{"components":{"schemas":{"JWK":{"additionalProperties":false,"properties":{"alg":{"type":"string"},"e":{"type":"string"},"kid":{"type":"string"},"kty":{"type":"string"},"n":{"type":"string"},"use":{"type":"string"}},"required":["kty"],"type":"object"},"JWKS":{"additionalProperties":false,"properties":{"$schema":{"description":"A URL to the JSON Schema for this object.","examples":["http://localhost:8080/{tenant_short}/v1/schemas/JWKS.json"],"format":"uri","readOnly":true,"type":"string"},"keys":{"items":{"$ref":"#/components/schemas/JWK"},"type":["array","null"]}},"required":["keys"],"type":"object"},"OAuthError":{"additionalProperties":false,"properties":{"$schema":{"description":"A URL to the JSON Schema for this object.","examples":["http://localhost:8080/{tenant_short}/v1/schemas/OAuthError.json"],"format":"uri","readOnly":true,"type":"string"},"error":{"type":"string"},"error_description":{"type":"string"}},"required":["error"],"type":"object"},"OpenIDConfiguration":{"additionalProperties":false,"properties":{"$schema":{"description":"A URL to the JSON Schema for this object.","examples":["http://localhost:8080/{tenant_short}/v1/schemas/OpenIDConfiguration.json"],"format":"uri","readOnly":true,"type":"string"},"grant_types_supported":{"items":{"type":"string"},"type":["array","null"]},"issuer":{"type":"string"},"jwks_uri":{"type":"string"},"response_types_supported":{"items":{"type":"string"},"type":["array","null"]},"scopes_supported":{"items":{"type":"string"},"type":["array","null"]},"service_documentation":{"type":"string"},"token_endpoint":{"type":"string"},"token_endpoint_auth_methods_supported":{"items":{"type":"string"},"type":["array","null"]},"token_introspection_endpoint":{"type":"string"},"token_revocation_endpoint":{"type":"string"}},"required":["issuer","token_endpoint","jwks_uri","grant_types_supported","response_types_supported","token_endpoint_auth_methods_supported"],"type":"object"},"RefreshRequestBody":{"additionalProperties":false,"properties":{"$schema":{"description":"A URL to the JSON Schema for this object.","examples":["http://localhost:8080/{tenant_short}/v1/schemas/RefreshRequestBody.json"],"format":"uri","readOnly":true,"type":"string"},"client_id":{"type":"string"},"client_secret":{"type":"string"},"refresh_token":{"description":"Shadow refresh token to exchange for a fresh pair of tokens","minLength":1,"type":"string"}},"required":["refresh_token"],"type":"object"},"RefreshResponseBody":{"additionalProperties":false,"properties":{"$schema":{"description":"A URL to the JSON Schema for this object.","examples":["http://localhost:8080/{tenant_short}/v1/schemas/RefreshResponseBody.json"],"format":"uri","readOnly":true,"type":"string"},"access_token":{"type":"string"},"expires_in":{"format":"int64","type":"integer"},"refresh_expires_in":{"format":"int64","type":"integer"},"refresh_token":{"type":"string"},"scope":{"type":"string"},"token_type":{"type":"string"}},"required":["access_token","token_type","expires_in"],"type":"object"},"RevokeRequestBody":{"additionalProperties":false,"properties":{"$schema":{"description":"A URL to the JSON Schema for this object.","examples":["http://localhost:8080/{tenant_short}/v1/schemas/RevokeRequestBody.json"],"format":"uri","readOnly":true,"type":"string"},"client_id":{"type":"string"},"client_secret":{"type":"string"},"token":{"description":"Shadow token to revoke","minLength":1,"type":"string"}},"required":["token"],"type":"object"},"TokenResponseBody":{"additionalProperties":false,"properties":{"$schema":{"description":"A URL to the JSON Schema for this object.","examples":["http://localhost:8080/{tenant_short}/v1/schemas/TokenResponseBody.json"],"format":"uri","readOnly":true,"type":"string"},"access_token":{"type":"string"},"expires_in":{"format":"int64","type":"integer"},"refresh_expires_in":{"format":"int64","type":"integer"},"refresh_token":{"type":"string"},"scope":{"type":"string"},"token_type":{"type":"string"}},"required":["access_token","token_type","expires_in"],"type":"object"},"ValidateRequestBody":{"additionalProperties":false,"properties":{"$schema":{"description":"A URL to the JSON Schema for this object.","examples":["http://localhost:8080/{tenant_short}/v1/schemas/ValidateRequestBody.json"],"format":"uri","readOnly":true,"type":"string"},"token":{"description":"Shadow token to validate","minLength":1,"type":"string"}},"required":["token"],"type":"object"},"ValidateResponseBody":{"additionalProperties":false,"properties":{"$schema":{"description":"A URL to the JSON Schema for this object.","examples":["http://localhost:8080/{tenant_short}/v1/schemas/ValidateResponseBody.json"],"format":"uri","readOnly":true,"type":"string"},"active":{"type":"boolean"},"client_id":{"type":"string"},"exp":{"format":"int64","type":"integer"},"scopes":{"items":{"type":"string"},"type":["array","null"]},"tenant_id":{"type":"string"}},"required":["active"],"type":"object"}},"securitySchemes":{"bearerAuth":{"bearerFormat":"JWT","description":"Keycloak-issued JWT bearer token from the shared realm.","scheme":"bearer","type":"http"}}},"info":{"description":"API documentation for authentication against the Instellix API","title":"Authentication API","version":"v2-0.11.3"},"openapi":"3.1.0","paths":{"/{tenant_short}/oauth2/.well-known/openid-configuration":{"get":{"description":"Returns OAuth2 / OpenID Connect discovery metadata (RFC 8414).","operationId":"openid-configuration","parameters":[{"in":"path","name":"tenant_short","required":true,"schema":{"pattern":"^[a-zA-Z0-9][a-zA-Z0-9_-]*$","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OpenIDConfiguration"}}},"description":"OK","headers":{"Cache-Control":{"schema":{"type":"string"}}}},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Bad Request"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unprocessable Entity"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Too Many Requests"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Internal Server Error"}},"summary":"OAuth2 Authorization Server Metadata.","tags":["Discovery"]}},"/{tenant_short}/oauth2/jwks":{"get":{"description":"Returns the RSA public key used to verify shadow token signatures (RFC 7517). The realm path parameter is accepted but does not affect the response — a single signing key is shared by all realms.","operationId":"jwks-realm","parameters":[{"in":"path","name":"tenant_short","required":true,"schema":{"pattern":"^[a-zA-Z0-9][a-zA-Z0-9_-]*$","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/JWKS"}}},"description":"OK","headers":{"Cache-Control":{"schema":{"type":"string"}}}},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Bad Request"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unprocessable Entity"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Too Many Requests"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Internal Server Error"}},"summary":"JSON Web Key Set for a realm.","tags":["Discovery"]}},"/{tenant_short}/oauth2/token":{"post":{"description":"Create an authentication token for authentication at an API.","operationId":"create-token","parameters":[{"in":"path","name":"tenant_short","required":true,"schema":{"pattern":"^[a-zA-Z0-9][a-zA-Z0-9_-]*$","type":"string"}},{"explode":false,"in":"query","name":"grant_type","schema":{"type":"string"}},{"explode":false,"in":"query","name":"client_id","schema":{"type":"string"}},{"explode":false,"in":"query","name":"client_secret","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"client_id":{"description":"Client identity credential","type":"string"},"client_secret":{"description":"Client private secret string","type":"string"},"grant_type":{"description":"OAuth2 grant type specification","type":"string"},"scope":{"description":"Scope of the client identity (ignored)","type":"string"}},"type":"object"}},"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"client_id":{"description":"Client identity credential","type":"string"},"client_secret":{"description":"Client private secret string","type":"string"},"grant_type":{"description":"OAuth2 grant type specification","type":"string"},"scope":{"description":"Scope of the client identity (ignored)","type":"string"}},"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TokenResponseBody"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Not Found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unprocessable Entity"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Too Many Requests"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Internal Server Error"}},"summary":"Create a token.","tags":["Token"]}},"/{tenant_short}/oauth2/token/refresh":{"post":{"description":"If refresh tokens are activated, you can refresh it here. (Bad Practice)","operationId":"refresh-token","parameters":[{"in":"path","name":"tenant_short","required":true,"schema":{"pattern":"^[a-zA-Z0-9][a-zA-Z0-9_-]*$","type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RefreshRequestBody"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RefreshResponseBody"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Not Found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unprocessable Entity"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Too Many Requests"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Internal Server Error"}},"summary":"Refresh a token.","tags":["Token"]}},"/{tenant_short}/oauth2/token/revoke":{"post":{"description":"Revoke an auth or refresh token.","operationId":"revoke-token","parameters":[{"in":"path","name":"tenant_short","required":true,"schema":{"pattern":"^[a-zA-Z0-9][a-zA-Z0-9_-]*$","type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeRequestBody"}}},"required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Not Found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unprocessable Entity"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Too Many Requests"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Internal Server Error"}},"summary":"Revoke a token.","tags":["Token"]}},"/{tenant_short}/oauth2/token/validate":{"post":{"description":"Validate an authentication token.","operationId":"validate-token","parameters":[{"in":"path","name":"tenant_short","required":true,"schema":{"pattern":"^[a-zA-Z0-9][a-zA-Z0-9_-]*$","type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidateRequestBody"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidateResponseBody"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Bad Request"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Forbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Not Found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Unprocessable Entity"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Too Many Requests"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}},"description":"Internal Server Error"}},"summary":"Validate token.","tags":["Token"]}}},"servers":[{"description":"Instellix Production","url":"https://api.instellix.io"}],"tags":[{"description":"Token related endpoints","externalDocs":{"description":"External documentation URL","url":"https://docs.instellix.io"},"name":"Token"},{"description":"Discovery endpoints","externalDocs":{"description":"External documentation URL","url":"https://docs.instellix.io"},"name":"Discovery"}],"x-readme":{"explorer-enabled":false,"proxy-enabled":true}}