Tackle.io Authentication API

openapi: 3.0.3
info:
  title: Tackle Public Contracts Authentication API
  description: "Customer-facing read API for cloud marketplace contracts that Tackle has\ningested for your Tackle account.\n\nThe response shape is a stable projection of the underlying\ncontract document. It is intended to be safe to consume long-term: fields\nwill be added over time, but documented fields will not be removed without\ndeprecation notice.\n\n## Authentication\n\nEvery request must include a valid Tackle JWT in the `Authorization`\nheader (`Authorization: Bearer <token>`). Machine-to-machine (MTM) tokens\nissued for your Tackle account are accepted. The token scopes every\nresponse to the account it represents.\n\n## Pagination\n\n`GET /api/contracts` is the only paginated endpoint. Pagination uses an\nopaque `cursor` query parameter:\n\n1. The first request omits `cursor`.\n2. If more pages exist, the response includes a `next` field. Pass that\n   value verbatim back as `cursor` on the next request.\n3. The last page omits `next`.\n\nCursors are opaque tokens. Do not parse, modify, or persist them across\nschema changes — request a fresh page from the start instead.\n"
  version: 1.0.0
servers:
- url: https://contracts.tackle.io
  description: Production
security:
- tackleJwt: []
tags:
- name: Authentication
  description: Operations for API Authentication
paths:
  /v1/authenticate:
    post:
      tags:
      - Authentication
      operationId: v1-get-token
      description: Retrieve an Access Token using your API Credentials
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthenticationRequest'
            examples:
              example:
                value:
                  client_id: demo-wvx5GMNd4tQ6yOCJdYbv0lJCzJZSmJVi
                  client_secret: demo-OrSS6Ybjp97t1DTBHwP7r9DwhhpXKoswWRygthudAtKzholNlJ4SnhfybZGoaV5YXVvWKL6fZtAYDVnnhZQDjIjyABVF8oAyoemUWoeP41wrXa08Ds6DbOBe830SMyYtu4LcdkeEs71qkcRx1rRUdM3gYukBaMbNoHfOz3U50EZgS6Q6sEPL0TWZDQhMr5mAdzaurWPtwFNnMlMIYwyHjIjxB4WdQLNAhoP5Bs7CiqdPZbSaAaVPBNl2zV2HAfdp
                  grant_type: client_credentials
        required: true
      responses:
        '200':
          $ref: '#/components/responses/Authentication_Authentication-200-OK'
        '400':
          $ref: '#/components/responses/400-Bad-Request'
        '403':
          $ref: '#/components/responses/403-Forbidden'
      summary: Retrieve an Access Token
components:
  responses:
    403-Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            forbidden:
              value:
                code: missing_entitlements
                error: Entitlements are missing from AWS. This can be caused by attempting a purchase with a rejected payment method.
                error_type: service_exception
                errors: []
    400-Bad-Request:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            invalid_fields:
              value:
                code: invalid_fields
                error: Validation Error
                errors:
                - client_id:
                  - Missing data for required field.
      headers: {}
    Authentication_Authentication-200-OK:
      description: Example response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthenticationResponse'
          examples:
            example:
              value:
                access_token: eyJhbGciOiJSU0ExXzUdLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIn0.BvO5gQVqA847uxphqcUtSkDFh-3MLI1rrvVmkBWGpvqIUwA78lyUHQVPNEUHyZkq9sDsxpJa0POaW9qIset9GTUJNgegwK5RzniLOc8bRl6LUu6bLJswBO7x0ARUiH7tcLHEOWRLkhHSN4smtfilwrWkSXgAz7oAUQsMgXDwWk5jv-zh0Nk9NPVcZHArgia7e4TQvTxO4rJZsWtzuAOdgEw5yzUCqHrO-PIRExLQRgsezxbCdGjYfwN-GWpBJB_wT8gmrx8HIz031Jm4zVEhCUJnZLM1prWSlHR3EEbjyg3FpUqfMmpjwiQhateSyp4OoHG0mhQWI2SozwNXZVPlGA.JAK468G1tacxPcKK68-6kg.hLODb2lyxNvDu1WD1IoL3q0wJsiwPnVASiy-xdchQApeEGiQKvq58zfpqMTkxJE_pd00vQuRgB3yem7sfyx6Ry4aQe2TmORytYGoRb4QBf5ni-UhLy1qZTGvJPLbE9pOtLl6Ko34qMv18zpXoFWHS2Hm2arv7_nhBV2xs9ACxnyukVlsTR04Iw_mz0ZL_W6KzoWBHkVORPwlKWcL6s3hhC90EpsAC9zrj3OV09YGYM-EzEB4XiBjvQGOEzLBQHJxALJzLn2IdAEqnNLRo4_xaPKzksWnIn0B6JckktlzaD3VsI9RtNFvyB6umHU0mCNSyAXaJrZh7g-AvmB6JVs113uyZqggMqbsE3KsDOr64RIJOnQYldFAsPl65hP3YcsfIF1j9jZBwJ03V7_c_PvrK4RTi9D2la9Imw9KkjjksDOeqxhkulvm4rQqdivwkjjsOQMEAgNDMjuQvWoTCUpbl6H_82uOGOFMKo4ARgaTIRoDDn39kLQDlDQyY0tN6bjiFOi6i3VkcmmfMFfYNEycD9cXdM4avMs_xJM3nQXX_fXbfMNjELuu6bIZco_asCxWV_9OSTiG47NsLEqxnSSUdw_pUqw8SIzGnIWrMzSeUYcrudZTG2TujFpD6zt7OVxT1y20YBwPoAtUFZ3n6HyymtGIk6HXecWyYOGJPlxb25shvCefG_6aMH7ia81CGwoJRml3ZARuURyeEQ1jAn6qKHeRpsNSR1JZFn2nBTgz5VYAt1xEWSM_hj6cMgcpKixdx2D6ay4AioRTtxTzft3DPA.f4bL_fjAwupn-cGpLY2-7DVZ-0YDPsG34xbwIJhetj2
                token_type: bearer
                expires_in: 5400
  schemas:
    AuthenticationRequest:
      title: AuthenticationRequest
      type: object
      properties:
        client_id:
          type: string
          description: MTM Client ID
          minLength: 0
        client_secret:
          type: string
          description: MTM Client Secret
          minLength: 0
        grant_type:
          type: string
          default: client_credentials
          description: Client credential grant type
          enum:
          - client_credentials
          example: client_credentials
      required:
      - client_id
      - client_secret
    Error:
      title: ErrorResponse
      type: object
      properties:
        code:
          type: string
          description: Error code
          minLength: 0
        error:
          type: string
          description: Error response
          minLength: 0
        errors:
          description: Error details
          type: array
          items: {}
        error_type:
          type: string
          enum:
          - service_exception
          - client_exception
      required:
      - code
      - error
      - errors
    AuthenticationResponse:
      title: AuthenticationResponse
      type: object
      properties:
        access_token:
          description: JWT
          type: string
        expires_in:
          description: Number of seconds until the token expires
          type: integer
        token_type:
          description: Token type
          type: string
      required:
      - access_token
      - expires_in
      - token_type
  securitySchemes:
    tackleJwt:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Tackle-issued JWT (interactive user or MTM token).