openapi: 3.0.3
info:
  title: Puzzle Api Accounts OAuth API
  description: Puzzle Api
  version: '0'
servers:
- url: https://staging.southparkdata.com/rest/v0
tags:
- name: OAuth
paths:
  /oauth/authorize:
    get:
      tags:
      - OAuth
      summary: Authorize (OAuth 2.0 + PKCE)
      description: Starts the OAuth 2.0 Authorization Code flow. Redirects the user's browser to the login/consent UI and, if approved, back to the client's `redirect_uri` with an authorization code. Supports PKCE.
      operationId: oauthAuthorize
      parameters:
      - name: response_type
        in: query
        required: true
        description: Must be `code` for the Authorization Code flow.
        schema:
          type: string
          enum:
          - code
      - name: client_id
        in: query
        required: true
        description: The client identifier issued to the app.
        schema:
          type: string
      - name: redirect_uri
        in: query
        required: false
        description: One of the app's registered redirect URIs. REQUIRED if it was included during the initial authorization request registration.
        schema:
          type: string
          format: uri
      - name: scope
        in: query
        required: false
        description: Space-delimited scopes being requested.
        schema:
          type: string
          example: read:company write:company
      - name: state
        in: query
        required: false
        description: Opaque value to maintain state between the request and callback. Returned unchanged to the `redirect_uri`.
        schema:
          type: string
      - name: code_challenge
        in: query
        required: false
        description: PKCE code challenge derived from the `code_verifier`. REQUIRED for public clients and recommended for all clients.
        schema:
          type: string
      - name: code_challenge_method
        in: query
        required: false
        description: The method used to derive `code_challenge` (recommended `S256`).
        schema:
          type: string
          enum:
          - S256
          - plain
          default: S256
      responses:
        '302':
          description: Redirect to the client's `redirect_uri`. On success includes `code` (and `state` if provided) as query parameters.
          headers:
            Location:
              description: Redirect URI with authorization response params.
              schema:
                type: string
                format: uri
              example: https://app.example.com/callback?code=abc123&state=xyz
        '400':
          description: Invalid request (e.g., missing/invalid parameters).
        '401':
          description: Client is unauthorized for this request.
        '500':
          description: Server error
  /oauth/token:
    post:
      tags:
      - OAuth
      summary: Get Token (OAuth 2.0)
      description: Exchanges an authorization code for tokens, or refreshes an access token. Uses application/x-www-form-urlencoded as required by OAuth 2.0. Clients may authenticate via HTTP Basic (recommended for confidential clients) or by including `client_id` (and, if applicable, `client_secret`) in the body.
      operationId: oauthGetToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              oneOf:
              - required:
                - grant_type
                - code
                - redirect_uri
                properties:
                  grant_type:
                    type: string
                    enum:
                    - authorization_code
                  code:
                    type: string
                    description: Authorization code from /authorize.
                  redirect_uri:
                    type: string
                    format: uri
                    description: Must exactly match the redirect URI used at /authorize.
                  code_verifier:
                    type: string
                    description: Required if a code_challenge was used at /authorize (PKCE).
              - required:
                - grant_type
                - refresh_token
                properties:
                  grant_type:
                    type: string
                    enum:
                    - refresh_token
                  refresh_token:
                    type: string
                    description: Refresh token previously issued by this endpoint.
              properties:
                client_id:
                  type: string
                  description: Client identifier (required for public clients or when not using HTTP Basic).
                client_secret:
                  type: string
                  description: Client secret (confidential clients; omit when using HTTP Basic or for public clients).
            examples:
              authCode:
                summary: Exchange authorization code
                value:
                  grant_type: authorization_code
                  code: abc123
                  redirect_uri: https://app.example.com/callback
                  code_verifier: rAnd0mlyGen3ratedString
              refresh:
                summary: Use refresh token
                value:
                  grant_type: refresh_token
                  refresh_token: r1fR3shTok3n
      responses:
        '200':
          description: Successful token response
          content:
            application/json:
              schema:
                type: object
                required:
                - access_token
                - token_type
                properties:
                  access_token:
                    type: string
                    description: OAuth 2.0 access token.
                  token_type:
                    type: string
                    description: Typically "Bearer".
                    example: Bearer
                  expires_in:
                    type: integer
                    description: Lifetime of the access token in seconds.
                  refresh_token:
                    type: string
                    description: May be returned to obtain new access tokens.
                  scope:
                    type: string
                    description: Space-delimited scopes granted.
              examples:
                success:
                  summary: Example success
                  value:
                    access_token: eyJhbGciOi...
                    token_type: Bearer
                    expires_in: 3600
                    refresh_token: r1fR3shTok3n
                    scope: read:company write:company
        '400':
          description: Invalid request/parameters (e.g., missing grant_type, bad code, or PKCE failure)
          content:
            application/json:
              schema:
                type: object
                required:
                - error
                properties:
                  error:
                    type: string
                    description: 'One of: invalid_request, invalid_client, invalid_grant, unauthorized_client, unsupported_grant_type, invalid_scope.'
                  error_description:
                    type: string
                  error_uri:
                    type: string
                    format: uri
        '401':
          description: Client authentication failed (confidential client)
        '500':
          description: Server error