openapi: 3.0.0
paths:
  /api/management/audit-logs:
    get:
      description: Fetches paginated audit log entries with optional filters.
      operationId: AuditLogController_list
      parameters:
        - name: order
          required: false
          in: query
          schema:
            default: DESC
            type: string
            enum:
              - ASC
              - DESC
        - name: order_by
          required: false
          in: query
          schema:
            default: modifiedDate
            type: string
        - name: page
          required: false
          in: query
          schema:
            minimum: 1
            default: 1
            type: number
        - name: per_page
          required: false
          in: query
          schema:
            minimum: 1
            maximum: 100
            default: 100
            type: number
        - name: callerSub
          required: false
          in: query
          schema:
            type: string
        - name: callerType
          required: false
          in: query
          schema:
            type: string
        - name: resultAllowed
          required: false
          in: query
          schema:
            type: boolean
        - name: correlationId
          required: false
          in: query
          schema:
            type: string
        - name: ipAddress
          required: false
          in: query
          schema:
            type: string
        - name: requestPath
          required: false
          in: query
          schema:
            type: string
        - name: from
          required: false
          in: query
          schema:
            type: string
        - name: to
          required: false
          in: query
          schema:
            type: string
        - name: resourceType
          required: false
          in: query
          schema:
            type: array
            items:
              type: string
        - name: action
          required: false
          in: query
          schema:
            type: array
            items:
              type: string
        - name: severity
          required: false
          in: query
          schema:
            type: array
            items:
              type: string
              enum:
                - debug
                - info
                - warning
                - error
                - critical
      responses:
        "200":
          description: Successful response
          headers:
            x-page:
              description: Index of the current page (starting at 1)
              schema:
                type: integer
            x-prev-page:
              description: Index of the previous page
              schema:
                type: integer
              required: false
            x-next-page:
              description: Index of the next page
              schema:
                type: integer
              required: false
            x-per-page:
              description: Number of items per page
              schema:
                type: integer
            x-total-pages:
              description: Total number of pages
              schema:
                type: integer
            x-total:
              description: Total number of items
              schema:
                type: integer
            link:
              description: Web Linking to other pages of this resource
              schema:
                type: string
      security:
        - oauth2:
            - read:sso.audit_log
      summary: List audit log entries
      tags: &a1
        - Audit Logs
  /api/management/audit-logs/{id}:
    get:
      description: Fetches a single audit log entry by its ID.
      operationId: AuditLogController_getById
      parameters:
        - name: id
          required: true
          in: path
          schema:
            type: string
      responses:
        "200":
          description: ""
      security:
        - oauth2:
            - read:sso.audit_log
      summary: Get audit log entry by ID
      tags: *a1
  /health:
    get:
      description: Retrieves the current health of the app. If the app is running and
        it is connected to the database it always returns an empty 200 OK
      operationId: HealthController_getHealth
      parameters: []
      responses:
        "200":
          description: The Health Check is successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    enum:
                      - ok
                      - degraded
                    example: ok
                  info:
                    type: object
                    example: &a2
                      database:
                        status: up
                        responseTime: 12
                    additionalProperties:
                      type: object
                      required:
                        - status
                      properties:
                        status:
                          type: string
                          enum:
                            - up
                            - degraded
                            - down
                        responseTime:
                          type: number
                          description: Time the health indicator took to respond, in ms
                      additionalProperties: true
                    nullable: true
                  error:
                    type: object
                    example: {}
                    additionalProperties:
                      type: object
                      required:
                        - status
                      properties:
                        status:
                          type: string
                          enum:
                            - up
                            - degraded
                            - down
                        responseTime:
                          type: number
                          description: Time the health indicator took to respond, in ms
                      additionalProperties: true
                    nullable: true
                  details:
                    type: object
                    example: *a2
                    additionalProperties:
                      type: object
                      required:
                        - status
                      properties:
                        status:
                          type: string
                          enum:
                            - up
                            - degraded
                            - down
                        responseTime:
                          type: number
                          description: Time the health indicator took to respond, in ms
                      additionalProperties: true
        "502":
          description: ""
        "503":
          description: The Health Check is not successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    enum:
                      - error
                      - shutting_down
                    example: error
                  info:
                    type: object
                    example:
                      database: &a3
                        status: up
                        responseTime: 12
                    additionalProperties:
                      type: object
                      required:
                        - status
                      properties:
                        status:
                          type: string
                          enum:
                            - up
                            - degraded
                            - down
                        responseTime:
                          type: number
                          description: Time the health indicator took to respond, in ms
                      additionalProperties: true
                    nullable: true
                  error:
                    type: object
                    example:
                      redis: &a4
                        status: down
                        message: Could not connect
                        responseTime: 3005
                    additionalProperties:
                      type: object
                      required:
                        - status
                      properties:
                        status:
                          type: string
                          enum:
                            - up
                            - degraded
                            - down
                        responseTime:
                          type: number
                          description: Time the health indicator took to respond, in ms
                      additionalProperties: true
                    nullable: true
                  details:
                    type: object
                    example:
                      database: *a3
                      redis: *a4
                    additionalProperties:
                      type: object
                      required:
                        - status
                      properties:
                        status:
                          type: string
                          enum:
                            - up
                            - degraded
                            - down
                        responseTime:
                          type: number
                          description: Time the health indicator took to respond, in ms
                      additionalProperties: true
      summary: Health check
      tags:
        - Health
  /api/auth/user:
    get:
      description: Get the current user and their roles and grants.
      operationId: AuthController_getUser
      parameters: []
      responses:
        "200":
          description: ""
      summary: Get user
      tags: &a5
        - Auth
  /api/auth/login:
    post:
      description: Login with username and password.
      operationId: AuthController_login
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                username:
                  example: admin
                  type: string
                password:
                  example: hunter2
                  type: string
              required:
                - username
                - password
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    example: b86483f3-3792-4a54-b11e-f1c6face9935
                    type: string
                  username:
                    example: admin
                    type: string
                  email:
                    example: admin@example.com
                    type: string
                  roles:
                    type: array
                    items:
                      type: string
                  grants:
                    type: array
                    items:
                      type: string
      summary: Login
      tags: *a5
  /api/auth/logout:
    get:
      description: Logout the current user.
      operationId: AuthController_logout
      parameters: []
      responses:
        "200":
          description: ""
      summary: Logout
      tags: *a5
  /api/auth/2fa/verify:
    post:
      description: Verify two-factor authentication token for login
      operationId: AuthController_verify2FA
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                token:
                  example: "123456"
                  type: string
              required:
                - token
      responses:
        "200":
          description: ""
      summary: Verify 2FA Token
      tags: *a5
  /api/auth/totp/qr:
    get:
      description: Get QR code for setting up TOTP two-factor authentication
      operationId: TotpController_get2FAQRCode
      parameters: []
      responses:
        "200":
          description: ""
      summary: Get TOTP Setup QR Code
      tags: &a6
        - TOTP
  /api/auth/totp/secret:
    get:
      description: Get the raw secret for manual entry into authenticator apps
      operationId: TotpController_get2FASecret
      parameters: []
      responses:
        "200":
          description: ""
      summary: Get TOTP Setup Secret
      tags: *a6
  /api/auth/totp/setup:
    post:
      description: Verify and complete TOTP two-factor authentication setup
      operationId: TotpController_verify2FASetup
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                token:
                  example: "123456"
                  type: string
              required:
                - token
      responses:
        "200":
          description: ""
      summary: Verify TOTP Setup
      tags: *a6
  /api/auth/totp/register/initiate:
    post:
      description: Start the process of registering a new TOTP credential
      operationId: TotpController_initiateTotpRegistration
      parameters: []
      responses:
        "200":
          description: ""
      summary: Initiate TOTP Registration
      tags: *a6
  /api/auth/totp/register/complete:
    post:
      description: Complete the registration of a new TOTP credential
      operationId: TotpController_completeTotpRegistration
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                token:
                  example: "123456"
                  type: string
                deviceName:
                  example: My Phone
                  type: string
              required:
                - token
      responses:
        "200":
          description: ""
      summary: Complete TOTP Registration
      tags: *a6
  /api/auth/totp/credentials:
    get:
      description: Get all registered TOTP credentials for the current user
      operationId: TotpController_listTotpCredentials
      parameters: []
      responses:
        "200":
          description: ""
      summary: List TOTP Credentials
      tags: *a6
  /api/auth/totp/credentials/{id}/delete:
    post:
      description: Remove a registered TOTP credential
      operationId: TotpController_deleteTotpCredential
      parameters: []
      responses:
        "200":
          description: ""
      summary: Delete TOTP Credential
      tags: *a6
  /api/auth/totp/enable:
    post:
      description: Enable two-factor authentication for the current user profile
      operationId: TotpController_enable2FA
      parameters: []
      responses:
        "200":
          description: ""
      summary: Enable 2FA for current user
      tags: *a6
  /api/auth/totp/disable:
    delete:
      description: Disable two-factor authentication (requires password confirmation)
      operationId: TotpController_disable2FA
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                password:
                  type: string
                  description: User password for confirmation
              required:
                - password
      responses:
        "200":
          description: ""
      summary: Disable 2FA for current user
      tags: *a6
  /api/auth/totp/reset:
    post:
      description: Reset two-factor authentication (requires password confirmation)
      operationId: TotpController_reset2FA
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                password:
                  type: string
                  description: User password for confirmation
              required:
                - password
      responses:
        "200":
          description: ""
      summary: Reset 2FA for current user
      tags: *a6
  /api/auth/totp/profile/qr:
    get:
      description: Get QR code for the current user's TOTP setup in profile settings
      operationId: TotpController_get2FAQRCodeForProfile
      parameters: []
      responses:
        "200":
          description: ""
      summary: Get 2FA QR Code for Profile
      tags: *a6
  /api/auth/totp/profile/secret:
    get:
      description: Get the raw secret for the current user's TOTP setup in profile settings
      operationId: TotpController_get2FASecretForProfile
      parameters: []
      responses:
        "200":
          description: ""
      summary: Get 2FA Secret for Profile
      tags: *a6
  /api/auth/totp/profile/verify:
    post:
      description: Verify and complete TOTP setup in profile settings
      operationId: TotpController_verify2FASetupForProfile
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                token:
                  example: "123456"
                  type: string
              required:
                - token
      responses:
        "200":
          description: ""
      summary: Verify 2FA Setup for Profile
      tags: *a6
  /api/auth/webauthn/register/initiate:
    post:
      description: Start the process of registering a new WebAuthn credential (passkey)
      operationId: WebAuthnController_initiateWebAuthnRegistration
      parameters: []
      responses:
        "200":
          description: ""
      summary: Initiate WebAuthn Registration
      tags: &a7
        - WebAuthn
  /api/auth/webauthn/register/complete:
    post:
      description: Complete the registration of a new WebAuthn credential
      operationId: WebAuthnController_completeWebAuthnRegistration
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                response:
                  type: object
                  description: WebAuthn registration response from navigator.credentials.create()
                deviceName:
                  example: My Phone
                  type: string
              required:
                - response
      responses:
        "200":
          description: ""
      summary: Complete WebAuthn Registration
      tags: *a7
  /api/auth/webauthn/authenticate/initiate:
    post:
      description: Start WebAuthn authentication as a second factor
      operationId: WebAuthnController_initiateWebAuthnAuthentication
      parameters: []
      responses:
        "200":
          description: ""
      summary: Initiate WebAuthn Authentication
      tags: *a7
  /api/auth/webauthn/authenticate/complete:
    post:
      description: Complete WebAuthn authentication for 2FA
      operationId: WebAuthnController_completeWebAuthnAuthentication
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                response:
                  type: object
                  description: WebAuthn authentication response from navigator.credentials.get()
              required:
                - response
      responses:
        "200":
          description: ""
      summary: Complete WebAuthn Authentication
      tags: *a7
  /api/auth/webauthn/credentials:
    get:
      description: Get all registered WebAuthn credentials for the current user
      operationId: WebAuthnController_listWebAuthnCredentials
      parameters: []
      responses:
        "200":
          description: ""
      summary: List WebAuthn Credentials
      tags: *a7
  /api/auth/webauthn/credentials/{id}/delete:
    post:
      description: Remove a registered WebAuthn credential
      operationId: WebAuthnController_deleteWebAuthnCredential
      parameters: []
      responses:
        "200":
          description: ""
      summary: Delete WebAuthn Credential
      tags: *a7
  /api/auth/recovery-codes/regenerate:
    post:
      description: Generate new recovery codes (requires authentication and 2FA enabled)
      operationId: RecoveryCodeController_regenerateRecoveryCodes
      parameters: []
      responses:
        "200":
          description: ""
      summary: Regenerate Recovery Codes
      tags: &a8
        - Recovery Codes
  /api/auth/recovery-codes/status:
    get:
      description: Get the count of remaining recovery codes
      operationId: RecoveryCodeController_getRecoveryCodesStatus
      parameters: []
      responses:
        "200":
          description: ""
      summary: Get Recovery Codes Status
      tags: *a8
  /api/auth/recovery-codes/acknowledge:
    post:
      description: Confirm that recovery codes have been saved and complete login
      operationId: RecoveryCodeController_acknowledgeRecoveryCodes
      parameters: []
      responses:
        "200":
          description: ""
      summary: Acknowledge Recovery Codes
      tags: *a8
  /api/users:
    get:
      operationId: UsersController_getUsers
      parameters:
        - name: order
          required: false
          in: query
          schema:
            default: DESC
            type: string
            enum:
              - ASC
              - DESC
        - name: order_by
          required: false
          in: query
          schema:
            default: modifiedDate
            type: string
        - name: page
          required: false
          in: query
          schema:
            minimum: 1
            default: 1
            type: number
        - name: per_page
          required: false
          in: query
          schema:
            minimum: 1
            maximum: 100
            default: 100
            type: number
      responses:
        "200":
          description: List of users returned.
          headers:
            x-page:
              description: Index of the current page (starting at 1)
              schema:
                type: integer
            x-prev-page:
              description: Index of the previous page
              schema:
                type: integer
              required: false
            x-next-page:
              description: Index of the next page
              schema:
                type: integer
              required: false
            x-per-page:
              description: Number of items per page
              schema:
                type: integer
            x-total-pages:
              description: Total number of pages
              schema:
                type: integer
            x-total:
              description: Total number of items
              schema:
                type: integer
            link:
              description: Web Linking to other pages of this resource
              schema:
                type: string
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/UserDto"
      security:
        - oauth2:
            - read:sso.user
      summary: Get all users
      tags: &a9
        - Users
  /api/users/lookup:
    get:
      description: Finds a user by their id, username, or email address. Provide
        exactly one of the query parameters. This endpoint is unauthenticated to
        allow service-to-service lookups.
      operationId: UsersController_lookupUser
      parameters:
        - name: id
          required: false
          in: query
          schema:
            type: string
        - name: username
          required: false
          in: query
          schema:
            type: string
        - name: email
          required: false
          in: query
          schema:
            type: string
      responses:
        "200":
          description: User found.
        "404":
          description: User not found.
      summary: Lookup a user by id, username, or email
      tags: *a9
  /api/users/create:
    post:
      operationId: UsersController_createUser
      parameters: []
      requestBody:
        required: true
        description: Data for the new user
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateUserDto"
      responses:
        "201":
          description: The user has been successfully created.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UserDto"
      security:
        - oauth2:
            - create:sso.user
      summary: Create a new user
      tags: *a9
  /api/users/{id}:
    delete:
      operationId: UsersController_deleteUser
      parameters:
        - name: id
          required: true
          in: path
          description: User id
          schema:
            type: string
      responses:
        "200":
          description: User successfully deleted.
      security:
        - oauth2:
            - delete:sso.user
      summary: Delete a user
      tags: *a9
  /api/users/update/{id}:
    patch:
      operationId: UsersController_updateUser
      parameters:
        - name: id
          required: true
          in: path
          description: User id
          schema:
            type: string
      requestBody:
        required: true
        description: Updated user data
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateUserDto"
      responses:
        "200":
          description: User successfully updated.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UserDto"
      security:
        - oauth2:
            - update:sso.user
      summary: Update an existing user
      tags: *a9
  /api/users/{id}/reset-2fa:
    post:
      description: Admin endpoint to reset two-factor authentication for a user.
        Deletes all TOTP credentials, WebAuthn credentials, and recovery codes.
      operationId: UsersController_resetUser2FA
      parameters:
        - name: id
          required: true
          in: path
          description: User id
          schema:
            type: string
      responses:
        "200":
          description: 2FA successfully reset for the user.
      security:
        - oauth2:
            - execute:sso.user
      summary: Reset 2FA for a user
      tags: *a9
  /api/profile:
    get:
      operationId: ProfileController_getProfile
      parameters: []
      responses:
        "200":
          description: Current user profile returned.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UserDto"
      summary: Get current user profile
      tags: &a10
        - Profile
  /api/profile/password:
    patch:
      operationId: ProfileController_changePassword
      parameters: []
      requestBody:
        required: true
        description: Current and new password
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ChangePasswordDto"
      responses:
        "200":
          description: Password successfully updated.
      summary: Change current user password
      tags: *a10
  /api/permissions:
    get:
      operationId: PermissionsController_getPermissions
      parameters: []
      responses:
        "200":
          description: List of permissions returned.
      security:
        - oauth2:
            - read:sso.config
      summary: Get all available permissions
      tags:
        - Permissions
  /api/oauth/authorize:
    get:
      description: Authorize a client and redirect to the client's redirect_uri.
      operationId: OauthController_authorize
      parameters:
        - name: response_type
          required: true
          in: query
          description: The response type of the authorization
          schema:
            example: code
            type: string
        - name: response_mode
          required: true
          in: query
          description: The response mode of the authorization
          schema:
            example: query
            type: string
            enum:
              - query
              - fragment
        - name: client_id
          required: true
          in: query
          description: The client identifier issuing the authorization request
          schema:
            example: client-id
            type: string
        - name: redirect_uri
          required: true
          in: query
          description: The URI to redirect to after authorization
          schema:
            example: https://example.com/redirect
            type: string
        - name: scope
          required: false
          in: query
          description: Optional scope
          schema:
            example: openid profile email
            type: string
        - name: state
          required: false
          in: query
          description: Optional state parameter
          schema:
            example: randomState
            type: string
        - name: nonce
          required: false
          in: query
          description: Optional nonce parameter
          schema:
            example: randomNonce
            type: string
        - name: code_challenge
          required: false
          in: query
          description: Optional challenge parameter
          schema:
            example: randomChallenge
            type: string
        - name: code_challenge_method
          required: false
          in: query
          description: Optional challenge method
          schema:
            example: S256
            type: string
            enum:
              - plain
              - S256
      responses:
        "200":
          description: ""
      summary: Authorize
      tags: &a11
        - Oauth
  /api/oauth/login:
    post:
      description: Login a user and redirect to the client's redirect_uri.
      operationId: OauthController_login
      parameters:
        - name: response_type
          required: true
          in: query
          description: The response type of the authorization
          schema:
            example: code
            type: string
        - name: response_mode
          required: true
          in: query
          description: The response mode of the authorization
          schema:
            example: query
            type: string
            enum:
              - query
              - fragment
        - name: client_id
          required: true
          in: query
          description: The client identifier issuing the authorization request
          schema:
            example: client-id
            type: string
        - name: redirect_uri
          required: true
          in: query
          description: The URI to redirect to after authorization
          schema:
            example: https://example.com/redirect
            type: string
        - name: scope
          required: false
          in: query
          description: Optional scope
          schema:
            example: openid profile email
            type: string
        - name: state
          required: false
          in: query
          description: Optional state parameter
          schema:
            example: randomState
            type: string
        - name: nonce
          required: false
          in: query
          description: Optional nonce parameter
          schema:
            example: randomNonce
            type: string
        - name: code_challenge
          required: false
          in: query
          description: Optional challenge parameter
          schema:
            example: randomChallenge
            type: string
        - name: code_challenge_method
          required: false
          in: query
          description: Optional challenge method
          schema:
            example: S256
            type: string
            enum:
              - plain
              - S256
        - name: redirect
          required: true
          in: query
          schema:
            type: boolean
      responses:
        "201":
          description: ""
      summary: Login
      tags: *a11
  /api/oauth/token:
    post:
      description: Get a token for the client.
      operationId: OauthController_token
      parameters: []
      responses:
        "200":
          description: ""
      summary: Token
      tags: *a11
  /api/oauth/userinfo:
    get:
      description: Get the userinfo for the token.
      operationId: OauthController_userinfoGet
      parameters:
        - name: token
          required: true
          in: query
          schema:
            type: string
      responses:
        "200":
          description: ""
      summary: Get Userinfo
      tags: *a11
    post:
      description: Get the userinfo for the token.
      operationId: OauthController_userinfoPost
      parameters: []
      responses:
        "200":
          description: ""
      summary: Get Userinfo
      tags: *a11
  /api/oauth/introspect:
    post:
      description: Introspect the token.
      operationId: OauthController_introspect
      parameters: []
      responses:
        "200":
          description: ""
      security:
        - oauth2:
            - execute:sso.config
      summary: Introspect
      tags: *a11
  /api/oauth/device_authorization:
    post:
      description: Device Authorization
      operationId: OauthController_deviceAuthorization
      parameters: []
      responses:
        "200":
          description: ""
      summary: Device Authorization
      tags: *a11
  /api/oauth/revocation:
    post:
      description: Revocation of the token.
      operationId: OauthController_revocation
      parameters: []
      responses:
        "200":
          description: ""
      security:
        - oauth2:
            - execute:sso.config
      summary: Revocation
      tags: *a11
  /api/oauth/jwks:
    get:
      description: Get the JWKS for the OAuth server
      operationId: OauthController_getJWKS
      parameters: []
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/JWKS"
        "502":
          description: ""
      summary: Get JWKS
      tags: *a11
  /api/.well-known/openid-configuration:
    get:
      description: Find all the open ID metadata for the OAuth server
      operationId: MetadataController_getOpenIDConfiguration
      parameters: []
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OpenIDConfiguration"
        "502":
          description: ""
      summary: Open ID Configuration
      tags:
        - Well-known endpoint
  /api/ingress-auth/auth-url:
    get:
      operationId: IngressAuthController_authUrl
      parameters: []
      responses:
        "200":
          description: ""
      tags: &a12
        - IngressAuth
  /api/ingress-auth/auth-signin:
    get:
      operationId: IngressAuthController_authSignin
      parameters:
        - name: clientId
          required: true
          in: query
          schema:
            type: string
        - name: rd
          required: true
          in: query
          schema:
            type: string
      responses:
        "200":
          description: ""
      tags: *a12
  /api/ingress-auth/auth-logout:
    post:
      operationId: IngressAuthController_authLogout
      parameters: []
      responses:
        "201":
          description: ""
      tags: *a12
  /api/ingress-auth/callback:
    get:
      operationId: IngressAuthController_authCallback
      parameters:
        - name: state
          required: false
          in: query
          description: The state parameter
          schema:
            example: randomState
            type: string
        - name: code
          required: false
          in: query
          description: The authorization code
          schema:
            example: code
            type: string
        - name: access_token
          required: false
          in: query
          description: The access token
          schema:
            type: string
        - name: token_type
          required: false
          in: query
          description: The token type
          schema:
            example: Bearer
            type: string
        - name: expires_in
          required: false
          in: query
          description: The token expiration in seconds
          schema:
            example: 3600
            type: string
        - name: id_token
          required: false
          in: query
          description: The ID token
          schema:
            type: string
        - name: code_verifier
          required: false
          in: query
          description: The code verifier
          schema:
            example: randomChallengeVerifier
            type: string
      responses:
        "200":
          description: ""
      tags: *a12
  /api/clients:
    get:
      operationId: ClientsController_getClients
      parameters:
        - name: order
          required: false
          in: query
          schema:
            default: DESC
            type: string
            enum:
              - ASC
              - DESC
        - name: order_by
          required: false
          in: query
          schema:
            default: modifiedDate
            type: string
        - name: page
          required: false
          in: query
          schema:
            minimum: 1
            default: 1
            type: number
        - name: per_page
          required: false
          in: query
          schema:
            minimum: 1
            maximum: 100
            default: 100
            type: number
      responses:
        "200":
          description: List of clients returned successfully.
          headers:
            x-page:
              description: Index of the current page (starting at 1)
              schema:
                type: integer
            x-prev-page:
              description: Index of the previous page
              schema:
                type: integer
              required: false
            x-next-page:
              description: Index of the next page
              schema:
                type: integer
              required: false
            x-per-page:
              description: Number of items per page
              schema:
                type: integer
            x-total-pages:
              description: Total number of pages
              schema:
                type: integer
            x-total:
              description: Total number of items
              schema:
                type: integer
            link:
              description: Web Linking to other pages of this resource
              schema:
                type: string
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ClientDto"
      security:
        - oauth2:
            - read:sso.client
      summary: Retrieve all clients
      tags: &a13
        - Clients
  /api/clients/create:
    post:
      operationId: ClientsController_createClient
      parameters: []
      requestBody:
        required: true
        description: Data for the new client
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateClientDto"
      responses:
        "201":
          description: Client created successfully.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ClientDto"
      security:
        - oauth2:
            - create:sso.client
      summary: Create a new client
      tags: *a13
  /api/clients/{id}:
    delete:
      operationId: ClientsController_deleteClient
      parameters:
        - name: id
          required: true
          in: path
          schema:
            type: string
      responses:
        "200":
          description: Client deleted successfully.
      security:
        - oauth2:
            - delete:sso.client
      summary: Delete a client by id
      tags: *a13
  /api/clients/update/{id}:
    patch:
      operationId: ClientsController_updateClient
      parameters:
        - name: id
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        description: Updated client data
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateClientDto"
      responses:
        "200":
          description: Client updated successfully.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ClientDto"
      security:
        - oauth2:
            - update:sso.client
      summary: Update an existing client
      tags: *a13
  /api/oid4vp/ar/{id}:
    get:
      description: Get the Authorization Request according to the OID4VP specification.
      operationId: OID4VPVerifierController_getAuthorizationRequest
      parameters:
        - name: id
          required: true
          in: path
          schema:
            type: string
      responses:
        "200":
          description: ""
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      summary: Get the Authorization Request
      tags: &a14
        - OID4VP
  /api/oid4vp/status/{id}:
    get:
      description: Get the Authorization Request Status.
      operationId: OID4VPVerifierController_status
      parameters:
        - name: id
          required: true
          in: path
          schema:
            type: string
      responses:
        "200":
          description: ""
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      summary: Get the Authorization Request Status
      tags: *a14
  /api/oid4vp/redirect/{id}:
    get:
      description: Redirect to the Authorization Request.
      operationId: OID4VPVerifierController_redirect
      parameters:
        - name: id
          required: true
          in: path
          schema:
            type: string
      responses:
        "200":
          description: ""
      summary: Redirect to the Authorization Request
      tags: *a14
  /api/oid4vp/authorize:
    post:
      description: Add an Authorization Request according to the OID4VP specification.
      operationId: OID4VPVerifierController_authorize
      parameters: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/OID4VPAuthorizationResponse"
      responses:
        "200":
          description: ""
      summary: Add an Authorization Request
      tags: *a14
  /api/management/oid4vp/verifier/{id}:
    get:
      description: Obtain an Authorization Request according to the OID4VP
        specification. Optionally specify a DCQL query ID to validate against.
      operationId: OID4VPVerifierManagementController_status
      parameters:
        - name: id
          required: true
          in: path
          schema:
            type: string
        - name: response_type
          required: true
          in: query
          description: The response type of the authorization
          schema:
            example: code
            type: string
        - name: response_mode
          required: true
          in: query
          description: The response mode of the authorization
          schema:
            example: query
            type: string
            enum:
              - query
              - fragment
        - name: client_id
          required: true
          in: query
          description: The client identifier issuing the authorization request
          schema:
            example: client-id
            type: string
        - name: redirect_uri
          required: true
          in: query
          description: The URI to redirect to after authorization
          schema:
            example: https://example.com/redirect
            type: string
        - name: scope
          required: false
          in: query
          description: Optional scope
          schema:
            example: openid profile email
            type: string
        - name: state
          required: false
          in: query
          description: Optional state parameter
          schema:
            example: randomState
            type: string
        - name: nonce
          required: false
          in: query
          description: Optional nonce parameter
          schema:
            example: randomNonce
            type: string
        - name: code_challenge
          required: false
          in: query
          description: Optional challenge parameter
          schema:
            example: randomChallenge
            type: string
        - name: code_challenge_method
          required: false
          in: query
          description: Optional challenge method
          schema:
            example: S256
            type: string
            enum:
              - plain
              - S256
        - name: dcql_query_id
          required: false
          in: query
          description: DCQL query ID to validate against
          schema:
            type: string
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                type: string
        "403":
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorDto"
      summary: Obtain an Authorization Request
      tags:
        - OID4VP
info:
  title: TSG SSO Bridge
  description: "TSG SSO Bridge API Documentation "
  version: ""
  contact: {}
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
tags:
  - name: Health
    description: Health controller
  - name: Auth
    description: Authentication controller
  - name: Users
    description: Users controller
  - name: Oauth
    description: Oauth controller
  - name: Clients
    description: Clients controller
servers: []
components:
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          scopes: &a15
            create:sso.client: create:sso.client
            read:sso.client: read:sso.client
            update:sso.client: update:sso.client
            delete:sso.client: delete:sso.client
            execute:sso.client: execute:sso.client
            manage:sso.client: manage:sso.client
            create:sso.config: create:sso.config
            read:sso.config: read:sso.config
            update:sso.config: update:sso.config
            delete:sso.config: delete:sso.config
            execute:sso.config: execute:sso.config
            manage:sso.config: manage:sso.config
            create:sso.logs: create:sso.logs
            read:sso.logs: read:sso.logs
            update:sso.logs: update:sso.logs
            delete:sso.logs: delete:sso.logs
            execute:sso.logs: execute:sso.logs
            manage:sso.logs: manage:sso.logs
            create:sso.role: create:sso.role
            read:sso.role: read:sso.role
            update:sso.role: update:sso.role
            delete:sso.role: delete:sso.role
            execute:sso.role: execute:sso.role
            manage:sso.role: manage:sso.role
            create:sso.user: create:sso.user
            read:sso.user: read:sso.user
            update:sso.user: update:sso.user
            delete:sso.user: delete:sso.user
            execute:sso.user: execute:sso.user
            manage:sso.user: manage:sso.user
        clientCredentials:
          scopes: *a15
  schemas:
    UserDto:
      type: object
      properties:
        id:
          type: string
          example: "1"
        username:
          type: string
          example: johndoe
        email:
          type: string
          example: johndoe@example.com
        permissions:
          example: &a16
            - manage:user
            - read:config
          description: User permissions (can be permission strings or permission set names)
          type: array
          items:
            type: string
        grants:
          example: &a17
            - read
            - write
          type: array
          items:
            type: string
        require2FA:
          type: boolean
          example: false
      required:
        - username
        - email
        - permissions
        - grants
    CreateUserDto:
      type: object
      properties:
        username:
          type: string
          example: johndoe
        email:
          type: string
          example: johndoe@example.com
        permissions:
          example: *a16
          description: User permissions (can be permission strings or permission set names)
          type: array
          items:
            type: string
        grants:
          example: *a17
          type: array
          items:
            type: string
        require2FA:
          type: boolean
          example: false
        password:
          type: string
          example: strongpassword123
      required:
        - username
        - email
        - permissions
        - grants
    UpdateUserDto:
      type: object
      properties:
        username:
          type: string
          example: johndoe
        email:
          type: string
          example: johndoe@example.com
        permissions:
          example: *a16
          description: User permissions (can be permission strings or permission set names)
          type: array
          items:
            type: string
        grants:
          example: *a17
          type: array
          items:
            type: string
        require2FA:
          type: boolean
          example: false
        password:
          type: string
          example: strongpassword123
    ChangePasswordDto:
      type: object
      properties:
        currentPassword:
          type: string
          example: currentpassword123
        newPassword:
          type: string
          example: newpassword456
      required:
        - currentPassword
        - newPassword
    JsonWebKeyDto:
      type: object
      properties:
        alg:
          type: string
          example: RS256
        crv:
          type: string
          example: P-256
        e:
          type: string
          example: AQAB
        ext:
          type: boolean
          example: false
        key_ops:
          example:
            - sign
            - verify
          type: array
          items:
            type: string
        kid:
          type: string
          example: bdfd4c8e-3a44-4b9f-bc3e-1a8e26e3e99d
        kty:
          type: string
          example: RSA
        n:
          type: string
          example: sample_modulus
        use:
          type: string
          example: sig
        x:
          type: string
          example: sample_x_coordinate
        y:
          type: string
          example: sample_y_coordinate
      required:
        - kty
    JWKS:
      type: object
      properties:
        keys:
          description: The key set
          type: array
          items:
            $ref: "#/components/schemas/JsonWebKeyDto"
      required:
        - keys
    OpenIDConfiguration:
      type: object
      properties:
        issuer:
          type: string
          description: Issuer of the OpenID configuration
        authorization_endpoint:
          type: string
          description: Authorization endpoint
        token_endpoint:
          type: string
          description: Token endpoint
        userinfo_endpoint:
          type: string
          description: Userinfo endpoint
        introspection_endpoint:
          type: string
          description: Introspection endpoint
        device_authorization_endpoint:
          type: string
          description: Device authorization endpoint
        revocation_endpoint:
          type: string
          description: Revocation endpoint
        jwks_uri:
          type: string
          description: JWKS URI
        response_types_supported:
          description: Supported response types
          type: array
          items:
            type: string
        response_modes_supported:
          description: Supported response modes
          type: array
          items:
            type: string
        id_token_signing_alg_values_supported:
          description: Supported ID token signing algorithms
          type: array
          items:
            type: string
        scopes_supported:
          description: Supported scopes
          type: array
          items:
            type: string
        grant_types_supported:
          description: Supported grant types
          type: array
          items:
            type: string
        subject_types_supported:
          description: Supported subject types
          type: array
          items:
            type: string
        claims_supported:
          description: Supported claims
          type: array
          items:
            type: string
        token_endpoint_auth_methods_supported:
          description: Supported token endpoint authentication methods
          example:
            - client_secret_post
            - private_key_jwt
          type: array
          items:
            type: string
        token_endpoint_auth_signing_alg_values_supported:
          description: Supported signing algorithms for token endpoint authentication with
            private_key_jwt
          example:
            - RS256
            - ES256
          type: array
          items:
            type: string
      required:
        - issuer
        - authorization_endpoint
        - token_endpoint
        - jwks_uri
        - response_types_supported
        - id_token_signing_alg_values_supported
        - subject_types_supported
    ClientDto:
      type: object
      properties:
        id:
          type: string
          example: "1"
        name:
          type: string
          example: Example Client
        secretName:
          type: string
          example: SecretExample
        description:
          type: string
          example: A sample client used for demonstration purposes.
        clientId:
          type: string
          example: client-id-123
        clientSecret:
          type: string
          example: client-secret-abc
          description: Client secret for symmetric authentication. Required when
            tokenEndpointAuthMethod is client_secret_post.
        tokenEndpointAuthMethod:
          type: string
          example: client_secret_post
          description: Authentication method used at the token endpoint. Defaults to
            client_secret_post.
          enum: &a18
            - client_secret_post
            - private_key_jwt
            - none
        jwk:
          type: object
          example: &a19
            kty: RSA
            n: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw
            e: AQAB
            kid: client-key-1
          description: Public key in JWK format for asymmetric authentication. Required
            when tokenEndpointAuthMethod is private_key_jwt.
        permissions:
          example: &a20
            - manage:catalog
            - read:dataset
          description: Client permissions (can be permission strings or permission set
            names)
          type: array
          items:
            type: string
        grants:
          example: &a21
            - authorization_code
            - client_credentials
          type: array
          items:
            type: string
        redirectUris:
          example: &a22
            - https://example.com/callback
          type: array
          items:
            type: string
      required:
        - name
        - secretName
        - description
        - clientId
        - permissions
        - grants
        - redirectUris
    CreateClientDto:
      type: object
      properties:
        name:
          type: string
          example: Example Client
        secretName:
          type: string
          example: SecretExample
        description:
          type: string
          example: A sample client used for demonstration purposes.
        clientId:
          type: string
          example: client-id-123
        clientSecret:
          type: string
          example: client-secret-abc
          description: Client secret for symmetric authentication. Required when
            tokenEndpointAuthMethod is client_secret_post.
        tokenEndpointAuthMethod:
          type: string
          example: client_secret_post
          description: Authentication method used at the token endpoint. Defaults to
            client_secret_post.
          enum: *a18
        jwk:
          type: object
          example: *a19
          description: Public key in JWK format for asymmetric authentication. Required
            when tokenEndpointAuthMethod is private_key_jwt.
        permissions:
          example: *a20
          description: Client permissions (can be permission strings or permission set
            names)
          type: array
          items:
            type: string
        grants:
          example: *a21
          type: array
          items:
            type: string
        redirectUris:
          example: *a22
          type: array
          items:
            type: string
      required:
        - name
        - secretName
        - description
        - clientId
        - permissions
        - grants
        - redirectUris
    UpdateClientDto:
      type: object
      properties:
        name:
          type: string
          example: Example Client
        secretName:
          type: string
          example: SecretExample
        description:
          type: string
          example: A sample client used for demonstration purposes.
        clientId:
          type: string
          example: client-id-123
        clientSecret:
          type: string
          example: client-secret-abc
          description: Client secret for symmetric authentication. Required when
            tokenEndpointAuthMethod is client_secret_post.
        tokenEndpointAuthMethod:
          type: string
          example: client_secret_post
          description: Authentication method used at the token endpoint. Defaults to
            client_secret_post.
          enum: *a18
        jwk:
          type: object
          example: *a19
          description: Public key in JWK format for asymmetric authentication. Required
            when tokenEndpointAuthMethod is private_key_jwt.
        permissions:
          example: *a20
          description: Client permissions (can be permission strings or permission set
            names)
          type: array
          items:
            type: string
        grants:
          example: *a21
          type: array
          items:
            type: string
        redirectUris:
          example: *a22
          type: array
          items:
            type: string
    ErrorDto:
      type: object
      properties:
        name:
          type: string
          example: ResourceNotFound
        status:
          type: string
          example: 404 Not Found
        code:
          type: number
          example: 404
        message:
          type: object
          example: The requested resource does not exist.
        error:
          type: string
          example: Not Found
      required:
        - name
        - status
        - code
    VpToken:
      type: object
      properties: {}
    OID4VPAuthorizationResponse:
      type: object
      properties:
        vp_token:
          example:
            identity_credential:
              - eyJhbGciOiJFUzI1NiJ9...
          description: VP Token with credential ID to presentations mapping
          allOf:
            - $ref: "#/components/schemas/VpToken"
        state:
          type: string
          example: state123
          description: State parameter from the authorization request
      required:
        - vp_token
        - state
externalDocs:
  description: Git Repository
  url: https://gitlab.com/tno-tsg/dataspace-protocol/tno-security-gateway