AgentPMT OAuth API

openapi: 3.2.0
info:
  title: Fast OAuth API
  version: 0.1.0
tags:
- name: OAuth
paths:
  /oauth/signup/send-otp:
    post:
      summary: Oauth Signup Send Otp
      description: Deprecated compatibility shim for legacy inline MCP OAuth signup.
      operationId: oauth_signup_send_otp_oauth_signup_send_otp_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - OAuth
  /oauth/signup/verify-otp:
    post:
      summary: Oauth Signup Verify Otp
      description: Deprecated compatibility shim for legacy inline MCP OAuth OTP verification.
      operationId: oauth_signup_verify_otp_oauth_signup_verify_otp_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - OAuth
  /oauth/jwks.json:
    get:
      summary: OAuth JSON Web Key Set
      operationId: oauth_jwks_oauth_jwks_json_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthJwksResponse'
      tags:
      - OAuth
  /oauth/register:
    post:
      summary: Register an OAuth client (RFC 7591)
      operationId: oauth_register_oauth_register_post
      responses:
        '200':
          description: Newly issued client credentials.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthClientRegistrationResponse'
      tags:
      - OAuth
  /oauth/authorize:
    get:
      summary: OAuth authorize (render login form)
      operationId: oauth_authorize_get_oauth_authorize_get
      responses:
        '200':
          description: HTML login form shown to the end user.
          content:
            application/json:
              schema: {}
            text/html:
              schema:
                type: string
                description: HTML document.
        '302':
          description: Authorization succeeded; redirects to `redirect_uri` with `code` (and optional `state`) appended.
          headers:
            Location:
              description: Redirect URI with `code` and optional `state` in the query string.
              schema:
                type: string
                format: uri
        '400':
          description: Invalid OAuth parameters. Returns the login form with an inline error message.
          content:
            text/html:
              schema:
                type: string
                description: HTML error page.
      tags:
      - OAuth
    post:
      summary: OAuth authorize (submit login form)
      operationId: oauth_authorize_post_oauth_authorize_post
      responses:
        '200':
          description: HTML login form shown to the end user.
          content:
            application/json:
              schema: {}
            text/html:
              schema:
                type: string
                description: HTML document.
        '302':
          description: Authorization succeeded; redirects to `redirect_uri` with `code` (and optional `state`) appended.
          headers:
            Location:
              description: Redirect URI with `code` and optional `state` in the query string.
              schema:
                type: string
                format: uri
        '400':
          description: Invalid OAuth parameters. Returns the login form with an inline error message.
          content:
            text/html:
              schema:
                type: string
                description: HTML error page.
      tags:
      - OAuth
  /oauth/token:
    post:
      summary: OAuth token exchange
      operationId: oauth_token_oauth_token_post
      responses:
        '200':
          description: Access token issued (and, for authorization_code grants, a rotatable refresh token).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthTokenResponse'
      tags:
      - OAuth
components:
  schemas:
    OAuthJwksResponse:
      properties:
        keys:
          items:
            $ref: '#/components/schemas/OAuthJwk'
          type: array
          title: Keys
          description: Active signing keys. Clients should verify tokens against the entry whose `kid` matches the JWT header.
      type: object
      required:
      - keys
      title: OAuthJwksResponse
      description: JWKS payload exposed for JWT signature verification.
    OAuthJwk:
      properties:
        kty:
          type: string
          title: Kty
          description: Key type (for example `EC` or `RSA`).
        kid:
          type: string
          title: Kid
          description: Key identifier used in JWT `kid` headers.
        use:
          anyOf:
          - type: string
          - type: 'null'
          title: Use
          description: Intended key use (typically `sig`).
        alg:
          anyOf:
          - type: string
          - type: 'null'
          title: Alg
          description: Signing algorithm (for example `ES256`).
      additionalProperties: true
      type: object
      required:
      - kty
      - kid
      title: OAuthJwk
      description: Single JSON Web Key entry as defined by RFC 7517.
    OAuthClientRegistrationResponse:
      properties:
        client_id:
          type: string
          title: Client Id
          description: Issued OAuth client identifier.
        client_id_issued_at:
          type: integer
          title: Client Id Issued At
          description: Unix timestamp (seconds) when the client_id was issued.
        token_endpoint_auth_method:
          type: string
          title: Token Endpoint Auth Method
          description: Auth method the client must use when calling `/oauth/token`.
          examples:
          - none
          - client_secret_basic
          - client_secret_post
        redirect_uris:
          items:
            type: string
          type: array
          title: Redirect Uris
          description: Redirect URIs registered for this client.
        grant_types:
          items:
            type: string
          type: array
          title: Grant Types
          description: Grant types the client is authorized to use.
          examples:
          - - authorization_code
        response_types:
          items:
            type: string
          type: array
          title: Response Types
          description: OAuth response types the client may request.
          examples:
          - - code
        client_secret:
          anyOf:
          - type: string
          - type: 'null'
          title: Client Secret
          description: Client secret returned when `token_endpoint_auth_method` is not `none`. Store this securely - it is not retrievable later.
        client_secret_expires_at:
          anyOf:
          - type: integer
          - type: 'null'
          title: Client Secret Expires At
          description: Unix timestamp (seconds) when the secret expires; `0` indicates no expiration.
      type: object
      required:
      - client_id
      - client_id_issued_at
      - token_endpoint_auth_method
      - redirect_uris
      - grant_types
      - response_types
      title: OAuthClientRegistrationResponse
      description: RFC 7591 Dynamic Client Registration response.
    OAuthTokenResponse:
      properties:
        access_token:
          type: string
          title: Access Token
          description: 'Signed JWT bearer token. Include as `Authorization: Bearer <token>` on MCP requests.'
        refresh_token:
          anyOf:
          - type: string
          - type: 'null'
          title: Refresh Token
          description: Rotatable refresh token for obtaining new access tokens. Returned for the `authorization_code` grant and whenever a new refresh token is issued by `refresh_token`.
        token_type:
          type: string
          title: Token Type
          description: Token type; always `Bearer` for this endpoint.
          examples:
          - Bearer
        expires_in:
          type: integer
          title: Expires In
          description: Lifetime of the access token in seconds.
        scope:
          anyOf:
          - type: string
          - type: 'null'
          title: Scope
          description: Space-separated scopes granted to the token.
      type: object
      required:
      - access_token
      - token_type
      - expires_in
      title: OAuthTokenResponse
      description: RFC 6749 token endpoint success response.
  securitySchemes:
    HTTPBasic:
      type: http
      scheme: basic