C. Hoare & Co. Client Registration API

openapi: 3.2.0
info:
  title: Dynamic Client Registration API
  description: This specification defines the APIs for a TPP to submit a Software Statement Assertion to an ASPSP for the purpose of creating OAuth clients that are registered with ASPSP.
  version: v3.1.0
servers:
- url: https://api.hoaresbank.co.uk/open-banking/v3.1
  description: Base URL declared by the provider in apis.yml (roadmap#122).
tags:
- name: Client Registration
paths:
  /register:
    post:
      summary: Register a client by way of a Software Statement Assertion
      description: Endpoint will be secured by way of Mutual Authentication over TLS
      tags:
      - Client Registration
      parameters: []
      responses:
        '201':
          $ref: '#/components/responses/OBClientRegistration1'
        '400':
          $ref: '#/components/responses/400Error'
      requestBody:
        $ref: '#/components/requestBodies/ClientRegistration'
      operationId: postRegister
      x-operation-id-source: derived
  /register/{ClientId}:
    get:
      summary: Get a client by way of Client ID
      tags:
      - Client Registration
      parameters:
      - $ref: '#/components/parameters/ClientId'
      - $ref: '#/components/parameters/Authorization'
      responses:
        '200':
          $ref: '#/components/responses/OBClientRegistration1'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
      security:
      - TPPOAuth2Security: []
      operationId: getRegisterByClientId
      x-operation-id-source: derived
    put:
      summary: Update a client by way of Client ID
      tags:
      - Client Registration
      parameters:
      - $ref: '#/components/parameters/ClientId'
      - $ref: '#/components/parameters/Authorization'
      responses:
        '200':
          $ref: '#/components/responses/OBClientRegistration1'
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
      security:
      - TPPOAuth2Security: []
      requestBody:
        $ref: '#/components/requestBodies/ClientRegistration'
      operationId: putRegisterByClientId
      x-operation-id-source: derived
    delete:
      summary: Delete a client by way of Client ID
      tags:
      - Client Registration
      parameters:
      - $ref: '#/components/parameters/ClientId'
      - $ref: '#/components/parameters/Authorization'
      responses:
        '204':
          description: Client deleted
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '405':
          $ref: '#/components/responses/403Error'
      security:
      - TPPOAuth2Security: []
      operationId: deleteRegisterByClientId
      x-operation-id-source: derived
components:
  responses:
    400Error:
      description: Request failed due to client error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RegistrationError'
    401Error:
      description: Request failed due to unknown or invalid Client or invalid access token
      headers:
        WWW-Authenticate:
          description: Response header field specified in https://tools.ietf.org/html/rfc6750
          schema:
            type: string
    OBClientRegistration1:
      description: Client registration
      content:
        application/json:
          schema:
            allOf:
            - $ref: '#/components/schemas/OBRegistrationProperties1'
            - required:
              - client_id
    403Error:
      description: The client does not have permission to read, update or delete the Client
  requestBodies:
    ClientRegistration:
      description: A request to register a Software Statement Assertion with an ASPSP
      content:
        application/json:
          schema:
            type: string
            format: OBClientRegistration1
      required: true
  schemas:
    SupportedAlgorithms:
      type: string
      enum:
      - RS256
      - PS256
      - ES256
    OBRegistrationProperties1:
      type: object
      required:
      - redirect_uris
      - token_endpoint_auth_method
      - grant_types
      - software_statement
      - application_type
      - id_token_signed_response_alg
      - request_object_signing_alg
      - tls_client_auth_dn
      properties:
        client_id:
          description: OAuth 2.0 client identifier string
          type: string
          minLength: 1
          maxLength: 36
        client_secret:
          description: OAuth 2.0 client secret string
          type: string
          minLength: 1
          maxLength: 36
        client_id_issued_at:
          description: Time at which the client identifier was issued expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC
          type: integer
          format: int32
          minimum: 0
        client_secret_expires_at:
          description: Time at which the client secret will expire expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC. Set to 0 if does not expire
          type: integer
          format: int32
          minimum: 0
        redirect_uris:
          type: array
          items:
            type: string
            format: uri
            minLength: 1
            maxLength: 256
        token_endpoint_auth_method:
          type: string
          enum:
          - private_key_jwt
          - tls_client_auth
        grant_types:
          type: array
          items:
            type: string
            enum:
            - client_credentials
            - authorization_code
            - refresh_token
          minItems: 1
        response_types:
          type: array
          items:
            type: string
            enum:
            - code
            - code id_token
        software_id:
          type: string
        scope:
          type: array
          items:
            type: string
            minLength: 1
            maxLength: 32
        software_statement:
          type: string
          format: JWT
        application_type:
          type: string
          enum:
          - web
          - mobile
        id_token_signed_response_alg:
          $ref: '#/components/schemas/SupportedAlgorithms'
        request_object_signing_alg:
          $ref: '#/components/schemas/SupportedAlgorithms'
        token_endpoint_auth_signing_alg:
          $ref: '#/components/schemas/SupportedAlgorithms'
        tls_client_auth_dn:
          type: string
          minLength: 1
          maxLength: 128
    RegistrationError:
      type: object
      required:
      - error
      properties:
        error:
          type: string
          enum:
          - invalid_redirect_uri
          - invalid_client_metadata
          - invalid_software_statement
          - unapproved_software_statement
        error_description:
          type: string
          minLength: 1
          maxLength: 500
  parameters:
    ClientId:
      name: ClientId
      description: The client ID
      in: path
      required: true
      schema:
        type: string
    Authorization:
      in: header
      name: Authorization
      required: true
      description: An Authorisation Token as per https://tools.ietf.org/html/rfc6750
      schema:
        type: string
  securitySchemes:
    TPPOAuth2Security:
      type: oauth2
      description: TPP client credential authorisation flow with the ASPSP. No scopes defined as per specification
      flows:
        clientCredentials:
          tokenUrl: https://authserver.example/token
          scopes: {}