openapi: 3.2.0
info:
  title: Triodos Auth service Token Endpoint API
  description: Triodos Auth service
  termsOfService: https://www.triodos.com
  contact:
    name: Triodos Support
    url: https://www.triodos.com
    email: info@triodos.com
  license:
    name: Creative Commons Attribution 4.0 International Public License
    url: https://creativecommons.org/licenses/by/4.0/
  version: '1.0'
servers:
- url: https://xs2a-sandbox.triodos.com/auth
  description: Triodos Auth Sandbox
tags:
- name: Token Endpoint
  description: The Token Endpoint provides and revokes access tokens and refresh tokens.
  externalDocs:
    description: OpenID Connect Core 1.0 - Chapter 3.1.3 Token Endpoint
    url: https://openid.net/specs/openid-connect-core-1_0.html
paths:
  /{tenant}/v1/token:
    post:
      tags:
      - Token Endpoint
      summary: Get token
      description: To obtain an Access Token and a Refresh Token, the RP (Client) sends a Token Request to the Token Endpoint to obtain a Token Response, as described in Section 3.2 of OAuth 2.0.
      operationId: token
      parameters:
      - name: Authorization
        in: header
        description: Client secret basic authentication.
        required: true
        schema:
          type: string
      - name: tenant
        in: path
        description: Branch of the request.
        required: true
        schema:
          type: string
          enum:
          - uk
          - nl
          - be_fr
          - be_nl
      requestBody:
        content:
          '*/*':
            schema:
              required:
              - grant_type
              type: object
              properties:
                redirect_uri:
                  type: string
                  description: Must be identical to the "redirect_uri" parameter that was included in the authorization request. Not needed when requesting a refresh token.
                code:
                  type: string
                  description: The authorization code received from the authorization server. Not needed when requesting a refresh token.
                refresh_token:
                  type: string
                  description: The refresh token received from the authorization server. Not needed when using an authorization code.
                grant_type:
                  type: string
                  description: Specify "authorization_code" when an authorization code is provided or "refresh_token" when a refresh token is provided.
                  enum:
                  - IMPLICIT
                  - AUTHORIZATION_CODE
                  - REFRESH_TOKEN
                  - PASSWORD
                  - CLIENT_CREDENTIALS
                  - JWT_BEARER
                code_verifier:
                  type: string
                  description: Client provided code verifier for additional challenge-response verification, see RFC7636 for more information. Not needed when requesting a refresh token.
      responses:
        '200':
          description: After receiving and validating a valid and authorized Token Request from the Client, the Authorization Server returns a successful response that includes an ID Token, an Access Token and a Refresh Token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OIDCClientInformation'
        '400':
          description: unsupported_grant_type, invalid_request, invalid_grant or unauthorized_client
  /{tenant}/v1/token/revoke:
    post:
      tags:
      - Token Endpoint
      summary: Revoke token
      description: The client requests the revocation of a particular token by making an HTTP POST request to the token revocation endpoint URL. See RFC7009 for more information.
      operationId: tokenRevocation
      parameters:
      - name: Authorization
        in: header
        description: Client secret basic authentication.
        required: true
        schema:
          type: string
      - name: tenant
        in: path
        description: Branch of the request.
        required: true
        schema:
          type: string
          enum:
          - uk
          - nl
          - be_fr
          - be_nl
      requestBody:
        content:
          '*/*':
            schema:
              required:
              - token
              type: object
              properties:
                token:
                  type: string
                  description: The token that the client wants to get revoked.
                token_type_hint:
                  type: string
                  description: A hint about the type of the token submitted for revocation.
      responses:
        '200':
          description: If the request is technically correct, regardless of the token was actually found or revoked.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OIDCClientInformation'
        '400':
          description: unauthorized_client
        '401':
          description: access_denied
components:
  schemas:
    Secret:
      type: object
      properties:
        value:
          type: string
        expirationDate:
          type: string
          format: date-time
        sha256:
          type: string
          format: byte
        valueBytes:
          type: string
          format: byte
    SoftwareID:
      type: object
      properties:
        value:
          type: string
    TokenTypeURI:
      type: object
      properties:
        uri:
          type: string
          format: uri
    HashAlgorithm:
      type: object
      properties:
        value:
          type: string
    ClientRegistrationType:
      type: object
      properties:
        value:
          type: string
    JWEAlgorithm:
      type: object
      properties:
        name:
          type: string
        requirement:
          type: string
          enum:
          - REQUIRED
          - RECOMMENDED
          - OPTIONAL
    KeyType:
      type: object
      properties:
        value:
          type: string
        requirement:
          type: string
          enum:
          - REQUIRED
          - RECOMMENDED
          - OPTIONAL
    AuthorizationDetail:
      type: object
      properties:
        identifier:
          $ref: '#/components/schemas/Identifier'
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Action'
        type:
          $ref: '#/components/schemas/AuthorizationType'
        locations:
          type: array
          items:
            $ref: '#/components/schemas/Location'
        dataTypes:
          type: array
          items:
            $ref: '#/components/schemas/DataType'
        privileges:
          type: array
          items:
            $ref: '#/components/schemas/Privilege'
    ClientID:
      type: object
      properties:
        value:
          type: string
    Identifier:
      type: object
      properties:
        value:
          type: string
    ClientAuthenticationMethod:
      type: object
      properties:
        value:
          type: string
    Action:
      type: object
      properties:
        value:
          type: string
    JWTClaimsSet:
      type: object
      properties:
        claims:
          type: object
          additionalProperties:
            type: object
        expirationTime:
          type: string
          format: date-time
        issuer:
          type: string
        subject:
          type: string
        audience:
          type: array
          items:
            type: string
        notBeforeTime:
          type: string
          format: date-time
        issueTime:
          type: string
          format: date-time
        jwtid:
          type: string
    Location:
      type: object
      properties:
        value:
          type: string
        uri:
          type: string
          format: uri
    Value:
      type: object
      properties:
        value:
          type: string
    JWSHeader:
      type: object
      properties:
        customParams:
          type: object
          additionalProperties:
            type: object
        parsedBase64URL:
          $ref: '#/components/schemas/Base64URL'
        jwk:
          $ref: '#/components/schemas/JWK'
        algorithm:
          $ref: '#/components/schemas/JWSAlgorithm'
        base64URLEncodePayload:
          type: boolean
        includedParams:
          uniqueItems: true
          type: array
          items:
            type: string
        keyID:
          type: string
        jwkurl:
          type: string
          format: uri
        x509CertURL:
          type: string
          format: uri
        x509CertThumbprint:
          $ref: '#/components/schemas/Base64URL'
        x509CertSHA256Thumbprint:
          $ref: '#/components/schemas/Base64URL'
        x509CertChain:
          type: array
          items:
            $ref: '#/components/schemas/Base64'
        type:
          $ref: '#/components/schemas/JOSEObjectType'
        contentType:
          type: string
        criticalParams:
          uniqueItems: true
          type: array
          items:
            type: string
    GrantType:
      type: object
      properties:
        value:
          type: string
        shortName:
          type: string
        scopeRequirementInTokenRequest:
          type: string
          enum:
          - REQUIRED
          - OPTIONAL
          - NOT_ALLOWED
        requestParameterNames:
          uniqueItems: true
          type: array
          items:
            type: string
    JOSEObjectType:
      type: object
      properties:
        type:
          type: string
    Base64URL:
      type: object
    OIDCClientInformation:
      type: object
      properties:
        id:
          $ref: '#/components/schemas/ClientID'
        metadata:
          $ref: '#/components/schemas/ClientMetadata'
        secret:
          $ref: '#/components/schemas/Secret'
        registrationURI:
          type: string
          format: uri
        oidcmetadata:
          $ref: '#/components/schemas/OIDCClientMetadata'
        registrationAccessToken:
          $ref: '#/components/schemas/BearerAccessToken'
        idissueDate:
          type: string
          format: date-time
    ClientMetadata:
      type: object
      properties:
        scope:
          type: array
          properties:
            first:
              $ref: '#/components/schemas/Value'
            last:
              $ref: '#/components/schemas/Value'
            empty:
              type: boolean
          items:
            $ref: '#/components/schemas/Value'
        responseTypes:
          uniqueItems: true
          type: array
          items:
            type: array
            properties:
              empty:
                type: boolean
            items:
              $ref: '#/components/schemas/Value'
        grantTypes:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/GrantType'
        nameEntries:
          type: object
          additionalProperties:
            type: string
        logoURIEntries:
          type: object
          additionalProperties:
            type: string
            format: uri
        policyURIEntries:
          type: object
          additionalProperties:
            type: string
            format: uri
        signedJWKSetURI:
          type: string
          format: uri
        requestObjectURIs:
          uniqueItems: true
          type: array
          items:
            type: string
            format: uri
        requestObjectJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        requestObjectJWEAlg:
          $ref: '#/components/schemas/JWEAlgorithm'
        requestObjectJWEEnc:
          $ref: '#/components/schemas/EncryptionMethod'
        softwareID:
          $ref: '#/components/schemas/SoftwareID'
        softwareVersion:
          $ref: '#/components/schemas/SoftwareVersion'
        softwareStatement:
          $ref: '#/components/schemas/SignedJWT'
        backChannelTokenDeliveryMode:
          $ref: '#/components/schemas/BackChannelTokenDeliveryMode'
        backChannelClientNotificationEndpoint:
          type: string
          format: uri
        backChannelAuthRequestJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        clientRegistrationTypes:
          type: array
          items:
            $ref: '#/components/schemas/ClientRegistrationType'
        organizationName:
          type: string
        customFields:
          type: object
          properties:
            empty:
              type: boolean
          additionalProperties:
            type: object
        name:
          type: string
        uri:
          type: string
          format: uri
        tlsclientCertificateBoundAccessTokens:
          type: boolean
        redirectionURIs:
          uniqueItems: true
          type: array
          items:
            type: string
            format: uri
        emailContacts:
          type: array
          items:
            type: string
        urientries:
          type: object
          additionalProperties:
            type: string
            format: uri
        tokenEndpointAuthJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        tlsclientAuthSubjectDN:
          type: string
        tlsclientAuthSanDNS:
          type: string
        tlsclientAuthSanURI:
          type: string
        tlsclientAuthSanIP:
          type: string
        tlsclientAuthSanEmail:
          type: string
        dpoPBoundAccessTokens:
          type: boolean
        authorizationJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        authorizationJWEAlg:
          $ref: '#/components/schemas/JWEAlgorithm'
        authorizationJWEEnc:
          $ref: '#/components/schemas/EncryptionMethod'
        authorizationDetailsTypes:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizationType'
        logoURI:
          type: string
          format: uri
        policyURI:
          type: string
          format: uri
        termsOfServiceURI:
          type: string
          format: uri
        termsOfServiceURIEntries:
          type: object
          additionalProperties:
            type: string
            format: uri
        jwkset:
          $ref: '#/components/schemas/JWKSet'
        tokenEndpointAuthMethod:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
        jwksetURI:
          type: string
          format: uri
        supportsBackChannelUserCodeParam:
          type: boolean
          writeOnly: true
        redirectionURI:
          type: string
          format: uri
        redirectionURIStrings:
          uniqueItems: true
          type: array
          items:
            type: string
        mutualTLSSenderConstrainedAccessTokens:
          type: boolean
    KeyRevocation:
      type: object
      properties:
        reason:
          $ref: '#/components/schemas/Reason'
        revocationTime:
          type: string
          format: date-time
    Base64:
      type: object
    Privilege:
      type: object
      properties:
        value:
          type: string
    DataType:
      type: object
      properties:
        value:
          type: string
    JWSAlgorithm:
      type: object
      properties:
        name:
          type: string
        requirement:
          type: string
          enum:
          - REQUIRED
          - RECOMMENDED
          - OPTIONAL
    KeyUse:
      type: object
      properties:
        value:
          type: string
    OIDCClientMetadata:
      type: object
      properties:
        scope:
          type: array
          properties:
            first:
              $ref: '#/components/schemas/Value'
            last:
              $ref: '#/components/schemas/Value'
            empty:
              type: boolean
          items:
            $ref: '#/components/schemas/Value'
        responseTypes:
          uniqueItems: true
          type: array
          items:
            type: array
            properties:
              empty:
                type: boolean
            items:
              $ref: '#/components/schemas/Value'
        grantTypes:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/GrantType'
        nameEntries:
          type: object
          additionalProperties:
            type: string
        logoURIEntries:
          type: object
          additionalProperties:
            type: string
            format: uri
        policyURIEntries:
          type: object
          additionalProperties:
            type: string
            format: uri
        signedJWKSetURI:
          type: string
          format: uri
        requestObjectURIs:
          uniqueItems: true
          type: array
          items:
            type: string
            format: uri
        requestObjectJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        requestObjectJWEAlg:
          $ref: '#/components/schemas/JWEAlgorithm'
        requestObjectJWEEnc:
          $ref: '#/components/schemas/EncryptionMethod'
        softwareID:
          $ref: '#/components/schemas/SoftwareID'
        softwareVersion:
          $ref: '#/components/schemas/SoftwareVersion'
        softwareStatement:
          $ref: '#/components/schemas/SignedJWT'
        backChannelTokenDeliveryMode:
          $ref: '#/components/schemas/BackChannelTokenDeliveryMode'
        backChannelClientNotificationEndpoint:
          type: string
          format: uri
        backChannelAuthRequestJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        clientRegistrationTypes:
          type: array
          items:
            $ref: '#/components/schemas/ClientRegistrationType'
        organizationName:
          type: string
        customFields:
          type: object
          properties:
            empty:
              type: boolean
          additionalProperties:
            type: object
        applicationType:
          type: string
          enum:
          - native
          - web
        subjectType:
          type: string
          enum:
          - pairwise
          - public
          - ephemeral
        sectorIDURI:
          type: string
          format: uri
        userInfoJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        userInfoJWEAlg:
          $ref: '#/components/schemas/JWEAlgorithm'
        userInfoJWEEnc:
          $ref: '#/components/schemas/EncryptionMethod'
        defaultMaxAge:
          type: integer
          format: int32
        defaultACRs:
          type: array
          items:
            $ref: '#/components/schemas/ACR'
        initiateLoginURI:
          type: string
          format: uri
        frontChannelLogoutURI:
          type: string
          format: uri
        backChannelLogoutURI:
          type: string
          format: uri
        attachmentDigestAlg:
          $ref: '#/components/schemas/HashAlgorithm'
        idtokenJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        idtokenJWEAlg:
          $ref: '#/components/schemas/JWEAlgorithm'
        idtokenJWEEnc:
          $ref: '#/components/schemas/EncryptionMethod'
        postLogoutRedirectionURIs:
          uniqueItems: true
          type: array
          items:
            type: string
            format: uri
        name:
          type: string
        uri:
          type: string
          format: uri
        tlsclientCertificateBoundAccessTokens:
          type: boolean
        redirectionURIs:
          uniqueItems: true
          type: array
          items:
            type: string
            format: uri
        emailContacts:
          type: array
          items:
            type: string
        urientries:
          type: object
          additionalProperties:
            type: string
            format: uri
        tokenEndpointAuthJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        tlsclientAuthSubjectDN:
          type: string
        tlsclientAuthSanDNS:
          type: string
        tlsclientAuthSanURI:
          type: string
        tlsclientAuthSanIP:
          type: string
        tlsclientAuthSanEmail:
          type: string
        dpoPBoundAccessTokens:
          type: boolean
        authorizationJWSAlg:
          $ref: '#/components/schemas/JWSAlgorithm'
        authorizationJWEAlg:
          $ref: '#/components/schemas/JWEAlgorithm'
        authorizationJWEEnc:
          $ref: '#/components/schemas/EncryptionMethod'
        authorizationDetailsTypes:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizationType'
        logoURI:
          type: string
          format: uri
        policyURI:
          type: string
          format: uri
        termsOfServiceURI:
          type: string
          format: uri
        termsOfServiceURIEntries:
          type: object
          additionalProperties:
            type: string
            format: uri
        jwkset:
          $ref: '#/components/schemas/JWKSet'
        tokenEndpointAuthMethod:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
        jwksetURI:
          type: string
          format: uri
        supportsBackChannelUserCodeParam:
          type: boolean
          writeOnly: true
        redirectionURI:
          type: string
          format: uri
        redirectionURIStrings:
          uniqueItems: true
          type: array
          items:
            type: string
        mutualTLSSenderConstrainedAccessTokens:
          type: boolean
    SignedJWT:
      type: object
      properties:
        payload:
          $ref: '#/components/schemas/Payload'
        parsedParts:
          type: array
          items:
            $ref: '#/components/schemas/Base64URL'
        header:
          $ref: '#/components/schemas/JWSHeader'
        signature:
          $ref: '#/components/schemas/Base64URL'
        state:
          type: string
          enum:
          - UNSIGNED
          - SIGNED
          - VERIFIED
        jwtclaimsSet:
          $ref: '#/components/schemas/JWTClaimsSet'
        parsedString:
          type: string
        signingInput:
          type: string
          format: byte
    JWKSet:
      type: object
      properties:
        keys:
          type: array
          items:
            $ref: '#/components/schemas/JWK'
        empty:
          type: boolean
        additionalMembers:
          type: object
          additionalProperties:
            type: object
    Algorithm:
      type: object
      properties:
        name:
          type: string
        requirement:
          type: string
          enum:
          - REQUIRED
          - RECOMMENDED
          - OPTIONAL
    EncryptionMethod:
      type: object
      properties:
        name:
          type: string
        requirement:
          type: string
          enum:
          - REQUIRED
          - RECOMMENDED
          - OPTIONAL
    Payload:
      type: object
      properties:
        origin:
          type: string
          enum:
          - JSON
          - STRING
          - BYTE_ARRAY
          - BASE64URL
          - JWS_OBJECT
          - SIGNED_JWT
    SoftwareVersion:
      type: object
      properties:
        value:
          type: string
    AccessTokenType:
      type: object
      properties:
        value:
          type: string
    BearerAccessToken:
      type: object
      properties:
        value:
          type: string
        type:
          $ref: '#/components/schemas/AccessTokenType'
        lifetime:
          type: integer
          format: int64
        scope:
          type: array
          properties:
            first:
              $ref: '#/components/schemas/Value'
            last:
              $ref: '#/components/schemas/Value'
            empty:
              type: boolean
          items:
            $ref: '#/components/schemas/Value'
        authorizationDetails:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizationDetail'
        issuedTokenType:
          $ref: '#/components/schemas/TokenTypeURI'
        parameterNames:
          uniqueItems: true
          type: array
          items:
            type: string
        customParameters:
          type: object
          additionalProperties:
            type: object
    Reason:
      type: object
      properties:
        value:
          type: string
    AuthorizationType:
      type: object
      properties:
        value:
          type: string
        uri:
          type: string
          format: uri
    ACR:
      type: object
      properties:
        value:
          type: string
    JWK:
      type: object
      properties:
        keyStore:
          type: object
          properties:
            type:
              type: string
            provider:
              type: object
              additionalProperties:
                type: string
        expirationTime:
          type: string
          format: date-time
        private:
          type: boolean
        algorithm:
          $ref: '#/components/schemas/Algorithm'
        keyType:
          $ref: '#/components/schemas/KeyType'
        keyID:
          type: string
        x509CertURL:
          type: string
          format: uri
        x509CertThumbprint:
          $ref: '#/components/schemas/Base64URL'
        x509CertSHA256Thumbprint:
          $ref: '#/components/schemas/Base64URL'
        x509CertChain:
          type: array
          items:
            $ref: '#/components/schemas/Base64'
        notBeforeTime:
          type: string
          format: date-time
        issueTime:
          type: string
          format: date-time
        keyUse:
          $ref: '#/components/schemas/KeyUse'
        keyOperations:
          uniqueItems: true
          type: array
          items:
            type: string
            enum:
            - sign
            - verify
            - encrypt
            - decrypt
            - wrapKey
            - unwrapKey
            - deriveKey
            - deriveBits
        parsedX509CertChain:
          type: array
          items:
            type: object
            properties:
              subjectDN:
                type: object
                properties:
                  name:
                    type: string
              issuerDN:
                type: object
                properties:
                  name:
                    type: string
              tbscertificate:
                type: string
                format: byte
              sigAlgName:
                type: string
              sigAlgOID:
                type: string
              issuerUniqueID:
                type: array
                items:
                  type: boolean
              subjectUniqueID:
                type: array
                items:
                  type: boolean
              subjectAlternativeNames:
                type: array
                items:
                  type: array
                  items:
                    type: object
              issuerAlternativeNames:
                type: array
                items:
                  type: array
                  items:
                    type: object
              sigAlgParams:
                type: string
                format: byte
              notBefore:
                type: string
                format: date-time
              notAfter:
                type: string
                format: date-time
              extendedKeyUsage:
                type: array
                items:
                  type: string
              keyUsage:
                type: array
                items:
                  type: boolean
              signature:
                type: string
                format: byte
              basicConstraints:
                type: integer
                format: int32
              issuerX500Principal:
                type: object
                properties:
                  name:
                    type: string
                  encoded:
                    type: string
                    format: byte
              subjectX500Principal:
                type: object
                properties:
                  name:
                    type: string
                  encoded:
                    type: string
                    format: byte
              version:
                type: integer
                format: int32
              serialNumber:
                type: integer
              nonCriticalExtensionOIDs:
                uniqueItems: true
                type: array
                items:
                  type: string
              criticalExtensionOIDs:
                uniqueItems: true
                type: array
                items:
                  type: string
              type:
                type: string
              encoded:
                type: string
                format: byte
              publicKey:
                type: object
                properties:
                  encoded:
                    type: string
                    format: byte
                  format:
                    type: string
                  algorithm:
                    type: string
        keyRevocation:
          $ref: '#/components/schemas/KeyRevocation'
        requiredParams:
          type: object
          additionalProperties:
            type: object
    BackChannelTokenDeliveryMode:
      type: object
      properties:
        value:
          type: string
externalDocs:
  description: OpenID Connect 1.0 specifications
  url: https://openid.net/connect/