Weavr Authorised Users API

openapi: 3.2.0
info:
  title: Weavr Authorised Users API
  contact:
    name: Weavr
    url: https://weavr.io
  x-logo:
    url: https://storage.googleapis.com/weavr-cdn/weavr_logo-new.png
    backgroundColor: '#FFFFFF'
    altText: Weavr
  version: '1.0'
  description: 'Operations tagged Authorised Users across 2 of this provider''s published API definitions: weavr-multi-backoffice-openapi-original.yml, weavr-webhooks-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- description: Weavr Sandbox Environment
  url: https://sandbox.weavr.io/multi/backoffice
- url: '""'
tags:
- name: Authorised Users
  description: "Corporate and Consumer identities can invite authorised users to access their account. Once on-boarded, authorised users can create and manage instruments and transactions on behalf of the identity they are on-boarded with.      \nWith the `access_token` representing the identity and the consent of the identity, you will be able to create and invite authorised users for the Identity.\n\nCreating and inviting users on behalf of identities are restricted features; by default these endpoints are not available for use.\n"
paths:
  /users:
    post:
      tags:
      - Authorised Users
      description: "Creates a user linked to the identity represented by the `access_token`.\n        \nCreating authorised users on behalf of an identity is a restricted feature and by default, this functionality is not available for use.\n"
      summary: Create a user
      operationId: userCreate
      parameters:
      - $ref: '#/components/parameters/idempotency-ref'
      requestBody:
        $ref: '#/components/requestBodies/UserCreateRequest'
      responses:
        '200':
          $ref: '#/components/responses/UserResponse'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/UserCreateConflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        default:
          $ref: '#/components/responses/Error'
      security:
      - auth_token: []
        api_key: []
    servers:
    - description: Weavr Sandbox Environment
      url: https://sandbox.weavr.io/multi/backoffice
  /users/{user_id}/deactivate:
    post:
      tags:
      - Authorised Users
      description: 'De-activate the user identified by the `user_id` path parameter.


        Deactivated users cannot log in or execute any operations with their credentials.


        This operations is not final and a user can be re-activated using the userActivate operation. Note that another active user would need to log in so as to re-activate the de-activated user.


        Please contact our support team or your account manager to request access to this endpoint.

        '
      summary: Deactivate a user
      operationId: userDeactivate
      parameters:
      - $ref: '#/components/parameters/userIdExplode'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/UserDeactivateConflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        default:
          $ref: '#/components/responses/Error'
      security:
      - auth_token: []
        api_key: []
    servers:
    - description: Weavr Sandbox Environment
      url: https://sandbox.weavr.io/multi/backoffice
  /users/{user_id}/invite:
    post:
      tags:
      - Authorised Users
      summary: Send a user invite
      operationId: userInviteSend
      description: 'Once a user is created using the `userCreate` operation, the user needs to setup his/her password.


        An invitation needs to be sent to the user in order to be able to set up the password for the first time. The invitation email, which remains valid for 1 month, will contain a URL having all information required to setup the password.


        Inviting authorised users on behalf of an identity is a restricted feature and by default, this functionality is not available for use.

        '
      parameters:
      - $ref: '#/components/parameters/userIdExplode'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/UserInviteSendConflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        default:
          $ref: '#/components/responses/Error'
      security:
      - auth_token: []
        api_key: []
    servers:
    - description: Weavr Sandbox Environment
      url: https://sandbox.weavr.io/multi/backoffice
webhooks:
  /auth/users/user_deactivated/watch:
    post:
      tags:
      - Authorised Users
      summary: Auth user deactivation
      description: Notification that an auth user has been deactivated.
      operationId: auth_users_user_deactivated_watch
      parameters:
      - $ref: '#/components/parameters/call-ref'
      - $ref: '#/components/parameters/published-timestamp'
      - $ref: '#/components/parameters/signature'
      - $ref: '#/components/parameters/signature-v2'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdentityDeactivatedEvent'
        required: true
      responses:
        '204':
          description: Success - No Content
    servers:
    - url: '""'
components:
  responses:
    InternalServerError:
      description: Internal Server Error - There is a problem with the server. Please try again later.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
    TooManyRequests:
      description: Too many requests.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
        x-ratelimit-limit:
          $ref: '#/components/headers/x-ratelimit-limit'
        x-ratelimit-reset:
          $ref: '#/components/headers/x-ratelimit-reset'
    Unauthorized:
      description: Unauthorized - Your credentials or access token are invalid.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
    UserDeactivateConflict:
      description: Conflict
      content:
        application/json:
          schema:
            type: object
            properties:
              errorCode:
                type: string
                enum:
                - CARD_HAS_REMAINING_BALANCE
    Forbidden:
      description: Forbidden - Access to the requested resource or action is forbidden.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
      content:
        application/json:
          schema:
            type: object
            properties:
              errorCode:
                type: string
                enum:
                - INSUFFICIENT_PERMISSIONS
    UserResponse:
      description: Success
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/User'
    NoContent:
      description: Success - No Content.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
    NotFound:
      description: Not found - The requested resource couldn't be found.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    UserInviteSendConflict:
      description: Conflict
      content:
        application/json:
          schema:
            type: object
            properties:
              errorCode:
                type: string
                enum:
                - INVITE_ALREADY_CONSUMED
    BadRequestError:
      description: Bad Request Error - Your request is invalid.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                maxLength: 255
                type: string
                description: When present helps to identify and fix the problem.
              syntaxErrors:
                $ref: '#/components/schemas/SyntaxError'
    Error:
      description: Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    UserCreateConflict:
      description: Conflict
      content:
        application/json:
          schema:
            type: object
            properties:
              errorCode:
                type: string
                enum:
                - EMAIL_NOT_UNIQUE
                - MOBILE_OR_COUNTRY_CODE_INVALID
                - EMAIL_DOMAIN_NOT_ALLOWED
                - COUNTRY_OF_RESIDENCE_INVALID
                - ROLE_NOT_FOUND
                - CANNOT_MODIFY_OWN_ROLES
                - ADMIN_ROLE_REMOVAL_NOT_ALLOWED
    ServiceUnavailable:
      description: Service Unavailable - The requested service is temporarily unavailable. Please try again later.
      headers:
        request-ref:
          $ref: '#/components/headers/request-ref'
  schemas:
    UserPredefinedRole:
      type: string
      enum:
      - CARD_ASSIGNEE
      - CARDS_MANAGEMENT_ROLE
      - FUNDS_MANAGEMENT_ROLE
      - ACCESS_MANAGEMENT_ROLE
      - ADMIN
    Brand:
      type: string
      pattern: ^[a-zA-Z0-9]+$
      description: 'Brand identifier used to determine the set of email and SMS user notification templates. Must be alphanumeric, up to 25 characters, and contain no spaces.

        '
      maxLength: 25
    Mobile:
      required:
      - number
      - countryCode
      type: object
      properties:
        countryCode:
          maxLength: 4
          minLength: 1
          type: string
          pattern: ^\+[0-9]+$
          description: The country code of the user mobile number (e.g. +44).
        number:
          pattern: ^[0-9]{1,12}$
          type: string
          description: The mobile number of the user - excluding country code.
    UserLocale:
      type: string
      pattern: ^[a-z]{2}(-[A-Z]{2})?$
      description: 'BCP47 locale code (e.g. en, en-US). The locale determines which email and SMS user notification templates are used.

        '
      maxLength: 5
      example: en-GB
    SyntaxError:
      type: object
      description: Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.
      properties:
        invalidFields:
          type: array
          items:
            type: object
            properties:
              params:
                type: array
                items:
                  type: string
              fieldName:
                type: string
              error:
                type: string
                enum:
                - REQUIRED
                - HAS_TEXT
                - REQUIRES
                - SIZE
                - RANGE
                - IN
                - NOT_IN
                - REGEX
                - EXACTLY
                - AT_LEAST
                - AT_MOST
                - ALL_OR_NONE
    UserId:
      type: string
      pattern: ^[0-9]+$
    Error:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
    Date:
      required:
      - year
      - month
      - day
      type: object
      properties:
        year:
          type: integer
          format: int32
          maximum: 2100
          minimum: 1900
        month:
          type: integer
          format: int32
          maximum: 12
          minimum: 1
        day:
          type: integer
          format: int32
          maximum: 31
          minimum: 1
    IdentityId:
      required:
      - type
      - id
      type: object
      properties:
        type:
          enum:
          - CONSUMER
          - CORPORATE
          type: string
          description: Indicates the identity type.
        id:
          type: string
          pattern: ^[0-9]+$
          description: The identifier for the identity.
    Tag:
      type: string
      description: The tag field is a custom field that can be used to search and filter.
      maxLength: 50
      pattern: ^[a-zA-Z0-9_-]+$
    User:
      required:
      - id
      - email
      - name
      - surname
      - identity
      - active
      type: object
      properties:
        id:
          type: string
          pattern: ^[0-9]+$
          description: The unique identifier of the user.
        identity:
          description: The identity that the user belongs to.
          $ref: '#/components/schemas/IdentityId'
        name:
          maxLength: 100
          type: string
          description: The first name of the user.
        surname:
          maxLength: 100
          type: string
          description: The last name of the user.
        email:
          $ref: '#/components/schemas/Email'
        mobile:
          $ref: '#/components/schemas/Mobile'
        active:
          type: boolean
          description: The state of the user. If the `active` attribute is false, then the user will not be able to log in.
        dateOfBirth:
          description: Date of birth of the authorised user.
          $ref: '#/components/schemas/Date'
        tag:
          $ref: '#/components/schemas/Tag'
        countryOfResidence:
          type: string
          maxLength: 2
          minLength: 2
          pattern: ^[A-Z]+$
        locale:
          $ref: '#/components/schemas/UserLocale'
        brand:
          $ref: '#/components/schemas/Brand'
        roles:
          type: array
          items:
            $ref: '#/components/schemas/UserPredefinedRole'
    Email:
      type: string
      description: E-mail Address of the user
      format: email
    IdentityDeactivatedEvent:
      required:
      - actionDoneBy
      - emailAddress
      - reasonCode
      type: object
      properties:
        actionDoneBy:
          $ref: '#/components/schemas/ActionDoneBy'
        emailAddress:
          type: string
        reasonCode:
          $ref: '#/components/schemas/IdentityDeactivatedReasonCode'
    IdentityDeactivatedReasonCode:
      type: string
      enum:
      - UNDEFINED_REASON
      - ACCOUNT_REVIEW
      - ACCOUNT_SECURITY
      - TEMPORARY
      - ACCOUNT_CLOSURE
      - ACCOUNT_ABANDONED
    ActionDoneBy:
      type: string
      enum:
      - UNDEFINED
      - ADMIN
      - INNOVATOR
  parameters:
    userIdExplode:
      name: user_id
      in: path
      required: true
      description: The unique identifier for the user.
      style: simple
      explode: false
      schema:
        $ref: '#/components/schemas/UserId'
    idempotency-ref:
      name: idempotency-ref
      in: header
      description: A unique call reference generated by the caller that, taking into consideration the payload as well as the operation itself, helps avoid duplicate operations. Idempotency reference uniqueness is maintained for at least 24 hours.
      required: false
      schema:
        type: string
    signature:
      name: signature
      in: header
      description: The signature to verify the authenticity of this request.  This is the base64 hash (HmacSHA256) of the `published-timestamp` using your API key.
      required: true
      style: simple
      explode: false
      deprecated: true
      schema:
        type: string
    signature-v2:
      name: signature-v2
      in: header
      description: The signature to verify the authenticity of this request.  This is the base64 hash (HmacSHA256) of the `call-ref + payload + published-timestamp` using your API key.
      required: true
      style: simple
      explode: false
      schema:
        type: string
    call-ref:
      description: A call reference generated by the caller and unique to the caller to provide correlation between the caller and system with a maximum length of 255
      in: header
      name: call-ref
      required: false
      schema:
        type: string
    published-timestamp:
      name: published-timestamp
      in: header
      description: The timestamp, expressed in Epoch timestamp using millisecond precision, when this event was published.
      required: true
      style: simple
      explode: false
      schema:
        type: integer
        format: int64
  headers:
    request-ref:
      description: A request identifier. Providing this reference when contacting our support team will help us investigate your query.
      required: true
      schema:
        type: string
    x-ratelimit-reset:
      description: The number of seconds until the window is reset.
      required: true
      schema:
        minimum: 0
        type: integer
        format: int32
    x-ratelimit-limit:
      description: 'Example: `20, 10;w=60, 20;w=3600, 200;w=86400`

        The first number (20) is the limit that has been exceeded.

        The remaining numbers are the limits that are in force, with ''w'' meaning ''window in seconds''. In this example `20;w=3600` was exceeded. 20 calls in 3600secs (1hr)

        '
      required: true
      schema:
        type: string
  requestBodies:
    UserCreateRequest:
      required: true
      content:
        application/json:
          schema:
            required:
            - email
            - name
            - surname
            type: object
            properties:
              name:
                minLength: 1
                maxLength: 50
                type: string
                description: The first name of the user.
              surname:
                minLength: 1
                maxLength: 50
                type: string
                description: The last name of the user.
              email:
                $ref: '#/components/schemas/Email'
              mobile:
                $ref: '#/components/schemas/Mobile'
              dateOfBirth:
                description: Date of birth of the authorised user.
                $ref: '#/components/schemas/Date'
              tag:
                $ref: '#/components/schemas/Tag'
              countryOfResidence:
                type: string
                maxLength: 2
                minLength: 2
                pattern: ^[A-Z]+$
              locale:
                $ref: '#/components/schemas/UserLocale'
              brand:
                $ref: '#/components/schemas/Brand'
              roles:
                type: array
                items:
                  $ref: '#/components/schemas/UserPredefinedRole'
                description: Optional roles to assign to the user. For a full description of the permissions associated with each role, see our product documentation.
  securitySchemes:
    api_key:
      type: apiKey
      description: The API Key representing your Multi account.
      name: api-key
      in: header
    auth_token:
      type: http
      description: The authentication token representing the user. This will be included in the login response object.
      scheme: bearer
      bearerFormat: JWT
x-refined-from:
- weavr-multi-backoffice-openapi-original.yml
- weavr-webhooks-openapi-original.yml
x-tagGroups:
- name: Access
  tags:
  - Access Token
  - User Impersonation
  - Consent Request
- name: Identities
  tags:
  - Corporates
  - Consumers
- name: User Management
  tags:
  - Authorised Users
- name: Instruments
  tags:
  - Managed Accounts
  - Managed Cards
- name: Transactions
  tags:
  - Transfers
- name: Fees
  tags:
  - Fees
- name: Bulk Operations [Beta]
  tags:
  - Operations
  - Manage