openapi: 3.0.0
info:
  title: Fence OpenAPI Specification admin/user login API
  version: 0.1.0
  description: Access management for Gen3 data commons. Code is available on [GitHub](https://github.com/uc-cdis/fence).
  termsOfService: http://cdis.uchicago.edu/terms/
  contact:
    email: cdis@uchicago.edu
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://example.domain/
tags:
- name: login
paths:
  /login/shib:
    get:
      tags:
      - login
      summary: Initiate login via shibboleth provider
      description: 'NOTE that this endpoint only exists if shibboleth is enabled as an

        identity provider in the fence config. Currently this only happens for

        `login.bionimbus.org`.

        '
      parameters:
      - name: shib_idp
        required: false
        in: query
        description: Identifier for the shibboleth IDP. Available identifiers are what is listed by the `login.bionimbus.org/Shibboleth.sso/DiscoFeed` endpoint. If no `shib_idp` is specified, defaults to NIH login.
        schema:
          type: string
        example: urn:mace:incommon:uchicago.edu
      responses:
        302:
          description: redirect to external identity provider
  /login/fence:
    get:
      tags:
      - login
      summary: Initiate login via Fence provider (multi-tenant Fence)
      description: 'NOTE that this endpoint only exists if fence is enabled as an

        identity provider in the fence config.

        '
      parameters:
      - name: idp
        required: false
        in: query
        description: Identifier for the IDP. Specifying `idp=shibboleth` lets us specify a `shib_idp`. If no `idp` is specified, defaults to NIH login.
        schema:
          type: string
        example: shibboleth
      - name: shib_idp
        required: false
        in: query
        description: Identifier for the shibboleth IDP. Available identifiers are what is listed by the `login.bionimbus.org/Shibboleth.sso/DiscoFeed` endpoint. If no `shib_idp` is specified, defaults to NIH login.
        schema:
          type: string
        example: urn:mace:incommon:uchicago.edu
      responses:
        302:
          description: redirect to external identity provider
components:
  securitySchemes:
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: /oauth/authorize
          tokenUrl: /oauth/token
          scopes:
            user: generic user access