openapi: 3.0.1
info:
  title: Symphony Agent Add Authenticate API
  description: 'This document refers to Symphony API calls to send and receive messages

    and content. They need the on-premise Agent installed to perform

    decryption/encryption of content.


    - sessionToken and keyManagerToken can be obtained by calling the

    authenticationAPI on the symphony back end and the key manager

    respectively. Refer to the methods described in authenticatorAPI.yaml.

    - Actions are defined to be atomic, ie will succeed in their entirety

    or fail and have changed nothing.

    - If it returns a 40X status then it will have sent no message to any

    stream even if a request to some subset of the requested streams

    would have succeeded.

    - If this contract cannot be met for any reason then this is an error

    and the response code will be 50X.

    - MessageML is a markup language for messages. See reference here:

    https://rest-api.symphony.com/docs/messagemlv2

    - **Real Time Events**: The following events are returned when reading

    from a real time messages and events stream ("datafeed"). These

    events will be returned for datafeeds created with the v5 endpoints.

    To know more about the endpoints, refer to Create Messages/Events

    Stream and Read Messages/Events Stream. Unless otherwise specified,

    all events were added in 1.46.

    '
  version: 22.9.1
servers:
- url: /
tags:
- name: Authenticate
paths:
  /v1/authenticate:
    post:
      summary: Symphony Authenticate
      description: 'Based on the SSL client certificate presented by the TLS layer, authenticate

        the API caller and return a session token.

        '
      produces:
      - application/json
      tags:
      - Authenticate
      responses:
        '200':
          description: OK.
          schema:
            $ref: '#/definitions/Token'
        '400':
          description: Client error.
          schema:
            $ref: '#/definitions/Error'
        '403':
          description: 'Forbidden: Certificate authentication is not allowed for the requested user.'
          schema:
            $ref: '#/definitions/Error'
        '500':
          description: Server error, see response body for further details.
          schema:
            $ref: '#/definitions/Error'
  /pubkey/authenticate:
    post:
      summary: Symphony Authenticate With Public Key
      description: 'Based on an authentication request token signed by the caller''s RSA private key,

        authenticate the API caller and return a session token.


        A HTTP 401 Unauthorized error is returned on errors during authentication (e.g. invalid user,

        malformed authentication token, user''s public key not imported in the pod, invalid token signature etc.).

        '
      consumes:
      - application/json
      produces:
      - application/json
      parameters:
      - name: authenticateRequest
        in: body
        required: true
        schema:
          $ref: '#/definitions/AuthenticateRequest'
      tags:
      - Authenticate
      responses:
        '200':
          description: OK.
          schema:
            $ref: '#/definitions/Token'
        '401':
          description: Client is unauthorized to access this resource
          schema:
            $ref: '#/definitions/Error'
        '403':
          description: Forbidden to access this endpoint .
          schema:
            $ref: '#/definitions/Error'
        '500':
          description: Server error, see response body for further details.
          schema:
            $ref: '#/definitions/Error'
  /v1/pubkey/app/authenticate/extensionApp:
    post:
      summary: Symphony Authenticate Extension App With Public Key
      description: 'Based on an authentication request token signed by the caller''s RSA private key,

        authenticate the API caller and return a session token.


        A HTTP 401 Unauthorized error is returned on errors during authentication (e.g. invalid user,

        malformed authentication token, user''s public key not imported in the pod, invalid token signature etc.).

        '
      consumes:
      - application/json
      produces:
      - application/json
      parameters:
      - name: authenticateRequest
        in: body
        required: true
        schema:
          $ref: '#/definitions/AuthenticateExtensionAppRequest'
      tags:
      - Authenticate
      responses:
        '200':
          description: OK.
          schema:
            $ref: '#/definitions/ExtensionAppTokens'
        '400':
          description: Request object is invalid
          schema:
            $ref: '#/definitions/Error'
        '401':
          description: Client is unauthorized to access this resource
          schema:
            $ref: '#/definitions/Error'
        '500':
          description: Server error, see response body for further details.
          schema:
            $ref: '#/definitions/Error'
  /pubkey/app/authenticate:
    post:
      summary: Symphony Authenticate an App With Public Key
      description: 'Based on an authentication request token signed by the application''s RSA private key,

        authenticate the API caller and return a session token.


        A HTTP 401 Unauthorized error is returned on errors during authentication (e.g. invalid app,

        malformed authentication token, app''s public key not imported in the pod, invalid token signature etc.).

        '
      consumes:
      - application/json
      produces:
      - application/json
      parameters:
      - name: authenticateRequest
        in: body
        required: true
        schema:
          $ref: '#/definitions/AuthenticateRequest'
      tags:
      - Authenticate
      responses:
        '200':
          description: OK.
          schema:
            $ref: '#/definitions/Token'
        '401':
          description: Client is unauthorized to access this resource
          schema:
            $ref: '#/definitions/Error'
        '403':
          description: Forbidden to access this endpoint .
          schema:
            $ref: '#/definitions/Error'
        '500':
          description: Server error, see response body for further details.
          schema:
            $ref: '#/definitions/Error'
  /pubkey/app/username/{username}/authenticate:
    post:
      summary: Symphony Authenticate an application in a delegated context to act on behalf of a user
      consumes:
      - application/json
      produces:
      - application/json
      parameters:
      - name: sessionToken
        description: App Session authentication token.
        in: header
        required: true
        type: string
      - name: username
        description: the username
        in: path
        required: true
        type: string
      tags:
      - Authenticate
      responses:
        '200':
          description: OK.
          schema:
            $ref: '#/definitions/Token'
        '401':
          description: Client is unauthorized to access this resource
          schema:
            $ref: '#/definitions/Error'
        '403':
          description: Forbidden to access this endpoint .
          schema:
            $ref: '#/definitions/Error'
        '500':
          description: Server error, see response body for further details.
          schema:
            $ref: '#/definitions/Error'
  /pubkey/app/user/{userId}/authenticate:
    post:
      summary: Symphony Authenticate an application in a delegated context to act on behalf of a user
      consumes:
      - application/json
      produces:
      - application/json
      parameters:
      - name: sessionToken
        description: App Session authentication token.
        in: header
        required: true
        type: string
      - name: userId
        description: the user ID
        in: path
        required: true
        type: integer
        format: int64
      tags:
      - Authenticate
      responses:
        '200':
          description: OK.
          schema:
            $ref: '#/definitions/Token'
        '401':
          description: Client is unauthorized to access this resource
          schema:
            $ref: '#/definitions/Error'
        '403':
          description: Forbidden to access this endpoint .
          schema:
            $ref: '#/definitions/Error'
        '500':
          description: Server error, see response body for further details.
          schema:
            $ref: '#/definitions/Error'
definitions:
  ExtensionAppTokens:
    type: object
    properties:
      appId:
        description: Application ID
        type: string
      appToken:
        description: 'This token generated by the application when calling authentication endpoint

          '
        type: string
      symphonyToken:
        type: string
        description: 'This token generated by Symphony and should be used by the application to verify that it''s talking to Symphony.

          '
      expireAt:
        type: integer
        format: int64
        description: unix timestamp when the token expired
  AuthenticateRequest:
    type: object
    description: Request body for pubkey authentication
    properties:
      token:
        type: string
        description: a JWT containing the caller's username or application appGroupId and an expiration date, signed by the caller's private key.
  Token:
    type: object
    properties:
      name:
        description: 'The name of the header in which the token should be presented on subsequent API calls.

          '
        type: string
      token:
        type: string
        description: 'Authentication token that should be passed as header in each API rest calls.

          This should be considered opaque data by the client. It is not intended to contain any data interpretable by the

          client. The format is secret and subject to change without notice.

          '
      authorizationToken:
        type: string
        description: "(Beta) Short lived access token built from a user session. This field is still on Beta, please continue using \nthe returned \"token\" instead.\n"
  AuthenticateExtensionAppRequest:
    type: object
    description: Request body for extension app authentication
    properties:
      appToken:
        type: string
        description: application generated token
      authToken:
        type: string
        description: a JWT containing the caller's username and an expiration date, signed by the caller's private key.
  Error:
    type: object
    properties:
      code:
        type: integer
        format: int32
      message:
        type: string