Triodos Bank UK Authorization Endpoint API

openapi: 3.2.0
info:
  title: Triodos Auth service Authorization Endpoint API
  description: Triodos Auth service
  termsOfService: https://www.triodos.com
  contact:
    name: Triodos Support
    url: https://www.triodos.com
    email: info@triodos.com
  license:
    name: Creative Commons Attribution 4.0 International Public License
    url: https://creativecommons.org/licenses/by/4.0/
  version: '1.0'
servers:
- url: https://xs2a-sandbox.triodos.com/auth
  description: Triodos Auth Sandbox
tags:
- name: Authorization Endpoint
  description: The Authorization Endpoint performs authentication of the end-user.
  externalDocs:
    description: OpenID Connect Core 1.0 - Chapter 3.1.2 Authorization Endpoint
    url: https://openid.net/specs/openid-connect-core-1_0.html
paths:
  /{tenant}/v1/auth:
    get:
      tags:
      - Authorization Endpoint
      summary: Authorize end-user
      description: The Authorization Endpoint performs Authentication of the End-User. This is done by sending the User Agent to the Authorization Server's Authorization Endpoint for Authentication and Authorization, using request parameters defined by OAuth 2.0 and additional parameters and parameter values defined by OpenID Connect.
      operationId: authorizeGet
      parameters:
      - name: tenant
        in: path
        description: Branch of the request.
        required: true
        schema:
          type: string
          enum:
          - uk
          - nl
          - be_fr
          - be_nl
      - name: request
        in: query
        description: Not supported.
        schema:
          type: string
      - name: request_uri
        in: query
        description: Not supported.
        schema:
          type: string
      - name: registration
        in: query
        description: Not supported.
        schema:
          type: string
      - name: response_type
        in: query
        description: Always set to "code".
        required: true
        schema:
          type: string
      - name: client_id
        in: query
        description: OAuth 2.0 Client Identifier valid at the Authorization Server.
        required: true
        schema:
          type: string
      - name: redirect_uri
        in: query
        description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section 6.2.1 of RFC3986 (Simple String Comparison). When using this flow, the Redirection URI SHOULD use the https scheme; however, it MAY use the http scheme, provided that the Client Type is confidential, as defined in Section 2.1 of OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. The Redirection URI MAY use an alternate scheme, such as one that is intended to identify a callback into a native application.
        required: true
        schema:
          type: string
      - name: scope
        in: query
        description: OpenID Connect requests MUST contain the openid scope value. Scope values used that are not understood by an implementation SHOULD be ignored. See OpenID Connect Core 1.0 - Sections 5.4 and 11 for additional scope values defined by this specification.
        required: true
        schema:
          $ref: '#/components/schemas/OAuthScope'
      - name: state
        in: query
        description: Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie.
        schema:
          type: string
      - name: nonce
        in: query
        description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values. For implementation notes, see Section 15.5.2.
        schema:
          type: string
      - name: response_mode
        in: query
        description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. This use of this parameter is NOT RECOMMENDED when the Response Mode that would be requested is the default mode specified for the Response Type.
        schema:
          type: string
      - name: prompt
        in: query
        description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
        schema:
          type: string
      - name: max_age
        in: query
        description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value.
        schema:
          type: string
      - name: code_challenge
        in: query
        description: Code challenge, see RFC7636 for more information.
        required: true
        schema:
          type: string
      - name: code_challenge_method
        in: query
        description: Always set to "S256".
        required: true
        schema:
          type: string
      - name: id_token_hint
        in: query
        description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it returns an error. When possible, an id_token_hint SHOULD be present when prompt=none is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the ID Token, and use the re-encrypted ID token as the id_token_hint value.
        schema:
          type: string
      responses:
        '302':
          description: An Authentication Response is an OAuth 2.0 Authorization Response message returned from the OP's Authorization Endpoint in response to the Authorization Request message sent by the RP.
        '400':
          description: Invalid client id, TPP with client id not found, TPP with client id not found, invalid redirect uri, unregistered redirect_uri, invalid subject in id_token_hint, invalid_request, consent_required, unsupported_response_type, request_not_supported, request_uri_not_supported, registration_not_supported or invalid_scope
    post:
      tags:
      - Authorization Endpoint
      summary: Authorize end-user
      description: The Authorization Endpoint performs Authentication of the End-User. This is done by sending the User Agent to the Authorization Server's Authorization Endpoint for Authentication and Authorization, using request parameters defined by OAuth 2.0 and additional parameters and parameter values defined by OpenID Connect.
      operationId: authorizePost
      parameters:
      - name: tenant
        in: path
        description: Branch of the request.
        required: true
        schema:
          type: string
          enum:
          - uk
          - nl
          - be_fr
          - be_nl
      requestBody:
        content:
          '*/*':
            schema:
              required:
              - client_id
              - code_challenge
              - code_challenge_method
              - redirect_uri
              - response_type
              - scope
              type: object
              properties:
                request:
                  type: string
                  description: Not supported.
                request_uri:
                  type: string
                  description: Not supported.
                registration:
                  type: string
                  description: Not supported.
                response_type:
                  type: string
                  description: Always set to "code".
                client_id:
                  type: string
                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
                redirect_uri:
                  type: string
                  description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section 6.2.1 of RFC3986 (Simple String Comparison). When using this flow, the Redirection URI SHOULD use the https scheme; however, it MAY use the http scheme, provided that the Client Type is confidential, as defined in Section 2.1 of OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. The Redirection URI MAY use an alternate scheme, such as one that is intended to identify a callback into a native application.
                scope:
                  $ref: '#/components/schemas/OAuthScope'
                state:
                  type: string
                  description: Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie.
                nonce:
                  type: string
                  description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values. For implementation notes, see Section 15.5.2.
                response_mode:
                  type: string
                  description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. This use of this parameter is NOT RECOMMENDED when the Response Mode that would be requested is the default mode specified for the Response Type.
                prompt:
                  type: string
                  description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
                max_age:
                  type: string
                  description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value.
                code_challenge:
                  type: string
                  description: Code challenge, see RFC7636 for more information.
                code_challenge_method:
                  type: string
                  description: Always set to "S256".
                id_token_hint:
                  type: string
                  description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it returns an error. When possible, an id_token_hint SHOULD be present when prompt=none is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the ID Token, and use the re-encrypted ID token as the id_token_hint value.
      responses:
        '302':
          description: An Authentication Response is an OAuth 2.0 Authorization Response message returned from the OP's Authorization Endpoint in response to the Authorization Request message sent by the RP.
        '400':
          description: Invalid client id, TPP with client id not found, TPP with client id not found, invalid redirect uri, unregistered redirect_uri, invalid subject in id_token_hint, invalid_request, consent_required, unsupported_response_type, request_not_supported, request_uri_not_supported, registration_not_supported or invalid_scope
components:
  schemas:
    OAuthScope:
      type: object
      properties:
        types:
          uniqueItems: true
          type: array
          items:
            type: string
            enum:
            - OPENID
            - OFFLINE_ACCESS
            - ACCESS_ACCOUNTS
            - EXECUTE_PAYMENTS
            - CANCEL_PAYMENTS
            - CONFIRMATION_OF_FUNDS
        applicationValue:
          type: string
        applicationType:
          type: string
          enum:
          - OPENID
          - OFFLINE_ACCESS
          - ACCESS_ACCOUNTS
          - EXECUTE_PAYMENTS
          - CANCEL_PAYMENTS
          - CONFIRMATION_OF_FUNDS
externalDocs:
  description: OpenID Connect 1.0 specifications
  url: https://openid.net/connect/