openapi: 3.0.0
info:
  description: |
    This is the API for authn in MM

    ## Security:
    Paths | Authorization header
    ----- |---------
    /oauth/token | Basic <base64(client_id:client_secret)> OR JWT client assertion (private_key_jwt)

    ## JWT Client Authentication:
    Clients can authenticate using signed JWT assertions instead of client secrets by providing:
    - `client_assertion_type`: `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`
    - `client_assertion`: A signed JWT containing `iss`, `sub`, `aud`, `jti`, and `exp` claims

  version: 6.0.0
  title: Authn API
  contact:
    email: authn@masmovil.com

tags:
  - name: TokenInfo
    description: API getting token claims once we have an accessToken
  - name: OAuth2
    description: OAuth2 authentication endpoints
  - name: Magic Links
    description: Retrieve access_token without credentials, only with a magic link
  - name: CIBA
    description: OpenID Connect Client-Initiated Backchannel Authentication Flow

paths:
  /webauthn/registration/options:
    post:
      tags: [WebAuthn]
      summary: Get registration options for WebAuthn
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnRegistrationRequest'
            example:
              username: gasai@yahoo.es
              user_verification: preferred
              attestation: none
              attachment: all
              algorithms:
                - es256
                - rs256
              discoverable_credential: preferred
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebAuthnRegistrationResponse'
              example:
                rp:
                  name: Authn
                  id: localhost
                user:
                  name: gasai@yahoo.es
                  displayName: gasai@yahoo.es
                  id: Z2FzYWlAeWFob28uZXNfbWFzbW92aWxfTHVtaWVyZSBRdmFudGVsMQ
                challenge: kLnLjjcbKoZxiHitcqZh0U6NZxZdImHvfCitQlOI3e8
                pubKeyCredParams:
                  - type: public-key
                    alg: -7
                  - type: public-key
                    alg: -35
                  - type: public-key
                    alg: -36
                  - type: public-key
                    alg: -257
                  - type: public-key
                    alg: -258
                  - type: public-key
                    alg: -259
                  - type: public-key
                    alg: -37
                  - type: public-key
                    alg: -38
                  - type: public-key
                    alg: -39
                  - type: public-key
                    alg: -8
                timeout: 300000
                authenticatorSelection:
                  requireResidentKey: false
                  userVerification: preferred
  /webauthn/registration/verify:
    post:
      tags: [WebAuthn]
      summary: Verify WebAuthn Registration
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnVerifyRequest'
            example:
              username: gasai@yahoo.es
              response:
                id: "1oiirNJ62KeeucBn6MAsfFHyB9k"
                rawId: "1oiirNJ62KeeucBn6MAsfFHyB9k"
                response:
                  attestationObject: "o2NmbXRkbm9uZWdhdHRTdG10..."
                  clientDataJSON: "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoia0xuTGpq..."
                  transports:
                    - hybrid
                    - internal
                  publicKeyAlgorithm: -7
                  publicKey: "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjmgQf1tLUkjKDus1ipkNsOmLtzcp5ZtanTowgUzB3RkCxSge-e-8Mrq76Pl0x_8SffYTXlaqkm0fBmAX911Vtg"
                  authenticatorData: "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NdAAAAAPv8MAcVTk7MjAtuAgVX170AFNaIoqzSetinnrnAZ-jALHxR8gfZpQECAyYgASFYII5oEH9bS1JIyg7rNYqZDbDpi7c3KeWbWp06MIFMwd0ZIlggAsUoHvnvvDK6u-j5dMf_En32E15WqpJtHwZgF_ddVbY"
                type: "public-key"
                clientExtensionResults: {}
                authenticatorAttachment: "platform"
      responses:
        '200':
          description: Successful verification
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebAuthnVerifyResponse'
              example:
                verified: true

  /webauthn/authentication/options:
    post:
      tags: [WebAuthn]
      summary: Get WebAuthn authentication options
      operationId: getWebAuthnAuthenticationOptions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnAuthenticationOptionsRequest'
            example:
              username: gasai@yahoo.es
              user_verification: preferred
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebAuthnAuthenticationOptionsResponse'
              example:
                challenge: MdycdqU2giNAZR5pnkRPem3ACKZUQnAFEmIzbiqztHU
                timeout: 300000
                rpId: localhost
                allowCredentials:
                  - type: public-key
                    id: 1oiirNJ62KeeucBn6MAsfFHyB9k
                    transports:
                      - hybrid
                      - internal
                userVerification: preferred

  /webauthn/authentication/verification:
    post:
      tags: [WebAuthn]
      summary: Verify WebAuthn Authentication
      operationId: verifyWebAuthnAuthentication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnAuthenticationVerificationRequest'
            example:
              username: gasai@yahoo.es
              response:
                id: "1oiirNJ62KeeucBn6MAsfFHyB9k"
                rawId: "1oiirNJ62KeeucBn6MAsfFHyB9k"
                response:
                  authenticatorData: "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA"
                  clientDataJSON: "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiTWR5Y2RxVTJnaU5BWlI1cG5rUlBlbTNBQ0taVVFuQUZFbUl6YmlxenRIVSIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MCIsImNyb3NzT3JpZ2luIjpmYWxzZX0"
                  signature: "MEQCIFz7zeflWv5p3rDZglFzwbDLgAZqMheLkubu94FPKCNpAiA0KikVURD5D8t1JpwLoOeEgtizVZd1owDwv9C2ZJA2kw"
                  userHandle: "Z2FzYWlAeWFob28uZXNfbWFzbW92aWxfTHVtaWVyZSBRdmFudGVsMQ"
                type: "public-key"
                clientExtensionResults: {}
                authenticatorAttachment: "platform"
      responses:
        '200':
          description: Successful verification
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebAuthnAuthenticationVerificationResponse'
              example:
                access_token: "eyJhbGciOiJSUzI1NiIsImtpZCI6IjgzMmE2NWFhLWU3ODYtNGE1ZC04MDk3LTNjYWQ1MzQzZDMxZCIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJzYWxlczE3OTMwOWQ3LWI4NDgtNDgyZC1hZTg3LTNlMWFjZjRjNGE3Ni5hdXRoLm1hc21vdmlsLmNvbSIsImV4cCI6MTcwNTM4ODQwOSwiaWF0IjoxNzA1MzM0ODA5LCJncm91cHMiOiJjdXN0b21lciIsImlhdCI6MTcwNTMzNDgwOSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo2MDQwIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiZ2FzYWkteWFob28uZXMiLCJyb2xlcyI6Iml0c2VsZiIsInNjb3BlIjoiYXBpOmV2ZXJ5dGhpbmciLCJzdHJlbmd0aCI6InR4aW5kb2tpIiwic3ViIjoiZ2FzYWlAeWFob28uZXMiLCJ0ZW5hbnRzIjoidjE6OjIiLCJ0aWQiOiJjN2RjZWJmMC1hNmU0LTQ0MTctYmEwYi04YmNlYmJkMTg5N2UiLCJ0aWVyIjoiZ3JlZW4ifQ.aytlxbbC1TaPFpNyuj0_ZXNFgS90Xnf0zS1dswJ4BojWezU5jvri9jRlqqD8dpAAU5pBYo__xwir0mlgTh6fjdZZ4d8MX_uDEVbOjBGESe4uWztF3mWLcUdy6AeU80zhaQIFdtXvo-2_0KEuFw79qWUUm1w3kgq2-DZ21ok8__YnH4XY6dg9qQvSzIcGTKA8Z1I0u6oF2GlcOWcqu_36ssOJ8J30RgGBHjHVhg0vS6FbY02CUiDcJv5sa0flWpKUfY9raygWxe-UARHHxttM8ZICDhQm4B76DOtUjS0ww2Ik96q31WWWA7tfOsO9ymDXQivSY9fV9duSeI0O6drCUA"
                expires_in: 3600
                refresh_token: "eyJhbGciOiJSUzI1NiIsImtpZCI6IjgzMmE2NWFhLWU3ODYtNGE1ZC04MDk3LTNjYWQ1MzQzZDMxZCIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJIN2VadHpxbmhTYVlEY3YwY1pwayIsImV4cCI6MTcwNTQyMjQwOSwiaWF0IjoxNzA1MzM0ODA5LCJzdWIiOiJnYXNhaUB5YWhvby5lcyIsInRpZCI6ImM3ZGNlYmYwLWE2ZTQtNDQxNy1iYTBiLThiY2ViYmQxODk3ZSJ9.jCjfz9YAxVEuKKs-gLw0PQnMC_tg7wt5gtG0DNo82bLNtIc-7_LQFPIhompPkqPa4j9k0VeiIg_MxZNe1PY6Kx6s5x6DR4f1FhNEeoNJ8CwkpHTk6oxjYT0_BIyFBwTS3LJd5VTgT7xHkHeRFdb_5QoM_ifhXDAyzKWG6nCAUDIPdNmmkeSHN-SzBN2TrrdBPs32WjqE_Wkcl2o9PjBLVpq_Ul-_Lmv2wo7ONcry3T11lGrR-UWZjPeJO6OCN0M-Zgxpfgz-mqMUsZEhhGW6FeTxcy_Yzxg-bpRK4PPaCPXdnlxUjimtGmhDvMA5Sl19roEdASWf9EhOxDzM1ihk7w"
                token_type: "Bearer"

  /bc-authorize:
    post:
      tags: [CIBA]
      summary: The Backchannel Authentication Endpoint 
      description: "The Backchannel Authentication Endpoint is used to initiate an out-of-band authentication of the end-user. This is done by sending an HTTP POST message directly from the Client to the OpenID Provider's Backchannel Authentication Endpoint"
      operationId: postBcAuthorize
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                login_hint:
                  description: A hint to the OpenID Provider regarding the end-user for whom authentication is being requested. The value may contain an email address or msisdn, which identifies the end-user to the OP
                  example: myemail@gmail.com
                  type: string
                scope:
                  description: Scope of permissions
                  type: string
                binding_message:
                  description: "A human-readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user. This interlocking message enables the end-user to ensure that the action taken on the authentication device is related to the request initiated by the consumption device."
                  example: "usuario@gmail.com"
                  type: string
                acr_values:
                  description: "Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request. Can include language preference using the format 'locale:xx' where xx is the ISO 639-1 language code (e.g., 'locale:eu', 'locale:es', 'locale:en'). Language preference is only supported by +Credentials provider."
                  example: "locale:eu"
                  type: string
                client_assertion_type:
                  description: |-
                    The format of the assertion used for client authentication (private_key_jwt). Must be `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` when authenticating with a signed JWT instead of a client secret.

                    Use together with `client_assertion`. Mutually exclusive with `Authorization: Basic` header.
                  type: string
                  enum:
                    - urn:ietf:params:oauth:client-assertion-type:jwt-bearer
                  example: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
                client_assertion:
                  description: |-
                    A signed JWT used to authenticate the client (private_key_jwt). The JWT must be signed with the client's private key and contain:
                    - `iss`: Client ID
                    - `sub`: Client ID
                    - `aud`: Backchannel authentication endpoint URL
                    - `jti`: Unique identifier
                    - `exp`: Expiration time

                    Use together with `client_assertion_type`. Mutually exclusive with `Authorization: Basic` header.
                  type: string
                  example: "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJjbGllbnRfaWQiLCJzdWIiOiJjbGllbnRfaWQiLCJhdWQiOiJodHRwczovL2F1dGhuLmthcy5tYXNtb3ZpbC5jb20vYmMtYXV0aG9yaXplIiwianRpIjoiYWJjMTIzIiwiZXhwIjoxNzA1MzM0ODA5fQ.signature"
                resource:
                  description: "RFC 8707 — The URI of the resource server where the requested access token will be used. When provided and the client has allowed_resources configured, the issued token's aud claim will be set to this value instead of the default application issuer. Must be an absolute URI without a fragment component."
                  example: "https://api.example.com"
                  type: string
              required:
                - login_hint

      responses:
        "200":
          description: OK
          headers:
            Cache-Control:
              description: The authorization server MUST include the HTTP "Cache-Control"
                response header field with a value of "no-store" in any response
                containing tokens, secrets, or other sensitive information.
              schema:
                type: string
                enum:
                  - no-store
                default: no-store
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/bcAuthorizeResponse"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
  /device-authorize:
    post:
      tags: [Device Code]
      summary: The Device Code Authentication Endpoint 
      description: "The Device Code Authentication Endpoint is used to initiate an out-of-band authentication of the end-user. The client initiates the authorization flow by requesting a set of verification codes from the authorization server by making an HTTP \"POST\" request to the device authorization endpoint."
      operationId: postDeviceCode
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  description: The identifier of the client representing the app.
                  type: string
                scope:
                  description: Scope of permissions
                  type: string
                resource:
                  description: "RFC 8707 — The URI of the resource server where the requested access token will be used. When provided and the client has allowed_resources configured, the issued token's aud claim will be set to this value instead of the default application issuer. Must be an absolute URI without a fragment component."
                  example: "https://api.example.com"
                  type: string
              required:
                - client_id

      responses:
        "200":
          description: OK
          headers:
            Cache-Control:
              description: The authorization server MUST include the HTTP "Cache-Control"
                response header field with a value of "no-store" in any response
                containing tokens, secrets, or other sensitive information.
              schema:
                type: string
                enum:
                  - no-store
                default: no-store
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/deviceCodeAuthorizeResponse"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"

  /oauth/token:
    post:
      tags: [OAuth2]
      summary: Generate an access_token
      description: "Returns an access token that allows request to MasStack APIs."
      operationId: getAccessTokenWithForm
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  description: Grant type of token
                  example: password
                  type: string
                  enum:
                    - authorization_code
                    - password
                    - refresh_token
                    - urn:ietf:params:oauth:grant-type:jwt-bearer
                    - urn:masstack:params:oauth:grant-type:magic-link
                    - urn:masstack:params:oauth:grant-type:passwordless
                    - urn:masstack:params:oauth:grant-type:webauthn
                    - urn:openid:params:grant-type:ciba
                    - urn:ietf:params:oauth:grant-type:device_code
                scope:
                  description: Scope of permissions
                  type: string
                username:
                  description: Username of final customers (required for
                    grant_type=password)
                  example: "usuario@gmail.com"
                  type: string
                password:
                  description: Password of final customers (required for
                    grant_type=password)
                  example: "123456"
                  type: string
                refresh_token:
                  description: Is a signed JWT whose main goal is to obtain a new access_token without repeating customer authentication once the user has an active session.
                  type: string
                state:
                  description: CSRF token used in the authorization request (for authorization_code and implicit flows)
                  type: string
                  example: "OyMh_ObySiyWi7SrXgfIdg"
                code:
                  description: Authorization code (required for authorization_code flow)
                  type: string
                  example: "OyMh_ObySiyWi7SrXgfIdg"
                code_verifier:
                  description: Code challenge value generated by the client in the authorization request (required for authorization_code flow)
                  type: string
                  example: "5VTycQU924SQ3jHp5g9zcvMF2ai3aN89kxzB2D5QJUrejxam3jddqFUugD8F"
                assertion:
                  description: Assertion with which to get an access_token (required for
                    grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer)
                  type: string
                token:
                  description: Magic link token (required for
                    grant_type=urn:masstack:params:oauth:grant-type:magic-link)
                  type: string
                otp:
                  description: One time password token (required for
                    grant_type=urn:masstack:params:oauth:grant-type:passwordless)
                  type: string
                auth_req_id:
                  description: Authentication request ID (required for
                    grant_type=urn:openid:params:grant-type:ciba)
                  example: "d221eb9b-9d33-4fe9-ba41-9711ed0309ce"
                  type: string
                client_id:
                  description: The identifier of the client representing the app. (required for
                    grant_type=urn:ietf:params:oauth:grant-type:device_code)
                  type: string
                device_code:
                  description: Device Code Authentication request ID (required for
                    grant_type=urn:ietf:params:oauth:grant-type:device_code)
                  example: "d221eb9b-9d33-4fe9-ba41-9711ed0309ce"
                  type: string
                subject_token:
                  description: Represents the identity of the party on behalf of whom the token is being requested while the actor_token represents the identity of the party to whom the access rights of the issued token are being delegated. (required for
                    grant_type=urn:ietf:params:oauth:grant-type:token-exchange)
                  type: string
                subject_token_type:
                  description: Indicates the type of the security token in the subject_token parameter (required for
                    grant_type=urn:ietf:params:oauth:grant-type:token-exchange)
                  type: string
                actor_token:
                  description: Represents the identity of the acting party. Typically, this will be the party that is authorized to use the requested security token and act on behalf of the subject. (used for
                    grant_type=urn:ietf:params:oauth:grant-type:token-exchange)
                  type: string
                actor_token_type:
                  description: Indicates the type of the security token in the actor_token parameter. This is REQUIRED when the actor_token parameter is present in the request but MUST NOT be included otherwise. (used for
                    grant_type=urn:ietf:params:oauth:grant-type:token-exchange)
                  type: string
                resource:
                  description: "RFC 8707 — The URI of the resource server where the requested access token will be used. Supported for grant types: password, client_credentials, authorization_code, urn:openid:params:grant-type:ciba, urn:ietf:params:oauth:grant-type:device_code. When provided and the client has allowed_resources configured, the issued token's aud claim will be set to this value instead of the default application issuer. Must be an absolute URI without a fragment component. Not supported for refresh_token (resource from the original grant is preserved) or token-exchange."
                  example: "https://api.example.com"
                  type: string
                client_assertion_type:
                  description: |-
                    The format of the assertion as defined by the authorization server. The value must be urn:ietf:params:oauth:client-assertion-type:jwt-bearer when using JWT client authentication (private_key_jwt).

                    This parameter is used together with client_assertion to authenticate the client using a signed JWT instead of client_secret.
                  type: string
                  enum:
                    - urn:ietf:params:oauth:client-assertion-type:jwt-bearer
                  example: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
                client_assertion:
                  description: |-
                    A single JWT that contains the client authentication information. The JWT must be signed with the client's private key and contain the following claims:
                    - iss: Client ID
                    - sub: Client ID
                    - aud: Token endpoint URL
                    - jti: Unique identifier for the JWT
                    - exp: Expiration time

                    This parameter is used together with client_assertion_type for JWT client authentication (private_key_jwt) as an alternative to Basic authentication.
                  type: string
                  example: "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJjbGllbnRfaWQiLCJzdWIiOiJjbGllbnRfaWQiLCJhdWQiOiJodHRwczovL2F1dGhuLmthcy5tYXNtb3ZpbC5jb20vb2F1dGgvdG9rZW4iLCJqdGkiOiJhYmMxMjMiLCJleHAiOjE3MDUzMzQ4MDl9.signature"
              required:
                - grant_type
      parameters:
        - name: X-User-Agent-Alias
          in: header
          description: Alias of the device obtaining the token
          required: false
          schema:
            type: string
      responses:
        "200":
          description: OK
          headers:
            Cache-Control:
              description: The authorization server MUST include the HTTP "Cache-Control"
                response header field with a value of "no-store" in any response
                containing tokens, secrets, or other sensitive information.
              schema:
                type: string
                enum:
                  - no-store
                default: no-store
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/accessTokenResponse"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
        "403":
          description: Too Many Login Attempts Error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
  /oauth/authorize:
    get:
      tags: [OAuth2]
      summary: Get authentication page
      description: Logs in the user or redirects it to a page to authenticate itself
      operationId: getAuthorizationPage
    
      parameters:
        - name: client_id
          in: query
          description: The identifier of the client representing the app.
          required: true
          example: TtsdmebPcQtEnvLsKw7x
          schema:
            type: string
        - name: response_type
          in: query
          description: Which in a basic authorization code flow request should be code. Authn only support code
          required: true
          example: token
          schema:
            type: string
            enum:
              - token
              - code
        - name: redirect_uri
          in: query
          required: false
          description: Should be the HTTP endpoint on your server that will receive the response from Authn. The value must exactly match one of the authorized redirect URIs for the OAuth 2.0 client, which you configured in the register of application. If this value doesn't match an authorized URI, the request will fail with a 401 error.
          example: https://masmovil.com/login/callback
          schema:
            type: string
        - name: state
          in: query
          required: true
          description: Should include the value of the anti-forgery unique session token, as well as any other information needed to recover the context when the user returns to your application, e.g., the starting URL.
          example: 0AxLygT73V6kreKzkQySOjfYShIvK/TR
          schema:
            type: string
        - name: login_hint
          in: query
          required: false
          description: If your application knows which user is trying to authenticate, it can use this parameter to provide a hint to the Authentication Server. The server uses the hint to simplify the login flow either by prefilling the email field in the sign-in form or by selecting the appropriate multi-login session.
          example: my_user@masmovil.com
          schema:
            type: string
        - name: groups_hint
          in: query
          required: false
          description: The sub string is equivalent to the groups in the provider (only support Google ). If you do not provide a groups_hint and the user is currently logged in, in the next request of token, the access_token will not contain claim groups
          example: group1+group2
          schema:
            type: string
        - name: access_type
          in: query
          required: false
          description: The allowed values are offline and online. If an access token is being requested, the client does not receive a refresh token unless a value of offline is specified.
          example: online
          schema:
            type: string
        - name: code_challenge
          in: query
          required: false
          description: Specifies an encoded code_verifier that will be used as a server-side challenge during authorization code exchange. This string helps mitigating against the threat usually through the use of Proof Key for Code Exchange (PKCE)
          example: 5VTycQU924SQ3jHp5g9zcvMF2ai3aN89kxzB2D5QJUrejxam3jddqFUugD8F
          schema:
            type: string
        - name: code_challenge_method
          in: query
          required: false
          description: Specifies what method was used to encode a code_verifier that will be used during authorization code exchange. This parameter must be used with the code_challenge parameter. The value of the code_challenge_method defaults to plain if not present in the request that includes a code_challenge. The only supported values for this parameter are S256 or plain.
          example: S256
          schema:
            type: string
        - name: resource
          in: query
          required: false
          description: "RFC 8707 — The URI of the resource server where the requested access token will be used. When provided and the client has allowed_resources configured, the issued token's aud claim will be set to this value instead of the default application issuer. The value is bound to the authorization code and carried through to the token response. Must be an absolute URI without a fragment component."
          example: "https://api.example.com"
          schema:
            type: string
      responses:
        "302":
          description: Authorization code/Implicit grant response
          headers:
            Location:
              description: The redirect uri of the client
              schema:
                type: string
        "400":
          description: Bad Request
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
        "401":
          description: Unauthorized
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
  /oauth/logout:
    get:
      tags: [OAuth2]
      summary: Logout endpoint
      description: Logout the user
      operationId: getLogout
      parameters:
        - name: client_id
          in: query
          description: The identifier of the client representing the app.
          required: false
          example: TtsdmebPcQtEnvLsKw7x
          schema:
            type: string
        - name: continue
          in: query
          description: The url to be redirected to after logout.
          required: false
          example: https://grupomasmovil.com/es/
          schema:
            type: string
        - name: scope
          in: query
          description: If the value is all, it will delete all the user's sessions and refresh_tokens that it has.
          required: false
          example: all
          schema:
            type: string
      responses:
        "302":
          description: Logout response
          headers:
            Location:
              description: The redirect to post_logout_redirect_uri of the client
              schema:
                type: string
        "400": 
          description: Bad Request
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
        "401":
          description: Unauthorized
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
    post:
      security:
        - basicAuth: []
      tags: [OAuth2]
      summary: Logout endpoint by API
      description: Logout the user
      operationId: postLogout
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/logoutRequest'
        required: true
      responses:
        "204":
          description: Logout response
          headers:
            Location:
              description: The request has been processed
              schema:
                type: string
        "400": 
          description: Bad Request
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
        "401":
          description: Unauthorized
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"

  /oauth/revoke:
    post:
      security:
        - basicAuth: []
      tags: [OAuth2]
      summary: Token Revocation (RFC 7009)
      description: |-
        Revokes a previously obtained refresh or access token according to RFC 7009.

        This endpoint is fully RFC 7009 compliant:
        - Returns 200 OK even for invalid tokens (prevents information disclosure)
        - Idempotent operation (safe to retry)
        - When revoking a refresh token, associated access tokens are automatically blacklisted

        **Security Note**: Per RFC 7009 Section 2.2, this endpoint returns 200 OK
        for all tokens (valid, invalid, expired, or belonging to other clients) to
        prevent information disclosure attacks.
      operationId: postRevoke
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/revokeRequest'
        required: true
      responses:
        "200":
          description: |-
            Token successfully revoked or token was already invalid/revoked.

            Per RFC 7009, this endpoint always returns 200 OK to prevent
            information disclosure about token validity or ownership.
        "400":
          description: Bad Request (missing required parameters)
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
        "401":
          description: Unauthorized (invalid client credentials)
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"


  "/tokeninfo":
    post:
      tags: [TokenInfo]
      summary: check token claims
      operationId: getTokenInfo
      description: >
        This endpoint returns a 200 status code and token claims when the token is correct and is not expired.
        Also provides a claims JSON as response.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/tokenInfoRequest'
        required: true
      responses:
        "200":
          description: Correct token
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/tokenClaims"
        "400":
          description: invalid_token

  "/magiclink":
    get:
      security:
        - basicAuth: []
      tags: [Magic Links]
      summary: Retrieve access_token via magic link
      operationId: getMagicLink
      description: >
        This endpoint returns a 200 status code and in its body an access_token and refresh_token.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/accessTokenResponse"
        "400":
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/errorAccessTokenResponse"

  /.well-known/jwks.json:
    get:
      tags: [OAuth2]
      summary: URL of the OP JSON Web Key Set [JWK] document
      operationId: getJwks
      description: >
        This contains the signing key(s) the RP uses to validate signatures from
        the OP. The JWK Set MAY also contain the Server's encryption key(s),
        which are used by RPs to encrypt requests to the Server. When both
        signing and encryption keys are made available, a use (Key Use)
        parameter value is REQUIRED for all keys in the referenced JWK Set to
        indicate each key's intended usage. Although some algorithms allow the
        same key to be used for both signatures and encryption, doing so is NOT
        RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to
        provide X.509 representations of keys provided. When used, the bare key
        values MUST still be present and MUST match those in the certificate.
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/jwks"
  /.well-known/openid-configuration:
    get:
      tags: [OAuth2]
      summary: URL of list of the OpenID/OAuth endpoints
      operationId: getOpenidConfiguration
      description: >
        This URL returns a JSON listing of the OpenID/OAuth endpoints, 
        supported scopes and claims, public keys used to sign the tokens, 
        and other details. The clients can use this information to construct a request to the OpenID server. 
        The field names and values are defined in the OpenID Connect Discovery Specification
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/openid-configuration"

servers:
  - url: https://authn.masstack.com/v1/
    description: production
  - url: https://authn.sta.masstack.com/v1/
    description: staging

components:
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
  schemas:
    WebAuthnRegistrationRequest:
      type: object
      properties:
        username:
          type: string
        user_verification:
          type: string
        attestation:
          type: string
        attachment:
          type: string
        algorithms:
          type: array
          items:
            type: string
        discoverable_credential:
          type: string

    WebAuthnRegistrationResponse:
      type: object
      properties:
        rp:
          type: object
          properties:
            name:
              type: string
            id:
              type: string
        user:
          type: object
          properties:
            name:
              type: string
            displayName:
              type: string
            id:
              type: string
        challenge:
          type: string
        pubKeyCredParams:
          type: array
          items:
            type: object
            properties:
              type:
                type: string
              alg:
                type: integer
        timeout:
          type: integer
        authenticatorSelection:
          type: object
          properties:
            requireResidentKey:
              type: boolean
            userVerification:
              type: string
    WebAuthnVerifyRequest:
      type: object
      properties:
        username:
          type: string
        response:
          type: object
          properties:
            id:
              type: string
            rawId:
              type: string
            response:
              type: object
              properties:
                attestationObject:
                  type: string
                clientDataJSON:
                  type: string
                transports:
                  type: array
                  items:
                    type: string
                publicKeyAlgorithm:
                  type: integer
                publicKey:
                  type: string
                authenticatorData:
                  type: string
              required:
                - attestationObject
                - clientDataJSON
                - transports
                - publicKeyAlgorithm
                - publicKey
                - authenticatorData
            type:
              type: string
            clientExtensionResults:
              type: object
            authenticatorAttachment:
              type: string

    WebAuthnVerifyResponse:
      type: object
      properties:
        verified:
          type: boolean

    WebAuthnAuthenticationOptionsRequest:
      type: object
      properties:
        username:
          type: string
        user_verification:
          type: string

    WebAuthnAuthenticationOptionsResponse:
      type: object
      properties:
        challenge:
          type: string
        timeout:
          type: integer
        rpId:
          type: string
        allowCredentials:
          type: array
          items:
            type: object
            properties:
              type:
                type: string
              id:
                type: string
              transports:
                type: array
                items:
                  type: string
        userVerification:
          type: string

    WebAuthnAuthenticationVerificationRequest:
      type: object
      properties:
        username:
          type: string
        response:
          type: object
          properties:
            id:
              type: string
            rawId:
              type: string
            response:
              type: object
              properties:
                authenticatorData:
                  type: string
                clientDataJSON:
                  type: string
                signature:
                  type: string
                userHandle:
                  type: string
              required:
                - authenticatorData
                - clientDataJSON
                - signature
              additionalProperties: false
            type:
              type: string
            clientExtensionResults:
              type: object
            authenticatorAttachment:
              type: string
          required:
            - id
            - rawId
            - response
            - type
          additionalProperties: false
      required:
        - username
        - response
      additionalProperties: false

    # Response Schema
    WebAuthnAuthenticationVerificationResponse:
      type: object
      properties:
        access_token:
          type: string
        expires_in:
          type: integer
        refresh_token:
          type: string
        token_type:
          type: string
      required:
        - access_token
        - expires_in
        - refresh_token
        - token_type
      additionalProperties: false

    accessTokenResponse:
      type: object
      required:
        - access_token
        - token_type
      properties:
        access_token:
          type: string
          description: A token used by the client to make authenticated requests on behalf
            of the resource owner
          example: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1VTkJaNa0ZGTWtKQlFqVkRPVFV4TlVWQ04wRTRPVEV5UWpGRFJFSTFNMFZEUXpBMU1UVTVNQSJ9.eyJpc3MiOiJodHRwczovL21hc21vdmlsLmV1LmF1dGgwLmNvbS8iLCJzdWIiOiJNN3A0YWUyeVdIN1N5bXdiVVlHcTJVdXdlVmp6WE5PR0BjbGllbnRzIiwiYXVkIjoiaHR0cHM6Ly9tYXNtb3ZpbC5ldS5hdXRoMC5jb20vYXBpL3YyLyIsImlhdCI6MTU1MDQyMDM3NywiZXhwIjoxNTUwNTA2Nzc3LCJhenAiOiJNN3A0YWUyeVdIN1N5bXdiVVlHcTJVdXdlVmp6WE5PRyIsInNjb3BlIjoicmVhZDpjbGllbnRfZ3JhbnRzIGNyZWF0ZTpjbGllbnRfZ3JhbnRzIGRlbGV0ZTpjbGllbnRfZ3JhbnRzIHVwZGF0ZTpjbGllbnRfZ3JhbnRzIHJlYWQ6dXNlcnMgdXBkYXRlOnVzZXJzIGRlbGV0ZTp1c2VycyBjcmVhdGU6dXNlcnMgcmVhZDp1c2Vyc19hcHBfbWV0YWRhdGEgdXBkYXRlOnVzZXJzX2FwcF9tZXRhZGF0YSBkZWxldGU6dXNlcnNfYXBwX21ldGFkYXRhIGNyZWF0ZTp1c2Vyc19hcHBfbWV0YWRhdGEgY3JlYXRlOnVzZXJfdGlja2V0cyByZWFkOmNsaWVudHMgdXBkYXRlOmNsaWVudHMgZGVsZXRlOmNsaWVudHMgY3JlYXRlOmNsaWVudHMgcmVhZDpjbGllbnRfa2V5cyB1cGRhdGU6Y2xpZW50X2tleXMgZGVsZXRlOmNsaWVudF9rZXlzIGNyZWF0ZTpjbGllbnRfa2V5cyByZWFkOmNvbm5lY3Rpb25zIHVwZGF0ZTpjb25uZWN0aW9ucyBkZWxldGU6Y29ubmVjdGlvbnMgY3JlYXRlOmNvbm5lY3Rpb25zIHJlYWQ6cmVzb3VyY2Vfc2VydmVycyB1cGRhdGU6cmVzb3VyY2Vfc2VydmVycyBkZWxldGU6cmVzb3VyY2Vfc2VydmVycyBjcmVhdGU6cmVzb3VyY2Vfc2VydmVycyByZWFkOmRldmljZV9jcmVkZW50aWFscyB1cGRhdGU6ZGV2aWNlX2NyZWRlbnRpYWxzIGRlbGV0ZTpkZXZpY2VfY3JlZGVudGlhbHMgY3JlYXRlOmRldmljZV9jcmVkZW50aWFscyByZWFkOnJ1bGVzIHVwZGF0ZTpydWxlcyBkZWxldGU6cnVsZXMgY3JlYXRlOnJ1bGVzIHJlYWQ6cnVsZXNfY29uZmlncyB1cGRhdGU6cnVsZXNfY29uZmlncyBkZWxldGU6cnVsZXNfY29uZmlncyByZWFkOmVtYWlsX3Byb3ZpZGVyIHVwZGF0ZTplbWFpbF9wcm92aWRlciBkZWxldGU6ZW1haWxfcHJvdmlkZXIgY3JlYXRlOmVtYWlsX3Byb3ZpZGVyIGJsYWNrbGlzdDp0b2tlbnMgcmVhZDpzdGF0cyByZWFkOnRlbmFudF9zZXR0aW5ncyB1cGRhdGU6dGVuYW50X3NldHRpbmdzIHJlYWQ6bG9ncyByZWFkOnNoaWVsZHMgY3JlYXRlOnNoaWVsZHMgZGVsZXRlOnNoaWVsZHMgdXBkYXRlOnRyaWdnZXJzIHJlYWQ6dHJpZ2dlcnMgcmVhZDpncmFudHMgZGVsZXRlOmdyYW50cyByZWFkOmd1YXJkaWFuX2ZhY3RvcnMgdXBkYXRlOmd1YXJkaWFuX2ZhY3RvcnMgcmVhZDpndWFyZGlhbl9lbnJvbGxtZW50cyBkZWxldGU6Z3VhcmRpYW5fZW5yb2xsbWVudHMgY3JlYXRlOmd1YXJkaWFuX2Vucm9sbG1lbnRfdGlja2V0cyByZWFkOnVzZXJfaWRwX3Rva2VucyBjcmVhdGU6cGFzc3dvcmRzX2NoZWNraW5nX2pvYiBkZWxldGU6cGFzc3dvcmRzX2NoZWNraW5nX2pvYiByZWFkOmN1c3RvbV9kb21haW5zIGRlbGV0ZTpjdXN0b21fZG9tYWlucyBjcmVhdGU6Y3VzdG9tX2RvbWFpbnMgcmVhZDplbWFpbF90ZW1wbGF0ZXMgY3JlYXRlOmVtYWlsX3RlbXBsYXRlcyB1cGRhdGU6ZW1haWxfdGVtcGxhdGVzIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIn0.h6GTIB8OMcMXDxyUzUW8tJ8LW7U_yIQfCshDuOW9E-_rd9NNRBxzsPhVHllawcB336Xfo3kwrVmS0KdkLGWz4BJo67R_4KXjQ_1VcmHD2WfzpS06fmjdV1DWZbd5dv3LBtPXEIYxWVzFSUcAlIKo5cstYlUWvb1weh56yBu26Y48UK5CIjwLmqAtlxL3kNcMI_PPuM-UmiQPeNe8cKPN4c7Tf_aVw38DcGydY53GIJ_fTeRvB5kb9CO4bs6g4iWOFZFFuLAluRFZsKcqJwNdW1RDYB_blmva5Q8JrBeU5TkbfdrWIL2QfdD93hjLFcWgE9z6txUz5opW2qkcMoQkLA
        scope:
          type: string
          description: Scopes
          example: read:client_grants create:client_grants delete:client_grants
            update:client_grants
        expires_in:
          type: integer
          example: 86400
        token_type:
          type: string
          example: Bearer
        refresh_token:
          type: string
          description: A token used by the client to obtain a new access token without
            having to involve the resource owner.
          example: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1VTkJNa0ZGTWtKQlFqVkRPVFV4TlVWQ04wRTRPVEV5UWpGRFJFSTFNMFZEUXpBMU1UVTVNQSJ9
    
    bcAuthorizeResponse:
      type: object
      required:
        - auth_req_id
        - expires_in
        - interval
      properties:
        auth_req_id:
          type: string
          description: REQUIRED. This is a unique identifier to identify the authentication request made by the Client.
          example: d221eb9b-9d33-4fe9-ba41-9711ed0309ce
        expires_in:
          type: integer
          description: The duration in seconds for which the authentication request is valid.
          example: 360
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client SHOULD wait between polling to check if the authentication request has been completed.
          example: 60

    deviceCodeAuthorizeResponse:
      type: object
      required:
        - device_code
        - user_code
        - verification_uri
        - qr_code
        - expires_in
      properties:
        device_code:
          type: string
          description: REQUIRED. The unique code used for device verification.
          example: "817c6cf8-0adc-4e61-bc58-5c6de63af808"
        user_code:
          type: string
          description: REQUIRED. The human-readable user code to be displayed to the user.
          example: "RKNG-ZGXR"
        verification_uri:
          type: string
          description: REQUIRED. The end-user verification URI on the authorization server.  The URI should be short and easy to remember as end users will be asked to manually type it into their user agent.
          example: "https://authn.masstack.com/v1/device"
        verification_uri_complete:
          type: string
          description: A verification URI that includes the \"user_code\" (or other information with the same function as the \"user_code\"), which is designed for non-textual transmission.
          example: "https://authn.masstack.com/v1/device?user_code=RKNG-ZGXR"
        qr_code:
          type: string
          description: REQUIRED. The base64 encoded QR code image data.
          example: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAEQ0lEQVR4nOyd0aojSwgAk8v8/y/nvvYJOOiqc+pA1dvuTjqzKQSxbfv6fF4C4nq93u/5Zac0R+92rl99/8y7nWtGz+/8bv/NLyodFAJDITAUAkMhMK6ff+xkR5msI5O9TH1XZ/0oi4vWnPu/GCEwFAJDITAUAkMhMK74n6YymShLydSpMn8frVOtR23X307i7zJCYCgEhkJgKASGQmDcZFkbZDKuzDOdmlImK6uuOYcRAkMhMBQCQyEwFALj4Syrkx1lMq5MpsRuDTRCYCgEhkJgKASGQmDcZFkb2UgnO5qqQXVqZRl6v5sRAkMhMBQCQyEwFALjK8vaODd30qlHddaZ6k7fP29ohMBQCAyFwFAIDIXAeO/vn3UykE63fAZGL9aJEQJDITAUAkMhMBQC4/35dGpKEZ0u9Ck6O4aZNXd+HyMEhkJgKASGQmAoBMY111UesVHL6nxvJ7OqPlOfMmGEwFAIDIXAUAgMhcBIzsuqdqFnzhJ25mVNzdqa6hM76a1jhMBQCAyFwFAIDIXAGDxjOJXJTGU7U53qT9bTvGEHh0JgKASGQmAoBMZXX9ZJNcuaOou3cc/gxtnA6pq539MIgaEQGAqBoRAYCoFxc4/hVI/WVLZT3al88pbnzu7qibUsHAqBoRAYCoGhEBg33e8RmZ2+6PkMGzdBb8zO2pliaoTAUAgMhcBQCAyFwLjmajudGk60TuazU3WkzPtsTzc1QnAoBIZCYCgEhkJgJCc5REzNj8qwcU5w47OZdz6x+x2NQmAoBIZCYCgExk0tq9Nh3slqqkzdbxh9ttPlXs88jRAYCoGhEBgKgaEQGMnu92p3+vYNNU+eVayu3zs1YITAUAgMhcBQCAyFwLiZl3WyUWvqrJPJcLZvi96ZFGGEwFAIDIXAUAgMhcC4mZfVoTPVIfP89o0/U31ZmeetZaFRCAyFwFAIDIXAuNkxzLAxHXR75+7Jewwz72P3OxqFwFAIDIXAUAiM5I5hhk5Ws3Fv4NQu3saNPNay/gwKgaEQGAqBoRAYyduiM0zNdd+oNUXPV7Og7XOLRggOhcBQCAyFwFAIjH+oZXV26KLnq98VsbE72bn9p951b4TAUAgMhcBQCAyFwLhy0z4zbPRcVXchCXO9OjPq7cvCoRAYCoGhEBgKgTF4w85Jppb1W/1a0frRZzvr1z9rhMBQCAyFwFAIDIXAaJ4xPHny7sLMZ5/s7+pgLQuNQmAoBIZCYCgERrP7farzvPr8b92Ss1FP+4kRAkMhMBQCQyEwFAJjcJJDlY0Mrdp13+njmtrNPLGWhUMhMBQCQyEwFALj4SxrY/ZUtH6nDjY11aF+9tAIgaEQGAqBoRAYCoFxk2VN9R1t1IJOqmvOTV2ore+8rD+JQmAoBIZCYCgExleWtXHecKr7vdrl3qkpdTr5q+t7xhCNQmAoBIZCYCgExnuqgiMz/B8AAP//+pvzsRrwE2EAAAAASUVORK5CYII="
        expires_in:
          type: integer
          description: REQUIRED. The lifetime in seconds of the "device_code" and "user_code"
          example: 360
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client SHOULD wait between polling requests to the token endpoint.  If no value is provided, clients MUST use 5 as the default.
          example: 60
    
    tokenClaims:
      type: object
      required:
        - tid
        - cid
        - scope
      properties:
        tid:
          type: string
          description: tid
          example: 97c1a3c5-839f-4245-b32c-3292352faf66
        cid:
          type: string
          description: cid
          example: 5H3ui5FBKtPQraqPYpXD
        scope:
          type: string
          description: Scopes
          example: api:everything
        strength:
          type: string
          description: describes token level of security 
          example: amboto
        exp:
          type: integer
          example: 3500
        aud:
          type: string
          example: devops.auth.masmovil.com
        iat:
          type: string
          description: issued at
          example: 3500
        iss:
          type: integer
          description: http://localhost:6040
          example: 3500
        sub:
          type: string
          description: subject
          example: AE0001
        preferred_username:
          type: string
          description: user_name
          example: ae0001
        tenants:
          type: string
          example: v1::1
        tenants_translation:
          type: array
          items:
            type: object
            properties:
              tenant_id:
                type: string
                description: Internal id
                example: "15"
              org:
                type: string
                description: public name
                example: "yoigo"
        groups:
          type: string
          example: agent
        roles:
          type: string
          example: XSELLING RETENCION
        permissions:
          type: string
        family_name:
          type: string
        given_name:
          type: string
        require_password_change:
          type: boolean
        business:
          type: object
          description: Optional business-specific data associated with the token
          nullable: true
      
    errorAccessTokenResponse:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          description: A single error code
          example: invalid_request
          enum:
            - invalid_request
            - access_denied
            - invalid_client
            - invalid_grant
            - unauthorized_client
            - unauthorized_grant_type
            - invalid_scope
            - invalid_target
            - error_description
            - error_uri
        error_description:
          type: string
          description: A human-readable text providing additional information, used to
            assist in the understanding and resolution of the error occurred
        error_uri:
          type: string
    goError:
      type: object
      required:
        - id
        - status
      properties:
        id:
          type: string
          description: Unique identifier of error
          example: MM0000001
        status:
          type: integer
          description: Status code of the response
          example: 400
        msg:
          type: string
          description: Final user message
          example: Invalid inbound entit
        componentMsg:
          type: string
          description: Technical message
          example: EOF. Inbound application malformed
        sentryCode:
          type: string
          description: Unique identifier to use in sentry
          example: fake-req-id
  
    tokenInfoRequest:
      type: object
      properties:
        access_token:
          type: string
          description: A valid access token provided by authn
          example: "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE2MjM4MzU4OTEsImV4cCI6MTY1NTM3MTg5MSwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIkdpdmVuTmFtZSI6IkpvaG5ueSIsIlN1cm5hbWUiOiJSb2NrZXQiLCJFbWFpbCI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJSb2xlIjpbIk1hbmFnZXIiLCJQcm9qZWN0IEFkbWluaXN0cmF0b3IiXX0.oSm7gu7N4ypkz0e7W-hyOTozX2AUEZ_YacSoYqMkyLs"
      required:
        - access_token
    logoutRequest:
      type: object
      properties:
        token:
          type: string
          description: A valid token (access_token or refresh_token) provided by authn
          example: "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE2MjM4MzU4OTEsImV4cCI6MTY1NTM3MTg5MSwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIkdpdmVuTmFtZSI6IkpvaG5ueSIsIlN1cm5hbWUiOiJSb2NrZXQiLCJFbWFpbCI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJSb2xlIjpbIk1hbmFnZXIiLCJQcm9qZWN0IEFkbWluaXN0cmF0b3IiXX0.oSm7gu7N4ypkz0e7W-hyOTozX2AUEZ_YacSoYqMkyLs"
        scope:
          type: string
          description: If the value is all, it will delete all the user's sessions and refresh_tokens that it has.
          example: "all"
      required:
        - access_token
    revokeRequest:
      type: object
      properties:
        token:
          type: string
          description: The token that the client wants to revoke (access_token or refresh_token)
          example: "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjVmYjkyOWE5LWZiMTktNDdjYy04ZWI4LTEwZjZmMzkwNzlhMiJ9..."
        token_type_hint:
          type: string
          description: |-
            A hint about the type of the token submitted for revocation.

            Possible values:
            - `access_token`: Indicates the token is an OAuth 2.0 access token
            - `refresh_token`: Indicates the token is an OAuth 2.0 refresh token

            This parameter is optional but helps optimize token lookup performance.
            If not provided, the server will automatically determine the token type.
          example: "refresh_token"
          enum:
            - access_token
            - refresh_token
      required:
        - token
    openid-configuration:
      type: object
      properties:
        token_endpoint:
          type: string
          example: "https://authn.k8s.masmovil.com/oauth/token"
        token_endpoint_auth_methods_supported:
          type: array
          items:
            type: string
            enum:
              - client_secret_post
              - client_secret_basic
              - private_key_jwt
            example:
              - client_secret_post
              - client_secret_basic
              - private_key_jwt
        jwks_uri:
          type: string
          example: "https://authn.k8s.masmovil.com/.well-known/jwks.json"
        response_modes_supported:
          type: array
          items:
            type: string
            enum:
              - query 
              - fragment
              - form_post
            example:
              - query 
              - fragment
              - form_post
        subject_types_supported:
          type: array
          items:
            type: string
            enum:
              - public 
            example:
              - public 
        id_token_signing_alg_values_supported:
          type: array
          items:
            type: string
            enum:
              - RS256 
            example:
              - RS256 
        response_types_supported:
          type: array
          items:
            type: string
            enum:
              - code 
              - token 
            example:
              - code 
              - token 
        scopes_supported:
          type: array
          items:
            type: string
            enum:
              - openid 
              - profile 
              - email 
              - offline_access 
            example:
              - openid 
              - profile 
              - email 
              - offline_access 
        issuer:
          type: string
          example: "{appName}.auth.masmovil.com"
        request_uri_parameter_supported:
          type: boolean
          example: false
        userinfo_endpoint:
          type: string
          example: ""
        authorization_endpoint:
          type: string
          example: "https://authn.k8s.masmovil.com/oauth/authorize"
        http_logout_supported:
          type: boolean
          example: false
        frontchannel_logout_supported:
          type: boolean
          example: false
        end_session_endpoint:
          type: string
          example: ""
        claims_supported:
          type: array
          items:
            type: string
            enum:
              - aud
              - cid
              - exp
              - iat
              - iss
              - tenant
              - scopes
              - sub
              - tid
              - user_metadata
              - app_metadata
              - given_name
              - family_name
              - name
            example:
              - aud
              - cid
              - exp
              - iat
              - iss
              - tenant
              - scope
              - sub
              - tid
              - user_metadata
              - app_metadata
              - given_name
              - family_name
              - name

    jwk:
      type: object
      required:
        - keys
      properties:
        alg:
          type: string
          description: The "alg" (algorithm) member identifies the algorithm intended for
            use with the key
          example: RS256
        kty:
          type: string
          description: The "kty" (key type) member identifies the cryptographic algorithm
            family used with the key, such as "RSA" or "EC". "kty" values should
            either be registered in the IANA JSON Web Key Types registry defined
            in [JWA] or be a value that contains a Collision-Resistant
            Name.  The "kty" value is a case-sensitive string.
          example: RSA
        use:
          type: string
          description: The "use" (public key use) member identifies the intended use of the
            public key.  The "use" parameter is employed to indicate whether a
            public key is used for encrypting data or verifying the signature on
            data.
          enum:
            - sig
            - enc
          example: sig
        x5c:
          type: array
          items:
            type: string
          description: The "x5c" (X.509 Certificate Chain) member contains a chain of one
            or more PKIX certificates [RFC5280].  The certificate chain is
            represented as a JSON array of certificate value strings.  Each
            string in the array is a base64 encoded ([RFC4648] Section 4 -- not
            base64url encoded) DER [ITU.X690.1994] PKIX certificate value
          example:
            - MIIDBTCCAe2gAwIBAgIJMg1BS/K2xovDMA0GCSqGSIb3DQEBCwUAMCAxHjAcBgNVBAMTFW1hc21vdmlsLmV1LmF1dGgwLmNvbTAeFw0xODA0MjcwNzQ5MjFaFw0zMjAxMDQwNzQ5MjFaMCAxHjAcBgNVBAMTFW1hc21vdmlsLmV1LmF1dGgwLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALRLXzvNzYGhvXUVefnrw+2+5k/J5PkSiv3dpbQjJB/kM3uPPVa/+qiy9gvcZbSkeN+Z6D3+fTcIW+xdWuiIj8kiBGLpHCjPz5ybaTq87uvx2KfEqx+T/Q7z9...
        n:
          type: string
          example: tEtfO83NgaG9dRV5-evD7b7mT8nk-RKK_d2ltCMkH-Qze489Vr_6qLL2C9xltKR435noPf59Nwhb7F1a6IiPySIEYuk...
        e:
          type: string
          example: AQAB
        kid:
          type: string
          description: The "kid" (key ID) member is used to match a specific key.  This is
            used, for instance, to choose among a set of keys within a JWK Set
            during key rollover
          example: MUNBMkFFMkJBQjVDOTUxNUVCN0E4OTEyQjFDREI1M0VDQzA1MTU5MA
        x5t:
          type: string
          description: The "x5t" (X.509 Certificate SHA-1 Thumbprint) member is a base64url
            encoded SHA-1 thumbprint (a.k.a. digest) of the DER encoding of an
            X.509 certificate [RFC5280].
          example: MUNBMkFFMkJBQjVDOTUxNUVCN0E4OTEyQjFDREI1M0VDQzA1MTU5MA
    jwks:
      type: object
      required:
        - keys
      properties:
        keys:
          type: array
          description: The JSON object MUST have a "keys" member, which is an array of JWKs.
          items:
            $ref: "#/components/schemas/jwk"
            