openapi: 3.0.0
info:
  title: Fence OpenAPI Specification admin/ user API
  version: 0.1.0
  description: Access management for Gen3 data commons. Code is available on [GitHub](https://github.com/uc-cdis/fence).
  termsOfService: http://cdis.uchicago.edu/terms/
  contact:
    email: cdis@uchicago.edu
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://example.domain/
tags:
- name: user
  description: User information
paths:
  /user:
    get:
      tags:
      - user
      summary: Return info about the current user
      description: '**IMPORTANT NOTE**: These docs are provided as a courtesy but do _NOT_ include the entirety of the OIDC Standard simply because of its length and complexity.

        Please [refer to the standard](https://openid.net/specs/openid-connect-core-1_0.html) for complete details.'
      security:
      - OAuth2:
        - user
      operationId: getUserInfo
      responses:
        '200':
          description: successful operation
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/UserInfo'
components:
  schemas:
    UserInfo:
      type: object
      required:
      - user_id
      - idp
      - sub
      - username
      - name
      - display_name
      - preferred_username
      - phone_number
      - email
      - is_admin
      - role
      - project_access
      - certificates_uploaded
      - resources_granted
      - groups
      - message
      properties:
        user_id:
          type: number
          description: This value is deprecated in favor of sub.
        idp:
          type: string
          description: 'The Identity Provider used to autheticate the user. Given instances of Fence

            may or may not have all of these available (the set of IDPs available is a configuration).


            * *google* - Google/GSuite

            * *ras* - NIH''s Researcher Auth Service (RAS)

            * *itrust* - NIH Login / iTrust / eRA Commons

            * *fence* - Upstream Fence (the idp used depends on the specific configuration, consult the Gen3 Operators)

            * *orcid* - ORCHID

            * *microsoft* - Microsoft

            * *elixir* - Elixir

            * *synapse* - Synapse

            * *cognito* - AWS Cognito

            * More may be added in the future...

            '
        sub:
          type: string
          description: Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the end-user.
        username:
          type: string
          description: This value is deprecated in favor of name.
        name:
          type: string
          description: The full name of the end-user.
        display_name:
          type: string
          description: The display name of the end-user.
        preferred_username:
          type: string
          description: The preferred username of the end-user.
        phone_number:
          type: string
          description: The phone number of the end-user.
        email:
          type: string
          description: The email of the end-user
        is_admin:
          type: boolean
          description: Boolean value stating if end-user is an admin or not
        active:
          type: boolean
          description: Boolean value stating if user is active or not
        role:
          type: string
          description: ''
        project_access:
          type: object
          description: This value is deprecated in favor of authz and resources.
        certificates_uploaded:
          type: array
          items:
            type: string
        resources_granted:
          type: array
          items:
            type: string
        groups:
          type: array
          items:
            type: string
        message:
          type: string
        primary_google_service_account:
          type: string
          description: email address of the users primary service account used for signing URLs
        authz:
          type: object
          description: end user authorization information, mapping of resource name to list of permission, service roles
        resources:
          type: array
          items:
            type: string
          description: list of resource paths the user has access to
        tags:
          type: object
          description: User's tags
        azp:
          type: string
          description: authorized party - the party to which the ID token was issued.
  securitySchemes:
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: /oauth/authorize
          tokenUrl: /oauth/token
          scopes:
            user: generic user access