swagger: '2.0'
info:
  version: 2020-08-01-preview
  title: Microsoft Azure AccessControlClient AccessConnector Get Token API
schemes:
- https
tags:
- name: Get Token
paths:
  /identity/oauth2/token:
    get:
      tags:
      - Get Token
      description: Get a Token from Azure AD
      operationId: microsoftAzureIdentityGettoken
      produces:
      - application/json
      security:
      - {}
      - basic_auth: []
      parameters:
      - $ref: '#/parameters/MetadataParameter'
      - name: resource
        in: query
        type: string
        description: This is the urlencoded identifier URI of the sink resource for the requested Azure AD token. The resulting token contains the corresponding aud for this resource.
        required: true
      - $ref: '#/parameters/ApiVersionParameter'
      - name: client_id
        in: query
        type: string
        description: This identifies, by Azure AD client id, a specific explicit identity to use when authenticating to Azure AD. Mutually exclusive with object_id and msi_res_id.
        required: false
      - name: object_id
        in: query
        type: string
        description: This identifies, by Azure AD object id, a specific explicit identity to use when authenticating to Azure AD. Mutually exclusive with client_id and msi_res_id.
        required: false
      - name: msi_res_id
        in: query
        type: string
        description: This identifies, by urlencoded ARM resource id, a specific explicit identity to use when authenticating to Azure AD. Mutually exclusive with client_id and object_id.
        required: false
      - name: authority
        in: query
        type: string
        description: This indicates the authority to request AAD tokens from. Defaults to the known authority of the identity to be used.
        required: false
      - name: bypass_cache
        in: query
        type: string
        enum:
        - 'true'
        description: If provided, the value must be 'true'. This indicates to the server that the token must be retrieved from Azure AD and cannot be retrieved from an internal cache.
        required: false
        x-ms-enum:
          name: BypassCache
          modelAsString: true
      responses:
        '200':
          description: Successful operation
          schema:
            $ref: '#/definitions/IdentityTokenResponse'
        default:
          headers:
            Www-Authenticate:
              type: string
              description: This is the response header containing a challenge for the Basic scheme with a realm value
          description: Error response describing why the operation failed.
          schema:
            $ref: '#/definitions/IdentityErrorResponse'
      x-ms-examples:
        Get Identity Token for the VM:
          $ref: ./examples/GetIdentityToken.json
      summary: Microsoft Azure Get Identity Oauth2 Token
definitions:
  IdentityTokenResponse:
    type: object
    description: This is the response from the Identity_GetToken operation.
    properties:
      access_token:
        type: string
        description: This is the requested access token. The app can use this token to authenticate to the sink resource.
      expires_in:
        type: string
        description: This is how long the access token is valid (in seconds).
      expires_on:
        type: string
        description: This is the time when the access token expires. The date is represented as the number of seconds from 1970-01-01T0:0:0Z UTC until the expiration time. This value is used to determine the lifetime of cached tokens.
      ext_expires_in:
        type: string
        description: This indicates the extended lifetime of the token (in seconds).
      not_before:
        type: string
        description: This is the time when the access token becomes effective. The date is represented as the number of seconds from 1970-01-01T0:0:0Z UTC until the expiration time.
      resource:
        type: string
        description: This is the app ID URI of the sink resource.
      token_type:
        type: string
        description: This indicates the token type value.
      client_id:
        type: string
        description: This is the client_id specified in the request, if any.
      object_id:
        type: string
        description: This is the object_id specified in the request, if any.
      msi_res_id:
        type: string
        description: This is the msi_res_id specified in the request, if any.
  IdentityErrorResponse:
    type: object
    description: This is the response from an Identity operation in the case an error occurs.
    properties:
      error:
        type: string
        description: Error code
        enum:
        - invalid_request
        - unauthorized_client
        - access_denied
        - unsupported_response_type
        - invalid_scope
        - server_error
        - service_unavailable
        - bad_request
        - forbidden
        - not_found
        - method_not_allowed
        - too_many_requests
        x-ms-enum:
          name: Error
          modelAsString: true
      error_description:
        type: string
        description: Error message indicating why the operation failed.
parameters:
  ApiVersionParameter:
    name: api-version
    in: query
    type: string
    enum:
    - '2018-10-01'
    description: This is the API version to use.
    required: true
    x-ms-enum:
      name: ApiVersion
      modelAsString: true
  MetadataParameter:
    name: Metadata
    in: header
    type: string
    enum:
    - 'true'
    description: This must be set to 'true'.
    required: true
    x-ms-parameter-location: method
x-ms-parameterized-host:
  hostTemplate: '{endpoint}'
  useSchemePrefix: false
  parameters:
  - $ref: '#/parameters/Endpoint'