Activision Blizzard User Authentication API

openapi: 3.2.0
info:
  title: Battle.net Battle.net OAuth User Authentication API
  version: 1.0.0
  description: Battle.net OAuth API from Blizzard Entertainment (Activision Blizzard, part of Microsoft Gaming), converted field-for-field from the machine-readable API reference the Battle.net Community Developer Portal serves at community.developer.battle.net/api/pages/content/documentation/*.json (saved verbatim in openapi/_original/battle-net-reference/). Response schemas are not published in that reference.
  contact:
    name: Battle.net Community Developer Portal
    url: https://community.developer.battle.net/
  termsOfService: https://www.blizzard.com/en-us/legal/a2aefd3f-87e1-4a35-a38d-e0f7a8f42a00/blizzard-developer-api-terms-of-use
  x-generated-from: provider-reference-json
  x-derived-from:
  - openapi/_original/battle-net-reference/battle-net-oauth-apis.json
  x-derived: '2026-11-04'
servers:
- url: https://oauth.battle.net
  description: 'Battle.net OAuth host (documented: curl ... https://oauth.battle.net/token)'
security:
- oauth2: []
tags:
- name: User Authentication
paths:
  /authorize:
    get:
      operationId: authorizationRequest
      summary: Authorization Request
      description: The authorization request is the first part of the authorization code flow, OAuth's authentication flow for performing API requests on behalf of a user. Applications can also ask for special access to user-specific data by specifying one or more "scopes."
      tags:
      - User Authentication
      x-source: https://community.developer.battle.net/documentation/battle-net/oauth-apis
      parameters:
      - name: response_type
        in: query
        required: true
        description: Specifies the type of authorization request being made. For an authorization code, grant this value must be `code`.
        schema:
          type: string
          default: code
      - name: client_id
        in: query
        required: true
        description: A string identifying the client application making this request. Labeled in [API Access](/access/clients) for an individual application as "Client ID".
        schema:
          type: string
      - name: redirect_uri
        in: query
        required: true
        description: The callback URL registered for an application. This value must match one of the URLs specified for the application in [API Access](/access/clients) or the request will return an error.
        schema:
          type: string
          default: http://example.com/oauth
      - name: scope
        in: query
        required: false
        description: A space-delimited, case-sensitive list of scopes to which to request access. The user may not grant access to any or all requested scopes. See [Using OAuth](/documentation/guides/using-oauth) for a list of valid scopes.
        schema:
          type: string
          default: wow.profile sc2.profile
      - name: state
        in: query
        required: false
        description: An opaque value supplied by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter **should** be used for preventing cross-site request forgery.
        schema:
          type: string
      responses:
        '200':
          description: Successful response (response schema not published in the reference).
  /token:
    post:
      operationId: accessTokenRequest
      summary: Access Token Request
      description: The access token request is the second part of the authorization code flow. When the first part completes, the user's browser is redirected to an application's `redirect_uri`. This redirect URI also includes an access code and (optionally) a state parameter. This request allows the application to exchange the access code for an access token to can use in subsequent API requests.
      tags:
      - User Authentication
      x-source: https://community.developer.battle.net/documentation/battle-net/oauth-apis
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  default: authorization_code
                  description: Identifies the type of authorization request being made. For a client credentials grant this value *must* be `authorization_code`.
                code:
                  type: string
                  default: '{code}'
                  description: The authorization code received from the authorization server.
                redirect_uri:
                  type: string
                  default: https://example.com/oauth
                  description: Must be identical to the `redirect_uri` value used in the authorization request.
                client_id:
                  type: string
                  default: '{client_id}'
                  description: A string identifying the client application making this request. Labeled in [API Access](/access/clients) for an individual application as "Client ID".
      responses:
        '200':
          description: Successful response (response schema not published in the reference).
  /userinfo:
    get:
      operationId: userInfoHeader
      summary: User Info (header)
      description: Returns basic information about the user associated with the current bearer token.
      tags:
      - User Authentication
      x-source: https://community.developer.battle.net/documentation/battle-net/oauth-apis
      parameters:
      - name: Authorization
        in: header
        required: true
        description: The user's bearer token. The OAuth 2.0 spec requires the Authorization header be formatted as "Bearer {token}", where {token} is the alpha-numeric authorization token returned by a previous OAuth grant flow.
        schema:
          type: string
          default: Bearer {token}
      - name: access_token
        in: query
        required: false
        description: The user's bearer token.
        schema:
          type: string
          default: '{token}'
      responses:
        '200':
          description: Successful response (response schema not published in the reference).
components:
  securitySchemes:
    oauth2:
      type: oauth2
      description: Documented at https://community.developer.battle.net/documentation/guides/using-oauth
      flows:
        clientCredentials:
          tokenUrl: https://oauth.battle.net/token
          scopes: {}
        authorizationCode:
          authorizationUrl: https://oauth.battle.net/authorize
          tokenUrl: https://oauth.battle.net/token
          scopes:
            openid: OpenID Connect
            wow.profile: World of Warcraft profile
            sc2.profile: StarCraft II profile
            d3.profile: Diablo III profile