openapi: 3.0.3
info:
  title: Tribute Store Authentication API
  description: 'The Tribute Store API is a REST-style JSON API from Tribute Technology for partners who integrate funeral-home case-management systems with the Tribute Store. It lets an integrator authenticate a funeral home, push its serving locations (rooftops), and push obituary cases (the deceased, their obituary text, service events, and a photo). Each successfully posted obituary automatically provisions a personalized Tribute Store page for the deceased, reachable at the store base URL with an ?oId={OBITUARY_ID} query string.


    Access is partner-gated. Tribute Technology issues each integrator a {Provider} credential plus an IP allowlist, and issues each funeral home a {HostName, UserName, Password} triple. The triple is exchanged at the token endpoint for a short-lived HTML bearer token that scopes all subsequent requests to that funeral home.


    This document was modeled from the public "Tribute Store API Documentation 1.1" (updated March 25, 2019). Field lists and endpoints are taken verbatim from that document; response object schemas beyond the documented sample fields are omitted rather than fabricated.'
  version: '1.1'
  contact:
    name: Tribute Technology
    url: https://www.tributetech.com
servers:
- url: https://api.tributecenteronline.com
  description: Production
- url: https://api.demo.tributecenteronline.com
  description: Development / Demo
security:
- bearerAuth: []
tags:
- name: Authentication
  description: Exchange a funeral-home credential triple for a bearer token.
paths:
  /token/:
    post:
      operationId: createToken
      tags:
      - Authentication
      summary: Request a bearer token for a funeral home
      description: Exchange a funeral home's {HostName, UserName, Password} triple for a short-lived HTML bearer token. The HostName is supplied in the f-hostname header and the integrator's Provider credential in the f-provider header; the username and password are supplied in a form-urlencoded body with grant_type=password and scope=external-api. The returned token identifies the funeral home on all other endpoints.
      security: []
      parameters:
      - name: f-hostname
        in: header
        required: true
        schema:
          type: string
        description: The funeral home HostName set up for your Provider.
      - name: f-provider
        in: header
        required: true
        schema:
          type: string
        description: Your integrator Provider credential string.
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - grant_type
              - username
              - password
              - scope
              properties:
                grant_type:
                  type: string
                  enum:
                  - password
                username:
                  type: string
                password:
                  type: string
                  format: password
                scope:
                  type: string
                  enum:
                  - external-api
      responses:
        '200':
          description: Token issued.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: Authorization failure (for example unsupported_grant_type).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenError'
components:
  schemas:
    TokenError:
      type: object
      properties:
        error:
          type: string
          example: unsupported_grant_type
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
          example: bearer
        expires_in:
          type: integer
          description: Token lifetime in seconds.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'HTML bearer token obtained from POST /token/. Include as Authorization: Bearer {TOKEN}.'