openapi: 3.1.0
info:
  title: OpenID Connect Authentication Token API
  description: OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 protocol. It allows clients to verify the identity of end-users based on the authentication performed by an authorization server, and to obtain basic profile information about the end-user in an interoperable and REST-like manner. This specification covers the core OIDC endpoints including discovery, token, userinfo, and JWKS.
  version: '1.0'
  contact:
    name: OpenID Foundation
    url: https://openid.net/
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://{issuer}
  description: OpenID Connect Provider
  variables:
    issuer:
      default: example.com
      description: The OIDC issuer domain
tags:
- name: Token
  description: Token endpoint for exchanging authorization codes for tokens.
paths:
  /token:
    post:
      operationId: getToken
      summary: Token Endpoint
      description: Exchanges an authorization code, refresh token, or client credentials for an access token and optionally a refresh token and ID token. The token endpoint is used by the client to obtain tokens after receiving an authorization code from the authorization endpoint.
      tags:
      - Token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - grant_type
              properties:
                grant_type:
                  type: string
                  description: The type of grant being presented.
                  enum:
                  - authorization_code
                  - refresh_token
                  - client_credentials
                code:
                  type: string
                  description: The authorization code received from the authorization endpoint.
                redirect_uri:
                  type: string
                  format: uri
                  description: The redirect URI used in the authorization request.
                client_id:
                  type: string
                  description: The client identifier.
                client_secret:
                  type: string
                  description: The client secret.
                refresh_token:
                  type: string
                  description: The refresh token for obtaining a new access token.
                scope:
                  type: string
                  description: The requested scope.
                code_verifier:
                  type: string
                  description: PKCE code verifier that was used to generate the code challenge.
      responses:
        '200':
          description: Successful token response containing access token and optionally ID token.
          content:
            application/json:
              schema:
                type: object
                required:
                - access_token
                - token_type
                properties:
                  access_token:
                    type: string
                    description: The access token issued by the authorization server.
                  token_type:
                    type: string
                    description: The type of token issued, typically 'Bearer'.
                    enum:
                    - Bearer
                  expires_in:
                    type: integer
                    description: The lifetime in seconds of the access token.
                  refresh_token:
                    type: string
                    description: A refresh token that can be used to obtain new access tokens.
                  id_token:
                    type: string
                    description: A JSON Web Token (JWT) that contains claims about the authentication event and the end-user.
                  scope:
                    type: string
                    description: The scope of the access token.
        '400':
          description: Invalid request, such as an invalid grant or unauthorized client.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    enum:
                    - invalid_request
                    - invalid_client
                    - invalid_grant
                    - unauthorized_client
                    - unsupported_grant_type
                    - invalid_scope
                  error_description:
                    type: string
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer Token obtained through OIDC authentication.