openapi: 3.2.0 info: title: Triodos Auth service Authorization Endpoint API description: Triodos Auth service termsOfService: https://www.triodos.com contact: name: Triodos Support url: https://www.triodos.com email: info@triodos.com license: name: Creative Commons Attribution 4.0 International Public License url: https://creativecommons.org/licenses/by/4.0/ version: '1.0' servers: - url: https://xs2a-sandbox.triodos.com/auth description: Triodos Auth Sandbox tags: - name: Authorization Endpoint description: The Authorization Endpoint performs authentication of the end-user. externalDocs: description: OpenID Connect Core 1.0 - Chapter 3.1.2 Authorization Endpoint url: https://openid.net/specs/openid-connect-core-1_0.html paths: /{tenant}/v1/auth: get: tags: - Authorization Endpoint summary: Authorize end-user description: The Authorization Endpoint performs Authentication of the End-User. This is done by sending the User Agent to the Authorization Server's Authorization Endpoint for Authentication and Authorization, using request parameters defined by OAuth 2.0 and additional parameters and parameter values defined by OpenID Connect. operationId: authorizeGet parameters: - name: tenant in: path description: Branch of the request. required: true schema: type: string enum: - uk - nl - be_fr - be_nl - name: request in: query description: Not supported. schema: type: string - name: request_uri in: query description: Not supported. schema: type: string - name: registration in: query description: Not supported. schema: type: string - name: response_type in: query description: Always set to "code". required: true schema: type: string - name: client_id in: query description: OAuth 2.0 Client Identifier valid at the Authorization Server. required: true schema: type: string - name: redirect_uri in: query description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section 6.2.1 of RFC3986 (Simple String Comparison). When using this flow, the Redirection URI SHOULD use the https scheme; however, it MAY use the http scheme, provided that the Client Type is confidential, as defined in Section 2.1 of OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. The Redirection URI MAY use an alternate scheme, such as one that is intended to identify a callback into a native application. required: true schema: type: string - name: scope in: query description: OpenID Connect requests MUST contain the openid scope value. Scope values used that are not understood by an implementation SHOULD be ignored. See OpenID Connect Core 1.0 - Sections 5.4 and 11 for additional scope values defined by this specification. required: true schema: $ref: '#/components/schemas/OAuthScope' - name: state in: query description: Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie. schema: type: string - name: nonce in: query description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values. For implementation notes, see Section 15.5.2. schema: type: string - name: response_mode in: query description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. This use of this parameter is NOT RECOMMENDED when the Response Mode that would be requested is the default mode specified for the Response Type. schema: type: string - name: prompt in: query description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. schema: type: string - name: max_age in: query description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value. schema: type: string - name: code_challenge in: query description: Code challenge, see RFC7636 for more information. required: true schema: type: string - name: code_challenge_method in: query description: Always set to "S256". required: true schema: type: string - name: id_token_hint in: query description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it returns an error. When possible, an id_token_hint SHOULD be present when prompt=none is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the ID Token, and use the re-encrypted ID token as the id_token_hint value. schema: type: string responses: '302': description: An Authentication Response is an OAuth 2.0 Authorization Response message returned from the OP's Authorization Endpoint in response to the Authorization Request message sent by the RP. '400': description: Invalid client id, TPP with client id not found, TPP with client id not found, invalid redirect uri, unregistered redirect_uri, invalid subject in id_token_hint, invalid_request, consent_required, unsupported_response_type, request_not_supported, request_uri_not_supported, registration_not_supported or invalid_scope post: tags: - Authorization Endpoint summary: Authorize end-user description: The Authorization Endpoint performs Authentication of the End-User. This is done by sending the User Agent to the Authorization Server's Authorization Endpoint for Authentication and Authorization, using request parameters defined by OAuth 2.0 and additional parameters and parameter values defined by OpenID Connect. operationId: authorizePost parameters: - name: tenant in: path description: Branch of the request. required: true schema: type: string enum: - uk - nl - be_fr - be_nl requestBody: content: '*/*': schema: required: - client_id - code_challenge - code_challenge_method - redirect_uri - response_type - scope type: object properties: request: type: string description: Not supported. request_uri: type: string description: Not supported. registration: type: string description: Not supported. response_type: type: string description: Always set to "code". client_id: type: string description: OAuth 2.0 Client Identifier valid at the Authorization Server. redirect_uri: type: string description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section 6.2.1 of RFC3986 (Simple String Comparison). When using this flow, the Redirection URI SHOULD use the https scheme; however, it MAY use the http scheme, provided that the Client Type is confidential, as defined in Section 2.1 of OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. The Redirection URI MAY use an alternate scheme, such as one that is intended to identify a callback into a native application. scope: $ref: '#/components/schemas/OAuthScope' state: type: string description: Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie. nonce: type: string description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values. For implementation notes, see Section 15.5.2. response_mode: type: string description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. This use of this parameter is NOT RECOMMENDED when the Response Mode that would be requested is the default mode specified for the Response Type. prompt: type: string description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. max_age: type: string description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value. code_challenge: type: string description: Code challenge, see RFC7636 for more information. code_challenge_method: type: string description: Always set to "S256". id_token_hint: type: string description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it returns an error. When possible, an id_token_hint SHOULD be present when prompt=none is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the ID Token, and use the re-encrypted ID token as the id_token_hint value. responses: '302': description: An Authentication Response is an OAuth 2.0 Authorization Response message returned from the OP's Authorization Endpoint in response to the Authorization Request message sent by the RP. '400': description: Invalid client id, TPP with client id not found, TPP with client id not found, invalid redirect uri, unregistered redirect_uri, invalid subject in id_token_hint, invalid_request, consent_required, unsupported_response_type, request_not_supported, request_uri_not_supported, registration_not_supported or invalid_scope components: schemas: OAuthScope: type: object properties: types: uniqueItems: true type: array items: type: string enum: - OPENID - OFFLINE_ACCESS - ACCESS_ACCOUNTS - EXECUTE_PAYMENTS - CANCEL_PAYMENTS - CONFIRMATION_OF_FUNDS applicationValue: type: string applicationType: type: string enum: - OPENID - OFFLINE_ACCESS - ACCESS_ACCOUNTS - EXECUTE_PAYMENTS - CANCEL_PAYMENTS - CONFIRMATION_OF_FUNDS externalDocs: description: OpenID Connect 1.0 specifications url: https://openid.net/connect/