openapi: 3.0.0
info:
  title: Threads Authorization API
  description: The Threads API enables developers to build their own unique integrations, and helps creators and brands manage their Threads presence at scale and easily share inspiring content with their communities.
  version: 1.0.0
servers:
- url: http://{{api_host}}
security:
- oauth2Auth: []
tags:
- name: Authorization
  description: 'Authorization is a required step to get the necessary user permissions to act on behalf of the user. Please take a look at the [walkthrough of the authentication process](https://developers.facebook.com/docs/threads/get-started/get-access-tokens-and-permissions). Once the access token is retrieved, use the [access token debugger](https://developers.facebook.com/tools/debug/accesstoken) to check if the access token has the correct permissions (including `threads_basic`, `threads_content_publish`, `threads_read_replies`, `threads_manage_replies`, `threads_manage_insights`) and verify that the access token hasn''t expired.


    Follow the [documentation](https://developers.facebook.com/docs/threads/get-started/long-lived-tokens) to exchange a short-lived Threads User Access Token for a long-lived token and refresh unexpired long-lived Threads User Access tokens. **Note:** The `threads_basic` permission is sufficient for the exchange or refresh process.'
paths:
  /oauth/access_token:
    post:
      tags:
      - Authorization
      summary: Exchange the Code For a Token
      description: Once you receive a code, exchange it for a short-lived access token by sending a `POST` request to the /oauth/access_token [endpoint](https://developers.facebook.com/docs/threads/get-started/get-access-tokens-and-permissions#step-2--exchange-the-code-for-a-token)
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              properties: {}
      security:
      - noauthAuth: []
      parameters:
      - name: client_id
        in: query
        schema:
          type: string
        description: 'Your Threads App ID displayed in App Dashboard > App settings > Basic > Threads App ID. Example: 990602627938098.'
        example: '{{app_id}}'
      - name: client_secret
        in: query
        schema:
          type: string
        description: 'Your Threads App Secret displayed in App Dashboard > App settings > Basic > Threads App secret. Example: a1b2C3D4.'
        example: '{{app_secret}}'
      - name: code
        in: query
        schema:
          type: string
        description: Authorization Code
        example: '{{code}}'
      - name: grant_type
        in: query
        schema:
          type: string
        description: This value is required
        example: authorization_code
      - name: redirect_uri
        in: query
        schema:
          type: string
        description: The redirect URI you passed when you directed the user to the Authorization Window. This must be the same URI or the request will be rejected.
        example: '{{redirect_uri}}'
      responses:
        undefined:
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                access_token: string
                user_id: string
  /access_token:
    get:
      tags:
      - Authorization
      summary: Get Long-Lived Access Token
      description: Use the `GET` /access_token [endpoint](https://developers.facebook.com/docs/threads/get-started/long-lived-tokens#get-a-long-lived-token) to exchange a short-lived Threads user access token for a long-lived token.
      parameters:
      - name: grant_type
        in: query
        schema:
          type: string
        example: th_exchange_token
      - name: client_secret
        in: query
        schema:
          type: string
        example: '{{app_secret}}'
      responses:
        undefined:
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                access_token: string
                token_type: bearer
                expires_in: 5184000
components:
  securitySchemes:
    noauthAuth:
      type: http
      scheme: noauth
    oauth2Auth:
      type: http
      scheme: oauth2