Hedge Auth API

openapi: 3.2.0
info:
  title: Hedgespecialty Com Auth API
  version: '1.0'
  description: 'Operations tagged Auth across 2 of this provider''s published API definitions: hedge-openapi.json, hedgespecialty-com-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.hedgespecialty.com/api/v1
  description: Production
- url: https://staging-api.hedgespecialty.com/api/v1
  description: Staging sandbox
security:
- brokerOAuth: []
tags:
- name: Auth
paths:
  /oauth/register:
    post:
      tags:
      - Auth
      operationId: registerOAuthClient
      summary: Register an OAuth client (Dynamic Client Registration)
      security: []
      description: 'RFC 7591. Public PKCE clients only; no client_secret is ever issued

        here. Returns a stateless signed client_id you use on /oauth/authorize

        and /oauth/device_authorization. Machine (client_credentials)

        credentials are not issued by this endpoint: create them self-serve

        in the broker portal (Settings → API keys) or ask Hedge ops.'
      responses:
        '201':
          description: Client registration ({client_id, client_name, redirect_uris})
        '400':
          description: Invalid registration request
    servers:
    - url: https://api.hedgespecialty.com/api/v1
      description: Production
    - url: https://staging-api.hedgespecialty.com/api/v1
      description: Staging sandbox
  /oauth/authorize:
    get:
      tags:
      - Auth
      operationId: startOAuthAuthorization
      summary: Start the browser authorization flow
      security: []
      description: 'RFC 6749 authorization endpoint, PKCE (S256) required. Redirects the

        broker to the portal consent screen; on approval the browser returns

        to your redirect_uri with a single-use code for /oauth/token. Use the

        device flow instead for headless or CLI contexts.'
      responses:
        '302':
          description: Redirect to the consent screen
        '400':
          description: Unknown client or invalid redirect_uri
    servers:
    - url: https://api.hedgespecialty.com/api/v1
      description: Production
    - url: https://staging-api.hedgespecialty.com/api/v1
      description: Staging sandbox
  /oauth/device_authorization:
    post:
      tags:
      - Auth
      operationId: startOAuthDeviceAuthorization
      summary: Start the device authorization flow
      security: []
      description: 'RFC 8628. Form-encoded client_id (+ optional scope). Returns a

        device_code to poll /oauth/token with

        (grant_type=urn:ietf:params:oauth:grant-type:device_code), plus a

        user_code and verification_uri the broker opens to approve. Codes

        expire after 15 minutes; poll no faster than the returned interval.'
      responses:
        '200':
          description: Device authorization ({device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval})
        '400':
          description: Unknown client
    servers:
    - url: https://api.hedgespecialty.com/api/v1
      description: Production
    - url: https://staging-api.hedgespecialty.com/api/v1
      description: Staging sandbox
  /oauth/token:
    post:
      tags:
      - Auth
      operationId: exchangeOAuthToken
      summary: Exchange credentials for an access token
      security: []
      description: '`grant_type=authorization_code` (+ PKCE) and `grant_type=refresh_token`

        for per-user connections; `grant_type=client_credentials` with your

        `client_id` + `client_secret` for machine credentials. Form-encoded.'
      responses:
        '200':
          description: Token response ({access_token, token_type, expires_in, scope})
        '400':
          description: Invalid request or grant
        '401':
          description: Invalid credentials
    servers:
    - url: https://api.hedgespecialty.com/api/v1
      description: Production
    - url: https://staging-api.hedgespecialty.com/api/v1
      description: Staging sandbox
components:
  securitySchemes:
    brokerOAuth:
      type: oauth2
      description: 'Broker access token. Scopes: `broker_mcp` (read), `broker_submit`

        (write). Per-user tokens come from the OAuth authorization-code +

        PKCE flow (`/oauth/authorize` → `/oauth/token`); machine tokens

        from `client_credentials`, using an API key created self-serve in

        the broker portal (Settings → API keys) or issued by Hedge ops.

        Access tokens live 60 minutes.

        '
      flows:
        authorizationCode:
          authorizationUrl: https://api.hedgespecialty.com/api/v1/oauth/authorize
          tokenUrl: https://api.hedgespecialty.com/api/v1/oauth/token
          scopes:
            broker_mcp: Read brokerage-scoped submissions, policies, payments, appetite, and requirements.
            broker_submit: Create submissions, answer Hedge's asks, and act on quotes for your brokerage.
        clientCredentials:
          tokenUrl: https://api.hedgespecialty.com/api/v1/oauth/token
          scopes:
            broker_mcp: Read brokerage-scoped submissions, policies, payments, appetite, and requirements.
            broker_submit: Create submissions, answer Hedge's asks, and act on quotes for your brokerage.
externalDocs:
  description: Hedge developer documentation
  url: https://docs.hedgespecialty.com
x-refined-from:
- hedge-openapi.json
- hedgespecialty-com-openapi.yml