openapi: 3.1.0
info:
  title: Matrix Client-Server Account Login API
  version: v3
  description: 'REST API used by Matrix clients to communicate with a homeserver. Covers

    login, account management, sync, room creation and membership, message

    send and history, profile and presence, device management, end-to-end

    encryption keys, and the public rooms directory. Newer endpoints sit

    under /_matrix/client/v3 with selected features under /v1.

    '
  contact:
    name: Matrix.org Foundation
    url: https://matrix.org
servers:
- url: https://{homeserver}/_matrix/client
  description: Matrix homeserver Client-Server API root
  variables:
    homeserver:
      default: matrix.org
security:
- BearerAuth: []
tags:
- name: Login
paths:
  /v3/login:
    get:
      summary: List supported login flows
      operationId: getLoginFlows
      security: []
      responses:
        '200':
          description: Supported login flows.
      tags:
      - Login
    post:
      summary: Authenticate and obtain an access token
      operationId: login
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - type
              properties:
                type:
                  type: string
                  description: e.g. `m.login.password`
                identifier:
                  type: object
                password:
                  type: string
                device_id:
                  type: string
                initial_device_display_name:
                  type: string
                refresh_token:
                  type: boolean
      responses:
        '200':
          description: Access token issued.
      tags:
      - Login
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: 'Matrix access token issued by the homeserver after login, passed as

        `Authorization: Bearer {access_token}`. Some endpoints (login,

        register, refresh) do not require authentication.

        '