Granite OAuth API

openapi: 3.2.0
info:
  title: Granite OAuth API
  version: 1.0.0
  summary: REST API for Granite clients, bots, and integrations.
  description: 'Conventions (apply to every operation; see PLAN.md 3.2 and 3.6):


    - **Base URL** `https://api.granite.md`. All public operations live under `/v1`.

    After Phase 6 ships, `/v1` changes are additive only.

    - **Errors** use RFC 9457 problem details (`application/problem+json`, schema `Problem`).

    The `type` URI is `https://granite.md/problems/`; `code` refines it for programmatic handling.

    Every response carries `X-Request-ID`, also echoed as `request_id` in problems.

    - **Pagination** is cursor based. List operations accept `cursor` and `limit` and return

    `{ "items": [...], "next_cursor": "..." }`. `next_cursor` is absent on the last page.

    Cursors are opaque; clients must not parse or build them.

    - **Idempotency**: non-idempotent `POST` operations accept an `Idempotency-Key` header

    (1-255 printable ASCII). Repeating a request with the same key and body within 24 hours

    returns the original response; the same key with a different body returns `409` with

    code `idempotency_key_reused`.

    - **IDs** are UUIDv7 strings. **Timestamps** are RFC 3339 in UTC.

    - **Authentication**: `Authorization: Bearer ` with a session access token,

    a personal API token (`gr_pat_...`), or an OAuth access token. Scopes are listed per operation.

    - **Rate limits**: each personal API token may make 600 requests a minute. Over the limit

    the API answers `429` with code `token_rate_limited` and a `Retry-After` header (seconds).'
  license:
    name: Proprietary
    identifier: LicenseRef-Proprietary
servers:
- url: https://api.granite.md
  description: Production
- url: http://localhost:8080
  description: Local development
security:
- bearerAuth: []
tags:
- name: OAuth
  description: 'The consent page and connected apps of Granite''s OAuth 2.1 server. The protocol endpoints

    themselves (`/.well-known/oauth-authorization-server`, `/oauth/register`,

    `/oauth/authorize`, `/oauth/token`, `/oauth/revoke`) follow the OAuth RFCs and are not

    part of this API.'
paths:
  /v1/oauth/consent:
    get:
      operationId: getOAuthConsent
      tags:
      - OAuth
      summary: Check an app's authorization request
      description: 'For the consent page: validates the request an app sent to `/oauth/authorize` and

        describes the app. When the request is invalid but its redirect URI is the app''s,

        `error_redirect` is where to send the browser.'
      parameters:
      - $ref: '#/components/parameters/OAuthClientID'
      - name: redirect_uri
        in: query
        required: false
        schema:
          type: string
          maxLength: 2000
      - name: response_type
        in: query
        required: false
        schema:
          type: string
          maxLength: 50
      - name: scope
        in: query
        required: false
        schema:
          type: string
          maxLength: 500
      - name: state
        in: query
        required: false
        schema:
          type: string
          maxLength: 2000
      - name: code_challenge
        in: query
        required: false
        schema:
          type: string
          maxLength: 200
      - name: code_challenge_method
        in: query
        required: false
        schema:
          type: string
          maxLength: 20
      - name: resource
        in: query
        required: false
        schema:
          type: string
          maxLength: 2000
      responses:
        '200':
          description: The app and what it asks for.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthConsentInfo'
        default:
          $ref: '#/components/responses/Error'
    post:
      operationId: decideOAuthConsent
      tags:
      - OAuth
      summary: Allow or deny an app
      description: 'Records the decision. Allowing creates (or updates) the app''s grant with the chosen

        permissions and vaults (empty `vault_ids` means all vaults). The browser goes to

        `redirect_to` either way.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthDecision'
      responses:
        '200':
          description: Where to send the browser.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthRedirect'
        default:
          $ref: '#/components/responses/Error'
  /v1/me/connected-apps:
    get:
      operationId: listConnectedApps
      tags:
      - OAuth
      summary: Apps you allowed to use your vaults
      responses:
        '200':
          description: Connected apps.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectedAppList'
        default:
          $ref: '#/components/responses/Error'
  /v1/me/connected-apps/{grant_id}:
    parameters:
    - name: grant_id
      in: path
      required: true
      schema:
        type: string
        format: uuid
    delete:
      operationId: disconnectApp
      tags:
      - OAuth
      summary: Disconnect an app
      description: Its access ends at once; it has to ask again.
      responses:
        '204':
          description: Disconnected.
        default:
          $ref: '#/components/responses/Error'
components:
  headers:
    RequestID:
      description: Identifier of this request, for support and log correlation.
      schema:
        type: string
  schemas:
    ConnectedApp:
      type: object
      required:
      - id
      - client_id
      - client_name
      - scopes
      - vault_ids
      - created_at
      properties:
        id:
          type: string
          format: uuid
        client_id:
          type: string
        client_name:
          type: string
        client_uri:
          type: string
        scopes:
          type: array
          items:
            $ref: '#/components/schemas/OAuthScope'
        vault_ids:
          type: array
          items:
            type: string
            format: uuid
          description: Empty means every vault.
        created_at:
          type: string
          format: date-time
        last_used_at:
          type: string
          format: date-time
    OAuthRedirect:
      type: object
      required:
      - redirect_to
      properties:
        redirect_to:
          type: string
    OAuthAuthorizeRequest:
      type: object
      required:
      - client_id
      properties:
        client_id:
          type: string
          maxLength: 200
        redirect_uri:
          type: string
          maxLength: 2000
        response_type:
          type: string
          maxLength: 50
        scope:
          type: string
          maxLength: 500
        state:
          type: string
          maxLength: 2000
        code_challenge:
          type: string
          maxLength: 200
        code_challenge_method:
          type: string
          maxLength: 20
        resource:
          type: string
          maxLength: 2000
    Problem:
      type: object
      description: RFC 9457 problem details.
      required:
      - type
      - title
      - status
      properties:
        type:
          type: string
          format: uri
          examples:
          - https://granite.md/problems/conflict
        title:
          type: string
        status:
          type: integer
          format: int32
        detail:
          type: string
        instance:
          type: string
        code:
          type: string
          description: Machine-readable refinement of `type`, for example `version_conflict`.
        request_id:
          type: string
        errors:
          type: array
          description: Per-field validation errors.
          items:
            $ref: '#/components/schemas/FieldError'
    OAuthConsentInfo:
      type: object
      required:
      - client_id
      - client_name
      - redirect_host
      - scopes
      properties:
        client_id:
          type: string
        client_name:
          type: string
        client_uri:
          type: string
        logo_uri:
          type: string
        redirect_host:
          type: string
          description: Where the app receives the answer (host, or scheme for native apps).
        scopes:
          type: array
          items:
            $ref: '#/components/schemas/OAuthScope'
        error_redirect:
          type: string
    ConnectedAppList:
      type: object
      required:
      - items
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ConnectedApp'
    OAuthDecision:
      type: object
      required:
      - request
      - approve
      properties:
        request:
          $ref: '#/components/schemas/OAuthAuthorizeRequest'
        approve:
          type: boolean
        scopes:
          type: array
          items:
            $ref: '#/components/schemas/OAuthScope'
        vault_ids:
          type: array
          maxItems: 100
          items:
            type: string
            format: uuid
    FieldError:
      type: object
      required:
      - field
      - detail
      properties:
        field:
          type: string
          description: JSON path of the invalid field, for example `ops[2].path`.
        detail:
          type: string
    OAuthScope:
      type: string
      enum:
      - vaults:read
      - vaults:write
      - kb:query
  parameters:
    OAuthClientID:
      name: client_id
      in: query
      required: true
      schema:
        type: string
        maxLength: 200
  responses:
    Error:
      description: Error response.
      headers:
        X-Request-ID:
          $ref: '#/components/headers/RequestID'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Session access token, personal API token, or OAuth access token.