openapi: 3.2.0
info:
  title: Pricefinder Oauth2 API
  version: 1.13.1
  contact:
    name: Pricefinder
  license:
    name: Terms and Conditions
    url: https://www.domain.com.au/group/api-terms-and-conditions/
  description: 'Operations tagged oauth2 across 2 of this provider''s published API definitions: pricefinder-api-swagger.json, pricefinder-api-swagger.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: /v1
tags:
- name: oauth2
paths:
  /oauth2/token:
    post:
      tags:
      - oauth2
      description: '<p>Retrieve an oauth2 acces_token for use with Pricefinder API. A basic auth header is supported as an alternative to the form parameters for username and password.</p><p>After retrieving the token, it must be either added as an authorization header(eg Authorization: Bearer &lt;token&gt;) or appended to the query (eg ?access_token=&lt;token&gt;).</p><p>The api supports three ''flows'' for retrieving a token; client_credentials, refresh_token and authorization_code</p><h4>client_credentials</h4><p>The client credentials flow requires the api user to pass their user name and password to retrieve the token.</p><h4>code_authorization</h4><p>The code authorization flow is used to authenticate on behalf of a another user.<p>To acquire authorization from a third party, direct that user to /v1/auth/authorize.html?client_id=&lt;username&gt;&state=&lt;random_number&gt;&redirect_uri=&lt;callback_in_your_app&gt;. Https is required.<p>The client_id is your username.<br/>The state is a random string used to verify that the authorization request was generated by your webapp.<br/>The redirect_uri is the callback uri after the third party has accepted or declined the authorization request.</p><div class=''documentation block request_url''><pre>eg https://api.pricefinder.com.au/v1/auth/authorize.html?client_id=username&state=123&redirect_uri=https%3A%2F%2Fyour.web.app%2Fsomepage</pre></div><p>The third party will authenticate and authorize access to the api on their behalf. If the user allows access, the third party is redirected to your.web.app/somepage?state=&lt;state&gt;&code=&lt;authorization_code&gt;</p><div class=''documentation block request_url''><pre>eg https://your.web.app/somepage?state=123&code=9efc4ad1cca0bae6255ffd6db6cc85</pre></div><p>(If the user declines, a callback is made with query parameter error=access_denied)</p><p>The api user can then retrieve an access token using this code from /v1/oauth2/token, using the ''authorization_code'' grant type.</p><p>eg</p><div class=''documentation block curl''><pre>curl -X POST --header "Content-Type: application/x-www-form-urlencoded" --header "Accept: application/json" -d "grant_type=authorization_code&client_id=username&client_secret=password&code=9efc4ad1cca0bae6255ffd6db6cc85&redirect_uri=https%3A%2F%2Fyour.web.app%2Fsomepage" "https://api.pricefinder.com.au/v1/oauth2/token"</pre></div><p>This will return an access token, as well as a refresh token, which can be used to acquire access tokens in the future without requiring the third party to reauthorize.</p><h4>refresh_token</h4><p>A refresh token can be used to acquire a new access token without requiring the third party to re authorize the user. This method consumes the refesh token and returns a new access token and a new refresh token.</p><h4>Required Parameters:</h4><ul><li>client_credentials => client_id, client_secret</li><li>refresh_token => client_id, client_secret, refresh_token</li><li>authorization_code => client_id, client_secret, redirect_uri, code</li></ul><h4>Simple OAuth2 Demonstration / test</h4><p><a href="https://api.pricefinder.com.au/v1/oauthTest/initiateOauth.html" target="_blank">Callback Example</a></p>'
      operationId: getToken
      responses:
        '200':
          description: Token created
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientAccessToken'
        '401':
          description: Invalid username/password
          headers: {}
        '400':
          description: Bad Request
          headers: {}
      security: []
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  format: string
                  enum:
                  - client_credentials
                  - refresh_token
                  - authorization_code
                  default: client_credentials
                  description: OAuth 2 token grant flow type
                client_id:
                  type: string
                  format: string
                  description: username
                client_secret:
                  type: string
                  format: password
                  description: password
                refresh_token:
                  type: string
                  format: string
                  description: Refresh token
                code:
                  type: string
                  format: string
                  description: code provided through callback
                redirect_uri:
                  type: string
                  format: string
                  description: URI that was used to generate code
              required:
              - grant_type
              - client_id
              - client_secret
    servers:
    - url: /v1
components:
  schemas:
    ClientAccessToken:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: string
        refresh_token:
          type: string
x-refined-from:
- pricefinder-api-swagger.json
- pricefinder-api-swagger.yml