openapi: 3.0.0
paths:
  /api/management/audit-logs:
    get:
      description: Fetches paginated audit log entries with optional filters.
      operationId: AuditLogController_list
      parameters:
        - name: order
          required: false
          in: query
          schema:
            default: DESC
            type: string
            enum:
              - ASC
              - DESC
        - name: order_by
          required: false
          in: query
          schema:
            default: modifiedDate
            type: string
        - name: page
          required: false
          in: query
          schema:
            minimum: 1
            default: 1
            type: number
        - name: per_page
          required: false
          in: query
          schema:
            minimum: 1
            maximum: 100
            default: 100
            type: number
        - name: callerSub
          required: false
          in: query
          schema:
            type: string
        - name: callerType
          required: false
          in: query
          schema:
            type: string
        - name: resultAllowed
          required: false
          in: query
          schema:
            type: boolean
        - name: correlationId
          required: false
          in: query
          schema:
            type: string
        - name: ipAddress
          required: false
          in: query
          schema:
            type: string
        - name: requestPath
          required: false
          in: query
          schema:
            type: string
        - name: from
          required: false
          in: query
          schema:
            type: string
        - name: to
          required: false
          in: query
          schema:
            type: string
        - name: resourceType
          required: false
          in: query
          schema:
            type: array
            items:
              type: string
        - name: action
          required: false
          in: query
          schema:
            type: array
            items:
              type: string
        - name: severity
          required: false
          in: query
          schema:
            type: array
            items:
              type: string
              enum:
                - debug
                - info
                - warning
                - error
                - critical
      responses:
        "200":
          description: Successful response
          headers:
            x-page:
              description: Index of the current page (starting at 1)
              schema:
                type: integer
            x-prev-page:
              description: Index of the previous page
              schema:
                type: integer
              required: false
            x-next-page:
              description: Index of the next page
              schema:
                type: integer
              required: false
            x-per-page:
              description: Number of items per page
              schema:
                type: integer
            x-total-pages:
              description: Total number of pages
              schema:
                type: integer
            x-total:
              description: Total number of items
              schema:
                type: integer
            link:
              description: Web Linking to other pages of this resource
              schema:
                type: string
      security:
        - oauth2:
            - read:hdp.audit_log
      summary: List audit log entries
      tags: &a1
        - Audit Logs
  /api/management/audit-logs/{id}:
    get:
      description: Fetches a single audit log entry by its ID.
      operationId: AuditLogController_getById
      parameters:
        - name: id
          required: true
          in: path
          schema:
            type: string
      responses:
        "200":
          description: ""
      security:
        - oauth2:
            - read:hdp.audit_log
      summary: Get audit log entry by ID
      tags: *a1
  /api/settings:
    get:
      description: Retrieves the settings of the control plane.
      operationId: ConfigController_getSettings
      parameters: []
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RuntimeConfigDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      summary: Retrieve settings
      tags: &a2
        - Settings
  /api/settings/update:
    post:
      description: Updates runtime settings for the control plane.
      operationId: ConfigController_updateSettings
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RuntimeConfigDto"
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RuntimeConfigDto"
        "400":
          description: Malformed request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security:
        - oauth2:
            - update:hdp.config
      summary: Update settings
      tags: *a2
  /api/settings/upload:
    post:
      description: Uploads logo for the control plane, receive a base64 encoded url.
      operationId: ConfigController_uploadFile
      parameters: []
      responses:
        "200":
          description: ""
      security:
        - oauth2:
            - update:hdp.config
      summary: Upload logo
      tags: *a2
  /api/catalog:
    get:
      description: Get catalog, currently not implemented.
      operationId: DataPlaneController_getCatalog
      parameters: []
      responses:
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
        "501":
          description: ""
      security: &a3
        - oauth2:
            - read:hdp.dataplane
      summary: Get catalog
      tags: &a4
        - Data Plane
  /health:
    get:
      description: Retrieves the current health of the control plane. If the control
        plane is running it always returns an empty 200 OK
      operationId: DataPlaneController_healthCheck
      parameters: []
      responses:
        "200":
          description: ""
        "502":
          description: ""
      security: *a3
      summary: Health check
      tags: *a4
  /api/auth/user:
    get:
      description: Retrieves current user state, whether someone is logged in or not a
        200 result is provided. This is used in the frontend to determine
        whether certain aspects should be shown.
      operationId: AuthController_getUser
      parameters: []
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: "#/components/schemas/AuthenticatedUser"
                  - $ref: "#/components/schemas/UnauthenticatedUser"
      summary: Retrieve current user status
      tags: &a5
        - Authentication
  /api/auth/login:
    get:
      description: Redirects user to the correct authorization server
      operationId: AuthController_login
      parameters: []
      responses:
        "302":
          description: ""
      summary: Login redirect
      tags: *a5
  /api/auth/logout:
    get:
      description: Removes session information and redirects user the root of the
        frontend (`auth.redirectURL`)
      operationId: AuthController_logout
      parameters: []
      responses:
        "302":
          description: ""
      summary: Logout redirect
      tags: *a5
  /api/auth/callback:
    get:
      description: Users are redirected from the authorization server to this endpoint
        which will redirect them to the frontend (`auth.redirectURL`)
      operationId: AuthController_callback
      parameters:
        - name: state
          required: false
          in: query
          description: The state parameter
          schema:
            example: randomState
            type: string
        - name: code
          required: false
          in: query
          description: The authorization code
          schema:
            example: code
            type: string
        - name: access_token
          required: false
          in: query
          description: The access token
          schema:
            type: string
        - name: token_type
          required: false
          in: query
          description: The token type
          schema:
            example: Bearer
            type: string
        - name: expires_in
          required: false
          in: query
          description: The token expiration in seconds
          schema:
            example: 3600
            type: string
        - name: id_token
          required: false
          in: query
          description: The ID token
          schema:
            type: string
        - name: code_verifier
          required: false
          in: query
          description: The code verifier
          schema:
            example: randomChallengeVerifier
            type: string
      responses:
        "302":
          description: ""
      summary: Login callback
      tags: *a5
  /api/management/logging/ingress:
    get:
      operationId: LoggingController_getIngressLogs
      parameters:
        - name: order
          required: false
          in: query
          schema:
            default: DESC
            type: string
            enum:
              - ASC
              - DESC
        - name: page
          required: false
          in: query
          schema:
            minimum: 1
            default: 1
            type: number
        - name: take
          required: false
          in: query
          schema:
            minimum: 1
            maximum: 50
            default: 10
            type: number
        - required: false
          name: order
          in: query
          schema:
            default: DESC
            type: string
        - required: false
          name: page
          in: query
          schema:
            minimum: 1
            default: 1
            type: number
        - required: false
          name: take
          in: query
          schema:
            minimum: 1
            maximum: 50
            default: 10
            type: number
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PageDto"
      security:
        - oauth2:
            - read:hdp.logs
      summary: Get ingress logs
      tags: &a6
        - Logging
  /api/management/logging/egress:
    get:
      operationId: LoggingController_getEgressLogs
      parameters:
        - name: order
          required: false
          in: query
          schema:
            default: DESC
            type: string
            enum:
              - ASC
              - DESC
        - name: page
          required: false
          in: query
          schema:
            minimum: 1
            default: 1
            type: number
        - name: take
          required: false
          in: query
          schema:
            minimum: 1
            maximum: 50
            default: 10
            type: number
        - required: false
          name: order
          in: query
          schema:
            default: DESC
            type: string
        - required: false
          name: page
          in: query
          schema:
            minimum: 1
            default: 1
            type: number
        - required: false
          name: take
          in: query
          schema:
            minimum: 1
            maximum: 50
            default: 10
            type: number
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PageDto"
      security:
        - oauth2:
            - read:hdp.logs
      summary: Get egress logs
      tags: *a6
  /api/dataflows/prepare:
    post:
      description: Ask the data plane to prepare the resources for a transfer.
      operationId: DataflowController_prepare
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataflowPrepareMessageDto"
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DataflowResponseDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security: &a7
        - oauth2:
            - dplane-signaling
      summary: Prepare a dataflow
      tags: &a8
        - Dataflow Signaling
  /api/dataflows/start:
    post:
      description: Ask the data plane to begin a prepared dataflow.
      operationId: DataflowController_start
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataflowStartMessageDto"
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DataflowResponseDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security: *a7
      summary: Start a dataflow
      tags: *a8
  /api/dataflows/{id}/started:
    post:
      description: Consumer-side notification that data transmission has begun.
        Carries the data address for pull transfers.
      operationId: DataflowController_started
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow identifier
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataflowStartedNotificationMessageDto"
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DataflowResponseDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security: *a7
      summary: Notify a dataflow has started
      tags: *a8
  /api/dataflows/{id}/suspend:
    post:
      operationId: DataflowController_suspend
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow identifier
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataflowSuspendMessageDto"
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DataflowResponseDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security: *a7
      summary: Suspend a dataflow
      tags: *a8
  /api/dataflows/{id}/resume:
    post:
      operationId: DataflowController_resume
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow identifier
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataflowResumeMessageDto"
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DataflowResponseDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security: *a7
      summary: Resume a dataflow
      tags: *a8
  /api/dataflows/{id}/terminate:
    post:
      operationId: DataflowController_terminate
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow identifier
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataflowTerminateMessageDto"
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DataflowResponseDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security: *a7
      summary: Terminate a dataflow
      tags: *a8
  /api/dataflows/{id}/completed:
    post:
      description: Signals that a data transmission has completed normally.
      operationId: DataflowController_completed
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow identifier
          schema:
            type: string
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DataflowResponseDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security: *a7
      summary: Complete a dataflow
      tags: *a8
  /api/dataflows/{id}/status:
    get:
      operationId: DataflowController_status
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow identifier
          schema:
            type: string
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DataflowStatusResponseDto"
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security: *a7
      summary: Get dataflow status
      tags: *a8
  /api/management/dataflows:
    get:
      operationId: DataflowManagementController_getDataflows
      parameters: []
      responses:
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      security:
        - oauth2:
            - read:dp.transfer
      summary: List dataflows executed by this data plane
      tags:
        - Dataflow Management
  /.well-known/jwks.json:
    get:
      operationId: DataAccessController_jwks
      parameters: []
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                type: object
                required:
                  - keys
                properties:
                  keys:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
      summary: Get current and retained data access public signing keys
      tags: &a9
        - Data access
  /api/token:
    post:
      description: Authenticate with a consumer DID-signed bearer proof. Its iss and
        sub identify the consumer, aud identifies the provider, and token
        contains the current access JWT. The proof requires iat and exp and may
        live at most 300 seconds.
      operationId: DataAccessController_refresh
      parameters:
        - name: authorization
          required: true
          in: header
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/RefreshGrantRequest"
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RefreshGrantResponse"
      security:
        - bearer: []
      summary: Rotate a refresh grant
      tags: *a9
  /api/proxy/{id}/{path}:
    get:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_get
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: &a10
        - Proxy
    post:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_post
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    put:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_put
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    delete:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_delete
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    patch:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_patch
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    options:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_options
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    head:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_head
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    search:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_search
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
  /api/proxy/{id}:
    get:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_get
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    post:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_post
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    put:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_put
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    delete:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_delete
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    patch:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_patch
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    options:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_options
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    head:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_head
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
    search:
      description: "This endpoint is used if the HTTP Data Plane needs to serve as a
        proxy. "
      operationId: ProxyController_getData_search
      parameters:
        - name: id
          required: true
          in: path
          description: Dataflow id (signaling)
          schema:
            type: string
        - name: path
          required: true
          in: path
          description: Path of receiving application
          schema:
            type: string | string[] | undefined
      responses:
        "200":
          description: ""
      summary: Proxy a request
      tags: *a10
info:
  title: TSG HTTP Data Plane
  description: This OpenAPI specification shows the endpoints of the HTTP Data Plane.
  version: ""
  contact: {}
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
tags:
  - name: Health
    description: Health Controller
  - name: Settings
    description: Settings Controller
  - name: Authentication
    description: Authentication Controller
  - name: Data Plane
    description: Data Plane Controller
  - name: Data Plane Management
    description: Data Plane Management Controller
  - name: Proxy
    description: Proxy Controller
  - name: Logging
    description: Logging Controller
servers: []
components:
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          scopes: &a11
            create:hdp.config: create:hdp.config
            read:hdp.config: read:hdp.config
            update:hdp.config: update:hdp.config
            delete:hdp.config: delete:hdp.config
            execute:hdp.config: execute:hdp.config
            manage:hdp.config: manage:hdp.config
            create:hdp.dataplane: create:hdp.dataplane
            read:hdp.dataplane: read:hdp.dataplane
            update:hdp.dataplane: update:hdp.dataplane
            delete:hdp.dataplane: delete:hdp.dataplane
            execute:hdp.dataplane: execute:hdp.dataplane
            manage:hdp.dataplane: manage:hdp.dataplane
            create:hdp.logs: create:hdp.logs
            read:hdp.logs: read:hdp.logs
            update:hdp.logs: update:hdp.logs
            delete:hdp.logs: delete:hdp.logs
            execute:hdp.logs: execute:hdp.logs
            manage:hdp.logs: manage:hdp.logs
            dplane-signaling: Audience-bound data plane signaling
        clientCredentials:
          scopes: *a11
  schemas:
    RuntimeConfigDto:
      type: object
      properties:
        color:
          type: string
          example: "#3B8BF6"
        darkThemeUrl:
          type: string
          example: https://example.com/darktheme.png
        lightThemeUrl:
          type: string
          example: https://example.com/lighttheme.png
      required:
        - color
    ErrorDto:
      type: object
      properties:
        name:
          type: string
          example: ResourceNotFound
        status:
          type: string
          example: 404 Not Found
        code:
          type: number
          example: 404
        message:
          type: object
          example: The requested resource does not exist.
        error:
          type: string
          example: Not Found
      required:
        - name
        - status
        - code
    ClientInfo:
      type: object
      properties:
        sub:
          type: string
          example: user-id-123
        name:
          type: string
          example: John Doe
        email:
          type: string
          example: john.doe@example.com
        didId:
          type: string
          example: did:example:123456789
        permissions:
          example:
            - read:credential:own
            - manage:key
          description: ABAC permissions
          type: array
          items:
            type: string
        refreshToken:
          type: string
          example: refresh-token-abc123
      required:
        - sub
        - name
        - email
        - permissions
    AuthenticatedUser:
      type: object
      properties:
        state:
          type: object
          example: authenticated
        user:
          example:
            sub: user-id-123
            name: John Doe
            email: john.doe@example.com
            permissions:
              - read:credential:own
              - manage:key
            didId: did:example:123456789
            refreshToken: refresh-token-abc123
          allOf:
            - $ref: "#/components/schemas/ClientInfo"
      required:
        - state
        - user
    UnauthenticatedUser:
      type: object
      properties:
        state:
          type: object
          example: unauthenticated
      required:
        - state
    PageMetaDto:
      type: object
      properties:
        page:
          type: number
          example: 1
        take:
          type: number
          example: 10
        itemCount:
          type: number
          example: 100
        pageCount:
          type: number
          example: 10
        hasPreviousPage:
          type: boolean
          example: false
        hasNextPage:
          type: boolean
          example: true
      required:
        - page
        - take
        - itemCount
        - pageCount
        - hasPreviousPage
        - hasNextPage
    PageDto:
      type: object
      properties:
        data:
          type: array
          items:
            type: array
        meta:
          $ref: "#/components/schemas/PageMetaDto"
      required:
        - data
        - meta
    DataflowPrepareMessageDto:
      type: object
      properties:
        messageId:
          type: string
          example: b1d5f9e2-3c4b-4f7a-9c3e-2f1e5d6c7b8a
        participantId:
          type: string
          example: provider-participant-id
          description: The participant ID of the sender.
        counterPartyId:
          type: string
          example: consumer-participant-id
          description: The participant ID of the counterparty.
        dataspaceContext:
          type: string
          example: test-dataspace-context
          description: Identifier for the dataspace context when a data plane is used in
            multiple dataspaces.
        dataFlowId:
          type: string
          example: urn:uuid:provider:transfer-1
          description: The transfer process ID assigned by the control plane.
        agreementId:
          type: string
          example: urn:uuid:agreement-1
        datasetId:
          type: string
          example: urn:uuid:dataset-1
        profile:
          type: string
          example: https://w3id.org/dspace-sig/profile/http-pull
          description: The flow transfer profile. See the DPS Transfer Profile Registry.
        claims:
          type: object
          description: The DSP claims of the counterparty as verified by the control plane.
          example: &a12
            membership: active
            sub: subject
        labels:
          description: Labels representing different flavours of data flow.
          type: array
          items:
            type: string
        metadata:
          type: object
          description: Information used by the data plane during preparation/startup.
      required:
        - messageId
        - participantId
        - counterPartyId
        - dataspaceContext
        - dataFlowId
        - agreementId
        - datasetId
        - profile
        - claims
    DataPlaneProperty:
      type: object
      properties:
        "@type":
          type: string
          enum:
            - EndpointProperty
        name:
          type: string
        value:
          type: string
      required:
        - "@type"
        - name
        - value
    DataPlaneAddressDto:
      type: object
      properties:
        "@type":
          type: string
          enum:
            - DataAddress
        endpointType:
          type: string
        endpoint:
          type: string
        endpointProperties:
          type: array
          items:
            $ref: "#/components/schemas/DataPlaneProperty"
      required:
        - "@type"
        - endpointType
    DataflowResponseDto:
      type: object
      properties:
        messageId:
          type: string
          example: b1d5f9e2-3c4b-4f7a-9c3e-2f1e5d6c7b8a
        dataFlowId:
          type: string
          example: urn:uuid:dataflow-1
        state:
          type: string
          enum:
            - INITIALIZED
            - PREPARING
            - PREPARED
            - STARTING
            - STARTED
            - SUSPENDED
            - COMPLETED
            - TERMINATED
          example: PREPARED
        dataAddress:
          $ref: "#/components/schemas/DataPlaneAddressDto"
        error:
          type: string
          example: Backend unreachable
      required:
        - messageId
        - dataFlowId
        - state
    DataflowStartMessageDto:
      type: object
      properties:
        messageId:
          type: string
          example: b1d5f9e2-3c4b-4f7a-9c3e-2f1e5d6c7b8a
        participantId:
          type: string
          example: provider-participant-id
          description: The participant ID of the sender.
        counterPartyId:
          type: string
          example: consumer-participant-id
          description: The participant ID of the counterparty.
        dataspaceContext:
          type: string
          example: test-dataspace-context
          description: Identifier for the dataspace context when a data plane is used in
            multiple dataspaces.
        dataFlowId:
          type: string
          example: urn:uuid:provider:transfer-1
          description: The transfer process ID assigned by the control plane.
        agreementId:
          type: string
          example: urn:uuid:agreement-1
        datasetId:
          type: string
          example: urn:uuid:dataset-1
        profile:
          type: string
          example: https://w3id.org/dspace-sig/profile/http-pull
          description: The flow transfer profile. See the DPS Transfer Profile Registry.
        claims:
          type: object
          description: The DSP claims of the counterparty as verified by the control plane.
          example: *a12
        labels:
          description: Labels representing different flavours of data flow.
          type: array
          items:
            type: string
        metadata:
          type: object
          description: Information used by the data plane during preparation/startup.
        dataAddress:
          $ref: "#/components/schemas/DataPlaneAddressDto"
      required:
        - messageId
        - participantId
        - counterPartyId
        - dataspaceContext
        - dataFlowId
        - agreementId
        - datasetId
        - profile
        - claims
    DataflowStartedNotificationMessageDto:
      type: object
      properties:
        messageId:
          type: string
          example: b1d5f9e2-3c4b-4f7a-9c3e-2f1e5d6c7b8a
        dataAddress:
          $ref: "#/components/schemas/DataPlaneAddressDto"
      required:
        - messageId
    DataflowSuspendMessageDto:
      type: object
      properties:
        messageId:
          type: string
          example: b1d5f9e2-3c4b-4f7a-9c3e-2f1e5d6c7b8a
        reason:
          type: string
          example: Suspending due to scheduled maintenance.
      required:
        - messageId
    DataflowResumeMessageDto:
      type: object
      properties:
        messageId:
          type: string
          example: b1d5f9e2-3c4b-4f7a-9c3e-2f1e5d6c7b8a
        dataAddress:
          $ref: "#/components/schemas/DataPlaneAddressDto"
      required:
        - messageId
    DataflowTerminateMessageDto:
      type: object
      properties:
        messageId:
          type: string
          example: b1d5f9e2-3c4b-4f7a-9c3e-2f1e5d6c7b8a
        reason:
          type: string
          example: Terminating due to an unrecoverable error.
      required:
        - messageId
    DataflowStatusResponseDto:
      type: object
      properties:
        dataFlowId:
          type: string
        state:
          type: string
          enum:
            - INITIALIZED
            - PREPARING
            - PREPARED
            - STARTING
            - STARTED
            - SUSPENDED
            - COMPLETED
            - TERMINATED
      required:
        - dataFlowId
        - state
    RefreshGrantRequest:
      type: object
      properties:
        grant_type:
          type: string
          enum:
            - refresh_token
        refresh_token:
          type: string
          description: The current single-use refresh token
      required:
        - grant_type
        - refresh_token
    RefreshGrantResponse:
      type: object
      properties:
        access_token:
          type: string
          description: Flow-bound access JWT
        token_type:
          type: string
          enum:
            - Bearer
        expires_in:
          type: number
          description: Access token lifetime in seconds
          example: 300
        refresh_token:
          type: string
          description: Rotated single-use refresh token
      required:
        - access_token
        - token_type
        - expires_in
        - refresh_token
externalDocs:
  description: Git Repository
  url: https://gitlab.com/tno-tsg/dataspace-protocol/tno-security-gateway