openapi: 3.1.0
info:
  title: VMware Tanzu Service Mesh Authentication API
  description: The VMware Tanzu Service Mesh REST API provides programmatic management of Kubernetes clusters onboarded to Tanzu Service Mesh, global namespaces spanning multiple clusters and clouds, resource groups for policy enforcement, and service groups. Authentication uses a CSP API token exchanged for a short-lived Bearer token passed via the csp-auth-token header.
  version: v1alpha1
  contact:
    name: VMware Tanzu Support
    url: https://tanzu.vmware.com/support
  license:
    name: Proprietary
    url: https://tanzu.vmware.com/
servers:
- url: https://prod-2.nsxservicemesh.vmware.com
  description: VMware Tanzu Service Mesh Production API
tags:
- name: Authentication
  description: Exchange CSP API tokens for Bearer access tokens
paths:
  /csp/gateway/am/api/auth/api-tokens/authorize:
    post:
      operationId: exchangeApiToken
      summary: Exchange API Token for Access Token
      description: Exchange a long-lived CSP API token for a short-lived Bearer access token. The returned token must be used in the csp-auth-token header for all subsequent API calls.
      tags:
      - Authentication
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - refresh_token
              properties:
                refresh_token:
                  type: string
                  description: Your long-lived CSP API token.
      responses:
        '200':
          description: Access token response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  responses:
    Unauthorized:
      description: Invalid or expired csp-auth-token
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Invalid request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    TokenResponse:
      type: object
      description: OAuth access token response from CSP token exchange.
      properties:
        access_token:
          type: string
          description: Short-lived Bearer access token. Use in csp-auth-token header.
        token_type:
          type: string
          description: Token type (always bearer).
        expires_in:
          type: integer
          description: Token lifetime in seconds.
        scope:
          type: string
    Error:
      type: object
      properties:
        code:
          type: integer
        message:
          type: string
        details:
          type: string
  securitySchemes:
    CspAuthToken:
      type: apiKey
      in: header
      name: csp-auth-token
      description: Short-lived Bearer token obtained by exchanging a CSP API token via POST /csp/gateway/am/api/auth/api-tokens/authorize.
externalDocs:
  description: Tanzu Service Mesh API Documentation
  url: https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/api-programming-guide/GUID-6C5044B8-6950-42A6-87A5-3D88BEAE09DB.html