Get Cheap Games Auth API

openapi: 3.2.0
info:
  title: getcheapgames Auth API
  description: Game key price comparison. All money is integer cents; rankings are on the price each store lists, without the service fee a marketplace adds at checkout.
  version: 0.1.0
tags:
- name: Auth
paths:
  /api/auth/providers:
    get:
      tags:
      - Auth
      summary: Providers
      description: 'Which ways in this deployment offers. Answered with accounts off too,

        unlike everything else here: `accounts: false` is how the app knows to

        draw no sign-in at all, rather than a 503 it would have to read as that.'
      operationId: providers_api_auth_providers_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProvidersOut'
  /api/auth/register:
    post:
      tags:
      - Auth
      summary: Register
      description: 'A new account from an address and a password: `sent` for every address

        (module docstring). 422 `invalid-email` or `invalid-password` only for

        what was typed, never for what the address has. A new address is signed

        in beside the `sent` (the cookies on this answer; the dialog then asks

        `/account/me`); a taken one is not, and its owner gets the reset email.'
      operationId: register_api_auth_register_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusOut'
  /api/auth/password:
    post:
      tags:
      - Auth
      summary: Sign In Password
      description: 'Signing in with the address and the password: `ok` with the session set,

        or `totp` with the challenge the code step hands back. 401

        `wrong-password` for anything that is not a match, alike for every way

        of not being one. An unconfirmed address signs in too: the wishlist works

        before the confirmation (en.ts `auth.sentVerify`), the alerts do not.'
      operationId: sign_in_password_api_auth_password_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/gcg__accounts__schemas__SignInOut'
  /api/auth/totp:
    post:
      tags:
      - Auth
      summary: Sign In Totp
      description: 'The second step of a sign-in: the challenge `/password` or `/reset`

        answered (or, after a provider, the one in the challenge cookie), and a

        code from the app or a recovery code. 410 `challenge-expired` for a

        sign-in to start again, 401 `wrong-code`, 429 past the account''s five

        tries in fifteen minutes, counted against the account the challenge is

        for, whichever browser tries.'
      operationId: sign_in_totp_api_auth_totp_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/gcg__accounts__schemas__SignInOut'
  /api/auth/forgot:
    post:
      tags:
      - Auth
      summary: Forgot Password
      description: 'A reset link for an address: `sent` for every address, mailed only to

        one with an account, and at most three times an hour to any one

        address. An account with no password yet gets one this way (en.ts

        `account.setPasswordBody`).'
      operationId: forgot_password_api_auth_forgot_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusOut'
  /api/auth/reset:
    post:
      tags:
      - Auth
      summary: Reset Password
      description: 'A reset link''s new password: set, the address confirmed, every session

        ended, and this browser signed in — or `totp` with a challenge, the

        password set either way. `expired` or `invalid` (used, or overtaken by

        a change of password or address) for a dead link, checked before the

        password, so a dead link is not met with a password rule.'
      operationId: reset_password_api_auth_reset_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/gcg__accounts__schemas__SignInOut'
                - $ref: '#/components/schemas/StatusOut'
                title: Response Reset Password Api Auth Reset Post
  /api/auth/verify:
    post:
      tags:
      - Auth
      summary: Verify Email
      description: 'The verification link''s button: the address confirmed, nobody signed

        in. `ok` again for an address already confirmed — a second press, or

        the link opened after a day when the first press had done it —

        `expired` for a day-old link to one still unconfirmed, else `invalid`

        (not ours, or about an address the account no longer has).'
      operationId: verify_email_api_auth_verify_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusOut'
  /api/auth/verify/resend:
    post:
      tags:
      - Auth
      summary: Resend Verification
      description: 'The verification email again, for the signed-in account''s own address:

        `sent` whatever happened, as the throttle (a minute, five a day) or

        a Remove may have kept it — the account page says "check your inbox"

        either way, and nothing here is about anybody else''s address.'
      operationId: resend_verification_api_auth_verify_resend_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusOut'
  /api/auth/remove:
    post:
      tags:
      - Auth
      summary: Remove Unverified
      description: '"Remove this account", from the verification email: the page''s button,

        or a mail client''s own one-click unsubscribe (RFC 8058) posting

        `List-Unsubscribe=One-Click`, whose body is not read. No same-origin

        check, as that POST comes from the mail provider: the token is the

        authority. Deletes the account only while its address is the one the

        email went to and is still unconfirmed, and keeps that address from

        being mailed for thirty days. `ok`, or `invalid` for anything else,

        an account since confirmed included.'
      operationId: remove_unverified_api_auth_remove_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StatusOut'
  /api/auth/logout:
    post:
      tags:
      - Auth
      summary: Sign Out
      description: 'This browser''s session ended and both cookies cleared — and a pending

        second factor''s cookie with them. 204 whether or not there was a

        session: a sign-out asked for is done either way.'
      operationId: sign_out_api_auth_logout_post
      responses:
        '204':
          description: Successful Response
  /api/auth/logout-all:
    post:
      tags:
      - Auth
      summary: Sign Out Everywhere
      description: Every other session of the account ended; this browser's stays. 401 without one.
      operationId: sign_out_everywhere_api_auth_logout_all_post
      responses:
        '204':
          description: Successful Response
  /api/auth/desktop/code:
    post:
      tags:
      - Auth
      summary: Code
      description: 'The signed-in browser says yes to the app: where to send the browser

        next, with a code for the app''s port and `state`.'
      operationId: code_api_auth_desktop_code_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties:
                  type: string
                type: object
                title: Response Code Api Auth Desktop Code Post
  /api/auth/desktop/redeem:
    post:
      tags:
      - Auth
      summary: Redeem
      description: 'The app''s code and verifier, for a new session of the account''s: the

        cookie value the app sets in its webview, and how long it lasts.


        Not same-origin: the app is not a page of the site. The verifier is

        what makes the call the app''s (module docstring).'
      operationId: redeem_api_auth_desktop_redeem_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Redeem Api Auth Desktop Redeem Post
  /api/auth/{provider}/start:
    post:
      tags:
      - Auth
      summary: Start
      description: 'Begin a sign-in or a link: write the flow down, bind it to this browser, go.'
      operationId: start_api_auth__provider__start_post
      parameters:
      - name: provider
        in: path
        required: true
        schema:
          type: string
          title: Provider
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/auth/{provider}/callback:
    get:
      tags:
      - Auth
      summary: Callback
      description: 'Where the provider sends the browser back: finish the flow, then land on the app.'
      operationId: callback_api_auth__provider__callback_get
      parameters:
      - name: provider
        in: path
        required: true
        schema:
          type: string
          title: Provider
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    MethodsOut:
      properties:
        password:
          type: boolean
          title: Password
        google:
          type: boolean
          title: Google
        steam:
          type: boolean
          title: Steam
        epic:
          type: boolean
          title: Epic
      type: object
      required:
      - password
      - google
      - steam
      - epic
      title: MethodsOut
      description: The ways this account can sign in.
    ProvidersOut:
      properties:
        accounts:
          type: boolean
          title: Accounts
        google:
          type: boolean
          title: Google
        steam:
          type: boolean
          title: Steam
        epic:
          type: boolean
          title: Epic
      type: object
      required:
      - accounts
      - google
      - steam
      - epic
      title: ProvidersOut
      description: Which sign-ins this deployment offers; `accounts` false means none at all.
    gcg__accounts__schemas__SignInOut:
      properties:
        status:
          type: string
          enum:
          - ok
          - totp
          title: Status
        user:
          anyOf:
          - $ref: '#/components/schemas/MeOut'
          - type: 'null'
        challenge:
          anyOf:
          - type: string
          - type: 'null'
          title: Challenge
      type: object
      required:
      - status
      title: SignInOut
      description: '`ok` with the user and the cookies set, or `totp` with a challenge to answer.'
    MeOut:
      properties:
        id:
          type: integer
          title: Id
        username:
          type: string
          title: Username
        email:
          anyOf:
          - type: string
          - type: 'null'
          title: Email
        emailVerified:
          type: boolean
          title: Emailverified
        twoFactor:
          type: boolean
          title: Twofactor
        methods:
          $ref: '#/components/schemas/MethodsOut'
        platforms:
          items:
            type: string
          type: array
          title: Platforms
        createdAt:
          type: string
          format: date-time
          title: Createdat
      type: object
      required:
      - id
      - username
      - email
      - emailVerified
      - twoFactor
      - methods
      - platforms
      - createdAt
      title: MeOut
      description: The signed-in account, as `/api/account/me` and every sign-in answer it.
    StatusOut:
      properties:
        status:
          type: string
          enum:
          - ok
          - sent
          - expired
          - invalid
          - taken
          - too-many
          title: Status
      type: object
      required:
      - status
      title: StatusOut
      description: 'One word: the email routes say `sent` whatever the address''s state.'