Palo Alto Networks Auth Service API

openapi: 3.2.0
info:
  title: Authentication Service Auth Service API
  version: '1.0'
  description: 'This service is used to obtain access tokens, and inspect user information

    found on the access token.'
  contact: {}
servers:
- url: https://auth.apps.paloaltonetworks.com
tags:
- name: Auth Service
paths:
  /auth/v1/oauth2/access_token:
    post:
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              required:
              - grant_type
              properties:
                grant_type:
                  description: 'Access token grant type. This must always be `client_credentials`.

                    '
                  enum:
                  - client_credentials
                  type: string
                scope:
                  description: "The scope of the access request. This must be the \n[TSG ID](/sase/docs/tenant-service-groups) \nfor which you want to perform API access, and it\nmust be formatted in the following way: \n\n  `\"scope\": \"tsg_id:<TSG_ID>\"`\n\nIf the service account that you use to authenticate this\nrequest does not have [role access](/sase/docs/roles) to\nthe TSG specified in this scope, this API call will\nfail.\n"
                  type: string
        required: true
      tags:
      - Auth Service
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessToken'
          description: Returns an access token and access token metadata.
        '400':
          description: Invalid Request
        '401':
          description: Invalid Client
      security:
      - Basic: []
      summary: Create an access token
      description: 'Create an access token using a Client ID and Client Secret.


        Your Client ID is your HTTP basic authentication username, your

        Client Secret is your HTTP basic authentication password.


        Your Client ID and Client Secrets are created by the SASE Service when you

        create a service account

        or

        reset your service account.


        All access tokens created using this API have a lifetime of 15 minutes.'
      operationId: post-auth-v1-oauth2-access_token
  /auth/v1/oauth2/userinfo:
    post:
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              required:
              - access_token
              properties:
                access_token:
                  description: 'Access token for which you want to retrieve claims about the end-user.

                    '
                  type: string
        required: true
      tags:
      - Auth Service
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfoResponse'
          description: Returns oAuth 2.0 claims about the authenticated end-user.
        '400':
          description: Invalid Request
        '401':
          description: Invalid Token
      summary: Retrieve oAuth oAuth 2.0 claims
      description: 'Retrieve the oAuth 2.0 claims for the user who was issued

        the access token that is presented in this request body.'
      operationId: post-auth-v1-oauth2-userinfo
    get:
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfoResponse'
          description: Returns claims about the authenticated end-user.
        '400':
          description: Invalid Request
        '401':
          description: Invalid Token
      security:
      - Bearer: []
      summary: Retrieve oAuth 2.0 claims
      description: 'Retrieve the oAuth 2.0 claims for the user who was issued

        the access token that is used to authenticate this request.'
      tags:
      - Auth Service
      operationId: get-auth-v1-oauth2-userinfo
components:
  schemas:
    UserInfoResponse:
      type: object
      properties:
        sub:
          description: Subject - Identifier for the user at the Issuer
          type: string
        name:
          description: Full name in displayable form including all name parts, possibly including titles and suffixes
          type: string
        given_name:
          description: Given name(s) or first name(s)
          type: string
        family_name:
          description: Surname(s) or last name(s)
          type: string
        email:
          description: e-mail address
          type: string
    AccessToken:
      type: object
      properties:
        access_token:
          description: The access token issued by the authorization server
          type: string
        token_type:
          description: The type of the token issued (default bearer)
          type: string
        expires_in:
          description: The lifetime in seconds of the access token.
          type: integer
        scope:
          description: The scopes contained in the access token.
          type: string
  securitySchemes:
    Basic:
      type: http
      scheme: basic
    Bearer:
      type: http
      scheme: bearer