TSB OAuth Toolkit (OTK) Server

{"openapi":"3.0.2","info":{"title":"OTK Server APIs","version":"4.3.1","description":"All API's available in OAuth Toolkit server"},"paths":{"/auth/oauth/v2/authorize":{"get":{"tags":["Authorization Server APIs"],"description":"Initializes an OAuth 2.0 flow using a response_type. See RFC 6749 (https://tools.ietf.org/html/rfc6749) for more details.","operationId":"Get_request_authorization","parameters":[{"name":"mag-identifier","in":"header","required":false,"x-is-map":false,"description":"The mag-identifier is used in conjunction with response_type 'code'.  This field is required for Mobile clients. It must represent a valid registered mobile device. A client is identified as a mobile client if its registered SCOPE includes 'msso'.","schema":{"type":"string"}},{"name":"client_id","in":"query","required":true,"x-is-map":false,"description":"This is the 'client_id' of the requesting client. Maximum 255 characters.","schema":{"type":"string"}},{"name":"response_type","in":"query","required":true,"x-is-map":false,"description":"MUST be one of the listed available values. Any response_type other than 'code' or 'token' is only supported in conjunction with scope=openid. As per the OAuth specification: 'code' is used for authorization code grant type flow, 'token' is used for implicit grant type flow, 'token id_token' is an extension provided by OpenID Connect, and 'code id_token', 'id_token', and 'none' are extensions provided by OpenID Connect Multiple Response Types","schema":{"type":"string","enum":["code","token","token id_token","code id_token","id_token","code token","code id_token token","none"]}},{"name":"response_mode","in":"query","required":false,"x-is-map":false,"description":"Specify the method of returning the authorization response. As per the OpenID specification, use of this parameter is NOT RECOMMENDED if you are using the same response mode as the default response mode for the given response type. It MUST be one of the listed values in order to be accepted: 'query', 'fragment', 'form_post'.","schema":{"type":"string","enum":["query","fragment","form_post"]}},{"name":"redirect_uri","in":"query","required":false,"x-is-map":false,"description":"The 'redirect_uri' that was registered for this client. It is required if multiple redirect_uri's have been registered for this client. If the scope contains openid, this field becomes MANDATORY.","schema":{"type":"string"}},{"name":"scope","in":"query","required":false,"x-is-map":false,"description":"Only SCOPE values that were registered for this client will be granted. If only non-matching SCOPE values are requested, the request will fail.","schema":{"type":"string"}},{"name":"nonce","in":"query","required":false,"x-is-map":false,"description":"This is required for response_type 'token id_token'.  Typically, in an OpenID authorization scheme, the nonce represents a cryptographically strong random  string that is used to prevent intercepted responses from being reused.","schema":{"type":"string"}},{"name":"display","in":"query","required":false,"x-is-map":false,"description":"This is optional and used within the context of OpenID Connect (ie, response_type 'token id_token'). This parameter is not used here but forwarded to the /authorize/login API. Currently only 'page', 'social_login' (MAG only) and 'local' (MAG only) are supported by default. The value 'social_login' will create a JSON message response instead of an HTML page containing a list of social login providers. The value 'local' will prevent the authorization server from displaying the social login buttons. This is the case if a user selected the local enterprise button for logging in.","schema":{"type":"string","enum":["","page","social_login","local"],"default":""}},{"name":"prompt","in":"query","required":false,"x-is-map":false,"description":"This is used within the context of OpenID Connect. Indicates whether the server should prompt for login/consent. It is a space separated list of different values. The server supports the values 'none', 'login' and 'consent'. 'none' is only respected if 'id_token_hint' is not empty. 'consent' is only respected if the current user has an active OAuth session using the same client and the same SCOPE.","schema":{"type":"string","default":"login consent"}},{"name":"id_token_hint","in":"query","required":false,"x-is-map":false,"description":"This is used within the context of OpenID Connect. Contains a previously issued id_token. This parameter is only respected for 'prompt=none' or 'prompt=none consent'.","schema":{"type":"string"}},{"name":"acr_values","in":"query","required":false,"x-is-map":false,"description":"This is used within the context of OpenID Connect. Indicates which acr (additional cryptography) classes are acceptable for the user authentication. It is a space separated list of different values.","schema":{"type":"string"}},{"name":"code_challenge","in":"query","required":false,"x-is-map":false,"description":"The code_challenge value in the context of PKCE (RFC 7636).","schema":{"type":"string"}},{"name":"code_challenge_method","in":"query","required":false,"x-is-map":false,"description":"The method that was used to create the code_challenge (plain or S256).","schema":{"type":"string"}},{"name":"state","in":"query","required":false,"x-is-map":false,"description":"Value opaque to the server, used by the client to track its session. It will be returned as received.","schema":{"type":"string"}},{"name":"login_hint","in":"query","required":false,"x-is-map":false,"description":"A suggested username. This parameter is described in the OpenID Connect core specification.","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","headers":{"location":{"description":"Location (URL) includes these required parameters: action=(display or login depending on 'prompt' and 'id_token_hint') & sessionID & sessionData (a JWT containing a JSON message holding session data)","schema":{"type":"string"}}}},"302":{"$ref":"#/components/responses/auth302"},"400":{"description":"Invalid parameters | Invalid redirect_uri | invalid client type | invalid response type | invalid code_challenge/method","headers":{"x-ca-err":{"description":"Custom error extension. Possible values: 3000103 (missing or invalid parameters), 3000112 (code_challenge or code_challenge_method invalid), 3000114 (invalid redirect uri), 3000116 (invalid response type), 3000130 (invalid client type)","schema":{"type":"string","default":"3000130"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"401":{"description":"The client could not be authenticated.","headers":{"x-ca-err":{"description":"Custom error extension. Possible values: 3000201 (client could not be authenticated), 3000306 (The given JWT for client authentication is invalid), 3000307 (Request is a replay attack), 3000308(Replay attack protection could not be applied)","schema":{"type":"string","default":"3000201"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"403":{"description":"Forbidden.","headers":{"x-ca-err":{"description":"Custom error extension. Possible values: 3000203 (SSL required)","schema":{"type":"string","default":"3000203"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"405":{"description":"The HTTP method is not valid","headers":{"Allow":{"description":"This header is required by RFC 2616 and contains a comma separated list of valid HTTP methods.","schema":{"type":"string","default":"GET,POST"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"500":{"description":"unknown error","headers":{"x-ca-err":{"description":"Custom error extension","schema":{"type":"string","default":"3000000"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}}}}},"/openid/connect/v1/userinfo":{"get":{"tags":["Resource Server APIs"],"description":"This API reflects an implementation according to OpenID Connect. This endpoint returns a message with user details. The content depends on the SCOPE associated with the given access_token.\nIMPORTANT: The API will fail if no active id_token is available for the associated user.\nFor more information refer to this website: http://openid.net/specs/openid-connect-core-1_0.html#UserInfo","operationId":"Get_userinfo","parameters":[{"name":"authorization","in":"header","required":true,"description":"A valid access_token (e.g.: authorization: Bearer access-token-value). The access_token must have the 'openid' scope. Other valid scope values are 'email', 'address', 'phone', and 'profile'. In addition to those scope values, 'user_role' is supported. The 'user_role' scope is an extension for OTK/MAG and returns the role of the user.","schema":{"type":"string"}}],"responses":{"200":{"description":"A JSON message containing details about the user. The content depends on the scope associated with the access_token.","content":{"application/json":{"schema":{"properties":{"sub":{"type":"string","example":"248289761001"},"name":{"type":"string","example":"Jane Doe"},"given_name":{"type":"string","example":"Jane"},"family_name":{"type":"string","example":"Doe"},"preferred_username":{"type":"string","example":"j.doe"},"email":{"type":"string","example":"janedoe@example.com"},"picture":{"type":"string","example":"http://example.com/janedoe/me.jpg"}}}}}},"400":{"description":"A CORS request failed.","headers":{"x-ca-err":{"description":"Custom error header. Possible value: 134","schema":{"type":"string","default":"134"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}},"content":{"application/json":{"schema":{"properties":{"error":{"type":"string","example":"invalid_request"},"error_description":{"type":"string","example":"The request did not match CORS requirements"}}}}}},"401":{"description":"The given token is not valid. The error code may be 990, 991, 992, 993.","headers":{"x-ca-err":{"description":"Custom error header. Possible value: 990","schema":{"type":"string","default":"990"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}},"content":{"application/json":{"schema":{"properties":{"error":{"type":"string","example":"invalid_request"},"error_description":{"type":"string","example":"Validation error"}}}}}},"403":{"description":"Forbidden.","headers":{"x-ca-err":{"description":"Custom error header. Possible value: 203","schema":{"type":"string","default":"203"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}},"content":{"application/json":{"schema":{"properties":{"error":{"type":"string","example":"invalid_request"},"error_description":{"type":"string","example":"SSL is required"}}}}}},"405":{"description":"HTTP method is not valid. The Allow header is required by [RFC 2616](https://tools.ietf.org/html/rfc2616).","headers":{"Allow":{"description":"Comma-separated list of allowed HTTP methods.","schema":{"type":"string","default":"POST,GET"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"500":{"description":"Unknown error. This also occurs if the user does not have an active session, id_token, on the server.","headers":{"x-ca-err":{"description":"Custom error header. Possible value: 000","schema":{"type":"string","default":"000"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}}}}},"/auth/oauth/health":{"get":{"tags":["Authorization Server APIs"],"description":"An endpoint that can be used to verify your OAuth authentication flow is working correctly. Is only usable if the context variable otk.health.apikey is defined inside the corresponding service policy.","operationId":"Get_request_health_check","parameters":[{"name":"apikey","in":"query","required":true,"description":"Key that needs to be used to perform health check.","schema":{"type":"string","default":"Empty"}}],"responses":{"200":{"description":"Responds with \"SUCCESS\""},"500":{"description":"Responds with \"error\". This can be due to missing or incorrect API key. Check audit log messages for more information."},"503":{"description":"Responds with \"error\". Returned on health check failure. This can be returned due to bad database configuration, bad certification configuration, etc. Check the audit log messages for more information."}}}},"/auth/oauth/v2/authorize/login":{"get":{"tags":["Authorization Server APIs"],"description":"Receives a request as the result of a redirect from the /auth/oauth/v2/authorize endpoint. Creates a login page or forwards a request to the consent screen.","operationId":"Get_request_authorize_login","parameters":[{"name":"action","in":"query","required":true,"x-is-map":false,"description":"","schema":{"type":"string","default":"display"}},{"name":"sessionID","in":"query","required":true,"x-is-map":false,"description":"The current session which was initiated at the initial authorization request.","schema":{"type":"string"}},{"name":"sessionData","in":"query","required":true,"x-is-map":false,"description":"A signed JSON Web Token (JWT) which contains a JSON structure holding values initially received and validated at authorize.","schema":{"type":"string"}}],"responses":{"200":{"description":"Responds with authentication form"},"400":{"description":"invalid parameters | The session has expired or already been granted","headers":{"x-ca-err":{"description":"Custom error extension. Possible values: 3001103 (missing or duplicate parameters), 3001110 (session expired)","schema":{"type":"string","default":"3001103"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"403":{"description":"Forbidden.","headers":{"x-ca-err":{"description":"Custom error extension. Possible values: 3001203 (SSL required)","schema":{"type":"string","default":"3001203"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"405":{"description":"The HTTP method is not valid","headers":{"Allow":{"description":"This header is required by RFC 2616 and contains a comma separated list of valid HTTP methods.","schema":{"type":"string","default":"POST"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"500":{"description":"Unknown error.","headers":{"x-ca-err":{"description":"Custom error extension","schema":{"type":"string","default":"3001000"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}}}},"post":{"tags":["Authorization Server APIs"],"description":"Authenticates a user during the OAuth 2.0 response_type flow OR Authenticates a user during the OAuth 2.0 response_type using a social platform.","operationId":"Post_request_authorize_login","parameters":[{"name":"action","in":"query","required":true,"x-is-map":false,"description":"Display the login screen, Authenticate the user (login), Cancel the login process or Reset","schema":{"type":"string","enum":["reset","display","login","cancel"],"default":"login"}},{"name":"username","in":"query","required":false,"x-is-map":false,"description":"The username of the user to authenticate.","schema":{"type":"string"}},{"name":"password","in":"query","required":false,"x-is-map":false,"description":"The password for user authentication.","schema":{"type":"string","format":"password"}},{"name":"sessionID","in":"query","required":true,"x-is-map":false,"description":"The current session which was initiated at the initial authorization request.","schema":{"type":"string"}},{"name":"sessionData","in":"query","required":true,"x-is-map":false,"description":"A signed JSON Web Token (JWT) which contains a JSON structure holding values initially received and validated at authorize.","schema":{"type":"string"}},{"name":"code","in":"query","required":false,"x-is-map":false,"description":"An OAuth 2.0 authorization_code issued by a social login provider.","schema":{"type":"string"}},{"name":"provider","in":"query","required":false,"x-is-map":false,"description":"The social login provider that issued the 'code'. This value is specified as part of the redirect_uri configured with each social login provider.","schema":{"type":"string"}},{"name":"response_mode","in":"query","required":false,"x-is-map":false,"description":"Specify the method of returning the authorization response. As per the OpenID specification, use of this parameter is NOT RECOMMENDED if you are using the same response mode as the default response mode for the given response type. It MUST be one of the listed values in order to be accepted: 'query', 'fragment', 'form_post'.","schema":{"type":"string","enum":["query","fragment","form_post"]}},{"name":"oauth_token","in":"query","required":false,"x-is-map":false,"description":"OAuth 1.0 token when the social login provider is used with OAuth 1.0.","schema":{"type":"string"}},{"name":"oauth_verifier","in":"query","required":false,"x-is-map":false,"description":"OAuth 1.0 verifier when the social login provider is used with OAuth 1.0.","schema":{"type":"string"}}],"responses":{"200":{"description":"Authenticates a user during the OAuth 2.0 response_type flow OR if authentication was successful the API auto-form posts to the API that handles the consent screen, /authorize/consent (login via social provider)","headers":{"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"302":{"description":"Authentication Denied, If the redirect_uri is not available, the server displays an HTML page showing the error and error_description. The HTTP status will be '400'","headers":{"location":{"description":"Location (URL) has the 'error', 'error_description' and 'state' (if provided) parameters attached.","schema":{"type":"string"}},"x-ca-err":{"description":"Custom error extension. Possible values: 3001103 (missing or duplicate parameters), 3001116 (invalid response type)","schema":{"type":"string","default":"3001103"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"400":{"description":"Invalid parameters | The session has expired or already been granted | invalid response type ","headers":{"x-ca-err":{"description":"Custom error extension. Possible values: 3001103 (missing or duplicate parameters), 3001116 (invalid response type)","schema":{"type":"string","default":"3001103"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"401":{"description":"The resource owner could not be authenticated. An HTML page displaying an authentication error will be returned.","headers":{"x-ca-err":{"description":"Custom error extension","schema":{"type":"string","default":"3001202"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"403":{"description":"Forbidden.","headers":{"x-ca-err":{"description":"Custom error extension","schema":{"type":"string","default":"3001203"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"405":{"description":"The HTTP method is not valid","headers":{"Allow":{"description":"This header is required by RFC 2616 and contains a comma separated list of valid HTTP methods.","schema":{"type":"string","default":"POST"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"500":{"description":"Unknown error.","headers":{"x-ca-err":{"description":"Custom error extension","schema":{"type":"string","default":"3001000"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}}}}},"/auth/oauth/v2/authorize/consent":{"post":{"tags":["Authorization Server APIs"],"description":"Handles the 'deny' and 'grant' result of a resource owner's decision at the consent page when 'action' is: 'consent', the API returns an HTML page for the user to grant or deny the request. 'grant', the API handles the 'grant' result of the owner's decision at the consent page. 'deny', the API handles the 'deny' result of the owner's decision at the consent page.","operationId":"Post_request_authorize_consent","parameters":[{"name":"response_mode","in":"query","required":false,"x-is-map":false,"description":"Specify the method of returning the authorization response. As per the OpenID specification, use of this parameter is NOT RECOMMENDED if you are using the same response mode as the default response mode for the given response type. It MUST be one of the listed values in order to be accepted: 'query', 'fragment', 'form_post'.","schema":{"type":"string","enum":["query","fragment","form_post"]}}],"responses":{"200":{"description":"Success, redirect to client redirect url","headers":{"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"302":{"description":"Access was denied, redirect to client redirect with error","headers":{"location":{"description":"If 'action' is 'grant': the redirect location will include the query parameters: state(if provided) and code.  In the 'implicit' response flow, the query parameters include: redirect_uri, access_token, expires_in, token_type, scope, id_token, id_token_type and state.  \r\nIf 'action' is 'deny':  the redirect will location include the 'x-ca-err', 'error', 'error_description' and 'state' (if provided) parameters.  In such a case the 'error' is 'access_denied'","schema":{"type":"string"}},"x-ca-err":{"description":"Custom error extension. Possible values: 3002116 (invalid response type)","schema":{"type":"string","default":"3002116"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"400":{"description":"Invalid parameters","headers":{"x-ca-err":{"description":"Custom error extension. Possible values: 3002103 (missing or duplicate parameters), 3002110 (session expired), 3002116 (invalid response type), 3002135 (token limit reached)","schema":{"type":"string","default":"3002103"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"401":{"description":"The resource owner could not be authenticated. An HTML page displaying an authentication error will be returned.","headers":{"x-ca-err":{"description":"Custom error extension. Possible values: 3002202 (resource owner could not be authenticated)","schema":{"type":"string","default":"3002202"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"403":{"description":"Forbidden.","headers":{"x-ca-err":{"description":"Custom error extension. Possible values: 3002203 (SSL required)","schema":{"type":"string","default":"3002203"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"405":{"description":"The HTTP method is not valid","headers":{"Allow":{"description":"This header is required by RFC 2616 and contains a comma separated list of valid HTTP methods.","schema":{"type":"string","default":"POST"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"500":{"description":"Unknown error.","headers":{"x-ca-err":{"description":"Custom error extension","schema":{"type":"string","default":"3002203"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}}},"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"action":{"description":"Deny or Grant the resource with scope requested.","type":"string","enum":["deny","grant"],"default":"grant"},"sessionID":{"type":"string"},"sessionData":{"description":"A signed JSON Web Token (JWT) which contains a JSON structure holding values initially received and validated at authorize.","type":"string"}},"required":["action","sessionID","sessionData"]}}}}}},"/auth/oauth/v2/token":{"post":{"tags":["Token Server APIs"],"description":"Request access_token or refresh_token using OAuth 2.0 grant_type: password authorization_code refresh_token client_credentials urn:ietf:params:oauth:grant-type:jwt-bearer urn:ietf:params:oauth:grant-type:saml2-bearer. See RFC 6749 for more details.","operationId":"Create_request_token","parameters":[{"name":"mag-identifier","in":"header","required":false,"x-is-map":false,"description":"[MAG]\r\n[MAG]: mobile clients MUST use this header. It must represent a valid registered device. This grant_type, however, is not supported by MAG","schema":{"type":"string"}},{"name":"authorization","in":"header","required":false,"x-is-map":false,"description":"The HTTP basic authorization header containing the client credentials as base64 encoded string (authorization: Basic base64(client_id:client_secret)). This can only be used INSTEAD of the parameters 'client_id', 'client_secret'.","schema":{"type":"string"}},{"name":"client_id","in":"query","required":false,"x-is-map":false,"description":"The client_id. This can only be used INSTEAD of using the authorization header. Maximum 255 characters.","schema":{"type":"string"}},{"name":"client_secret","in":"query","required":false,"x-is-map":false,"description":"The client_secret. This can only be used INSTEAD of using the authorization header.","schema":{"type":"string"}},{"name":"grant_type","in":"query","required":true,"x-is-map":false,"description":"For grant_type=password either authorization or client_id AND client_secret, username and password must be provided. For grant_type=client_credentials, either authorization or client_id AND client_secret must be provided. For grant_type=authorization_code: client_id, client_secret, code, and redirect_uri are required. For grant_type=refresh_token: client_id and refresh_token are required. For grant_type=jwt or saml2-bearer: client_id and assertion are required","schema":{"type":"string","enum":["password","refresh_token","authorization_code","client_credentials","urn:ietf:params:oauth:grant-type:jwt-bearer","urn:ietf:params:oauth:grant-type:saml2-bearer"],"default":"password"}},{"name":"code","in":"query","required":false,"x-is-map":false,"description":"Required if grant_type is authorization_code","schema":{"type":"string"}},{"name":"redirect_uri","in":"query","required":false,"x-is-map":false,"description":"Required if grant_type is authorization_code.  Must contain a valid auth code","schema":{"type":"string"}},{"name":"scope","in":"query","required":false,"x-is-map":false,"description":"Only SCOPE values that were registered for this client will be granted. If only non-matching SCOPE values are requested, the request will fail.","schema":{"type":"string"}},{"name":"username","in":"query","required":false,"x-is-map":false,"description":"If grant_type is password or client_credentials, this parameter must contain a valid username ","schema":{"type":"string"}},{"name":"password","in":"query","required":false,"x-is-map":false,"description":"If grant_type is password or client_credentials, this parameter must contain a valid password","schema":{"type":"string","format":"password"}},{"name":"assertion","in":"query","required":false,"x-is-map":false,"description":"If grant_type is saml2-bearer or jwt, this parameter must contain a base64 encoded SAML or JWT token that represents an authenticated resource owner.","schema":{"type":"string"}},{"name":"refresh_token","in":"query","required":false,"x-is-map":false,"description":"If grant_type is refresh_token, this parameter must contain a valid refresh_token.","schema":{"type":"string"}},{"name":"code_verifier","in":"query","required":false,"x-is-map":false,"description":"A random value of 43-256 characters. See https://tools.ietf.org/html/rfc7636#section-4 for details.  This parameter is required only when a code_challenge is provided with the authorization request for this session.","schema":{"type":"string"}}],"responses":{"200":{"$ref":"#/components/responses/authToken200"},"204":{"description":"No Content, applicable to OPTIONS request with preflight configuration","headers":{"Access-Control-Allow-Methods":{"description":"Allowable Methods, POST","schema":{"type":"string","default":"POST"}}}},"400":{"description":"Bad Request, see x-ca-err for possible error codes","headers":{"x-ca-err":{"description":"Custom error extension, possible values: 3003103 (missing or duplicate parameters), 3003107 (invalid mag-identifier), 3003113 (invalid grant), 3003115 (no registered scope value for client), 3003119 (grant type not supported), 3003134 (request did not match CORS requirements), 3003135 (token limit reached), 3003201 (client credentials not valid),","schema":{"type":"string","default":"3003107"}},"Pragma":{"description":"Pragma browser directive","schema":{"type":"string","default":"no-cache"}},"Cache-Control":{"description":"Cache-Control browser directive","schema":{"type":"string","default":"no-store"}}}},"401":{"description":"The client could not be authenticated.","headers":{"x-ca-err":{"description":"Custom error extension, possible values: 3003201 (Invalid or Missing credentials), 3003202 (Resource owner could not be authenticated)","schema":{"type":"string","default":"3003202"}},"WWW-Authenticate":{"description":"This header is required by RFC 7235 if an authentication scheme has been used. It contains

# --- truncated at 32 KB (84 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tsb-bank/refs/heads/main/openapi/tsb-bank-oauth-server-openapi.json