Componecat Credentials API

openapi: 3.2.0
info:
  title: Componecat Ai Credentials API
  version: v1
  description: 'Operations tagged Credentials across 2 of this provider''s published API definitions: componecat-ai-openapi.json, componecat-ai-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://app.componecat.ai/
security:
- {}
tags:
- name: Credentials
paths:
  /api/rest/v1/service-accounts/{serviceAccountId}/credentials:
    get:
      tags:
      - Credentials
      summary: List a service account's credentials (OAuth clients, federated trusts, and…
      operationId: ListServiceAccountCredentials
      parameters:
      - name: serviceAccountId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CredentialResource'
        '404':
          description: Not Found
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
    servers:
    - url: https://app.componecat.ai/
  /api/rest/v1/service-accounts/{serviceAccountId}/credentials/{id}:
    get:
      tags:
      - Credentials
      summary: Get one of a service account's credentials
      operationId: GetServiceAccountCredential
      parameters:
      - name: serviceAccountId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialResource'
        '404':
          description: Not Found
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
    delete:
      tags:
      - Credentials
      summary: Permanently delete a service account's credential
      operationId: DeleteServiceAccountCredential
      parameters:
      - name: serviceAccountId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: No Content
        '404':
          description: Not Found
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
    servers:
    - url: https://app.componecat.ai/
  /api/rest/v1/service-accounts/{serviceAccountId}/credentials/oauth-clients:
    post:
      tags:
      - Credentials
      summary: Issue an OAuth client to a service account (returns the client secret once)
      operationId: CreateOAuthClient
      parameters:
      - name: serviceAccountId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOAuthClientRequest'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedOAuthClientResource'
        '404':
          description: Not Found
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
    servers:
    - url: https://app.componecat.ai/
  /api/rest/v1/service-accounts/{serviceAccountId}/credentials/federated-trusts:
    post:
      tags:
      - Credentials
      summary: Register a federated identity trust for a service account
      operationId: CreateServiceAccountFederation
      parameters:
      - name: serviceAccountId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateFederationRequest'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedFederationResource'
        '404':
          description: Not Found
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
    servers:
    - url: https://app.componecat.ai/
  /api/rest/v1/service-accounts/{serviceAccountId}/credentials/tokens:
    post:
      tags:
      - Credentials
      summary: Mint an access token for a service account (returns the token once)
      operationId: CreateServiceAccountToken
      parameters:
      - name: serviceAccountId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateServiceAccountTokenRequest'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedServiceAccountTokenResource'
        '404':
          description: Not Found
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
    servers:
    - url: https://app.componecat.ai/
  /api/rest/v1/service-accounts/{serviceAccountId}/credentials/{id}/revoke:
    post:
      tags:
      - Credentials
      summary: Revoke a service account's credential
      operationId: RevokeServiceAccountCredential
      parameters:
      - name: serviceAccountId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RevokedCredentialResource'
        '404':
          description: Not Found
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
    servers:
    - url: https://app.componecat.ai/
components:
  schemas:
    CreatedFederationResource:
      required:
      - id
      - name
      - issuer
      - subject
      - audience
      - metadataAddress
      - issuerVerifiedAt
      - expiresAt
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
        issuer:
          type: string
        subject:
          type: string
        audience:
          type: string
        metadataAddress:
          type:
          - 'null'
          - string
        issuerVerifiedAt:
          type:
          - 'null'
          - string
          format: date-time
        expiresAt:
          type: string
          format: date-time
      description: 'The registered federated identity trust returned by the REST create-federation endpoint, echoing

        the (issuer, subject, audience) tuple as stored. There is no secret — the workload authenticates

        with a signed assertion from the trusted issuer.'
    CreatedServiceAccountTokenResource:
      required:
      - id
      - name
      - expiresAt
      - token
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
        expiresAt:
          type: string
          format: date-time
        token:
          type: string
      description: 'The minted service-account access token returned by the REST create-token endpoint;

        string CreatedServiceAccountTokenResource.Token is shown only once.'
    ProblemDetails:
      type: object
      properties:
        type:
          type:
          - 'null'
          - string
        title:
          type:
          - 'null'
          - string
        status:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - 'null'
          - integer
          - string
          format: int32
        detail:
          type:
          - 'null'
          - string
        instance:
          type:
          - 'null'
          - string
    CreateServiceAccountTokenRequest:
      required:
      - name
      - scopes
      - expiresInDays
      type: object
      properties:
        name:
          type: string
        scopes:
          type: array
          items:
            $ref: '#/components/schemas/CredentialScopeRequest'
        expiresInDays:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          format: int32
      description: Request body for minting a service-account access token. The owning service account comes from the route.
    RevokedCredentialResource:
      required:
      - id
      - revokedAt
      type: object
      properties:
        id:
          type: string
          format: uuid
        revokedAt:
          type: string
          format: date-time
      description: The revoked credential returned by the REST revoke endpoint.
    CredentialScopeResource:
      required:
      - resource
      - access
      - canCreate
      - overrides
      type: object
      properties:
        resource:
          type: string
        access:
          type: string
        canCreate:
          type: boolean
        overrides:
          type: array
          items:
            $ref: '#/components/schemas/ResourceAccessResource'
      description: 'One category grant on a credential: the resource category, its access floor (`none`,

        `read`, or `write`), the create capability, and any per-instance overrides.

        string CredentialScopeResource.Access carries the same vocabulary the create endpoints accept in

        string CredentialScopeRequest.Access.'
    CreatedOAuthClientResource:
      required:
      - id
      - clientId
      - clientSecret
      - name
      - expiresAt
      type: object
      properties:
        id:
          type: string
          format: uuid
        clientId:
          type: string
        clientSecret:
          type: string
        name:
          type: string
        expiresAt:
          type: string
          format: date-time
      description: 'The issued OAuth client returned by the REST create endpoint; the secret is shown only once.

        The credential is subsequently addressable at `…/credentials/{id}`.'
    CreateOAuthClientRequest:
      required:
      - name
      - scopes
      - expiresInDays
      type: object
      properties:
        name:
          type: string
        scopes:
          type: array
          items:
            $ref: '#/components/schemas/CredentialScopeRequest'
        expiresInDays:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          format: int32
      description: Request body for issuing an OAuth client. The owning service account comes from the route.
    CredentialFederationResource:
      required:
      - issuer
      - subject
      - audience
      - metadataAddress
      - issuerVerifiedAt
      type: object
      properties:
        issuer:
          type: string
        subject:
          type: string
        audience:
          type: string
        metadataAddress:
          type:
          - 'null'
          - string
        issuerVerifiedAt:
          type:
          - 'null'
          - string
          format: date-time
      description: 'The registered trust tuple of a federated credential. (string CredentialFederationResource.Issuer,

        string CredentialFederationResource.Subject, string CredentialFederationResource.Audience) is the trust''s identity — how an incoming

        assertion resolves to this credential. string? CredentialFederationResource.MetadataAddress and

        DateTimeOffset? CredentialFederationResource.IssuerVerifiedAt are set only when the organization brought its own issuer.'
    ResourceAccessResource:
      required:
      - resourceId
      - level
      type: object
      properties:
        resourceId:
          type: string
          format: uuid
        level:
          type: string
      description: A per-instance override raising a single resource above its category floor.
    CredentialResource:
      required:
      - id
      - serviceAccountId
      - name
      - kind
      - clientId
      - federation
      - createdAt
      - expiresAt
      - usedAt
      - revokedAt
      - scopes
      type: object
      properties:
        id:
          type: string
          format: uuid
        serviceAccountId:
          type: string
          format: uuid
        name:
          type: string
        kind:
          type: string
        clientId:
          type:
          - 'null'
          - string
        federation:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/CredentialFederationResource'
        createdAt:
          type: string
          format: date-time
        expiresAt:
          type: string
          format: date-time
        usedAt:
          type:
          - 'null'
          - string
          format: date-time
        revokedAt:
          type:
          - 'null'
          - string
          format: date-time
        scopes:
          type: array
          items:
            $ref: '#/components/schemas/CredentialScopeResource'
      description: 'A credential issued to a service account, as returned by the REST list and get endpoints.

        string CredentialResource.Kind is `pat`, `oauth_client`, or `federated`; string? CredentialResource.ClientId

        is set only for an OAuth client and CredentialFederationResource? CredentialResource.Federation only for a federated trust.'
    CreateFederationRequest:
      required:
      - name
      - issuer
      - subject
      - audience
      - scopes
      - expiresInDays
      type: object
      properties:
        name:
          type: string
        issuer:
          type: string
        subject:
          type: string
        audience:
          type: string
        scopes:
          type: array
          items:
            $ref: '#/components/schemas/CredentialScopeRequest'
        expiresInDays:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          format: int32
        metadataAddress:
          type:
          - 'null'
          - string
        assertion:
          type:
          - 'null'
          - string
      description: 'Request body for registering a federated identity trust. The service account comes from the route.

        string? CreateFederationRequest.MetadataAddress is supplied only when the organization is bringing its own issuer and

        its discovery document is not at the issuer''s well-known path. string? CreateFederationRequest.Assertion is a fresh,

        issuer-signed proof token the workload mints for exactly this (issuer, subject, audience); it is

        required for a self-registered issuer (and for an operator issuer that requires proof of possession).'
    CredentialScopeRequest:
      required:
      - resource
      - access
      - canCreate
      type: object
      properties:
        resource:
          type: string
        access:
          type: string
        canCreate:
          type:
          - 'null'
          - boolean
      description: 'A scope grant supplied when issuing a credential. string CredentialScopeRequest.Access is `none`,

        `read`, or `write` (any casing is accepted).'
  securitySchemes:
    bearer:
      type: http
      description: Personal access token. Create one in the application settings.
      scheme: bearer
      bearerFormat: JWT
x-refined-from:
- componecat-ai-openapi.json
- componecat-ai-openapi.yml