CM.com Authorization API

openapi: 3.2.0
info:
  title: Payments Gateway Authorization API
  description: Common payments API
  version: 1.27.22
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: /api/v1
security:
- oAuth2ClientCredentials: []
tags:
- name: Authorization
  description: OAuth2.0 Authorization Framework
  externalDocs:
    url: https://tools.ietf.org/html/rfc6749#section-4.4.2
paths:
  /authorization/oauth2/token:
    post:
      tags:
      - Authorization
      summary: Obtain access token using OAuth 2.0
      externalDocs:
        description: RFC 6749 - The OAuth2.0 Authorization Framework
        url: https://tools.ietf.org/html/rfc6749#section-4.4.2
      operationId: obtainAccessTokenViaClientCredentialsGrant
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - client_id
              - client_secret
              - grant_type
              properties:
                client_id:
                  description: Client id that was provided for authentication
                  type: string
                  example: 904c5037ad72ec1d1d99a5d14e04d7e0
                client_secret:
                  description: Client secret that was provided for authentication
                  type: string
                  example: 543d8f8b5d6b4c6a8643bbf9a3ba0682
                grant_type:
                  description: Authorization grant type. The only supported value is `client_credentials`.
                  type: string
                  enum:
                  - client_credentials
                  example: client_credentials
      responses:
        '200':
          description: 'Successful Response.

            [The OAuth2.0 Authorization Framework - 5.1. Successful Response](https://tools.ietf.org/html/rfc6749#section-5.1)

            The authorization server issues an access token and optional refresh token, and constructs the response by adding the following parameters to the entity-body of the HTTP response with a 200 (OK) status code.'
          content:
            application/json:
              schema:
                title: Token
                description: 'Access Token

                  [The OAuth2.0 Authorization Framework - 1.4. Access Token](https://tools.ietf.org/html/rfc6749#section-1.4)

                  Access tokens are credentials used to access protected resources.  An access token is a string representing an authorization issued to the client.  The string is usually opaque to the client.  Tokens represent specific scopes and durations of access, granted by the resource owner, and enforced by the resource server and authorization server.'
                type: object
                required:
                - access_token
                - token_type
                properties:
                  access_token:
                    description: The access token issued by the authorization server.
                    type: string
                    example: 2YotnFZFEjr1zCsicMWpAA
                  token_type:
                    description: The type of the token issued as described in [Section 7.1](https://tools.ietf.org/html/rfc6749#section-7.1).  Value is case insensitive.
                    type: string
                    example: Bearer
                  expires_in:
                    description: The lifetime in seconds of the access token.  For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value.
                    type: integer
                    example: 3600
        4XX:
          description: 'Error Response.

            [The OAuth2.0 Authorization Framework - 5.2. Error Response](https://tools.ietf.org/html/rfc6749#section-5.2)

            The authorization server responds with an HTTP 400 (Bad Request) status code (unless specified otherwise) and includes the following parameters with the response.

            Values for the "error" parameter **MUST NOT** include characters outside the set %x20-21 / %x23-5B / %x5D-7E.'
          content:
            application/json:
              schema:
                title: TokenError
                description: '[The OAuth2.0 Authorization Framework - 5.2. Error Response](https://tools.ietf.org/html/rfc6749#section-5.2)'
                type: object
                required:
                - error
                properties:
                  error:
                    description: 'A single ASCII [[USASCII](https://tools.ietf.org/html/rfc6749#ref-USASCII)] error code from the following:

                      | Error Code| Description |

                      |-----------|-------------|

                      | invalid_request | The request is missing a required parameter, includes an unsupported parameter value (other than grant type), repeats a parameter, includes multiple credentials, utilizes more than one mechanism for authenticating the client, or is otherwise malformed. |

                      | invalid_client | Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).  The authorization server MAY return an HTTP 401 (Unauthorized) status code to indicate which HTTP authentication schemes are supported.  If the client attempted to authenticate via the "Authorization" request header field, the authorization server MUST respond with an HTTP 401 (Unauthorized) status code and include the "WWW-Authenticate" response header field matching the authentication scheme used by the client. |

                      | invalid_grant | The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. |

                      | unauthorized_client | The authenticated client is not authorized to use this authorization grant type. |

                      | unsupported_grant_type | The authorization grant type is not supported by the authorization server. |

                      | invalid_scope | The requested scope is invalid, unknown, malformed, or exceeds the scope granted by the resource owner. |'
                    type: string
                    enum:
                    - invalid_request
                    - invalid_client
                    - invalid_grant
                    - unauthorized_client
                    - unsupported_grant_type
                    - invalid_scope
                    example: invalid_client
                  error_description:
                    description: Human-readable ASCII [[USASCII](https://tools.ietf.org/html/rfc6749#ref-USASCII)] text providing additional information, used to assist the client developer in understanding the error that occurred.
                    type: string
                    example: Client authentication failed
                  error_uri:
                    description: A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
                    type: string
                    example: http://example.test/client_authentication_failed.html
      security: []
components:
  securitySchemes:
    oAuth2ClientCredentials:
      type: oauth2
      description: OAuth 2.0 Client Credentials Grant.
      flows:
        clientCredentials:
          tokenUrl: /api/v1/authorization/oauth2/token
          scopes: {}