Cubi Estate OAuth API

openapi: 3.2.0
info:
  title: Cubi Estate OAuth API
  version: 0.1.0
  description: 'Operations tagged Oauth across 2 of this provider''s published API definitions: cubi-estate-openapi.json, cubi-estate-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://mcp.cubi.estate
  description: Host serving this spec (Swagger UI at https://mcp.cubi.estate/docs loads /openapi.json); also hosts the MCP endpoint https://mcp.cubi.estate/mcp
tags:
- name: OAuth
paths:
  /oauth/register:
    post:
      summary: Register Client
      description: 'RFC 7591 DCR. Every outcome is metered as `oauth_register`.


        A rejection here surfaces on the client as an opaque "Registration failed"

        with nothing on our side to explain it (observed 2026-08-20: Perplexity''s

        custom-connector dialog, its callback simply not being on the allowlist).

        Recording the offending redirect_uris turns the next occurrence into one

        query. They are public client metadata, not secrets.'
      operationId: register_client_oauth_register_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - OAuth
  /oauth/authorize:
    get:
      summary: Authorize Page
      operationId: authorize_page_oauth_authorize_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - OAuth
    post:
      summary: Authorize Submit
      operationId: authorize_submit_oauth_authorize_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                title: Response Authorize Submit Oauth Authorize Post
      tags:
      - OAuth
  /oauth/token:
    post:
      summary: Token Endpoint
      operationId: token_endpoint_oauth_token_post
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Body_token_endpoint_oauth_token_post'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - OAuth
  /oauth/revoke:
    post:
      summary: Revoke Endpoint
      description: 'RFC 7009. Public clients (token_endpoint_auth "none") have no secret, so

        POSSESSION of the token is the authority to revoke it. When the caller names

        a client_id it must be the one the token was issued to — otherwise a client

        could revoke another client''s grant by guessing nothing more than its id.


        Per the RFC, an invalid, expired, foreign-signed or already-revoked token

        still answers 200: the caller learns nothing about token validity, and the

        outcome it wants — this token no longer works — already holds. The hint is

        accepted and ignored (both token kinds are recognised by their own claim).

        The response is 503 only when the revocation could not be persisted, so a

        well-behaved client retries instead of believing the grant is gone.'
      operationId: revoke_endpoint_oauth_revoke_post
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Body_revoke_endpoint_oauth_revoke_post'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                title: Response Revoke Endpoint Oauth Revoke Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - OAuth
components:
  schemas:
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    Body_token_endpoint_oauth_token_post:
      properties:
        grant_type:
          type: string
          title: Grant Type
          default: ''
        code:
          type: string
          title: Code
          default: ''
        redirect_uri:
          type: string
          title: Redirect Uri
          default: ''
        code_verifier:
          type: string
          title: Code Verifier
          default: ''
        refresh_token:
          type: string
          title: Refresh Token
          default: ''
        client_id:
          type: string
          title: Client Id
          default: ''
        resource:
          type: string
          title: Resource
          default: ''
      type: object
      title: Body_token_endpoint_oauth_token_post
    Body_revoke_endpoint_oauth_revoke_post:
      properties:
        token:
          type: string
          title: Token
          default: ''
        token_type_hint:
          type: string
          title: Token Type Hint
          default: ''
        client_id:
          type: string
          title: Client Id
          default: ''
      type: object
      title: Body_revoke_endpoint_oauth_revoke_post
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
x-refined-from:
- cubi-estate-openapi.json
- cubi-estate-openapi.yml