openapi: 3.1.0
info:
  title: Azure Web PubSub Service Data Plane REST ClientToken Permission API
  description: 'Data plane REST API for Azure Web PubSub. Lets app servers send messages

    to connected WebSocket clients (broadcast, group, user, connection),

    manage connection/group/user membership, generate client tokens, and

    check/grant/revoke permissions. Authentication uses a JWT bearer token

    signed with the service AccessKey (HS256) or a Microsoft Entra ID token

    with scope https://webpubsub.azure.com/.default.

    '
  version: '2024-01-01'
  contact:
    name: Kin Lane
    email: kin@apievangelist.com
  license:
    name: Microsoft Terms of Use
    url: https://www.microsoft.com/en-us/legal/terms-of-use
servers:
- url: https://{instance}.webpubsub.azure.com
  description: Azure Web PubSub service instance
  variables:
    instance:
      default: example
      description: Web PubSub service instance name
security:
- bearer_auth: []
tags:
- name: Permission
  description: Permission management for client connections
paths:
  /api/hubs/{hub}/permissions/{permission}/connections/{connectionId}:
    put:
      tags:
      - Permission
      summary: Grant permission to a connection
      operationId: webPubSub_grantPermission
      parameters:
      - $ref: '#/components/parameters/hub'
      - name: permission
        in: path
        required: true
        schema:
          type: string
          enum:
          - sendToGroup
          - joinLeaveGroup
      - name: connectionId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/apiVersion'
      - name: targetName
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
    delete:
      tags:
      - Permission
      summary: Revoke permission from a connection
      operationId: webPubSub_revokePermission
      parameters:
      - $ref: '#/components/parameters/hub'
      - name: permission
        in: path
        required: true
        schema:
          type: string
      - name: connectionId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/apiVersion'
      responses:
        '204':
          description: No Content
    head:
      tags:
      - Permission
      summary: Check connection permission
      operationId: webPubSub_checkPermission
      parameters:
      - $ref: '#/components/parameters/hub'
      - name: permission
        in: path
        required: true
        schema:
          type: string
      - name: connectionId
        in: path
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/apiVersion'
      responses:
        '200':
          description: Has permission
        '404':
          description: No permission
components:
  parameters:
    apiVersion:
      name: api-version
      in: query
      required: true
      schema:
        type: string
        default: '2024-01-01'
    hub:
      name: hub
      in: path
      required: true
      schema:
        type: string
        pattern: ^[A-Za-z][A-Za-z0-9_`,.[\]]{0,127}$
  securitySchemes:
    bearer_auth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'JWT signed with the service AccessKey using HS256, or a Microsoft

        Entra ID OAuth 2.0 bearer token with scope

        https://webpubsub.azure.com/.default

        '