Weavr Access Tokens API

openapi: 3.2.0
info:
  version: v3
  title: Weavr Multi Product Access Tokens API
  x-logo:
    url: https://storage.googleapis.com/weavr-cdn/weavr_logo-new.png
    backgroundColor: '#FFFFFF'
    altText: Weavr
  description: 'Weavr Multi API provides a simple and flexible way to issue cards and accounts to your customers.


    By integrating Weavr Multi API in your application you can embed banking capabilities within your app and provide a seamless experience for your customers.


    # Authentication


    Each request to the Multi API must include an `api-key` that represents your account. You can obtain an API Key by registering for a Multi account [here](https://portal.weavr.io).


    Almost all endpoints require a secondary authentication token `auth_token` that represents the user for whom the request is being executed.

    '
  contact:
    name: Weavr
    url: https://weavr.io
servers:
- description: Weavr Sandbox Environment
  url: https://sandbox.weavr.io/multi
tags:
- name: Access Tokens
  description: Acquire and revoke access tokens.
paths:
  /access_token:
    post:
      tags:
      - Access Tokens
      description: 'This API endpoint accepts a POST request with an auth_token parameter and returns an access_token that grants authorized access to additional resources within the API, with a different expiration time and unique signature.

        '
      summary: Acquire a new access token
      operationId: requestAccessToken
      requestBody:
        $ref: '#/components/requestBodies/AccessTokenRequest'
      responses:
        '200':
          $ref: '#/components/responses/AccessTokenResponse'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: The auth token is not specified or is incorrect.
        '423':
          $ref: '#/components/responses/Locked'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        default:
          $ref: '#/components/responses/Error'
      security:
      - auth_token: []
        api-key: []
      - api-key: []
components:
  headers:
    x-ratelimit-limit:
      description: 'Example: `20, 10;w=60, 20;w=3600, 200;w=86400`

        The first number (20) is the limit that has been exceeded.

        The remaining numbers are the limits that are in force, with ''w'' meaning ''window in seconds''. In this example `20;w=3600` was exceeded. 20 calls in 3600secs (1hr)

        '
      required: true
      schema:
        type: string
    request-ref:
      description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
      required: true
      schema:
        type: string
    x-ratelimit-reset:
      description: The number of seconds until the window is reset.
      required: true
      schema:
        minimum: 0
        type: integer
        format: int32
  responses:
    InternalServerError:
      description: Internal Server Error - There is a problem with the server. Please try again later.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
    BadRequestError:
      description: Bad Request Error - Your request is invalid.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                maxLength: 255
                type: string
                description: When present helps to identify and fix the problem.
              syntaxErrors:
                $ref: '#/components/schemas/SyntaxError'
    Error:
      description: Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    TooManyRequests:
      description: Too many requests.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
        x-ratelimit-limit:
          $ref: '#/components/headers/x-ratelimit-limit'
        x-ratelimit-reset:
          $ref: '#/components/headers/x-ratelimit-reset'
    Unauthorized:
      description: Unauthorized - Your credentials or access token are invalid.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
    AccessTokenResponse:
      description: Success
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
      content:
        application/json:
          schema:
            type: object
            properties:
              token:
                type: string
              identity:
                description: The identity to which the logged-in user belongs to.
                $ref: '#/components/schemas/IdentityId'
              credentials:
                description: The unique identifier for the logged-in user.
                $ref: '#/components/schemas/CredentialId'
              status:
                type: string
                description: "The token status, as follows:\n  - STANDARD: it is a standard token. \n  - STEPPED_UP: it is a stepped up token.\n"
                enum:
                - STANDARD
                - STEPPED_UP
    ServiceUnavailable:
      description: Service Unavailable - The requested service is temporarily unavailable. Please try again later.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
    Locked:
      description: Locked - Account is temporarily locked due to failed consecutive login attempts. Try again in 30 minutes.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
  schemas:
    IdentityId:
      required:
      - type
      - id
      type: object
      properties:
        type:
          enum:
          - CONSUMER
          - CORPORATE
          type: string
          description: Indicates the identity type.
        id:
          type: string
          pattern: ^[0-9]+$
          description: The identifier for the identity.
    CredentialId:
      required:
      - type
      - id
      type: object
      properties:
        type:
          maxLength: 50
          pattern: ^[a-zA-Z0-9_-]+$
          type: string
          enum:
          - ROOT
          - USER
          - API_CLIENT
          description: The type of user.
        id:
          type: string
          pattern: ^[0-9]+$
          description: The identifier of the user.
    SyntaxError:
      type: object
      description: Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.
      properties:
        invalidFields:
          type: array
          items:
            type: object
            properties:
              params:
                type: array
                items:
                  type: string
              fieldName:
                type: string
              error:
                type: string
                enum:
                - REQUIRED
                - HAS_TEXT
                - REQUIRES
                - SIZE
                - RANGE
                - IN
                - NOT_IN
                - REGEX
                - EXACTLY
                - AT_LEAST
                - AT_MOST
                - ALL_OR_NONE
    Error:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
  requestBodies:
    AccessTokenRequest:
      required: true
      content:
        application/json:
          schema:
            required:
            - identity
            type: object
            properties:
              identity:
                $ref: '#/components/schemas/IdentityId'
              clientAssertion:
                description: Generated using the certificate linked to the Delegated API Client. This feature is available only to customers that have been enabled with delegation functionality.
                type: string
              token:
                description: A short-lived one-time token to be exchanged for an access token. This token is used for identity verification and authorisation purposes.
                type: string
  securitySchemes:
    api-key:
      type: apiKey
      description: An API key defined in your User API Client  (or Delegate API Client - this feature is available only to customers enabled with delegation functionality).  API Clients are as managed in the Embedder Portal
      name: api-key
      in: header
    auth_token:
      type: http
      description: The authentication token representing the user. This will be included in the login response object.
      scheme: bearer
      bearerFormat: JWT
    webhooks_key:
      type: apiKey
      description: The Webhooks key can be found in the API Credentials tab in your Portal Page.
      name: webhooks-key
      in: header
x-tagGroups:
- name: Customer Registration
  tags:
  - Corporates
  - Consumers
- name: Users & User Authentication
  tags:
  - Setup
  - Sign-in
  - Step-up Challenges
  - Confirmation Challenges
  - Authentication Factors
- name: Access
  tags:
  - Access Tokens
- name: Customer Settings
  tags:
  - Customer Data & Due Diligence
  - Authorised Signatories
  - Trusted Payees
- name: Instruments
  tags:
  - Managed Accounts
  - Managed Cards
- name: Funds Management
  tags:
  - Transfers
  - Transaction Activity
- name: External Payments
  tags:
  - Incoming Wire Transfers
  - Outgoing Wire Transfers
  - Correspondent Bank Transfers
- name: Card Payments
  tags:
  - Card Payments
  - Spend Controls
- name: In-Platform Payments
  tags:
  - Sends
  - Fees
- name: Bulk Operations
  tags:
  - Operations
  - Manage