openapi: 3.2.0
info:
  title: Spyderbat STS API
  version: 1.0.0
  contact:
    name: API Support
    url: https://api.prod.spyderbat.com/openapi
    email: support@spyderbat.com
  license:
    name: MIT
    url: https://mit-license.org/
  termsOfService: https://www.spyderbat.com/terms-of-use/
  x-logo:
    url: /static/sb-logo.svg
    backgroundColor: '#161A21'
    altText: Spyderbat Logo
  description: 'Operations tagged STS across 2 of this provider''s published API definitions: spyderbat-openapi-original.json, spyderbat-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prod.spyderbat.com/
  description: Spyderbat API Server
security:
- apiToken: []
tags:
- name: STS
  description: '

    Security Token Service endpoints. Trusted services assume a role on a single org and receive a short-lived, org-locked JWT for downstream consumers. The caller''s authority to assume is gated by the sts:AssumeRole action on srn:sts::<org>:<role_uid>; the resulting token carries the assumed role on the assumed org only.

    '
paths:
  /api/v1/sts/assumerole:
    post:
      tags:
      - STS
      summary: Assume a role on an org and receive a scoped JWT
      description: "\nAssumes a single Org/* role on a single org and returns a short-lived JWT bound to both.\n\n * Requires action *sts:AssumeRole* on resource *srn:sts::<org_uid>:<role_uid>*\n * role_uid must be an Org/* role UID; Global/* roles are not assumable\n * TTL default is 1200 seconds (20m); max is 3600 seconds (1h)\n * The resulting token carries the assumed role on the assumed org only; onward assumption is gated by whether that role grants sts:AssumeRole\n"
      operationId: StsAssumeRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StsAssumeRoleInput'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiStsAssumeRoleOutput'
        '400':
          description: invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: permission denied
    servers:
    - url: https://api.prod.spyderbat.com/
      description: Spyderbat API Server
components:
  schemas:
    ApiStsAssumeRoleOutput:
      type: object
      properties:
        expires_at:
          type: integer
          description: Unix timestamp (seconds) at which the token expires.
          format: int64
        token:
          type: string
          description: Signed scoped JWT. Present in the Authorization header as 'Bearer <token>' on subsequent requests.
    StsAssumeRoleInput:
      type: object
      properties:
        correlation_id:
          type: string
          description: Audit/tracing identifier for this assumption (alphanumeric, max 64 chars)
          maxLength: 64
        org_uid:
          type: string
          description: UID of the org the scoped token will be locked to
        role_uid:
          type: string
          description: UID of the Org/* role the scoped token will carry
          maxLength: 64
        ttl_seconds:
          type: integer
          description: Requested lifetime in seconds. Clamped to [60, 3600]; 0 or unset applies the default (1200)
          format: int32
          maximum: 3600
      required:
      - org_uid
      - role_uid
    ValidationError:
      type: object
      properties:
        err_msg:
          type: string
          description: Message regarding the validation failure
        field:
          type: string
          description: Field name which failed validation
        property:
          type: string
          description: JSON property name of the field which failed validation
        tags:
          type: string
          description: Validation tag which failed
  securitySchemes:
    apiToken:
      type: http
      scheme: bearer
      bearerFormat: JWT
x-refined-from:
- spyderbat-openapi-original.json
- spyderbat-openapi.json