openapi: 3.0.3
info:
  title: Spring Server Authorization Token API
  description: Spring Authorization Server is a framework providing implementations of OAuth 2.1 and OpenID Connect 1.0 specifications. It exposes standard protocol endpoints for token issuance, token introspection, JWKS publication, device authorization, and OpenID Connect session management.
  version: 1.3.0
  contact:
    name: Spring Security Team
    url: https://spring.io/projects/spring-authorization-server
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: http://localhost:9000
  description: Default authorization server port
tags:
- name: Token
paths:
  /oauth2/token:
    post:
      operationId: tokenRequest
      summary: OAuth2 Token Request
      description: Issues access tokens for all supported grant types
      tags:
      - Token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - grant_type
              properties:
                grant_type:
                  type: string
                  enum:
                  - authorization_code
                  - refresh_token
                  - client_credentials
                  - urn:ietf:params:oauth:grant-type:device_code
                  - urn:ietf:params:oauth:grant-type:token-exchange
                code:
                  type: string
                redirect_uri:
                  type: string
                code_verifier:
                  type: string
                refresh_token:
                  type: string
                scope:
                  type: string
                client_id:
                  type: string
                client_secret:
                  type: string
      security:
      - basicAuth: []
      - {}
      responses:
        '200':
          description: Token response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: Token error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
  /oauth2/introspect:
    post:
      operationId: tokenIntrospection
      summary: Token Introspection
      description: Validates tokens and returns active token metadata per RFC 7662
      tags:
      - Token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - token
              properties:
                token:
                  type: string
                token_type_hint:
                  type: string
      security:
      - basicAuth: []
      responses:
        '200':
          description: Introspection response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntrospectionResponse'
  /oauth2/revoke:
    post:
      operationId: tokenRevocation
      summary: Token Revocation
      description: Revokes access or refresh tokens per RFC 7009
      tags:
      - Token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - token
              properties:
                token:
                  type: string
                token_type_hint:
                  type: string
      security:
      - basicAuth: []
      responses:
        '200':
          description: Token revoked
components:
  schemas:
    IntrospectionResponse:
      type: object
      properties:
        active:
          type: boolean
        scope:
          type: string
        client_id:
          type: string
        username:
          type: string
        token_type:
          type: string
        exp:
          type: integer
        sub:
          type: string
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: integer
        refresh_token:
          type: string
        scope:
          type: string
        id_token:
          type: string
    OAuthError:
      type: object
      properties:
        error:
          type: string
        error_description:
          type: string
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT