openapi: 3.1.0
info:
  title: Prismatic GraphQL Authentication API
  description: Prismatic provides a GraphQL-based API for building, deploying, and supporting integrations programmatically. The API allows you to manage customers, integrations, instances, components, and other resources. GraphQL operations include queries (pulling data) and mutations (creating, modifying, or deleting data). The API endpoint accepts GraphQL queries via HTTP POST requests. Authentication is handled via JWT bearer tokens obtained through the Prismatic web app or CLI tool.
  version: 1.0.0
  contact:
    name: Prismatic
    url: https://prismatic.io
  license:
    name: Proprietary
    url: https://prismatic.io/legal/terms/
  x-topics:
  - Integrations
  - Embedded SaaS Integration
  - Workflows
  - Connectors
  - GraphQL
servers:
- url: https://app.prismatic.io
  description: Prismatic Production API
tags:
- name: Authentication
  description: Authentication endpoints for obtaining, refreshing, and revoking JWT tokens used to access the Prismatic API
paths:
  /auth/refresh:
    post:
      operationId: refreshAuthToken
      summary: Prismatic Refresh Authentication Token
      description: Refresh an expired or expiring access token using a valid refresh token. Returns a new access token that can be used to authenticate against the GraphQL API. Refreshed tokens are valid for 7 days.
      tags:
      - Authentication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RefreshTokenRequest'
      responses:
        '200':
          description: Successfully refreshed token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          description: Invalid or expired refresh token
  /auth/revoke:
    post:
      operationId: revokeAuthToken
      summary: Prismatic Revoke Refresh Token
      description: Revoke a refresh token to prevent it from being used to generate new access tokens. Use this endpoint if you believe a refresh token has been compromised.
      tags:
      - Authentication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RefreshTokenRequest'
      responses:
        '200':
          description: Successfully revoked refresh token
        '401':
          description: Invalid refresh token
  /get_auth_token/:
    get:
      operationId: getAuthToken
      summary: Prismatic Get Short-Lived Auth Token
      description: Retrieve a short-lived authentication token while logged in to the Prismatic web application. This endpoint is accessed via browser and returns a JWT that can be used for API queries.
      tags:
      - Authentication
      security:
      - cookieAuth: []
      responses:
        '200':
          description: Returns a short-lived JWT token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          description: Not authenticated - must be logged in to web application
components:
  schemas:
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: JWT access token for authenticating API requests
        refresh_token:
          type: string
          description: Refresh token for obtaining new access tokens
        token_type:
          type: string
          description: Type of token, typically Bearer
        expires_in:
          type: integer
          description: Token expiration time in seconds
    RefreshTokenRequest:
      type: object
      required:
      - refresh_token
      properties:
        refresh_token:
          type: string
          description: The refresh token to use for obtaining a new access token or to revoke
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT token obtained via the Prismatic web app, CLI tool (me:token subcommand), or the /auth/refresh endpoint. Pass as Authorization Bearer header.
    cookieAuth:
      type: apiKey
      in: cookie
      name: session
      description: Session cookie from Prismatic web application login