openapi: 3.0.3
info:
  title: Rokwire Core Building Block Admin Third-Party Services API
  description: Core Building Block API Documentation
  version: 1.62.0
servers:
- url: https://api.rokwire.illinois.edu/core
tags:
- name: Third-Party Services
  description: APIs consumed by third-party services.
paths:
  /tps/service-regs:
    get:
      tags:
      - Third-Party Services
      summary: Get service registrations
      description: 'Returns service registration records

        '
      parameters:
      - name: ids
        in: query
        description: A comma-separated list of service IDs to return registrations for
        required: true
        style: form
        explode: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuthServiceReg'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '500':
          description: Internal error
  /tps/auth-keys:
    get:
      tags:
      - Third-Party Services
      summary: Get auth public key
      description: 'Returns auth public key in JWKS format

        '
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JWKS'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '500':
          description: Internal error
  /tps/service-account/{id}:
    post:
      tags:
      - Third-Party Services
      summary: Get service account params
      description: 'Returns service account parameters

        '
      parameters:
      - name: id
        in: path
        description: ID of the service account
        required: true
        style: simple
        explode: false
        schema:
          type: string
      requestBody:
        description: 'Service account credentials

          '
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/_services_req_service-accounts_params'
            examples:
              static_token:
                summary: Static token
                value:
                  auth_type: static_token
                  creds:
                    token: account_token
              signature:
                summary: Signature
                value:
                  auth_type: signature
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AppOrgPair'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '500':
          description: Internal error
  /tps/access-token:
    post:
      tags:
      - Third-Party Services
      summary: Get service account access token
      description: 'Returns a new service account access token

        '
      requestBody:
        description: 'Service account credentials

          '
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/_services_req_service-accounts_access-token'
            examples:
              static_token:
                summary: Static token
                value:
                  account_id: service_account_id
                  app_id: '9766'
                  org_id: 0a2eff20-e2cd-11eb-af68-60f81db5ecc0
                  auth_type: static_token
                  creds:
                    token: account_token
              signature:
                summary: Signature
                value:
                  account_id: service_account_id
                  app_id: '9766'
                  org_id: 0a2eff20-e2cd-11eb-af68-60f81db5ecc0
                  auth_type: signature
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_shared_res_RokwireToken'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '500':
          description: Internal error
  /tps/access-tokens:
    post:
      tags:
      - Third-Party Services
      summary: Get all service account access tokens
      description: 'Returns a new service account access token for all authorized app org pairs

        '
      requestBody:
        description: 'Service account credentials

          '
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/_services_req_service-accounts_access-tokens'
            examples:
              static_token:
                summary: Static token
                value:
                  account_id: service_account_id
                  auth_type: static_token
                  creds:
                    token: account_token
              signature:
                summary: Signature
                value:
                  account_id: service_account_id
                  auth_type: signature
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/_services_res_service-accounts_access-tokens'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '500':
          description: Internal error
  /tps/accounts:
    post:
      tags:
      - Third-Party Services
      summary: Finds user accounts
      description: 'Finds accounts for the given app_id and org_id (query or token)


        **Auth:** Requires service access token with `get_accounts` or `all_accounts` permission

        '
      security:
      - bearerAuth: []
      parameters:
      - name: app_id
        in: query
        description: The application ID to use to filter accounts
        required: false
        style: form
        explode: false
        schema:
          type: string
      - name: org_id
        in: query
        description: The organization ID to use to filter accounts
        required: false
        style: form
        explode: false
        schema:
          type: string
      - name: limit
        in: query
        description: The maximum number of accounts to return
        required: false
        style: form
        explode: false
        schema:
          type: integer
      - name: offset
        in: query
        description: The index of the first account to return
        required: false
        style: form
        explode: false
        schema:
          type: integer
      requestBody:
        description: 'Service account credentials

          '
        content:
          application/json:
            schema:
              type: object
            examples:
              single_value:
                summary: Multiple single-value search parameters
                value:
                  profile.first_name: Example
                  preferences.privacy_level: 4
                  external_ids.uin: '123456789'
              multiple_value:
                summary: Some single-value, some multi-value search parameters
                value:
                  profile.first_name: Example
                  preferences.privacy_level:
                  - 3
                  - 4
                  - 5
                  external_ids.uin: '123456789'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Internal error
  /tps/accounts/count:
    post:
      tags:
      - Third-Party Services
      summary: Finds the count of user accounts
      description: 'Finds the count of accounts for the given app_id and org_id (query or token)


        **Auth:** Requires service access token with `get_accounts_count` or `get_accounts_count_limited` permission

        '
      security:
      - bearerAuth: []
      parameters:
      - name: app_id
        in: query
        description: The application ID to use to filter accounts
        required: false
        style: form
        explode: false
        schema:
          type: string
      - name: org_id
        in: query
        description: The organization ID to use to filter accounts
        required: false
        style: form
        explode: false
        schema:
          type: string
      requestBody:
        description: 'Service account credentials

          '
        content:
          application/json:
            schema:
              type: object
            examples:
              single_value:
                summary: Multiple single-value search parameters
                value:
                  profile.first_name: Example
                  preferences.privacy_level: 4
                  external_ids.uin: '123456789'
              multiple_value:
                summary: Some single-value, some multi-value search parameters
                value:
                  profile.first_name: Example
                  preferences.privacy_level:
                  - 3
                  - 4
                  - 5
                  external_ids.uin: '123456789'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: integer
        '400':
          description: Bad request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Internal error
components:
  schemas:
    _shared_res_RokwireToken:
      type: object
      properties:
        access_token:
          description: The user's access token to be provided to authorize access to ROKWIRE APIs
          type: string
        refresh_token:
          description: A refresh token that can be used to get a new access token once the one provided expires
          type: string
        token_type:
          description: The type of the provided tokens to be specified when they are sent in the "Authorization" header
          type: string
          enum:
          - Bearer
    AppOrgPair:
      required:
      - app_id
      - org_id
      type: object
      properties:
        app_id:
          type: string
        org_id:
          type: string
    PubKey:
      required:
      - key_pem
      - alg
      type: object
      properties:
        key_pem:
          type: string
        alg:
          type: string
    JWKParamsRSA:
      type: object
      description: JSON Web Key RSA parameters
      properties:
        n:
          type: string
          description: The modulus of the key - Base64URL encoded
        e:
          type: string
          description: The exponent of the key - Base64URL encoded
    JWKParamsEC:
      type: object
      description: JSON Web Key EC parameters
      properties:
        crv:
          type: string
          description: The curve used with the key
        x:
          type: string
          description: x coordinate of the key - Base64URL encoded
        y:
          type: string
          description: y coordinate of the key - Base64URL encoded
    _services_req_service-accounts_access-tokens:
      required:
      - account_id
      - auth_type
      type: object
      properties:
        account_id:
          type: string
        auth_type:
          type: string
          enum:
          - static_token
          - signature
        creds:
          $ref: '#/components/schemas/_services_service-accounts_CredsStaticToken'
    _services_req_service-accounts_params:
      required:
      - auth_type
      type: object
      properties:
        auth_type:
          type: string
          enum:
          - static_token
          - signature
        creds:
          $ref: '#/components/schemas/_services_service-accounts_CredsStaticToken'
    _services_res_service-accounts_access-tokens:
      required:
      - app_id
      - org_id
      - token
      type: object
      properties:
        app_id:
          type: string
        org_id:
          type: string
        token:
          $ref: '#/components/schemas/_shared_res_RokwireToken'
    JWKS:
      required:
      - keys
      type: object
      description: JSON Web Key Set (JWKS)
      properties:
        keys:
          type: array
          items:
            $ref: '#/components/schemas/JWK'
    JWKParamsOKP:
      type: object
      description: JSON Web Key OKP parameters
      properties:
        crv:
          type: string
          description: The curve used with the key
        x:
          type: string
          description: x coordinate of the key - Base64URL encoded
    _services_req_service-accounts_access-token:
      required:
      - account_id
      - app_id
      - org_id
      - auth_type
      type: object
      properties:
        account_id:
          type: string
        app_id:
          type: string
        org_id:
          type: string
        auth_type:
          type: string
          enum:
          - static_token
          - signature
        creds:
          $ref: '#/components/schemas/_services_service-accounts_CredsStaticToken'
    AuthServiceReg:
      required:
      - service_id
      - host
      type: object
      description: Service registration record used for auth
      properties:
        service_id:
          type: string
        service_account_id:
          type: string
        host:
          type: string
        pub_key:
          $ref: '#/components/schemas/PubKey'
    _services_service-accounts_CredsStaticToken:
      required:
      - token
      type: object
      description: Service account token for auth_type="static_token"
      properties:
        token:
          type: string
    JWK:
      type: object
      allOf:
      - $ref: '#/components/schemas/JWKParamsEC'
      - $ref: '#/components/schemas/JWKParamsOKP'
      - $ref: '#/components/schemas/JWKParamsRSA'
      - required:
        - kty
        - use
        - alg
        - kid
        description: JSON Web Key (JWK)
        properties:
          kty:
            type: string
            description: The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key
            enum:
            - RSA
            - EC
            - OKP
          use:
            type: string
            description: The "use" (public key use) parameter identifies the intended use of the public key
            enum:
            - sig
          alg:
            type: string
            description: The "alg" (algorithm) parameter identifies the algorithm intended for use with the key
            enum:
            - RS256
            - RS384
            - RS512
            - PS256
            - PS384
            - PS512
            - ES256
            - ES384
            - ES512
            - OKP
          kid:
            type: string
            description: The "kid" (key ID) parameter is used to match a specific key
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT