Alloy OAuth API
These endpoints allow the API to be used by OAuth clients. They convert (application token) + (application secret) credentials into OAuth bearer tokens that can be used with any other API endpoint.
OpenAPI Specification
openapi: 3.0.0
info:
title: Alloy Identity Bank Accounts OAuth API
version: 1.0.0
description: The Alloy Identity API provides endpoints for creating and managing person and business entities, running evaluations through configurable risk workflows, managing journey applications, submitting events for ongoing monitoring, handling document verification, and managing investigations and case alerts. Authentication is via Basic HTTP credentials or OAuth 2.0 Client Credentials.
contact:
name: Alloy Support
url: https://help.alloy.com/hc/en-us
license:
name: Proprietary
servers:
- url: https://sandbox.alloy.co/v1
description: Sandbox environment
- url: https://alloy.co/v1
description: Production environment
security:
- basic: []
- oauth2: []
tags:
- name: OAuth
description: These endpoints allow the API to be used by OAuth clients. They convert (application token) + (application secret) credentials into OAuth bearer tokens that can be used with any other API endpoint.
paths:
/oauth/bearer:
post:
tags:
- OAuth
summary: Generate a new OAuth bearer token from the given client credentials.
description: 'Application token and application secret MUST be provided, either as properties in the JSON body, or in the Authorization header.
The returned bearer token will allow the client all the same access permissions as the given application token and secret. Bearer tokens are sent in the `Authorization` header in the form `Bearer <bearer_token>`.
All bearer tokens expire one hour from generation.
'
parameters:
- in: header
name: Authorization
schema:
type: string
description: 'Basic authorization header per the OAuth Client Authorization Header standard.
The format is `Basic <auth_string>`, where `<auth_string>` is the base64 encoding of the string `application_token:application_secret` (the application token and application secret, separated by a colon character).
'
requestBody:
content:
application/json:
schema:
type: object
properties:
application_token:
type: string
pattern: ^[A-Za-z0-9]{32}$
description: Application token for the client. This is the application token for a particular workflow.
application_secret:
type: string
pattern: ^[A-Za-z0-9]{32}$
description: Application secret for the client. This is the application secret for a particular workflow (and must match the application token).
grant_type:
type: string
description: OAuth grant type. Only the "Client Credentials" grant type is supported.
enum:
- client_credentials
responses:
'200':
x-summary: OK
description: 'The generated OAuth bearer token.
If credentials are sent in the Authorization header, the OAuth standard fields `access_token`, `token_type`, and `expires_in` are returned.
If credentials are sent in the JSON body, fields `bearer_token` and `expires` are returned. This is for backwards-compatibility with the original version of this API.
'
content:
application/json:
schema:
type: object
properties:
access_token:
type: string
pattern: ^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$
description: OAuth bearer token in JWT format.
bearer_token:
type: string
pattern: ^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$
description: OAuth bearer token.
token_type:
type: string
enum:
- bearer
expires_in:
type: number
description: Seconds until expiration.
expires:
type: number
description: Expiration time, in **milliseconds** past the epoch.
example:
access_token: IcR6p1pbUJjn58xCXewm8ni2U3c0pRCbyqTA5I0x
token_type: bearer
expires_in: 3600
'400':
description: Bad Request
content:
application/json:
schema:
type: object
properties:
error:
type: object
properties:
minor_code:
type: number
type:
type: string
message:
type: string
details:
type: object
required:
- minor_code
- type
- message
required:
- error
examples:
HeaderValidationFailure:
value:
error:
minor_code: 4001
type: Header Validation Failure
message: Verify that your request headers comply with HTTP v1.1 standards.
RequestBodyValiationFailure:
value:
error:
minor_code: 4002
type: Request Body Validation Failure
'401':
x-summary: Unauthorized
description: Authorization failed / invalid credentials.
content:
application/json:
schema:
type: object
properties:
error:
type: object
properties:
minor_code:
type: number
enum:
- 4011
type:
type: string
enum:
- Unauthorized
message:
type: string
details:
type: object
required:
- minor_code
- type
- message
required:
- error
example:
error:
minor_code: 4011
type: Unauthorized
message: Unable to obtain a bearer token using specified application credentials. The application may be disabled?
components:
securitySchemes:
basic:
type: http
description: HTTP basic authorization using a workflow token and secret
scheme: basic
oauth2:
type: oauth2
description: OAuth2 using a workflow token and secret to generate a bearer token
flows:
clientCredentials:
tokenUrl: /oauth/bearer
scopes: {}