Candid Health Default API

openapi: 3.2.0
info:
  title: Reference Default API
  version: 1.0.0
servers:
- url: https://pre-api.joincandidhealth.com
  description: Production
- url: https://pre-api-staging.joincandidhealth.com
  description: Staging
- url: https://sandbox-pre-api.joincandidhealth.com
  description: CandidSandbox
- url: https://staging-pre-api.joincandidhealth.com
  description: CandidStaging
- url: http://localhost:4000
  description: Local
- url: https://api.joincandidhealth.com
  description: Production
- url: https://api-staging.joincandidhealth.com
  description: Staging
- url: https://sandbox-api.joincandidhealth.com
  description: CandidSandbox
- url: https://staging-api.joincandidhealth.com
  description: CandidStaging
- url: http://localhost:5050
  description: Local
tags:
- name: Default
paths:
  /api/auth/v2/token:
    post:
      operationId: get_token
      summary: Get token
      description: 'Candid Health SDKs automatically handle authentication workflows after configuring them with the `client_id` and

        `client_secret`.


        Candid Health utilizes the OAuth 2.0 bearer token authentication scheme in our auth flow. You obtain the bearer token for all

        subsequent API requests via the `/auth/v2/token` endpoint defined below, which requires you to provide your `client_id` and `client_secret`. Your `client_id` and `client_secret` can be generated from the "Users & Credentials" tab by your org admin.


        The `/auth/v2/token` endpoint accepts both `Content-Type: application/json` and `Content-Type: application/x-www-form-urlencoded`. The request body should contain the `client_id` and `client_secret` as follows:


        ```json

        {

        "client_id": "YOUR_CLIENT_ID",

        "client_secret": "YOUR_CLIENT_SECRET"

        }

        ```

        or as URL-encoded form data:


        ```

        client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET

        ```


        The bearer token is a signed JWT. The public key for the JWT can be found here for any verification workflows.


        The bearer token should be provided in the `Authorization` header for all subsequent API calls.


        The bearer token expires 5 hours after it has been created. After it has expired, the client will receive an "HTTP 401

        Unauthorized" error, at which point the client should generate a new token. It is important that tokens be reused between

        requests; if the client attempts to generate a token too often, it will be rate-limited and will receive an `HTTP 429 Too Many Requests` error.'
      tags:
      - Default
      responses:
        '200':
          description: Response with status 200
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/type_auth_default_AuthGetTokenResponse'
        '415':
          description: Error response with status 415
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorName:
                    type: string
                    enum:
                    - InvalidContentTypeError
                  content:
                    $ref: '#/components/schemas/type_auth_default_InvalidContentTypeErrorType'
                required:
                - errorName
                - content
        '429':
          description: Error response with status 429
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorName:
                    type: string
                    enum:
                    - TooManyRequestsError
                  content:
                    $ref: '#/components/schemas/type_auth_default_TooManyRequestsErrorType'
                required:
                - errorName
                - content
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  description: Your application's Client ID.
                client_secret:
                  type: string
                  description: Your application's Client Secret.
              required:
              - client_id
              - client_secret
components:
  schemas:
    type_auth_default_AuthGetTokenResponse:
      type: object
      properties:
        access_token:
          type: string
        expires_in:
          type: integer
          description: Time in seconds.
        token_type:
          type: string
      required:
      - access_token
      - expires_in
      - token_type
      title: AuthGetTokenResponse
    type_auth_default_InvalidContentTypeErrorType:
      type: object
      properties:
        message:
          type: string
      required:
      - message
      title: InvalidContentTypeErrorType
    type_auth_default_TooManyRequestsErrorType:
      type: object
      properties:
        message:
          type: string
      required:
      - message
      title: TooManyRequestsErrorType
  securitySchemes:
    OAuthScheme:
      type: http
      scheme: bearer
      description: OAuth 2.0 authentication