Clarafintech Authentication API

openapi: 3.2.0
info:
  title: Clara Authentication API
  summary: Corporate card and spend management API for Mexico, Brazil, and Colombia.
  description: Use the Clara API to manage corporate cards, retrieve transactions, provision users, reconcile billing statements, download transaction documents, and automate spend-management workflows. Every API request requires both mutual TLS and an OAuth 2.0 Bearer token. This docs-published schema is derived from the current Clara developer documentation and should be checked against backend-owned API contracts before being treated as exhaustive.
  version: 3.0.0
  contact:
    name: Clara Integration Support
    email: integration.support.mx@clara.team
    url: https://developers.clara.team
servers:
- url: https://public-api.mx.clara.com
  description: Mexico production
- url: https://public-api.br.clara.com
  description: Brazil production
- url: https://public-api.co.clara.com
  description: Colombia production
- url: https://public-api.mx.clara.com/api-test
  description: Mexico sandbox. Use the same paths without the leading /api segment when testing, for example /v3/transactions.
- url: https://public-api.br.clara.com/api-test
  description: Brazil sandbox. Use the same paths without the leading /api segment when testing, for example /v3/transactions.
- url: https://public-api.co.clara.com/api-test
  description: Colombia sandbox. Use the same paths without the leading /api segment when testing, for example /v3/transactions.
security:
- MutualTLS: []
  BearerAuth: []
tags:
- name: Authentication
  description: OAuth token exchange. Requests also require mutual TLS.
paths:
  /oauth/token:
    post:
      operationId: createOAuthToken
      summary: Create an OAuth access token
      description: Exchange client credentials for a short-lived Bearer token. Send the client ID and secret with HTTP Basic authentication and present the mTLS client certificate on the request.
      tags:
      - Authentication
      security:
      - MutualTLS: []
        BasicAuth: []
      responses:
        '200':
          description: Access token created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthTokenResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  responses:
    Unauthorized:
      description: Unauthorized. Refresh the token or verify mTLS certificate configuration.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      required:
      - message
      properties:
        code:
          type: string
          description: Machine-readable Clara or HTTP error code when available.
        message:
          type: string
          description: Human-readable error message.
        timestamp:
          type: string
          format: date-time
        details:
          type: array
          items:
            type: object
            additionalProperties: true
      additionalProperties: true
    OAuthTokenResponse:
      type: object
      required:
      - access_token
      - token_type
      - expires_in
      properties:
        access_token:
          type: string
          description: JWT Bearer token.
        token_type:
          type: string
          const: Bearer
        expires_in:
          type: integer
          description: Token lifetime in seconds.
  securitySchemes:
    MutualTLS:
      type: mutualTLS
      description: All API requests require a valid Clara-issued X.509 client certificate.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token from /oauth/token.
    BasicAuth:
      type: http
      scheme: basic
      description: Use CLIENT_ID:CLIENT_SECRET when requesting an access token.
externalDocs:
  description: Clara API documentation
  url: https://developers.clara.team
x-source: Derived from the developers.clara.team documentation in this repository. Replace with the backend-owned OpenAPI contract if one is available.