OpenAPI Specification
openapi: 3.1.0
info:
version: v3
title: Weavr Multi Product BackOffice Access Token Access Tokens API
x-logo:
url: https://storage.googleapis.com/weavr-cdn/weavr_logo-new.png
backgroundColor: '#FFFFFF'
altText: Weavr
description: 'Weavr Multi Back Office API allows you, as an innovator, to perform various back office operations concerning
identities and their instruments, without requiring the users to be logged in.
A token is to be obtained through the `access_token` method, and this will allow relevant operations
to be performed on behalf of this same identity.
'
contact:
name: Weavr
url: https://weavr.io
servers:
- description: Weavr Sandbox Environment
url: https://sandbox.weavr.io/multi/backoffice
tags:
- name: Access Tokens
description: Acquire and revoke access tokens.
paths:
/access_token:
post:
tags:
- Access Tokens
description: 'This API endpoint accepts a POST request with an auth_token parameter and returns an access_token that grants authorized access to additional resources within the API, with a different expiration time and unique signature.
'
summary: Acquire a new access token
operationId: requestAccessToken
requestBody:
$ref: '#/components/requestBodies/AccessTokenRequest'
responses:
'200':
$ref: '#/components/responses/AccessTokenResponse'
'400':
$ref: '#/components/responses/BadRequestError'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
description: The auth token is not specified or is incorrect.
'423':
$ref: '#/components/responses/Locked'
'429':
$ref: '#/components/responses/TooManyRequests'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
default:
$ref: '#/components/responses/Error'
security:
- auth_token: []
api-key: []
- api-key: []
components:
responses:
AccessTokenResponse:
description: Success
headers:
request-ref:
$ref: '#/components/headers/request-ref'
content:
application/json:
schema:
type: object
properties:
token:
type: string
identity:
description: The identity to which the logged-in user belongs to.
$ref: '#/components/schemas/IdentityId'
credentials:
description: The unique identifier for the logged-in user.
$ref: '#/components/schemas/CredentialId'
status:
type: string
description: "The token status, as follows:\n - STANDARD: it is a standard token. \n - STEPPED_UP: it is a stepped up token.\n"
enum:
- STANDARD
- STEPPED_UP
ServiceUnavailable:
description: Service Unavailable - The requested service is temporarily unavailable. Please try again later.
headers:
request-ref:
$ref: '#/components/headers/request-ref'
InternalServerError:
description: Internal Server Error - There is a problem with the server. Please try again later.
headers:
request-ref:
$ref: '#/components/headers/request-ref'
BadRequestError:
description: Bad Request Error - Your request is invalid.
headers:
request-ref:
$ref: '#/components/headers/request-ref'
content:
application/json:
schema:
type: object
properties:
message:
maxLength: 255
type: string
description: When present helps to identify and fix the problem.
syntaxErrors:
$ref: '#/components/schemas/SyntaxError'
Unauthorized:
description: Unauthorized - Your credentials or access token are invalid.
headers:
request-ref:
$ref: '#/components/headers/request-ref'
TooManyRequests:
description: Too many requests.
headers:
request-ref:
$ref: '#/components/headers/request-ref'
x-ratelimit-limit:
$ref: '#/components/headers/x-ratelimit-limit'
x-ratelimit-reset:
$ref: '#/components/headers/x-ratelimit-reset'
Error:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Locked:
description: Locked - Account is temporarily locked due to failed consecutive login attempts. Try again in 30 minutes.
headers:
request-ref:
$ref: '#/components/headers/request-ref'
schemas:
Error:
type: object
properties:
code:
type: string
message:
type: string
SyntaxError:
type: object
description: Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.
properties:
invalidFields:
type: array
items:
type: object
properties:
params:
type: array
items:
type: string
fieldName:
type: string
error:
type: string
enum:
- REQUIRED
- HAS_TEXT
- REQUIRES
- SIZE
- RANGE
- IN
- NOT_IN
- REGEX
- EXACTLY
- AT_LEAST
- AT_MOST
- ALL_OR_NONE
CredentialId:
required:
- type
- id
type: object
properties:
type:
maxLength: 50
pattern: ^[a-zA-Z0-9_-]+$
type: string
enum:
- ROOT
- USER
- API_CLIENT
description: The type of user.
id:
type: string
pattern: ^[0-9]+$
description: The identifier of the user.
IdentityId:
required:
- type
- id
type: object
properties:
type:
enum:
- CONSUMER
- CORPORATE
type: string
description: Indicates the identity type.
id:
type: string
pattern: ^[0-9]+$
description: The identifier for the identity.
requestBodies:
AccessTokenRequest:
required: true
content:
application/json:
schema:
required:
- identity
type: object
properties:
identity:
$ref: '#/components/schemas/IdentityId'
clientAssertion:
description: Generated using the certificate linked to the Delegated API Client. This feature is available only to customers that have been enabled with delegation functionality.
type: string
token:
description: A short-lived one-time token to be exchanged for an access token. This token is used for identity verification and authorisation purposes.
type: string
headers:
request-ref:
description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
required: true
schema:
type: string
x-ratelimit-limit:
description: 'Example: `20, 10;w=60, 20;w=3600, 200;w=86400`
The first number (20) is the limit that has been exceeded.
The remaining numbers are the limits that are in force, with ''w'' meaning ''window in seconds''. In this example `20;w=3600` was exceeded. 20 calls in 3600secs (1hr)
'
required: true
schema:
type: string
x-ratelimit-reset:
description: The number of seconds until the window is reset.
required: true
schema:
minimum: 0
type: integer
format: int32
securitySchemes:
api_key:
type: apiKey
description: The API Key representing your Multi account.
name: api-key
in: header
auth_token:
type: http
description: The authentication token representing the user. This will be included in the login response object.
scheme: bearer
bearerFormat: JWT
x-tagGroups:
- name: Access
tags:
- Access Token
- User Impersonation
- Consent Request
- name: Identities
tags:
- Corporates
- Consumers
- name: User Management
tags:
- Authorised Users
- name: Instruments
tags:
- Managed Accounts
- Managed Cards
- name: Transactions
tags:
- Transfers
- name: Fees
tags:
- Fees
- name: Bulk Operations [Beta]
tags:
- Operations
- Manage