Alloy OAuth API

openapi: 3.2.0
info:
  title: Alloy Com O Auth API
  version: '1.0'
  description: 'Operations tagged OAuth across 2 of this provider''s published API definitions: alloy-com-identity-api-openapi.yml, alloy-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://sandbox.alloy.co/v1
  description: Sandbox environment
- url: https://alloy.co/v1
  description: Production environment
- url: https://api.alloy.co/v1
  description: Production environment
tags:
- name: OAuth
  description: These endpoints allow the API to be used by OAuth clients. They convert (application token) + (application secret) credentials into OAuth bearer tokens that can be used with any other API endpoint.
paths:
  /oauth/bearer:
    post:
      tags:
      - OAuth
      summary: Generate a new OAuth bearer token from the given client credentials.
      description: 'Application token and application secret MUST be provided, either as properties in the JSON body, or in the Authorization header.


        The returned bearer token will allow the client all the same access permissions as the given application token and secret. Bearer tokens are sent in the `Authorization` header in the form `Bearer <bearer_token>`.


        All bearer tokens expire one hour from generation.

        '
      parameters:
      - in: header
        name: Authorization
        schema:
          type: string
          description: 'Basic authorization header per the OAuth Client Authorization Header standard.


            The format is `Basic <auth_string>`, where `<auth_string>` is the base64 encoding of the string `application_token:application_secret` (the application token and application secret, separated by a colon character).

            '
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                application_token:
                  type: string
                  pattern: ^[A-Za-z0-9]{32}$
                  description: Application token for the client. This is the application token for a particular workflow.
                application_secret:
                  type: string
                  pattern: ^[A-Za-z0-9]{32}$
                  description: Application secret for the client. This is the application secret for a particular workflow (and must match the application token).
                grant_type:
                  type: string
                  description: OAuth grant type. Only the "Client Credentials" grant type is supported.
                  enum:
                  - client_credentials
      responses:
        '200':
          x-summary: OK
          description: 'The generated OAuth bearer token.


            If credentials are sent in the Authorization header, the OAuth standard fields `access_token`, `token_type`, and `expires_in` are returned.


            If credentials are sent in the JSON body, fields `bearer_token` and `expires` are returned. This is for backwards-compatibility with the original version of this API.

            '
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                    pattern: ^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$
                    description: OAuth bearer token in JWT format.
                  bearer_token:
                    type: string
                    pattern: ^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$
                    description: OAuth bearer token.
                  token_type:
                    type: string
                    enum:
                    - bearer
                  expires_in:
                    type: number
                    description: Seconds until expiration.
                  expires:
                    type: number
                    description: Expiration time, in **milliseconds** past the epoch.
              example:
                access_token: IcR6p1pbUJjn58xCXewm8ni2U3c0pRCbyqTA5I0x
                token_type: bearer
                expires_in: 3600
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      minor_code:
                        type: number
                      type:
                        type: string
                      message:
                        type: string
                      details:
                        type: object
                    required:
                    - minor_code
                    - type
                    - message
                required:
                - error
              examples:
                HeaderValidationFailure:
                  value:
                    error:
                      minor_code: 4001
                      type: Header Validation Failure
                      message: Verify that your request headers comply with HTTP v1.1 standards.
                RequestBodyValiationFailure:
                  value:
                    error:
                      minor_code: 4002
                      type: Request Body Validation Failure
        '401':
          x-summary: Unauthorized
          description: Authorization failed / invalid credentials.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      minor_code:
                        type: number
                        enum:
                        - 4011
                      type:
                        type: string
                        enum:
                        - Unauthorized
                      message:
                        type: string
                      details:
                        type: object
                    required:
                    - minor_code
                    - type
                    - message
                required:
                - error
              example:
                error:
                  minor_code: 4011
                  type: Unauthorized
                  message: Unable to obtain a bearer token using specified application credentials. The application may be disabled?
      security:
      - basic: []
      - oauth2: []
    servers:
    - url: https://sandbox.alloy.co/v1
      description: Sandbox environment
    - url: https://alloy.co/v1
      description: Production environment
  /oauth/validate:
    post:
      tags:
      - OAuth
      summary: Validate a Bearer Token
      operationId: postOAuthValidate
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
      responses:
        '200':
          description: Validation result
      security:
      - basicAuth: []
      - bearerAuth: []
    servers:
    - url: https://sandbox.alloy.co/v1
      description: Sandbox environment
    - url: https://api.alloy.co/v1
      description: Production environment
components:
  schemas:
    OAuthToken:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: integer
  securitySchemes:
    basic:
      type: http
      description: HTTP basic authorization using a workflow token and secret
      scheme: basic
    oauth2:
      type: oauth2
      description: OAuth2 using a workflow token and secret to generate a bearer token
      flows:
        clientCredentials:
          tokenUrl: /oauth/bearer
          scopes: {}
    basicAuth:
      type: http
      scheme: basic
      description: HTTP Basic Authentication with workflow or account-level API key as username and secret as password.
    bearerAuth:
      type: http
      scheme: bearer
      description: OAuth 2.0 bearer token obtained via the OAuth endpoints.
x-refined-from:
- alloy-com-identity-api-openapi.yml
- alloy-openapi.yml