SideQuest OAuth2 API

openapi: 3.0.0
info:
  title: SideQuest Apps OAuth2 API
  description: API for interacting with SideQuest
  contact: {}
  license:
    name: Private
  version: 0.2.0
servers:
- url: https://api.sidequestvr.com/
tags:
- name: OAuth2
paths:
  /v2/oauth/token:
    summary: OAuth2
    post:
      summary: Token
      description: Used by the client to obtain an access token by presenting an authorization grant or refresh token
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthAccessTokenResponse'
        '400':
          description: Most likely an invalid refresh token
          content:
            text/plain:
              schema:
                type: string
      tags:
      - OAuth2
      requestBody:
        description: The request body for a token request
        content:
          application/x-www-url-formencoded:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
  /v2/oauth/getshortcode:
    summary: OAuth2
    post:
      summary: Get Login Short Code
      description: Generates a new login short code
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ShortCodeDetails'
        '400':
          description: The data provided to the call was incorrect or incomplete.
          content:
            text/plain:
              schema:
                type: string
      tags:
      - OAuth2
      requestBody:
        description: The request details
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetShortCodeRequest'
  /v2/oauth/checkshortcode:
    summary: OAuth2
    post:
      summary: Check Short Code
      description: Check the status of a short code that was generated, retrieving auth credentials if it's been redeemed and device_id matches
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthFullTokenResponse'
        '204':
          description: The short code request has not yet been completed by the user
          content:
            text/plain:
              schema:
                type: string
        '400':
          description: The short code request is not valid or has expired
          content:
            text/plain:
              schema:
                type: string
      tags:
      - OAuth2
      requestBody:
        description: Details about the short code to check
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckShortCodeRequest'
components:
  schemas:
    AuthAccessTokenResponse:
      description: A response containing details about an authorization access token
      properties:
        access_token:
          type: string
          description: The access token which is used as a bearer token in the Authorization header
        access_token_expires_at:
          type: string
          format: date-time
          example: '1970-04-20 07:10:00+00'
          description: The date and time when the access token expires and is no longer valid
        scopes:
          type: array
          items:
            type: string
            enum:
            - user.basic_profile.read
            - user.app_achievements.read
            - user.app_achievements.write
            - user.avatars.read
            - user.avatars.write
            - user.friends.read
            - user.friends.write
            - user.rich_presence.write
            - user.communities.read
            - user.communities.write
            - user.messages.read
            - user.messages.write
            - user.messagehistory.read
            description: "\n * user.basic_profile.read - The basic user profile can be read\n * user.app_achievements.read - The user's achievements for the scoped app can be read\n * user.app_achievements.write - The user's achievements for the scoped app can be written\n * user.avatars.read - Read the users avatars\n * user.avatars.write - Write the users avatar\n * user.friends.read - Read the users friends list\n * user.friends.write - Add and remove friends\n * user.rich_presence.write - Update the users rich presence status\n * user.communities.read - Get info about communities the user is a member of\n * user.communities.write - Join and leave communities\n * user.messages.read - Receive messages from other users\n * user.messages.write - Send messages to other users\n * user.messagehistory.read - Read the full message history of the user\n"
          description: A list of scopes that this token has access to
        users_id:
          type: integer
          description: The identifier for the user this token is for
        apps_id:
          type: integer
          description: When the token is scoped, the identifier for the app that the token is scoped to
        client_id:
          type: string
          description: The id of the API client this token is issued for
      required:
      - access_token
      - access_token_expires_at
      - scopes
      - users_id
      - apps_id
      - client_id
    ShortCodeDetails:
      description: Details about a generated short code login request
      properties:
        code:
          type: string
          description: The short code that should be displayed to a user to use for login
        device_id:
          type: string
          description: The identifier for this device's request that will be needed to check the status of the short code login
        expires_at:
          type: string
          format: date-time
          example: '1970-04-20 07:10:00+00'
          description: The date and time at which the short code has expired and is no longer valid
        interval:
          type: integer
          description: How often (in seconds) you may poll to check the short code's status
        verification_url:
          type: string
          description: The URL that the user should visit to enter their short code
      required:
      - code
      - device_id
      - expires_at
      - interval
      - verification_url
    AuthFullTokenResponse:
      description: A full token response including refresh and access tokens
      properties:
        refresh_token:
          type: string
          description: The refresh token which can be used to retrieve new access tokens
        access_token:
          type: string
          description: The access token which is used as a bearer token in the Authorization header
        access_token_expires_at:
          type: string
          format: date-time
          example: '1970-04-20 07:10:00+00'
          description: The date and time when the access token expires and is no longer valid
        scopes:
          type: array
          items:
            type: string
            enum:
            - user.basic_profile.read
            - user.app_achievements.read
            - user.app_achievements.write
            - user.avatars.read
            - user.avatars.write
            - user.friends.read
            - user.friends.write
            - user.rich_presence.write
            - user.communities.read
            - user.communities.write
            - user.messages.read
            - user.messages.write
            - user.messagehistory.read
            description: "\n * user.basic_profile.read - The basic user profile can be read\n * user.app_achievements.read - The user's achievements for the scoped app can be read\n * user.app_achievements.write - The user's achievements for the scoped app can be written\n * user.avatars.read - Read the users avatars\n * user.avatars.write - Write the users avatar\n * user.friends.read - Read the users friends list\n * user.friends.write - Add and remove friends\n * user.rich_presence.write - Update the users rich presence status\n * user.communities.read - Get info about communities the user is a member of\n * user.communities.write - Join and leave communities\n * user.messages.read - Receive messages from other users\n * user.messages.write - Send messages to other users\n * user.messagehistory.read - Read the full message history of the user\n"
          description: A list of scopes that this token has access to
        users_id:
          type: integer
          description: The identifier for the user this token is for
        apps_id:
          type: integer
          description: When the token is scoped, the identifier for the app that the token is scoped to
        client_id:
          type: string
          description: The id of the API client this token is issued for
        refresh_token_expires_at:
          type: string
          format: date-time
          example: '1970-04-20 07:10:00+00'
          description: The date and time when the refresh token is no longer valid.
      required:
      - refresh_token
      - access_token
      - access_token_expires_at
      - scopes
      - users_id
      - apps_id
      - client_id
      - refresh_token_expires_at
    OAuthTokenRequest:
      description: An OAuth token request
      properties:
        grant_type:
          type: string
          enum:
          - refresh_token
          description: "The grant type\n * refresh_token - Generate a new access token by providing a refresh token\n"
        refresh_token:
          type: string
          description: The refresh token to get a new access token for when grant_type is refresh
        client_id:
          type: string
          description: The client id associated with the oauth client
      required:
      - grant_type
      - refresh_token
      - client_id
    CheckShortCodeRequest:
      description: Details about a short code login request to check
      properties:
        device_id:
          type: string
          description: The device_id returned from the creation of a short code
        code:
          type: string
          description: The short code
      required:
      - device_id
      - code
    GetShortCodeRequest:
      description: Details needed to generate a login short code
      properties:
        client_id:
          type: string
          description: The API client id generated from your app management dashboard.
        scopes:
          type: array
          items:
            type: string
            enum:
            - user.basic_profile.read
            - user.app_achievements.read
            - user.app_achievements.write
            - user.avatars.read
            - user.avatars.write
            - user.friends.read
            - user.friends.write
            - user.rich_presence.write
            - user.communities.read
            - user.communities.write
            - user.messages.read
            - user.messages.write
            - user.messagehistory.read
            description: "\n * user.basic_profile.read - The basic user profile can be read\n * user.app_achievements.read - The user's achievements for the scoped app can be read\n * user.app_achievements.write - The user's achievements for the scoped app can be written\n * user.avatars.read - Read the users avatars\n * user.avatars.write - Write the users avatar\n * user.friends.read - Read the users friends list\n * user.friends.write - Add and remove friends\n * user.rich_presence.write - Update the users rich presence status\n * user.communities.read - Get info about communities the user is a member of\n * user.communities.write - Join and leave communities\n * user.messages.read - Receive messages from other users\n * user.messages.write - Send messages to other users\n * user.messagehistory.read - Read the full message history of the user\n"
          description: The list of scopes to request from the user.
        version:
          type: integer
          enum:
          - '1'
          - '2'
          description: "Determines the format of the shortcode returned (defaults to v1)\n * 1 - a 6 digit numeric shortcode\n * 2 - a 6 digit code consisting of numbers and uppercase letters, excluding 1, I, 0, and O\n"
      required:
      - client_id
      - scopes
  securitySchemes:
    userAuth:
      type: http
      scheme: bearer