openapi: 3.0.0
info:
  version: '1.176'
  title: API Documentation appointments credentials API
  description: Endpoints for booking, cancelling, and rescheduling appointments, including retrieving current appointment statuses and updated information.
servers:
- url: https://api-developer-sandbox.zocdoc.com
  description: Sandbox
- url: https://api-developer.zocdoc.com
  description: Production
tags:
- name: credentials
  description: Endpoints for managing API credentials.
  x-displayName: Credentials
paths:
  /v1/credentials/rotate:
    post:
      tags:
      - credentials
      security:
      - ClientCredentialsFlow:
        - external.credential.rotate
      description: 'Rotate the client secret for the authenticated external API client.

        '
      operationId: rotateCredentials
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RotateCredentialBody'
      responses:
        '200':
          description: Credential rotated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RotateCredentialResult'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResult'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResult'
        '404':
          description: Client not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResult'
        '500':
          description: Internal server error
      summary: Rotate Credentials
components:
  schemas:
    ErrorType:
      type: string
      enum:
      - api_error
      - invalid_request
    BaseResult:
      required:
      - request_id
      type: object
      properties:
        request_id:
          type: string
          description: Unique request identifier for tracing
    RotateCredentialResultData:
      type: object
      required:
      - application_client_id
      - client_secret
      properties:
        application_client_id:
          type: string
          description: The Auth0 application client ID.
          example: abc123xyz
        client_secret:
          type: string
          description: The newly rotated client secret.
          example: AiOiJSUzI1NiIsInR5cCI6IkpXVCJ9
    Error:
      required:
      - message
      type: object
      properties:
        field:
          type: string
        message:
          type: string
    ErrorResult:
      allOf:
      - $ref: '#/components/schemas/BaseResult'
      - type: object
        required:
        - error_type
        - errors
        properties:
          error_type:
            $ref: '#/components/schemas/ErrorType'
          errors:
            type: array
            items:
              $ref: '#/components/schemas/Error'
    RotateCredentialBody:
      type: object
      required:
      - application_client_id
      properties:
        application_client_id:
          type: string
          description: The Auth0 application client ID whose secret should be rotated.
          example: abc123xyz
    RotateCredentialResult:
      allOf:
      - $ref: '#/components/schemas/BaseResult'
      - type: object
        required:
        - data
        properties:
          data:
            $ref: '#/components/schemas/RotateCredentialResultData'
  securitySchemes:
    ClientCredentialsFlow:
      type: oauth2
      description: 'Machine to machine authentication (for use from client server to Zocdoc).

        Production: `https://auth.zocdoc.com/oauth/token`

        Sandbox: `https://auth-api-developer-sandbox.zocdoc.com/oauth/token`

        '
      flows:
        clientCredentials:
          tokenUrl: https://auth.zocdoc.com/oauth/token
          scopes:
            external.credential.rotate: Rotate the authenticated client secret.
            external.appointment.write: Book and modify appointments.
            external.appointment.read: Read basic details of your appointments.
            external.anonymous_token.write: Create anonymous tokens used for discovery endpoints.
            external.provider_insurance.write: Update the insurance accepted by a provider.
            external.schedulable_entity.read: Read schedulable entities.
    AuthorizationCodeFlow:
      type: oauth2
      description: 'Log in as a user. Client Secret is not necessary for this login flow.

        Production: `https://auth.zocdoc.com`

        Sandbox: `https://auth-api-developer-sandbox.zocdoc.com`

        '
      flows:
        authorizationCode:
          x-usePkce: true
          tokenUrl: https://auth.zocdoc.com/oauth/token
          authorizationUrl: https://auth.zocdoc.com/authorize
          scopes:
            external.appointment.write: Book and modify appointments.
            external.appointment.read: Read basic details of your appointments.
            external.schedulable_entity.read: Read schedulable entities.