swagger: '2.0'
info:
  version: 2020-08-01-preview
  title: Microsoft Azure AccessControlClient AccessConnector OAuth2PermissionGrant_Create API
schemes:
- https
tags:
- name: OAuth2PermissionGrant_Create
paths:
  /{tenantID}/oauth2PermissionGrants:
    post:
      tags:
      - OAuth2PermissionGrant_Create
      consumes:
      - application/json
      operationId: microsoftAzureOauth2permissiongrantCreate
      description: Grants OAuth2 permissions for the relevant resource Ids of an app.
      produces:
      - application/json
      parameters:
      - in: body
        name: body
        required: false
        description: The relevant app Service Principal Object Id and the Service Principal Object Id you want to grant.
        schema:
          $ref: '#/definitions/OAuth2PermissionGrant'
        x-examples:
          application/json: "{\n\t\"odata.type\": \"Microsoft.DirectoryServices.OAuth2PermissionGrant\",\n\t\"clientId\": \"39afbaa2-4a5c-4f5b-9ee3-2c83f09bbc87\", \n\t\"consentType\": \"AllPrincipals\",\n\t\"principalId\": null,\n\t\"resourceId\": \"d3247842-c517-4520-80a7-332690ae2fe4\",\n\t\"scope\": \"user_impersonation\",\n    \"startTime\": \"0001-01-01T00:00:00\",\n    \"expiryTime\": \"9000-01-01T00:00:00\"\n}"
          description: These are the values required to grant permission to a resourceId for an app, only one operation is allowed per request
      - $ref: '#/parameters/ApiVersionParameter'
      - $ref: '#/parameters/tenantIDInPath'
      responses:
        '201':
          description: OK. The operation was successful.
          schema:
            $ref: '#/definitions/OAuth2PermissionGrant'
      summary: Microsoft Azure Post Tenantid Oauth2permissiongrants
definitions:
  OAuth2PermissionGrant:
    properties:
      odata.type:
        type: string
        description: Microsoft.DirectoryServices.OAuth2PermissionGrant
      clientId:
        type: string
        description: The id of the resource's service principal granted consent to impersonate the user when accessing the resource (represented by the resourceId property).
      objectId:
        type: string
        description: The id of the permission grant
      consentType:
        type: string
        description: Indicates if consent was provided by the administrator (on behalf of the organization) or by an individual.
        enum:
        - AllPrincipals
        - Principal
        x-ms-enum:
          name: ConsentType
          modelAsString: true
      principalId:
        type: string
        description: When consent type is Principal, this property specifies the id of the user that granted consent and applies only for that user.
      resourceId:
        type: string
        description: Object Id of the resource you want to grant
      scope:
        type: string
        description: Specifies the value of the scope claim that the resource application should expect in the OAuth 2.0 access token. For example, User.Read
      startTime:
        type: string
        description: Start time for TTL
      expiryTime:
        type: string
        description: Expiry time for TTL
    example:
      odata.type: odata.type
      resourceId: resourceId
      clientId: clientId
      scope: scope
      expiryTime: expiryTime
      consentType: consentType
      principalId: ''
      startTime: startTime
parameters:
  ApiVersionParameter:
    name: api-version
    in: query
    required: true
    type: string
    description: Client API version.
  tenantIDInPath:
    name: tenantID
    in: path
    required: true
    type: string
    description: The tenant ID.
    x-ms-parameter-location: client
x-ms-parameterized-host:
  hostTemplate: '{endpoint}'
  useSchemePrefix: false
  parameters:
  - $ref: '#/parameters/Endpoint'