openapi: 3.2.0
info:
  title: Weavr Webhook Login API
  description: For Verification, create a base64 hash using HmacSHA256 using Published-Timestamp header as message and your API key as secret. The result should match the Signature header.
  contact:
    name: Weavr
    url: https://weavr.io
  version: v2
  x-logo:
    url: https://storage.googleapis.com/weavr-cdn/weavr_logo-new.png
    backgroundColor: '#FFFFFF'
    altText: Weavr
servers:
- url: '""'
tags:
- name: Login
paths: {}
webhooks:
  /login/watch:
    post:
      tags:
      - Login
      summary: Login attempt
      description: Notification that a login attempt was completed successfully or declined.
      operationId: login_watch
      parameters:
      - $ref: '#/components/parameters/call-ref'
      - $ref: '#/components/parameters/published-timestamp'
      - $ref: '#/components/parameters/signature'
      - $ref: '#/components/parameters/signature-v2'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginEvent'
        required: true
      responses:
        '204':
          description: Success - No Content
components:
  parameters:
    signature:
      name: signature
      in: header
      description: The signature to verify the authenticity of this request.  This is the base64 hash (HmacSHA256) of the `published-timestamp` using your API key.
      required: true
      style: simple
      explode: false
      deprecated: true
      schema:
        type: string
    signature-v2:
      name: signature-v2
      in: header
      description: The signature to verify the authenticity of this request.  This is the base64 hash (HmacSHA256) of the `call-ref + payload + published-timestamp` using your API key.
      required: true
      style: simple
      explode: false
      schema:
        type: string
    call-ref:
      description: A call reference generated by the caller and unique to the caller to provide correlation between the caller and system with a maximum length of 255
      in: header
      name: call-ref
      required: false
      schema:
        type: string
    published-timestamp:
      name: published-timestamp
      in: header
      description: The timestamp, expressed in Epoch timestamp using millisecond precision, when this event was published.
      required: true
      style: simple
      explode: false
      schema:
        type: integer
        format: int64
  schemas:
    StringWrappedTypeId:
      required:
      - type
      - id
      type: object
      properties:
        type:
          maxLength: 50
          pattern: ^[a-zA-Z0-9_-]+$
          type: string
        id:
          type: string
          pattern: ^[0-9]+$
    LoginEventLoginEventStatus:
      type: string
      enum:
      - VERIFIED
      - DECLINED
      - EXPIRED
    LoginEvent:
      required:
      - credential
      - publishedTimestamp
      - status
      - type
      type: object
      properties:
        credential:
          $ref: '#/components/schemas/CredentialId'
        identity:
          $ref: '#/components/schemas/StringWrappedTypeId'
        type:
          type: string
          description: Login type can be with password or with auth/access token
        status:
          $ref: '#/components/schemas/LoginEventLoginEventStatus'
        publishedTimestamp:
          type: string
          pattern: ^[0-9]+$
          description: Epoch timestamp using millisecond precision.
    CredentialId:
      required:
      - type
      - id
      type: object
      properties:
        type:
          maxLength: 50
          pattern: ^[a-zA-Z0-9_-]+$
          type: string
          enum:
          - ROOT
          - USER
          - API_CLIENT
          description: The type of user.
        id:
          type: string
          pattern: ^[0-9]+$
          description: The identifier of the user.
x-tagGroups:
- name: Webhooks
  tags:
  - Corporates
  - Consumers
  - Managed Cards
  - Managed Accounts
  - Transfers
  - Sends
  - Outgoing Wire Transfers
  - Correspondent Bank Transfers
  - Manual Transactions
  - Fees
  - Login
  - Stepup
  - Authentication Factors
  - Trusted Payees
  - Bulk Operations
  - Authorised Users