openapi: 3.1.0
info:
  title: Backstage Auth Actions API
  description: The Backstage Auth API provides endpoints for authenticating users and services with the Backstage backend. It supports multiple authentication providers (GitHub, Google, Okta, SAML, etc.) and handles OAuth flows, token issuance, token refresh, and session management. The Auth API is used by the Backstage frontend to initiate login flows and by backend plugins to verify caller identity via Backstage tokens.
  version: 1.0.0
  contact:
    name: Backstage
    url: https://backstage.io
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://localhost:7007/api/auth
  description: Local development server
tags:
- name: Actions
  description: Endpoints for listing available scaffolder actions.
paths:
  /v2/actions:
    get:
      operationId: listActions
      summary: Backstage List available actions
      description: Lists all available scaffolder actions that can be used in templates. Each action includes its ID, description, and input/output schemas.
      tags:
      - Actions
      security:
      - bearerAuth: []
      responses:
        '200':
          description: A list of available scaffolder actions.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Action'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  responses:
    Unauthorized:
      description: Missing or invalid authentication token.
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: object
                properties:
                  name:
                    type: string
                  message:
                    type: string
  schemas:
    Action:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier of the action.
          example: fetch:plain
        description:
          type: string
          description: A human-readable description of the action.
        schema:
          type: object
          properties:
            input:
              type: object
              description: JSON Schema for the action input.
            output:
              type: object
              description: JSON Schema for the action output.
  securitySchemes:
    cookieAuth:
      type: apiKey
      in: cookie
      name: backstage-auth
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
externalDocs:
  description: Backstage Auth Documentation
  url: https://backstage.io/docs/auth/