swagger: '2.0' info: version: 5.25.2 title: IO API for App contact: name: Digital Transformation Team url: https://forum.italia.it/c/progetto-io x-logo: url: https://io.italia.it/assets/img/io-logo-blue.svg description: > # Warning **This is an experimental API that is (most probably) going to change as we evolve the IO platform.** # Introduction This is the documentation of the IO API for App. host: api.cd.italia.it basePath: /api/v1 schemes: - https security: - SubscriptionKey: [] paths: /profiles/{fiscal_code}: get: operationId: getProfile summary: GetProfile description: Retrieve a user profile tags: - restricted parameters: - $ref: '#/parameters/FiscalCode' responses: '200': description: Profile created schema: $ref: '#/definitions/ExtendedProfile' '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '404': description: No message found. schema: $ref: '#/definitions/ProblemJson' '429': description: Too many requests '500': description: Server Error schema: $ref: '#/definitions/ProblemJson' post: operationId: createProfile summary: CreateProfile description: Create a new user profile tags: - restricted parameters: - $ref: '#/parameters/FiscalCode' - in: body name: body schema: $ref: '#/definitions/NewProfile' responses: '200': description: Profile created schema: $ref: '#/definitions/ExtendedProfile' '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '409': description: Conflict '429': description: Too many requests put: operationId: updateProfile summary: UpdateProfile description: Update a user profile tags: - restricted parameters: - $ref: '#/parameters/FiscalCode' - in: body name: body schema: $ref: '#/definitions/UpdateProfileParams' responses: '200': description: Profile updated schema: $ref: '#/definitions/ExtendedProfile' '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '404': description: Not found '409': description: Conflict '412': description: Precondition Failed schema: $ref: '#/definitions/ProblemJson' '429': description: Too many requests /profiles/{fiscal_code}/services/{service_id}/preferences: get: operationId: getServicePreferences summary: getServicePreferences description: Retrieve the User's preferences for a given Service Id tags: - restricted parameters: - $ref: '#/parameters/FiscalCode' - $ref: '#/parameters/ServiceId' responses: '200': description: The User's Service Preference schema: $ref: '#/definitions/ServicePreference' '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '404': description: Profile or Service not found schema: $ref: '#/definitions/ProblemJson' '409': description: >- Conflict. Either the provided preference setting version is not consistent with the current version stored in the Profile or the Profile is not in the correct preference mode. schema: $ref: '#/definitions/ProblemJson' '429': description: Too many requests post: operationId: upsertServicePreferences summary: getServicePreferences description: Either insert or update User's preferences for a given Service Id tags: - restricted parameters: - $ref: '#/parameters/FiscalCode' - $ref: '#/parameters/ServiceId' - in: body name: body schema: $ref: '#/definitions/UpsertServicePreference' responses: '200': description: User's Service Preference Upserted schema: $ref: '#/definitions/ServicePreference' '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '404': description: Profile or Service not found schema: $ref: '#/definitions/ProblemJson' '409': description: >- Conflict. Either the provided preference setting version is not consistent with the current version stored in the Profile or the Profile is not in the correct preference mode. schema: $ref: '#/definitions/ProblemJson' '429': description: Too many requests /email-validation-process/{fiscal_code}: post: operationId: startEmailValidationProcess summary: StartEmailValidationProcess description: |- Start the email validation process that create the validation token and send the validation email tags: - restricted parameters: - $ref: '#/parameters/FiscalCode' - in: body name: body schema: $ref: '#/definitions/EmailValidationProcessParams' responses: '202': description: Request accepted '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '404': description: Not found '429': description: Too many requests '500': description: Server Error schema: $ref: '#/definitions/ProblemJson' /user-data-processing/{fiscal_code}: post: operationId: upsertUserDataProcessing summary: UpsertUserDataProcessing description: Upsert a user data processing tags: - restricted parameters: - $ref: '#/parameters/FiscalCode' - in: body name: body schema: $ref: '#/definitions/UserDataProcessingChoiceRequest' description: The request wrapper of a user data processing choice. responses: '200': description: UserDataProcessing created schema: $ref: '#/definitions/UserDataProcessing' '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '409': description: Conflict schema: $ref: '#/definitions/ProblemJson' '429': description: Too many requests '500': description: Server Error schema: $ref: '#/definitions/ProblemJson' /user-data-processing/{fiscal_code}/{choice}: get: operationId: getUserDataProcessing summary: GetUserDataProcessing description: Retrieve user data processing tags: - restricted parameters: - $ref: '#/parameters/FiscalCode' - $ref: '#/parameters/UserDataProcessingChoiceParam' responses: '200': description: User data processing retrieved schema: $ref: '#/definitions/UserDataProcessing' '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '404': description: No message found. schema: $ref: '#/definitions/ProblemJson' '429': description: Too many requests delete: operationId: abortUserDataProcessing summary: AbortUserDataProcessing description: Ask for a request to abort, if present tags: - restricted parameters: - $ref: '#/parameters/FiscalCode' - $ref: '#/parameters/UserDataProcessingChoiceParam' responses: '202': description: The abort request has been recorded '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '404': description: Not Found '409': description: Conflict schema: $ref: '#/definitions/ProblemJson' '429': description: Too many requests '500': description: Server Error schema: $ref: '#/definitions/ProblemJson' /notify-login: post: operationId: startNotifyLoginProcess description: >- Initiate the Orchestrator to send an email to the user regarding a recently performed login. tags: - restricted parameters: - in: body name: body schema: $ref: '#/definitions/UserLoginParams' responses: '202': description: Request accepted '400': description: Invalid request. schema: $ref: '#/definitions/ProblemJson' '401': description: Unauthorized '404': description: Not found '429': description: Too many requests '500': description: Server Error schema: $ref: '#/definitions/ProblemJson' consumes: - application/json produces: - application/json securityDefinitions: SubscriptionKey: type: apiKey name: X-Functions-Key in: header description: The API key obtained through the developer portal. parameters: FiscalCode: name: fiscal_code in: path type: string maxLength: 16 minLength: 16 required: true description: The fiscal code of the user, all upper case. pattern: >- [A-Z]{6}[0-9LMNPQRSTUV]{2}[ABCDEHLMPRST][0-9LMNPQRSTUV]{2}[A-Z][0-9LMNPQRSTUV]{3}[A-Z] x-example: SPNDNL80R13C555X ServiceId: name: service_id in: path type: string required: true description: The ID of an existing Service. PaginationRequest: name: cursor in: query type: string minimum: 1 description: An opaque identifier that points to the next item in the collection. x-example: 01BX9NSMKVXXS5PSP2FATZM123 PageSize: type: integer name: page_size in: query minimum: 1 maximum: 100 description: How many items a page should include. UserDataProcessingChoiceParam: name: choice in: path type: string enum: - DOWNLOAD - DELETE description: A representation of a user data processing choice required: true x-example: DOWNLOAD definitions: UpdateProfileParams: allOf: - $ref: '#/definitions/Profile' - $ref: '#/definitions/EmailValidationProcessParams' UserLoginParams: type: object description: All the data related to a newly performed login properties: fiscal_code: $ref: '#/definitions/FiscalCode' name: type: string minLength: 1 family_name: type: string minLength: 1 email: $ref: '#/definitions/EmailAddress' identity_provider: type: string minLength: 1 ip_address: $ref: '#/definitions/IPAddress' device_name: type: string minLength: 1 is_email_validated: $ref: '#/definitions/IsEmailValidated' required: - fiscal_code - name - family_name - email - identity_provider - ip_address IPAddress: type: string description: An IP address. format: IPString x-import: '@pagopa/ts-commons/lib/strings' example: 127.0.0.1 EmailValidationProcessParams: type: object properties: name: type: string required: - name LimitedProfile: description: |- Describes the citizen's profile, mostly interesting for preferences attributes. type: object properties: sender_allowed: type: boolean description: |- True in case the service that made the request can send messages to the user identified by this profile (false otherwise). preferred_languages: $ref: '#/definitions/PreferredLanguages' required: - sender_allowed CIDR: type: string description: Describes a single IP or a range of IPs. pattern: ^([0-9]{1,3}[.]){3}[0-9]{1,3}(/([0-9]|[1-2][0-9]|3[0-2]))?$ ServicePayload: description: A payload used to create/update a service for a user. x-one-of: true allOf: - $ref: '#/definitions/VisibleServicePayload' - $ref: '#/definitions/HiddenServicePayload' ExtendedServicePayload: allOf: - $ref: '#/definitions/ServicePayload' - type: object properties: service_metadata: $ref: '#/definitions/ServiceMetadata' CommonServicePayload: description: Common properties for a ServicePayload type: object properties: service_name: $ref: '#/definitions/ServiceName' department_name: $ref: '#/definitions/DepartmentName' organization_name: $ref: '#/definitions/OrganizationName' organization_fiscal_code: $ref: '#/definitions/OrganizationFiscalCode' authorized_cidrs: description: >- Allowed source IPs or CIDRs for this service. When empty, every IP address it's authorized to call the IO API on behalf of the service. type: array items: $ref: '#/definitions/CIDR' version: type: integer require_secure_channels: type: boolean default: false description: | When true: * Messages won't trigger email notifications; * Push notifications will be anonymous. required: - service_name - department_name - organization_name - organization_fiscal_code - authorized_cidrs HiddenServicePayload: description: A payload used to create/update a service that is hidden. allOf: - $ref: '#/definitions/CommonServicePayload' - type: object properties: is_visible: type: boolean default: false enum: - false description: It indicates that service is hidden service_metadata: description: >- That service can't handle some ServiceMetadata fields (es. category) $ref: '#/definitions/CommonServiceMetadata' VisibleServicePayload: description: >- A payload used to create/update a service that appears in the service list. allOf: - $ref: '#/definitions/CommonServicePayload' - type: object properties: is_visible: type: boolean enum: - true description: It indicates that service appears in the service list service_metadata: description: >- That service can't handle some ServiceMetadata fields (es. category) $ref: '#/definitions/CommonServiceMetadata' required: - is_visible - service_metadata OrganizationName: type: string description: |- The organization that runs the service. Will be added to the content of sent messages to identify the sender. minLength: 1 DepartmentName: type: string description: |- The department inside the organization that runs the service. Will be added to the content of sent messages. minLength: 1 ExtendedProfile: description: |- Describes the citizen's profile, mostly interesting for preferences attributes. type: object properties: email: $ref: '#/definitions/EmailAddress' service_preferences_settings: $ref: '#/definitions/ServicePreferencesSettings' blocked_inbox_or_channels: $ref: '#/definitions/BlockedInboxOrChannels' preferred_languages: $ref: '#/definitions/PreferredLanguages' is_inbox_enabled: $ref: '#/definitions/IsInboxEnabled' accepted_tos_version: $ref: '#/definitions/AcceptedTosVersion' is_webhook_enabled: $ref: '#/definitions/IsWebhookEnabled' is_email_enabled: $ref: '#/definitions/IsEmailEnabled' is_email_validated: $ref: '#/definitions/IsEmailValidated' is_email_already_taken: type: boolean default: false description: |- True if the user email has been validated by another user. If so, the user must provide a new email. reminder_status: $ref: '#/definitions/ReminderStatus' is_test_profile: $ref: '#/definitions/IsTestProfile' last_app_version: $ref: '#/definitions/AppVersion' push_notifications_content_type: $ref: '#/definitions/PushNotificationsContentType' version: type: integer required: - is_email_enabled - is_email_validated - is_email_already_taken - is_inbox_enabled - is_webhook_enabled - service_preferences_settings - version NewProfile: type: object description: |- Describes a new citizen's profile. Used for profile creation. properties: email: $ref: '#/definitions/EmailAddress' is_email_validated: $ref: '#/definitions/IsEmailValidated' is_test_profile: $ref: '#/definitions/IsTestProfile' required: - is_email_validated ProblemJson: type: object properties: type: type: string format: uri description: |- An absolute URI that identifies the problem type. When dereferenced, it SHOULD provide human-readable documentation for the problem type (e.g., using HTML). default: about:blank example: https://example.com/problem/constraint-violation title: type: string description: |- A short, summary of the problem type. Written in english and readable for engineers (usually not suited for non technical stakeholders and not localized); example: Service Unavailable status: type: integer format: int32 description: >- The HTTP status code generated by the origin server for this occurrence of the problem. minimum: 100 maximum: 600 exclusiveMaximum: true example: 200 detail: type: string description: |- A human readable explanation specific to this occurrence of the problem. example: There was an error processing the request instance: type: string format: uri description: >- An absolute URI that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced. Profile: type: object description: |- Describes the citizen's profile. Used for profile update. properties: email: $ref: '#/definitions/EmailAddress' service_preferences_settings: $ref: '#/definitions/ServicePreferencesSettings' blocked_inbox_or_channels: $ref: '#/definitions/BlockedInboxOrChannels' preferred_languages: $ref: '#/definitions/PreferredLanguages' is_inbox_enabled: $ref: '#/definitions/IsInboxEnabled' accepted_tos_version: $ref: '#/definitions/AcceptedTosVersion' is_webhook_enabled: $ref: '#/definitions/IsWebhookEnabled' is_email_enabled: $ref: '#/definitions/IsEmailEnabled' reminder_status: $ref: '#/definitions/ReminderStatus' last_app_version: $ref: '#/definitions/AppVersion' push_notifications_content_type: $ref: '#/definitions/PushNotificationsContentType' version: type: integer required: - version ServiceId: type: string description: |- The ID of the Service. Equals the subscriptionId of a registered API user. minLength: 1 ServiceMetadata: x-one-of: true allOf: - $ref: '#/definitions/StandardServiceMetadata' - $ref: '#/definitions/SpecialServiceMetadata' - $ref: '#/definitions/CommonServiceMetadata' ServiceScope: type: string x-extensible-enum: - NATIONAL - LOCAL ServiceName: type: string description: The name of the service. Will be added to the content of sent messages. minLength: 1 EmailAddress: type: string format: email example: foobar@example.com BlockedInboxOrChannel: type: string description: |- All notification channels plus the message inbox. These represent all the possible channels a user could block. x-extensible-enum: - EMAIL - INBOX - WEBHOOK example: INBOX BlockedInboxOrChannels: type: object additionalProperties: type: array items: $ref: '#/definitions/BlockedInboxOrChannel' description: |- All the notification channels blocked by the user. Each channel is related to a specific service (sender). PreferredLanguage: type: string x-extensible-enum: - it_IT - en_GB - es_ES - de_DE - fr_FR example: it_IT PreferredLanguages: type: array items: $ref: '#/definitions/PreferredLanguage' description: >- Indicates the User's preferred written or spoken languages in order of preference. Generally used for selecting a localized User interface. Valid values are concatenation of the ISO 639-1 two letter language code, an underscore, and the ISO 3166-1 2 letter country code; e.g., 'en_US' specifies the language English and country US. IsInboxEnabled: type: boolean description: |- True if the recipient of a message wants to store its content for later retrieval. IsEmailEnabled: type: boolean description: >- True if the recipient of a message wants to forward the notifications to his email address. ReminderStatus: type: string x-extensible-enum: - ENABLED - DISABLED example: ENABLED description: Api definition of reminder opt-in status AcceptedTosVersion: type: number minimum: 1 description: Version of latest terms of service accepted by the user. IsWebhookEnabled: type: boolean description: >- True if the recipient of a message wants to forward the notifications to the default webhook. IsEmailValidated: type: boolean description: True if the user email has been validated. FiscalCode: type: string description: User's fiscal code. format: FiscalCode x-import: '@pagopa/ts-commons/lib/strings' example: SPNDNL80R13C555X TimeToLiveSeconds: type: integer default: 3600 minimum: 3600 maximum: 604800 description: |- This parameter specifies for how long (in seconds) the system will try to deliver the message to the channels configured by the user. example: 3600 Timestamp: type: string format: UTCISODateFromString description: A date-time field in ISO-8601 format and UTC timezone. x-import: '@pagopa/ts-commons/lib/dates' example: '2018-10-13T00:00:00.000Z' OrganizationFiscalCode: type: string description: Organization fiscal code. format: OrganizationFiscalCode x-import: '@pagopa/ts-commons/lib/strings' example: '12345678901' NotificationChannel: type: string description: All notification channels. x-extensible-enum: - EMAIL - WEBHOOK example: EMAIL NotificationChannelStatusValue: type: string description: >- The status of a notification (one for each channel). "SENT": the notification was succesfully sent to the channel (ie. email or push notification) "THROTTLED": a temporary failure caused a retry during the notification processing; the notification associated with this channel will be delayed for a maximum of 7 days or until the message expires "EXPIRED": the message expired before the notification could be sent; this means that the maximum message time to live was reached; no notification will be sent to this channel "FAILED": a permanent failure caused the process to exit with an error, no notification will be sent to this channel x-extensible-enum: - SENT - THROTTLED - EXPIRED - FAILED example: SENT UserDataProcessing: type: object description: A representation of a single user data processing request properties: choice: $ref: '#/definitions/UserDataProcessingChoice' status: $ref: '#/definitions/UserDataProcessingStatus' created_at: $ref: '#/definitions/Timestamp' updated_at: $ref: '#/definitions/Timestamp' version: type: integer required: - choice - status - version UserDataProcessingStatus: type: string description: The status of a user data processing request enum: - PENDING - WIP - CLOSED - FAILED - ABORTED example: PENDING UserDataProcessingChoice: type: string description: User's choice to delete or download his own data. enum: - DOWNLOAD - DELETE example: DOWNLOAD UserDataProcessingChoiceRequest: type: object description: A request wrapper for User data processing choice properties: choice: $ref: '#/definitions/UserDataProcessingChoice' required: - choice IsTestProfile: type: boolean description: True if the user's profile is only for test purpose. default: false ServicePreferencesSettings: description: |- Describes the citizen's profile, mostly interesting for preferences attributes. type: object properties: mode: $ref: '#/definitions/ServicesPreferencesMode' required: - mode ServicesPreferencesMode: type: string enum: - LEGACY - AUTO - MANUAL BasicServicePreference: description: >- Define a set of required preferences of a Citizen for a given Service. It's needed by Citizens to express how they want Services to get in touch with them. type: object properties: is_email_enabled: type: boolean is_inbox_enabled: type: boolean is_webhook_enabled: type: boolean settings_version: type: integer minimum: 0 required: - is_email_enabled - is_inbox_enabled - is_webhook_enabled - settings_version ServicePreference: description: |- Return the set of preferences of a Citizen for a given Service. It's needed by Citizens to read previoulsy expressed preferences. allOf: - $ref: '#/definitions/BasicServicePreference' - type: object properties: can_access_message_read_status: type: boolean required: - can_access_message_read_status UpsertServicePreference: description: >- Define a set of preferences of a Citizen for a given Service. Extends the BasicServicePreference with new optional preferences for backward compatibility. allOf: - $ref: '#/definitions/BasicServicePreference' - type: object properties: can_access_message_read_status: type: boolean StandardServiceMetadata: allOf: - $ref: '#/definitions/CommonServiceMetadata' - type: object properties: category: $ref: '#/definitions/StandardServiceCategory' required: - category SpecialServiceMetadata: allOf: - $ref: '#/definitions/CommonServiceMetadata' - type: object properties: category: $ref: '#/definitions/SpecialServiceCategory' custom_special_flow: type: string minLength: 1 required: - category CommonServiceMetadata: type: object description: A set of metadata properties related to this service. properties: description: type: string minLength: 1 web_url: type: string minLength: 1 app_ios: type: string minLength: 1 app_android: type: string minLength: 1 tos_url: type: string minLength: 1 privacy_url: type: string minLength: 1 address: type: string minLength: 1 phone: type: string minLength: 1 email: type: string minLength: 1 pec: type: string minLength: 1 cta: type: string minLength: 1 token_name: type: string minLength: 1 support_url: type: string minLength: 1 scope: $ref: '#/definitions/ServiceScope' required: - scope SpecialServiceCategory: type: string x-extensible-enum: - SPECIAL StandardServiceCategory: type: string x-extensible-enum: - STANDARD AppVersion: type: string pattern: ^((0|[1-9]\\d*)\\.){2}(0|[1-9]\\d*)(\\.(0|[1-9]\\d*)){0,1}$ description: A string field in Semantic Versioning format example: 1.10.11 PushNotificationsContentType: type: string x-extensible-enum: - FULL - ANONYMOUS example: FULL description: >- This parameter specifies how a specific user wants to visualize push notifications. FULL leads to descriptive push notifications while ANONYMOUS leads to silent ones. UpdateProfile412ErrorTypes: type: string description: >- List of error types returned by the updateProfile endpoint when the HTTP status code is 412 x-extensible-enum: - https://ioapp.it/problems/email-already-taken example: https://ioapp.it/problems/email-already-taken