: string
          description: UUID which uniquely identifies a set of transactions being executed within a single use-case.
          pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
          minLength: 36
          maxLength: 36
          example: be3ad617-04ad-43e1-a438-79425b6511b6
    RPScopes:
      required:
      - scopes
      - rpName
      - rpLogoUrl
      type: object
      properties:
        scopes:
          type: array
          items:
            type: string
            description: The list of scopes that have been requested.
            example: name:0:365
        rpName:
          type: string
          description: RP Name.
          minLength: 1
          maxLength: 255
          example: THISRP
        rpLogoUrl:
          type: string
          description: The URL of the logo of the RP.
          minLength: 1
          example: https://www.rpsite.com/logo.jpg
    PDS:
      type: string
      description: Encrypted Personal Device Storage (PDS) which hosts the users identity attributes. The PDS can be retrieved from the MIDS Core SDK, please refer to the SDK guide for details on how to retrieve this.
      pattern: ^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?$
      minLength: 1
      example: ZGZnZGVmZ2RnZGVnZXJnZXJncmRnZXJ5aGdld3J0eWJld3J5dHdleXd5d3l3cmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
    ErrorResponse:
      required:
      - Errors
      type: object
      description: The error response model used by all the API endpoints.
      properties:
        Errors:
          required:
          - Error
          type: object
          description: The error response model used by all the API endpoints.
          properties:
            Error:
              type: array
              description: A list of Error objects.
              minItems: 1
              items:
                type: object
                properties:
                  Source:
                    type: string
                    description: The source of the problem. That is where the error occurred.
                    example: mids
                  ReasonCode:
                    type: string
                    description: A code defining the error, as defined in documentation.
                    example: USER_PROFILE_ID_NOT_FOUND
                  Description:
                    type: string
                    description: A description of this specific occurrence of the Reason code.
                    example: The provided user profile ID does not exist.
                  Recoverable:
                    type: boolean
                    description: Whether or not retrying this request could result in a successful response.
                    example: false
                  Details:
                    type: string
                    description: More details of this specific error. This is an optional field and is sometimes used to give a more comprehensive description of the error that has occurred, when required.
                    example: User X was not found
                  redirectUri:
                    type: string
                    description: TP will use this URI to redirect to RP.
                    pattern: ^(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,})$
                    example: https://sample-rp-redirect-uri.com/?error=invalid_scope&state=AJahbadinvjbdvdnvljkdnvdfhsrbghrtiu4w&ARID=1234&error_description=claim_not_satisfied
    AuditEventsItem:
      type: object
      properties:
        dateTime:
          type: string
          description: Date and time at which the event is created.
          minLength: 1
          maxLength: 29
          example: '2020-01-28T13:16:01.714-05:00'
        softwareVersion:
          type: string
          description: Software version.
          minLength: 1
          maxLength: 30
          example: 1.0.0
        userProfileId:
          type: string
          description: UUID identifying the user, which the TP App generates using the MIDS Core SDK.
          pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
          example: df52649e-4096-456a-bca0-751ee470009f
        sessionId:
          type: string
          description: UUID which uniquely identifies a set of transactions being executed within the same authentication session.
          pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
          minLength: 36
          maxLength: 36
          example: 123ae1aa-6744-433e-879d-7da48d631234
        transactionGroupId:
          type: string
          description: UUID which uniquely identifies a set of transactions being executed within a single use-case.
          pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
          minLength: 36
          maxLength: 36
          example: 28eae1aa-6744-433e-879d-7da48d63e89a
        logRequestFlow:
          type: string
          description: Log Request Flow.
          minLength: 1
          maxLength: 255
          example: CoreSDK-TP
        logEvent:
          type: string
          description: Log Event.
          minLength: 0
          maxLength: 255
          example: ID Enrollment
        logEventType:
          type: string
          description: Log Event Type.
          minLength: 1
          maxLength: 255
          example: User Profile Creation
        osVersion:
          type: string
          description: OS version.
          minLength: 1
          maxLength: 255
          example: Android 5.0
        deviceMake:
          type: string
          description: Device make.
          minLength: 1
          maxLength: 255
          example: Samsung S10
        type:
          type: string
          description: Type of the event.
          minLength: 1
          maxLength: 255
          example: audit
        audit:
          type: object
          description: Represents the audit event.
          properties:
            privacyPolicy:
              type: string
              description: Version user confirmed.
              minLength: 1
              maxLength: 20
              example: 1.0.0
            userBiometricConsent:
              type: string
              description: User consent to capture details.
              enum:
              - 'TRUE'
              - 'FALSE'
              - NA
              minLength: 4
              maxLength: 5
              example: 'TRUE'
            event:
              type: string
              description: Event.
              minLength: 1
              maxLength: 255
              example: Document Scan
            eventType:
              type: string
              description: EventType.
              minLength: 1
              maxLength: 255
              example: Enrollment
            result:
              type: string
              description: API Call result.
              enum:
              - 'TRUE'
              - 'FALSE'
              - FAIL
              minLength: 4
              maxLength: 5
              example: 'TRUE'
            eventGeneratedSource:
              type: string
              description: Event generated source.
              minLength: 1
              maxLength: 50
              example: CoreSDK
            owner:
              type: string
              description: Owner.
              minLength: 2
              maxLength: 4
              example: TP
            requestDetails:
              type: object
              description: Request Details.
              example: Request URL
            responseDetails:
              type: object
              description: Response Details.
              example: Response Data
    RPClaimsUserConsentData:
      required:
      - flow
      - pds
      - rpSpecificIdentifier
      - redirectUri
      type: object
      properties:
        flow:
          type: string
          description: The user navigation flow for the RP Claim Sharing process.
          minLength: 1
          maxLength: 20
          example: APP2APP
        pds:
          $ref: '#/components/schemas/PDS'
        rpSpecificIdentifier:
          type: string
          description: The field rpSpecificIdentifier refers to a unique value for the Relying Party to identify the user for future reporting.
          minLength: 64
          maxLength: 64
          example: 46eb72430ffeca3daf31360264fa0424ba4facfdcb69c6f43e73063f290a75a8
        redirectUri:
          type: string
          description: TP will use this URI to redirect to RP.
          pattern: ^(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,})$
          minLength: 1
          example: https://sample-rp-redirect-uri.com/?error=invalid_scope&state=AJahbadinvjbdvdnvljkdnvdfhsrbghrtiu4w&ARID=1234&error_description=claim_not_satisfied
    SdkVersion:
      type: string
      description: Mastercard SDK version integrated with TP App, it is a constant extracted from MIDS SDK Configurations (generated while bundling SDK artifacts). If the TP app supports split PDS, this attribute MUST be specified.
      pattern: ^[0-9]{1,5}\.[0-9]{1,5}\.[0-9]{1,5}$
      minLength: 5
      maxLength: 255
      example: 2.3.0
    ARID:
      type: string
      description: A unique identifier for any activity being executed arising out of a Claim Share request. This value is passed as a parameter in the URL redirecting a User to the TP Flow during a Claim Share.
      format: uuid
      pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
      minLength: 36
      maxLength: 36
      example: a15fa6de-b199-11eb-8529-0242ac130003
    RPClaimsUserConsent:
      required:
      - arid
      - userConsent
      - pds
      type: object
      properties:
        arid:
          $ref: '#/components/schemas/ARID'
        userConsent:
          type: string
          enum:
          - ACCEPT
          - DECLINE
          pattern: ^(ACCEPT|DECLINE)$
          description: Confirmation provided by the TP that the user has consented that the ID-Network can have access to their identity for the purposes of the API call. Should be ACCEPT, a forbidden exception will be thrown if it is any other value.
          example: ACCEPT
        pds:
          $ref: '#/components/schemas/PDS'
        sdkAuditEvents:
          type: array
          description: Array of objects containing a record of any auditable steps occurring between the App and the SDK. A call must be made by the TP App from the MIDS Audit SDK prior to all API calls, with any audit events included in the subsequent call.
          items:
            $ref: '#/components/schemas/AuditEventsItem'
        tpAuditMetadata:
          $ref: '#/components/schemas/TpAuditMetadata'
        sdkVersion:
          $ref: '#/components/schemas/SdkVersion'
        locale:
          $ref: '#/components/schemas/Locale'
        countryCode:
          $ref: '#/components/schemas/CountryCode'
    CountryCode:
      type: string
      description: The country code of the country where the transaction originates from.
      pattern: ^[a-zA-Z]{2}$
      example: US
  examples:
    BadRequestARIDErrorExample:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: VALIDATION_ERROR
            Description: Invalid value null for ARID.
            Recoverable: false
            Details: Must not be null.
            redirectUri: https://sample-rp-redirect-uri.com?error=server_error&state=AJahbadinvjbdvdnvljkdnvdfhsrbghrtiu4w
    RPClaimsUserConsentDataSuccessExample:
      value:
        flow: APP2APP
        pds: ZGZnZGVmZ2RnZGVnZXJnZXJncmRnZXJ5aGdld3J0eWJld3J5dHdleXd5d3l3cmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
        rpSpecificIdentifier: 46eb72430ffeca3daf31360264fa0424ba4facfdcb69c6f43e73063f290a75a8
        redirectUri: https://sample-rp-redirect-uri.com/?arid=2cd8ed7e-0cbc-44cc-b393-45e42915d6db&code=eyJ4NXQjUzI1NiI6Ildvank5ekFZQzFCWlMxMTJDeTIzM&state=random%20string%22
    UnauthorizedExample:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: UNAUTHORIZED_REQUEST
            Description: Unauthorized request.
            Recoverable: false
    NotFoundExampleARIDnotExists:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: CLAIM_SHARING_ARID_DOES_NOT_EXIST
            Description: 'CLAIM_SHARING_ARID_DOES_NOT_EXIST: ARID does not Exist'
            Recoverable: false
            Details: ARID does not exist.
            redirectUri: https://sample-rp-redirect-uri.com/?arid=b6990018-73bb-4e8c-9658-556012c22a25&state=random%20string&error=server_error
    RPClaimsUserConsentDataExampleConsentNotGiven:
      value:
        flow: APP2APP
        pds: ZGZnZGVmZ2RnZGVnZXJnZXJncmRnZXJ5aGdld3J0eWJld3J5dHdleXd5d3l3cmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
        rpSpecificIdentifier: null
        redirectUri: https://sample-rp-redirect-uri.com/?arid=966eaf60-fa83-46d6-8ed5-7029609b4601&error_description=access_to_claims_denied&state=random%20string&error=access_denied
    BadRequestPDSErrorExample:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: VALIDATION_ERROR
            Description: Invalid value null for PDS.
            Recoverable: false
            Details: Must not be null.
            redirectUri: https://sample-rp-redirect-uri.com?error=server_error&state=AJahbadinvjbdvdnvljkdnvdfhsrbghrtiu4w
    UserProfileDeletedErrorExample:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: USER_PROFILE_DELETED
            Description: 'USER_PROFILE_DELETED: ID of the deleted profile.'
            Recoverable: false
            redirectUri: https://sample-rp-redirect-uri.com?error=server_error&state=AJahbadinvjbdvdnvljkdnvdfhsrbghrtiu4w
    NotFoundExample:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: USER_PROFILE_ID_NOT_FOUND
            Description: The provided user profile ID does not exist.
            Recoverable: false
  responses:
    UnauthorizedError:
      description: Unauthorized request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            UnauthorizedExample:
              $ref: '#/components/examples/UnauthorizedExample'
    RPScopesSuccessResponse:
      description: Success
      headers:
        X-Transaction-ID:
          schema:
            type: string
          description: A random 128-bit UUID represents the transaction.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RPScopes'
    NotFoundError:
      description: The request didn't match an existing resource.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            NotFoundExample:
              $ref: '#/components/examples/NotFoundExample'
    NotFoundErrorClaimSharing:
      description: The request didn't match an existing resource.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            NotFoundExampleARIDnotExists:
              $ref: '#/components/examples/NotFoundExampleARIDnotExists'
    BadRequestErrorClaimSharing:
      description: Something was wrong with the request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            BadRequestARIDErrorExample:
              $ref: '#/components/examples/BadRequestARIDErrorExample'
            BadRequestPDSErrorExample:
              $ref: '#/components/examples/BadRequestPDSErrorExample'
    UserConsentResponse:
      description: Success.
      headers:
        X-Transaction-ID:
          schema:
            type: string
          description: A random 128-bit UUID represents the transaction.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RPClaimsUserConsentData'
          examples:
            RPClaimsUserConsentDataSuccess:
              $ref: '#/components/examples/RPClaimsUserConsentDataSuccessExample'
            RPClaimsUserDataConsentNotGiven:
              $ref: '#/components/examples/RPClaimsUserConsentDataExampleConsentNotGiven'
    BadRequestError:
      description: Something was wrong with the request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            UserProfileDeletedErrorExample:
              $ref: '#/components/examples/UserProfileDeletedErrorExample'
  parameters:
    AridParameter:
      name: arid
      in: path
      description: A unique identifier for any activity being executed arising out of a Claim Share request. This value is passed as a parameter in the URL redirecting a User to the TP Flow during a Claim Share. .
      example: df52649e-4096-456a-bca0-751ee470009f
      required: true
      schema:
        type: string
        pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
        maxLength: 36
        minLength: 36
  requestBodies:
    UserConsentRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RPClaimsUserConsent'
      required: true