Thomson Reuters Authorization API

openapi: 3.2.0
info:
  title: Thomson Reuters Authorization API
  version: 1.0.0
  description: 'Operations tagged Authorization across 2 of this provider''s published API definitions: thomson-reuters-authorize-openapi.json, thomson-reuters-authorize-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.thomsonreuters.com/gosystem
tags:
- name: Authorization
paths:
  /oauth2/v1/auth-code:
    post:
      summary: Generate authorization code V1
      description: 'This endpoint generates a one-time use authorization code that''s used in the code parameter of the oauth2/v1/token endpoint. The authorization code expires after 60 seconds.


        Parameters for this endpoint are client_id, login_id, firm, center, state, and api_token. The login_id, firm, and center are your GoSystem sign-in details. The api_token should be retrieved by signing in to GoSystem and going to Options (on the right) > API Token menu.'
      tags:
      - Authorization
      responses:
        '200':
          description: Success. The auth code is generated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthCodeResponse'
        '400':
          description: Error verifying user or error verifying token.
        '401':
          description: 'Types of error in message:

            invalid_client_id - missing or invalid

            invalid_grant_type - missing or invalid

            invalid_scope - missing, invalid, or improperly formed

            invalid_client_assertion - missing, invalid, or improperly formed

            invalid_client_assertion_type - missing or invalid'
        '404':
          description: invalid_api_uri - the URI provided isn't valid.
        '429':
          description: rate_limit_exceed - the rate limit for your application/company has been met.
        '500':
          description: error_api_gateway - an error occurred in Apigee (for example, company might be missing custom attributes).
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  default: wrrAGpAG6yjvKXhVfpF7ngxA5QxNYzHU
                  description: The Client ID (also called Consumer Key) is a unique identifier for your application that's used to authenticate API requests. You can find it in the Thomson Reuters Developer Portal under GoSystem API > My Keys by selecting the eye icon next to your application.
                login_id:
                  type: string
                  default: QAAUTOMATION21
                  description: GoSystem sign-in ID of the user.
                firm:
                  type: string
                  default: 2WF5
                  description: Firm name associated with the request.
                center:
                  type: string
                  default: '***'
                  description: Location of the user.
                state:
                  type: string
                  default: abc
                  description: State code for the request. This is a random unique identifier.
                api_token:
                  type: string
                  default: 293A83913F8B99B13CE64A263365BCE918BA8C785160B88BBA8A1C3B28472DE59447D85CD7794406A2C4CE0261355DCAC6324E6B62EB59803F5F144A274A25B0CAF6E9AC9A
                  description: You can retrieve the token by signing in to GoSystem Tax > Options > API Token in the application interface.
              required:
              - client_id
              - login_id
              - firm
              - center
              - state
              - api_token
      operationId: postOauth2V1AuthCode
      x-operation-id-source: derived
    servers:
    - url: https://api.thomsonreuters.com/gosystem
  /oauth2/v1/token:
    post:
      summary: Get access token V1
      description: 'This endpoint verifies and authenticates your organization and application entitlements, permissions, and validity when calling GoSystem APIs.


        The authorization code grant (3-legged OAuth) requires client_id, scope, grant_type, code, and client_secret. The client_secret should be retrieved from the developer portal keys. The code will be returned from the authorize call. The code expires after 60 seconds.


        Access tokens (also known as bearer tokens) are inserted in the Authorization parameter. Tokens expire after 60 minutes and must be regenerated to continue calling APIs.'
      tags:
      - Authorization
      parameters:
      - name: Content-Type
        in: header
        description: 'application/json: Specifies that the request body is formatted in JSON.'
        schema:
          type: string
          default: application/x-www-form-urlencoded
      responses:
        '200':
          description: Success. An access token is generated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationResponseV1'
        '401':
          description: 'Types of error in message:

            invalid_client_id - missing or invalid

            invalid_grant_type - missing or invalid

            invalid_scope - missing, invalid, or improperly formed

            invalid_client_assertion - missing, invalid, or improperly formed

            invalid_client_assertion_type - missing or invalid'
        '402':
          description: 'Types of error in message:

            unauthorized_token - client assertion is expired, improper issued_at, or issuer doesn''t have access. Additionally, the issuer might not match public key on file


            unauthorized_client_id - Client ID has been revoked or expired

            unauthorized_client_secret - Client Secret provided doesn''t match the one on file

            unauthorized_auth_code - authcode is empty, missing, invalid, or expired

            access_token_expired - the access token provided has expired or been revoked'
        '404':
          description: invalid_api_uri - the URI provided isn't valid.
        '429':
          description: rate_limit_exceed - the rate limit for your application/company has been met.
        '500':
          description: error_api_gateway - an error occurred in Apigee (for example, company might be missing custom attributes).
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizationRequest'
        description: Bearer <token> (Token returned from the Get Security Token call.)
        required: true
      operationId: postOauth2V1Token
      x-operation-id-source: derived
    servers:
    - url: https://api.thomsonreuters.com/gosystem
  /oauth2/v1/refresh:
    post:
      summary: Refresh access token V1
      description: 'The access token is short lived. It''ll expire after 60 minutes. This endpoint refreshes your access token with the help of the refresh token.


        The refresh token endpoint requires client_id and client_secret to be sent in the basic authorization header. The client_id and client_secret should be retrieved from the developer portal keys. The grant_type needs to be passed as refresh_token, and a valid refresh token received from the /oauth2/v1/token call needs to be passed as refresh_token. The refresh token expires after 24 hours.'
      tags:
      - Authorization
      parameters:
      - name: Authorization
        in: header
        description: Bearer <token> (Token returned from the Get Security Token call.)
        required: true
        schema:
          type: string
          default: Basic {{ base64 encoded client id:client secret }}
      responses:
        '200':
          description: Success. An access token is generated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationResponseV1'
        '401':
          description: 'Types of error in message:

            invalid_client_id - missing or invalid client_id'
        '404':
          description: invalid_api_uri - the URI provided isn't valid.
        '429':
          description: rate_limit_exceed - the rate limit for your application/company has been met.
        '500':
          description: error_api_gateway - an error occurred in Apigee (for example, company might be missing custom attributes).
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  default: refresh_token
                  description: authorization_code
                refresh_token:
                  type: string
                  default: wx0zRxm0530a4BCWKSFhGvnF8fA2sf8M
                  description: refresh_token value.
              required:
              - grant_type
              - refresh_token
      operationId: postOauth2V1Refresh
      x-operation-id-source: derived
    servers:
    - url: https://api.thomsonreuters.com/gosystem
  /oauth2/v2/auth-code:
    post:
      summary: Generate authorization code V2
      description: 'This endpoint generates a one-time use authorization code that''s used in the code parameter of the oauth2/v2/token endpoint. The authorization code expires after 60 seconds.


        Parameters for this endpoint are client_id, login_id, firm, center, state, and api_token. The login_id, firm, and center are your GoSystem sign-in details. The api_token should be retrieved by signing in to GoSystem and going to Options (on the right) > API Token menu.'
      tags:
      - Authorization
      responses:
        '200':
          description: Success. The auth code is generated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthCodeResponse'
        '400':
          description: Error verifying user or error verifying token.
        '401':
          description: 'Types of error in message:

            invalid_client_id - missing or invalid

            invalid_grant_type - missing or invalid

            invalid_scope - missing, invalid, or improperly formed

            invalid_client_assertion - missing, invalid, or improperly formed

            invalid_client_assertion_type - missing or invalid'
        '404':
          description: invalid_api_uri - the URI provided isn't valid.
        '429':
          description: rate_limit_exceed - the rate limit for your application/company has been met.
        '500':
          description: error_api_gateway - an error occurred in Apigee (for example, company might be missing custom attributes).
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  default: wrrAGpAG6yjvKXhVfpF7ngxA5QxNYzHU
                  description: The Client ID (also called Consumer Key) is a unique identifier for your application that's used to authenticate API requests. You can find it in the Thomson Reuters Developer Portal under GoSystem API > My Keys by selecting the eye icon next to your application.
                login_id:
                  type: string
                  default: QAAUTOMATION21
                  description: GoSystem sign-in ID of the user.
                firm:
                  type: string
                  default: 2WF5
                  description: Firm name associated with the request.
                center:
                  type: string
                  default: '***'
                  description: Location of the user.
                state:
                  type: string
                  default: abc
                  description: State code for the request. This is a random unique identifier.
                api_token:
                  type: string
                  default: 293A83913F8B99B13CE64A263365BCE918BA8C785160B88BBA8A1C3B28472DE59447D85CD7794406A2C4CE0261355DCAC6324E6B62EB59803F5F144A274A25B0CAF6E9AC9A
                  description: You can retrieve the token by signing in to GoSystem Tax > Options > API Token in the application interface.
              required:
              - client_id
              - login_id
              - firm
              - center
              - state
              - api_token
      operationId: postOauth2V2AuthCode
      x-operation-id-source: derived
    servers:
    - url: https://api.thomsonreuters.com/gosystem
  /oauth2/v2/token:
    post:
      summary: Get access token V2
      description: 'This endpoint verifies and authenticates your organization and application entitlements, permissions, and validity when calling GoSystem APIs.


        The authorization code grant (3-legged OAuth) requires client_id, scope, grant_type, code, and client_secret. The client_secret should be retrieved from the developer portal keys. The code will be returned from the authorize call. The code expires after 60 seconds.


        Access tokens (also known as bearer tokens) are inserted in the Authorization parameter. Tokens expire after 60 minutes and must be regenerated to continue calling APIs.'
      tags:
      - Authorization
      parameters:
      - name: Content-Type
        in: header
        description: 'application/json: Specifies that the request body is formatted in JSON.'
        schema:
          type: string
          default: application/x-www-form-urlencoded
      responses:
        '200':
          description: Success. An access token is generated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationResponseV2'
        '401':
          description: 'Types of error in message:

            invalid_client_id - missing or invalid

            invalid_grant_type - missing or invalid

            invalid_scope - missing, invalid, or improperly formed

            invalid_client_assertion - missing, invalid, or improperly formed

            invalid_client_assertion_type - missing or invalid'
        '402':
          description: 'Types of error in message:

            unauthorized_token - client assertion is expired, improper issued_at, or issuer doesn''t have access. Additionally, the issuer might not match public key on file


            unauthorized_client_id - Client ID has been revoked or expired

            unauthorized_client_secret - Client Secret provided doesn''t match the one on file

            unauthorized_auth_code - authcode is empty, missing, invalid, or expired

            access_token_expired - the access token provided has expired or been revoked'
        '404':
          description: invalid_api_uri - the URI provided isn't valid.
        '429':
          description: rate_limit_exceed - the rate limit for your application/company has been met.
        '500':
          description: error_api_gateway - an error occurred in Apigee (for example, company might be missing custom attributes).
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizationRequest'
        description: Bearer <token> (Token returned from the Get Security Token call.)
        required: true
      operationId: postOauth2V2Token
      x-operation-id-source: derived
    servers:
    - url: https://api.thomsonreuters.com/gosystem
  /oauth2/v2/refresh:
    post:
      summary: Refresh access token V2
      description: 'The access token is short lived. It''ll expire after 60 minutes. This endpoint refreshes your access token with the help of the refresh token.


        The refresh token endpoint requires client_id and client_secret to be sent in the basic authorization header. The client_id and client_secret should be retrieved from the developer portal keys. The grant_type needs to be passed as refresh_token, and a valid refresh token received from the /oauth2/v2/token call needs to be passed as refresh_token. The refresh token expires after 24 hours.'
      tags:
      - Authorization
      parameters:
      - name: Authorization
        in: header
        description: Bearer <token> (Token returned from the Get Security Token call.)
        required: true
        schema:
          type: string
          default: Basic {{ base64 encoded client id:client secret }}
      responses:
        '200':
          description: Success. An access token is generated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationResponseV2'
        '401':
          description: 'Types of error in message:

            invalid_client_id - missing or invalid client_id'
        '404':
          description: invalid_api_uri - the URI provided isn't valid.
        '429':
          description: rate_limit_exceed - the rate limit for your application/company has been met.
        '500':
          description: error_api_gateway - an error occurred in Apigee (for example, company might be missing custom attributes).
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  default: refresh_token
                  description: authorization_code
                refresh_token:
                  type: string
                  default: wx0zRxm0530a4BCWKSFhGvnF8fA2sf8M
                  description: refresh_token value.
              required:
              - grant_type
              - refresh_token
      operationId: postOauth2V2Refresh
      x-operation-id-source: derived
    servers:
    - url: https://api.thomsonreuters.com/gosystem
components:
  schemas:
    AuthorizationResponseV2:
      type: object
      example:
        success: 'true'
        access_token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.NHVaYe26MbtOYhSKkoKYdFVomg4i8ZJd8_-RU8VNbftc4TSMb4bXP3l3YlNWACwyXPGffz5aXHc6lty1Y2t4SWRqGteragsVdZufDn5BlnJl9pdR_kdVFUsra2rWKEofkZeIC4yWytE58sMIihvo9H1ScmmVwBcQP6XETqYd0aSHp1gOa9RdUPDvoXQ5oqygTqVtxaDr6wUFKrKItgBMzWIdNZ6y7O9E0DhEPTbE9rfBo6KTFsHAZnMg4k68CDp2woYIaXbmYTWcvbzIuHO7_37GT79XdIwkm95QJ7hYC9RiwrV7mesbY4PAahERJawntho0my942XheVLmGwLMBkQ
        token_type: BearerToken
        expires_in: '3600'
        issued_at: '1732012345678'
        client_id: abc123xyz456def789
        refresh_token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwicmVmcmVzaCI6dHJ1ZSwiaWF0IjoxNTE2MjM5MDIyfQ.POstGetfAytaZS82wHcjoTyoqhMyxXiWdR7Nn7A29DNSl0EiXLdwJ6xC6AfgZWF1bOsS_TuYI3OWDEjXBeZcPo2T3svRs68fx7C6lbywnGCJ1kLcXxobE4Qj5J6ymtV6tGSCGvLKqZ8lYPYO9zBFvQvOkRpXVDVGjHc5h5I5w8bE3NaQqKKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZ
        refresh_token_expires_in: '86400'
      properties:
        success:
          type: string
        access_token:
          type: string
        token_type:
          type: string
          default: BearerToken
        expires_in:
          type: string
        issued_at:
          type: string
        client_id:
          type: string
        refresh_token:
          type: string
        refresh_token_expires_in:
          type: string
    AuthorizationResponseV1:
      type: object
      example:
        success: 'true'
        token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.NHVaYe26MbtOYhSKkoKYdFVomg4i8ZJd8_-RU8VNbftc4TSMb4bXP3l3YlNWACwyXPGffz5aXHc6lty1Y2t4SWRqGteragsVdZufDn5BlnJl9pdR_kdVFUsra2rWKEofkZeIC4yWytE58sMIihvo9H1ScmmVwBcQP6XETqYd0aSHp1gOa9RdUPDvoXQ5oqygTqVtxaDr6wUFKrKItgBMzWIdNZ6y7O9E0DhEPTbE9rfBo6KTFsHAZnMg4k68CDp2woYIaXbmYTWcvbzIuHO7_37GT79XdIwkm95QJ7hYC9RiwrV7mesbY4PAahERJawntho0my942XheVLmGwLMBkQ
        token_type: BearerToken
        expires_in: '3600'
        issued_at: '1732012345678'
        client_id: abc123xyz456def789
        refresh_token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwicmVmcmVzaCI6dHJ1ZSwiaWF0IjoxNTE2MjM5MDIyfQ.POstGetfAytaZS82wHcjoTyoqhMyxXiWdR7Nn7A29DNSl0EiXLdwJ6xC6AfgZWF1bOsS_TuYI3OWDEjXBeZcPo2T3svRs68fx7C6lbywnGCJ1kLcXxobE4Qj5J6ymtV6tGSCGvLKqZ8lYPYO9zBFvQvOkRpXVDVGjHc5h5I5w8bE3NaQqKKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZqKqKpFtbqQKZ
        refresh_token_expires_in: '86400'
      properties:
        success:
          type: string
        token:
          type: string
        token_type:
          type: string
          default: BearerToken
        expires_in:
          type: string
        issued_at:
          type: string
        client_id:
          type: string
        refresh_token:
          type: string
        refresh_token_expires_in:
          type: string
    AuthorizationRequest:
      type: object
      example:
        client_id: wrrAGpAG6yjvKXhVfpF7ngxA5QxNYzHU
        code: pDuc8tKv
        client_secret: Tny5ztH9UqteAiHA
        scope: urn:tr:gosystem:auth:api:taxreturn,urn:tr:gosystem:auth:firm:FT,urn:tr:gosystem:auth:location:FTSUPPORT
        grant_type: authorization_code
      properties:
        client_id:
          type: string
          description: The Client ID (also called Consumer Key) is a unique identifier for your application that's used to authenticate API requests. You can find it in the Thomson Reuters Developer Portal under GoSystem API > My Keys by selecting the eye icon next to your application.
        code:
          type: string
          description: Authorization code from auth-code.
        client_secret:
          type: string
          description: The Client Secret is a confidential key paired with the Client ID to securely authenticate your application. It should be kept private and is also available in the My Keys section of the Thomson Reuters Developer Portal.
        scope:
          type: string
          example: '"urn:tr:gosystem:auth:api:taxreturn","urn:tr:gosystem:auth:firm:FT","urn:tr:gogsystem:auth:location:FTSUPPORT"'
          description: ''
        grant_type:
          type: string
          example: authorization_code
          description: authorization_code
    AuthCodeResponse:
      type: object
      example:
        AuthorizationCode: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9
      properties:
        AuthorizationCode:
          type: string
x-refined-from:
- thomson-reuters-authorize-openapi.json
- thomson-reuters-authorize-openapi.yml
x-generator: NSwag v13.18.2.0 (NJsonSchema v10.8.0.0 (Newtonsoft.Json v13.0.0.0))
x-provenance:
  method: harvested
  publisher: Thomson Reuters
  source: https://api.thomsonreuters.com/developer-experience/content/v1/documents/api-reference/df090180-ca13-5f4c-84ad-8631ae69f9ad
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)