swagger.clean.yaml

openapi: 3.0.0
info:
  version: 1.0.0
  title: UEAuth Service
  description: "UEAuth is provided by <a href='https://unitedeffects.com'>United Effects Inc</a>. Copyright &#169; 2024, all rights reserved.<br><br>
  As a general reference, this provider implements the following OIDC endpoints. All OpenID Connect schema specific endpoints follow the pattern <code>/{group}/path</code>.<br>UE Auth identity and access endpoints follow the pattern <code>/api/{group}/path</code>. Full documentation on the OpenID Connect specification can be found here: <a href='https://openid.net/developers/specs/'>OIDC API DOCUMENTATION</a>.<br><code><br>authorization: '/{group}/auth',<br>
  check_session: '/{group}/session/check',<br>
  code_verification: '/{group}/device',<br>
  device_authorization: '/{group}/device/auth',<br>
  end_session: '/{group}/session/end',<br>
  introspection: '/{group}/token/introspection',<br>
  initial_access: '/{group}/token/initial_access',<br>
  jwks: '/{group}/jwks',<br>
  pushed_authorization_request: '/{group}/request',<br>
  registration: '/{group}/reg',<br>
  revocation: '/{group}/token/revocation',<br>
  token: '/{group}/token',<br>
  userinfo: '/{group}/me'</code><br><br>
  <small>Not all of the above endpoints are detailed with contracts in this API documentation. Please reference the <a href='https://openid.net/developers/specs/'>OIDC</a> docs for any path specs not shown.</small><br><br>
  <h2>Query and Patch Standards</h2>This API uses <a href='https://www.odata.org/documentation/'>oData</a> and <a href='http://jsonpatch.com/'>JSON Patch</a> as standards for most paginated GET and PATCH methods. You may wish to review these standards."
  x-logo:
    url: https://ue-platform-content.s3.amazonaws.com/0f8aeec8-8e9b-4629-b06c-6672b4a2e9ad
tags:
  - name: OIDC
    description: Some Key OIDC endpoints (not all) - see <a href='https://openid.net/developers/specs/'>OIDC API DOCUMENTATION</a>
  - name: Users
    description: User Accounts unique to the Auth Group. Email must be unique
  - name: Profiles
    description: Secured Account Profiles
  - name: Profile Requests
    description: Request access to someone's profile data
  - name: Profile Access
    description: View access you have or have granted to secured profiles
  - name: Clients
    description: Reading or Deleting Clients in your Auth Group. User OIDC /reg for Create or Updates
  - name: Account Dashboard
    description: Manage personal account notifications, organizations, products, and more
  - name: Client Access
    description: Clients can be supplied with a single product reference and multiple roles to empower them with permissions
  - name: Product Keys
    description: (WARNING - BETA) Create and manage groupings of long-lived and hidden client-credential tokens that can be used to create marketplace style integrations
  - name: Validate Access
    description: Use this endpoint to return the access associated to an accessToken or clientCredential
  - name: Products
    description: Manage Products within your Auth Group
  - name: Roles
    description: Manage Roles globally for all Products and all Organizations
  - name: Permissions
    description: Manage Permissinos for one Product at a time.
  - name: Notification
    description: Manage notifications sent to the http notification plugin. Requires the Notifications plugin to be enabled.
  - name: Device Challenge
    description: Manage device MFA/Challenge/Sign-on interactions. Requires the MFA Challenge plugin to be enabled.
  - name: WebAuthN
    description: Manage WebAuthN (passkey) interactions. Requires the WebAuthN plugin to be enabled.
  - name: Operations
    description: Commands for Artifact or Security Updates
  - name: Organizations
    description: Manage subsets of the Auth Group data to represent customers, departments, etc. Apply Products to indicate licensed software
  - name: Organization Users & Access
    description: Managing enterprise access being applied to users
  - name: Organization User Profiles
    description: Personal information (name, address, number) added and only accessible by the Organization and referenced Account
  - name: Organization Notification
    description: Manage notifications within the context of an Organization. Requires the plugin to be enabled.
  - name: Organization Domains
    description: Separate an Organization into smaller subsets to which product access can be assigned
  - name: Organization Products
    description: Access products associated to your Organization
  - name: Organization Permissions
    description: Access permissions of products associated to your Organization
  - name: Organization Roles
    description: Manage Roles specific to a single organization. Sometimes referred to as "Custom Roles"
  - name: System

paths:

  # Device Challenge
  /api/{group}/mfa/callback:
    post:
      tags:
        - Device Challenge
      summary: Callback used by provider to communicate user approval or denial of challenge
      description: When configuring an MFA provider, you will likely need to provide a callback uri.
      operationId: mfaCallback
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '204':
          description: callback accepted
        '400':
          $ref: '#/components/responses/BadRequest'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/callbackRequest'

  /api/{group}/mfa/{key}/account/{account}/interaction/{uid}/status:
    get:
      tags:
        - Device Challenge
      summary: Poll UE Auth for a response to a challenge.
      description: You can poll UE Auth for the response to a challenge sent to a user.
      operationId: mfaStatus
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: key
          in: path
          description: the providerKey (id) returned by the challenge request
          schema:
            type: string
          required: true
        - name: account
          in: path
          description: the account Id being challenged
          schema:
            type: string
          required: true
        - name: uid
          in: path
          description: the interaction Id or state used to ensure secure interaction
          schema:
            type: string
          required: true
      responses:
        '204':
          description: approved
        '206':
          description: not yet approved
        '400':
          $ref: '#/components/responses/BadRequest'

  /api/{group}/mfa/instructions:
    post:
      tags:
        - Device Challenge
      summary: Request an account be bound and instructions for device setup be provided
      description: This API is multi-purpose, responding to a request based on which properties have been provided. See request object for details.
      operationId: mfaInstructions
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/mfaInstructions'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '427':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - basic: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/mfaRequestBind'
        required: true

  /api/{group}/mfa/safe-recovery:
    post:
      tags:
        - Device Challenge
      summary: Request to verify your identity via email or an existing MFA device
      description: This API allows a user to validate who they are through email or a challenge. This is used as part of MFA recovery when the user wants to bind to a new device. Security on this is an initial access token as provided by the instructions endpoint.
      operationId: mfaSafeRecovery
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/mfaSafeRecovery'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '427':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/sendMfaSafeRecovery'
        required: true

  /api/{group}/device/challenge:
    put:
      tags:
        - Device Challenge
      summary: BETA - Send custom transaction challenges to a registered device within your AuthGroup.
      description: BETA - Send custom transaction challenges to a registered device within your AuthGroup. This API allows you to define and send a transaction challenge with a callback that is called when the user responds.
      operationId: customChallenge
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  key:
                    type: string
                    format: uuid
                  accountId:
                    type: string
                    format: uuid
                  state:
                    type: string
                    description: cryptographically secure 64 character value
                  callback:
                    type: string
                    format: uri
                  duration:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '427':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - title
                - header
                - message
                - lookup
              properties:
                title:
                  type: string
                  description: The title of your transaction challenge
                header:
                  type: string
                  description: The header that is displayed to the user on the auth app
                message:
                  type: string
                  description: The message the user will see in the auth app
                lookup:
                  type: string
                  description: The email address or account ID of the user
                state:
                  type: string
                  description: A unique cryptographically secure value to mark this transaction. If not provided, one will be generated. If unsure, we recommend letting UE Auth generate it.
                duration:
                  type: string
                  description: How long should the system wait before the request expires? 5m (five minutes), 10m (ten minutes), etc.
                callback:
                  type: string
                  format: uri
                  description: What url should UE Auth send a POST request to notify of a response?
    post:
      tags:
        - Device Challenge
      summary: For an account with a saved state session, initiate a device based challenge.
      description: For an account with a saved state session, initiate a device based challenge.
      operationId: deviceSendChallenge
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  accountId:
                    type: string
                    format: uuid
                  response:
                    type: object
                    description: response from provider
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '427':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                lookup:
                  type: string
                  description: an email, username, or phone number
                state:
                  type: string
                  description: a previously saved state session to ensure this endpoint is not abused
        required: true

  # WebAuthN
  /api/{group}/webauthn/bind:
    post:
      tags:
        - WebAuthN
      summary: Initiate binding a user local device webAuthN using a state value and token
      description: Initiate binding a user local device webAuthN using a state value and token
      operationId: webAuthNBind
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  registrationOptions:
                    type: object
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '427':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                state:
                  type: string
        required: true

  /api/{group}/webauthn/finish:
    post:
      tags:
        - WebAuthN
      summary: Complete webAuthN user to local device binding
      description: Complete webAuthN user to local device binding
      operationId: webAuthNFinish
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    default: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '427':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                state:
                  type: string
                credential:
                  type: object
        required: true

  /api/{group}/webauthn/authenticate:
    post:
      tags:
        - WebAuthN
      summary: Initiate a webAuthN (passkey) authentication
      description: Initiate a webAuthN (passkey) authentication
      operationId: webAuthNAuth
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    default: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '427':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  type: string
                  format: email
        required: true

  # Account APIs
  /api/account/groups:
    get:
      tags:
        - Users
      summary: Lookup any AuthGroups a user owns
      description: Lookup any AuthGroups a user owns. Must be a root user or Notifications must be on so an email can be sent to the user.
      operationId: findAccountGroups
      parameters:
        - name: lookup
          in: query
          description: the email address of a person
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Account
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        count:
                          type: number
                        groups:
                          type: object
                          properties:
                            _id:
                              type: string
                            email:
                              type: string
                            group:
                              type: object
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/account:
    post:
      tags:
        - Users
      summary: Register a new user
      description: Register a new user to an Auth Group independant of any organization or other access considerations. Self-registration is possible if the Auth Group has defined locked=false. Otherwise, an appropriately permissioned member of the Auth Group must create the user. Please note that the only data provided by this endpoint (or any Account API) is the id, username, and email (and creat/modify/active meta data) of the user within this AuthGroup. The Account record holds no personal information aside from this email address and an optional phone number which is only visible to that Account owner; however, if you supply profile information, a secured profile record will be generated which the account holder can administrate later.
      operationId: writeAccount
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/getAccount'
                  - $ref: '#/components/schemas/firstAccountWrite'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeAccount'
        description: Account data to be written
        required: true
  /api/{group}/organization/{org}/accounts/search:
    get:
      tags:
        - Organization Users & Access
      summary: Search Accounts in the authGroup with an org context
      description: Allows you to search accounts in the authgroup using a text search
      operationId: searchAccountsFromOrg
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization context
          schema:
            type: string
          required: true
        - name: q
          in: query
          description: keyword search
          required: true
          schema:
            type: string
        - name: restrictEmail
          in: query
          description: restrict the search to specific email domains. comma dilimited
          example: example.com,google.com,test.com
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Account
                  data:
                    $ref: '#/components/schemas/searchAccounts'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/accounts/search:
    get:
      tags:
        - Users
      summary: Search Accounts in the authGroup
      description: Allows you to search accounts in the authgroup using a text search
      operationId: searchAccounts
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: q
          in: query
          description: keyword search
          required: true
          schema:
            type: string
        - name: restrictEmail
          in: query
          description: restrict the search to specific email domains. comma dilimited
          example: example.com,google.com,test.com
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Account
                  data:
                    $ref: '#/components/schemas/searchAccounts'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/accounts:
    post:
      tags:
        - Users
      summary: Import users to the Auth Group
      description: This API allows you to import an array of users to the Auth Group independant of any organization or other access considerations. This API cannot be used for self-registration. Passwords are automatically generated and all users must claim their accounts. No profile data can be added with this API.
      operationId: importAccounts
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Accounts'
                  data:
                    type: object
                    properties:
                      attempted:
                        type: number
                        description: how many attempted
                      ok:
                        type: number
                        description: how many successfully written?
                      failed:
                        type: array
                        items:
                          type: object
                        description: which accounts failed and why
                      success:
                        type: array
                        items:
                          $ref: '#/components/schemas/getAccount'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
        - openId: [ ]
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/importAccount'
        description: Account data to be written
        required: true
    get:
      tags:
        - Users
      summary: Retrieve all users in the Auth Group
      description: This will return every Account (user) associated to the Auth Group.
      operationId: getAccounts
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: string
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAccounts'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  '/api/{group}/account/{id}':
    get:
      tags:
        - Users
      summary: Find a User with ID
      description: Identify a single user by their user ID. If you enter "me" in the ID field, it will return your own information.
      operationId: getAccount
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of account type to return
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAccount'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Users
      summary: Hard delete a user
      description: This request will completely remove the unique Account from the AuthGroup. You should be careful with this method as it may lead to unforeseen data states such as orphaned records if you have tightly integrated with this API.
      operationId: deleteAccount
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of account type to delete
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAccount'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    patch:
      tags:
        - Users
      summary: Patch an existing User
      description: This allows you to update an Account record. While there is a permission to allow administrators of the AuthGroup to do this, it is recommended that you typically allow users themselves to manage their information unless they request assistance.
      operationId: patchAccount
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of account to update
          required: true
          schema:
            type: string
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAccount'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonPatch'
        description: JSON Patch specific to your account object
        required: true

  /api/{group}/account/codes:
    put:
      tags:
        - Users
      summary: Create Account Recovery Codes
      description: Recovery codes are 10 hashed strings that are only ever displayed when the user generates them. In the event of an account lockout, they can be used to restore access and reset password should no other option be available. If lost, they must be reset. They cannot be updated and hitting this endpoint more than once will reset them.
      operationId: writeRecoveryCodes
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                    example: Accounts
                  data:
                    type: array
                    items:
                      type: string
                      description: the codes
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/account/panic:
    put:
      tags:
        - Users
      summary: Immediately Lock an Account
      description: If a user notices unusual activity, they can immediately lock their account. This action requires recovery codes to undo. If the user has not generated recovery codes, they will need to contact an administrator for assistance. This action will also kill all active sessions for the user. PLEASE NOTE, if JWT tokens have been issued for the account, this will not disable them. Always ensure that Access Tokens have reasonable expiration times to avoid issues with locked accounts and live active JWT tokens.
      operationId: lockMyAccount
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '204':
          description: successful operation
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - email
              properties:
                email:
                  type: string
                  format: email
      security:
        - bearer: []
        - openId: []

  /api/{group}/account/start-recovery:
    post:
      tags:
        - Users
      summary: Initiate Recovery of Locked Account
      description: This API will allow a user to recovery their account after locking using their recovery codes. If the request is successful, this API returns a bearer token to be used in the actual recovery. The API will also set a state cookie as part of the response to ensure the second recovery request is from the same device.
      operationId: startRecovery
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/recoveryRequestObject'

  /api/{group}/account/recover:
    put:
      tags:
        - Users
      summary: Unlock an Account and Reset Password
      description: Using the token from "start-recovery", you can unlock the account and set a new password. Optionally, you can set a random strong password.
      operationId: recoverAccount
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/recoverAccountResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/recoverAccountRequest'

  # Secured Account Profiles
  /api/{group}/profile:
    post:
      tags:
        - Profiles
      summary: Create a secured profile that only you (the account holder) can access or govern access to.
      description: "While Accounts themselves do not carry personal information, two concepts in UE Auth do: Secured Profiles and Organization User Profiles (as described here). Secured Profiles are entirely controlled by the Account holder (user) and not accessible by anyone other than that user. Secured Profile data can be requested but must always be actively approved and provided or denied by the User."
      operationId: writeProfile
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/securedProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/securedProfileWrite'
        description: Profile data to be written
        required: true
    patch:
      tags:
        - Profiles
      summary: Update your secured profile
      description: Update your secured profile tied to your account id.
      operationId: updateProfile
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/securedProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonPatch'
        description: Profile data to be updated
        required: true
    get:
      tags:
        - Profiles
      summary: Retrieve your secured profile
      description: This will return only your profile tied to your account id
      operationId: getProfile
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/securedProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Profiles
      summary: Delete your secured profile
      description: This will delete only your secured profile tied to your account id
      operationId: removeProfile
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/securedProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/profiles/{id}:
    get:
      tags:
        - Profiles
      summary: Retrieve a secured profile by ID
      description: You can retrieve your profile or one you have view access to
      operationId: getProfileById
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: account id of the profile owner
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/securedProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Request Account Profile Access
  /api/{group}/profile/request/{account_id}:
    post:
      tags:
        - Profile Requests
      summary: Create a request to access someone's profile information
      description: Requests are async mechanisms to access profile data. The Account holder may approve or deny the request. Requests automatically expire after 7 days.
      operationId: createRequest
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: account_id
          in: path
          description: the account Id to whom you are making the request
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/profileRequest'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeProfileRequest'
        description: Profile data to be written
        required: true

  /api/{group}/profile/requests/{sor}:
    get:
      tags:
        - Profile Requests
      summary: Retrieve your profile requests
      description: Specify requests to you or from you and retrieve the list
      operationId: getRequests
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: sor
          in: path
          description: specify sent or received
          schema:
            type: string
            default: received
            enum:
              - sent
              - received
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/profileRequest'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
        - openId: [ ]

  /api/{group}/profile/request/{id}:
    patch:
      tags:
        - Profile Requests
      summary: Approve or deny a request to access your profile data
      description: Approve or deny a request to access your profile data. Only the recipient can make this change.
      operationId: updateRequest
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the request id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/profileRequest'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/profileRequestUpdate'
        description: Profile data to be updated
        required: true
    get:
      tags:
        - Profile Requests
      summary: Get a profile request
      description: Get a profile request. You must be either the recipient or sender.
      operationId: getRequest
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the request id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/profileRequest'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Profile Requests
      summary: Delete a profile request
      description: Delete a profile request. You must be either the recipient or sender.
      operationId: removeRequest
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the request id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/profileRequest'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Secured Profile View Access

  /api/{group}/profile/accesses/{gor}:
    get:
      tags:
        - Profile Access
      summary: Retrieve secured profile access records
      description: Retrieve secured profile access records of those profiles you have been cleared to access or of people who have access to your profile
      operationId: getAllAccess
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: gor
          in: path
          description: access given or received
          schema:
            type: string
            default: given
            enum:
              - given
              - received
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/viewAccessObject'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
        - openId: [ ]

  /api/{group}/profile/access/{id}:
    get:
      tags:
        - Profile Access
      summary: Get a profile access record
      description: Get a profile access record. You must be either the target or person being granted access.
      operationId: getViewAccess
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the view access id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/viewAccessObject'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Profile Access
      summary: Delete a profile access record
      description: Delete a profile access record. You must be either the target or person being granted access.
      operationId: removeAccess
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the access id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/viewAccessObject'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # SNAPSHOTS of Profiles
  /api/{group}/profile/snapshot/{id}:
    get:
      tags:
        - Profile Access
      summary: Get an approved snapshot of a profile using the request id
      description: Get an approved snapshot of a profile using the request id. You must be the requesting party or the profile owner.
      operationId: getSnapShot
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the request id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/securedProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Profile Access
      summary: Remove a snapshot of a profile using the request id.
      description: Remove a snapshot of a profile using the request id. You must be the requesting party or the owner of the profile.
      operationId: deleteSnapShot
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the request id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Secured Profile'
                  data:
                    $ref: '#/components/schemas/securedProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Organization User Profiles
  /api/{group}/organization/{org}/profiles:
    post:
      tags:
        - Organization User Profiles
      summary: Create an Organization User Profile (name, contact info, bio, etc.) for an Account associated to this Organization
      description: "While Accounts themselves do not carry personal information, two concepts in UE Auth do: Secured Profiles and Organization User Profiles (as described here). Organizations may need to define information about their users such as first and last name, address, or other data over which they wish to have a measure of control. This data is limited in scope to the Organization itself and access is limited to Organization administrators or the Account holder. As such, Organization User Profiles are unique only to the Organization but reference a single unique Account in the AuthGroup. One Account could have as many Organization User Profiles as there are Organizations to which the Account has been given access. In contrast, Secured Profiles are entirely controlled by the Account holder (user) and not accessible by anyone other than that user. Secured Profile data can be requested but must always be actively approved and provided or denied by the User. In future iterations, it will be possible to request an Organization User Profile be seeded from a Secured Profile."
      operationId: writeOrgProfile
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Organization User Profile'
                  data:
                    $ref: '#/components/schemas/orgUserProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeOrgUserProfile'
        description: Profile data to be written
        required: true
    get:
      tags:
        - Organization User Profiles
      summary: Query all of the Organization User Profiles in an Organization
      description: Return and/or filter every Organization specific User Profile defined for this Organization.
      operationId: getOrgProfiles
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: string
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Organization User Profile'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/orgUserProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/organization/{org}/profile/{id}:
    patch:
      tags:
        - Organization User Profiles
      summary: Update an Organization User Profile (name, contact info, bio, etc.) for an Account associated to this Organization
      description: This will change values of the Organization User Profile assocaited to the Account within a specified Organization. This will not update any information on the Account's Secured Profile.
      operationId: updateOrgProfile
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the organization user profile ID OR the Account ID of the User
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Organization User Profile'
                  data:
                    $ref: '#/components/schemas/orgUserProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonPatch'
        description: Profile data to be written
        required: true
    get:
      tags:
        - Organization User Profiles
      summary: Retrieve an Organization User Profile
      description: This will return only the Profile information and not any Account information associated to the record except the Account ID or other information mirrored.
      operationId: getOrgProfile
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the organization user profile ID OR the Account ID of the User
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Organization User Profile'
                  data:
                    $ref: '#/components/schemas/orgUserProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Organization User Profiles
      summary: Completel remove an Organization User Profile
      description: This will delete the Organization User Profile but not change or update either the Account or Secured Profile (pending) in any way.
      operationId: removeOrgProfile
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the organization user profile ID OR the Account ID of the User
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Organization User Profile'
                  data:
                    $ref: '#/components/schemas/orgUserProfile'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/organizations/profiles/account/{id}:
    get:
      tags:
        - Account Dashboard
      summary: As an Account holder, you can view all Org Profiles tied to your Account, regardless of Org Access
      description: Even though the Organization Account Profile is controlled by the Org, Accounts can still see that the org has their data and request that data be removed at any time. Use this API to see which Organizations have an Org Account Profile tied to you and the status of any requests you've made.
      operationId: getAllOrgProfiles
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: your Account ID
          schema:
            type: string
            default: me
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Organization User Profile'
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        organizationId:
                          type: string
                          format: uuid
                        organizationName:
                          type: string
                        organizationProfileId:
                          type: string
                          format: uuid
                        contactEmail:
                          type: string
                          format: email
                        deleteRequested:
                          type: boolean
                        deleteRequestedDate:
                          type: string
                          format: date-time

        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/organizations/{org}/profiles/account/{id}:
    post:
      tags:
        - Account Dashboard
      summary: As an Account holder, request that an Organization delete your Org Profile, regardless of your access
      description: Even though the Organization Account Profile is controlled by the Org, Accounts can still see that the org has their data and request that data be removed at any time. Use this API to request the removal or clear the request. You can reference yourself with 'me' or if you have permissions, any Account ID.
      operationId: requestToOrgProfile
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: your Account ID
          schema:
            type: string
            default: me
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: 'Organization User Profile'
                  data:
                    type: object
                    properties:
                      request:
                        type: string
                        example: remove
                      verified:
                        type: boolean
                        example: true
                      date:
                        type: string
                        format: date-time
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                request:
                  type: string
                  enum:
                    - remove
                    - remain
        description: Profile data request to the Organization
        required: true

  # User Account API restricted to Organizations
  /api/{group}/organization/{org}/account:
    put:
      tags:
        - Organization Users & Access
      summary: Register a new or existing user as part of an organization
      description: If you intend to add or create a user specific to your organization, this is the correct API. You may want to use the account/search API first. This method will check to see if a user with the email specified exists. If the user exists, an organization access record will be added to that user's account, otherwise, the user is first created and then the access record added. This API does not allow you to set a password, one will be generated. If notifications are enabled (recommended), the caller will never see the password and a notification will be sent to the user or they can simply trigger a password reset to claim the account. If notifications are not enabled, the generated password will be returned with this call and include a warning that notifications are disabled. Please note that the only data provided by this endpoint (or any Account API) is the id, username, and email of the user within this AuthGroup. The Account record holds no personal information aside from this email address and an optional phone number which is only visible to that Account owner.
      operationId: writeAccountToOrg
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/getAccount'
                  - $ref: '#/components/schemas/firstAccountWrite'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeAccountByOrg'
        description: Account data to be written
        required: true
  /api/{group}/organization/{org}/accounts:
    put:
      tags:
        - Organization Users & Access
      summary: Register multiple existing Auth Group accounts to the organization.
      description: This will register multiple accounts to the organization. This API takes account Ids not email addresses. Unlike individual additions to an organization, this bulk endpoint will not create the accounts in the AuthGroup if they do not exist.
      operationId: bulkWriteAccountsToOrg
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/getAccount'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
                format: uuid
        description: Array of Account Ids to be added
        required: true
    delete:
      tags:
        - Organization Users & Access
      summary: Remove multiple accounts from an organization.
      description: This will bulk remove accounts from an organization. This API requires a body to be passed with a DELETE method.
      operationId: bulkRemoveAccountsFromOrg
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/getAccount'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
                format: uuid
        description: Array of Account Ids to be removed
        required: true
    get:
      tags:
        - Organization Users & Access
      summary: Retrieve all users associated to an organization
      description: This API allows you to browse the email and id of every user that has been added to your organization.
      operationId: getAccountsByOrg
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: string
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAccounts'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  '/api/{group}/organization/{org}/account/{id}':
    get:
      tags:
        - Organization Users & Access
      summary: Find a User with ID
      description: Identify a single user associated to an organization. Remember that Account records only return create/modified/active metadata, an email and an id.
      operationId: getAccountByOrg
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization ID
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of account type to return
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAccount'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/access/organization/{org}/account/{id}:
    delete:
      tags:
        - Organization Users & Access
      summary: Remove an organization from user's access
      description: This endpoint removes a user form an organization and cuts off all access immediately. Please be advised, if a user obtained access records as part ofa  JWT token, that token may still show access until it expires.
      operationId: remove Org from access
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Organization id access is being applied to
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: id that need to be updated
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/userAccessAction'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    get:
      tags:
        - Organization Users & Access
      summary: Get defined user access in order to make edits with PUT
      description: Get the specific record of domains and roles within the context of an organization. You can update and send back this record as part of the associated PUT endpoint to make changes.
      operationId: getDefinedUserAccess
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Organization id access is being applied to
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: id that need to be updated
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/writeAccess'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    put:
      tags:
        - Organization Users & Access
      summary: Overwrite defined user access of an Account in the context of a single Organization
      description: This endpoint allows you to change the domains and roles associated to an Account within the context of an Organization. Remember that this will overwrite the record not patch it.
      operationId: defineUserAccess
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Organization id access is being applied to
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: id that need to be updated
          required: true
          schema:
            type: string
        - name: notify
          in: query
          description: if notifications are enabled, you can override and skip them by setting this to false
          required: false
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/updateUserAccess'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeAccess'
        description: Updated access object
        required: true

  /api/{group}/access/organization/{org}/accounts:
    put:
      tags:
        - Organization Users & Access
      summary: Add multiple user accounts to multiple domains and roles
      description: Add multiple user accounts to multiple domains and roles. This is only an addition API and will not remove any roles or domains.
      operationId: defineBulkUserAccessAdd
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Organization id access is being applied to
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  domains:
                    type: object
                    properties:
                      matching:
                        type: number
                        description: how many records matched the account ids given
                      modified:
                        type: number
                        description: how many records were updated
                      operationRan:
                        type: boolean
                        description: did the update run as expected
                  roles:
                    type: object
                    properties:
                      matching:
                        type: number
                        description: how many records matched the account ids given
                      modified:
                        type: number
                        description: how many records were updated
                      operationRan:
                        type: boolean
                        description: did the update run as expected
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - accounts
              allOf:
                - $ref: '#/components/schemas/writeAccess'
              properties:
                accounts:
                  type: array
                  items:
                    type: string
                    format: uuid
        description: Updated access object
        required: true
    delete:
      tags:
        - Organization Users & Access
      summary: Remove multiple user accounts from multiple domains and roles
      description: Remove multiple user accounts from multiple domains and roles. This is only a remove API and will not add any roles or domains.
      operationId: defineBulkUserAccessRemove
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Organization id access is being applied to
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                type: object
                properties:
                  domains:
                    type: object
                    properties:
                      matching:
                        type: number
                        description: how many records matched the account ids given
                      modified:
                        type: number
                        description: how many records were updated
                      operationRan:
                        type: boolean
                        description: did the update run as expected
                  roles:
                    type: object
                    properties:
                      matching:
                        type: number
                        description: how many records matched the account ids given
                      modified:
                        type: number
                        description: how many records were updated
                      operationRan:
                        type: boolean
                        description: did the update run as expected
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - accounts
              allOf:
                - $ref: '#/components/schemas/writeAccess'
              properties:
                accounts:
                  type: array
                  items:
                    type: string
                    format: uuid
        description: Updated access object
        required: true

  # Account Dashboard
  /api/{group}/access/account/{id}:
    get:
      tags:
        - Account Dashboard
      summary: Query the organizations, products, roles and permissions of a user
      description: This API will return all of the access information available for a specific user. It is not recommended that anyone other than AuthGroup administrators be given permissions to this endpoint.
      operationId: getUserAccess
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: >-
            Unique user identifier
          required: true
          schema:
            type: string
        - name: org
          in: query
          description: allows a AuthGroup Admin to query a specific organization context. Otherwise, orgId is restricted to the domainId and token context
          required: false
          schema:
            type: string
        - name: domain
          in: query
          description: if ID provided, it restricts the response to this domain
          required: false
          schema:
            type: string
        - name: product
          in: query
          description: if ID provided, it restricts the response to this product
          required: false
          schema:
            type: string
        - name: includeMiscRoles
          in: query
          description: these are roles attributed to the user that do not correlate to the domains or products provided access
          required: false
          schema:
            type: boolean
        - name: excludePermissions
          in: query
          description: flag to let us know to return both roles and permissions, or just roles
          required: false
          schema:
            type: boolean
        - name: minimized
          in: query
          description: if true, this creates arrays of ids in string form to reduce the size of the data
          required: false
          schema:
            type: boolean
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: User Access
                  data:
                    $ref: '#/components/schemas/userAccess'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/access/validate:
    get:
      tags:
        - Validate Access
      summary: Query your token's access to organizations, domains, products, roles, and permissions
      description: This AIP returns the caller's specific access data as defined by the caller's token. This endpoint is unique in the API in that it is not specific to the associated client and audience of the API itself. You can use this endpoint to validate access information for any user or client (client_credential). Please note that if the token is a Client Credential token, only the minmized=true version will be dispalyed and the other query parameters will have no effect.
      operationId: validateToken
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: query
          description: allows a AuthGroup Admin to query a specific organization context. Otherwise, orgId is restricted to the domainId and token context. Access Token only
          required: false
          schema:
            type: string
        - name: domain
          in: query
          description: if ID provided, it restricts the response to this domain. Access Token only
          required: false
          schema:
            type: string
        - name: product
          in: query
          description: if ID provided, it restricts the response to this product. Access Token only
          required: false
          schema:
            type: string
        - name: includeMiscRoles
          in: query
          description: these are roles attributed to the user that do not correlate to the domains or products provided access. Access Token only
          required: false
          schema:
            type: boolean
        - name: excludePermissions
          in: query
          description: flag to let us know to return both roles and permissions, or just roles. Access Token only
          required: false
          schema:
            type: boolean
        - name: minimized
          in: query
          description: if true, this creates arrays of ids in string form to reduce the size of the data. Access Token only, Client Credential responses are always minimized.
          required: false
          schema:
            type: boolean
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: User Access
                  data:
                    $ref: '#/components/schemas/userAccess'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/access/organizations:
    get:
      tags:
        - Account Dashboard
      summary: Allows a user to view their account organizations and the state of those organizations
      description: When an organization is applied to a user, it may be fully functional immediately (providing full access) or it may require the user to accept Terms of Access. This API allows the user to view the state of those organizations so the user can accept, decline or otherwise take action with regards to their account and information relative to organizations.
      operationId: getMyOrgs
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: User Access
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        terms:
                          type: object
                          description: the terms that the user has recieved and or accepted
                        domains:
                          type: array
                          description: domain information including name and description
                          items:
                            type: object
                        roles:
                          type: array
                          items:
                            type: string
                            format: uuid
                        organization:
                          type: object
                          description: details about the organization context of these domains, roles, and terms. This will also include the latest terms of the orgnaization
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/access/organizations/{org}/terms:
    put:
      tags:
        - Account Dashboard
      summary: Accept or decline terms of access for an organization. Declining will remove you from the organization.
      description: This API allows a user to agree to the terms of access imposed by an organization, or decline and remove all access from that organization.
      operationId: acceptOrDeclineOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Organization id access is being applied to
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: User Access
                  data:
                    $ref: '#/components/schemas/userAccessAction'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              required:
                - action
              properties:
                action:
                  type: string
                  enum:
                    - 'accept'
                    - 'decline'
        required: true

  /api/{group}/access/my/organizations/{org}/products:
    get:
      tags:
        - Account Dashboard
      summary: Allows a user to view all products within the context of one org to which they have access and can be linked
      description: This will return an object array of all the b2c products the Auth Group has and all of the b2b products within the context of the organization. The data is derived from the token only.
      operationId: getMyProducts
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Organization context
          required: true
          schema:
            type: string
        - name: includeCore
          in: query
          description: Include Core B2B products in returned list
          required: false
          schema:
            type: boolean
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    type: object
                    properties:
                      sub:
                        type: string
                        format: uuid
                      authGroup:
                        type: string
                      b2c:
                        type: array
                        items:
                          $ref: '#/components/schemas/myProducts'
                      b2b:
                        type: array
                        items:
                          $ref: '#/components/schemas/myProducts'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/access/my/organizations:
    get:
      tags:
        - Account Dashboard
      summary: Allows a user to view detailed information about any organizations on their token
      description: "Query details about the organizations you have access to. They must be present on your token for this to work, which means the token was requested with the scope access or access::organization"
      operationId: getMyOrgDetails
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Organizations
                  data:
                    type: object
                    properties:
                      sub:
                        type: string
                        format: uuid
                      organizations:
                        type: array
                        items:
                          $ref: '#/components/schemas/organization'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/access/my/notifications:
    get:
      tags:
        - Account Dashboard
      summary: Allows a user to request any notifications sent to them
      description: View all notifications not yet expired (ttl) with your user Id as the recipient
      operationId: getMyNotifications
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Notification
                  data:
                    type: object
                    properties:
                      sub:
                        type: string
                        format: uuid
                      notifications:
                        type: array
                        items:
                          $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/access/my/notification/{id}:
    get:
      tags:
        - Account Dashboard
      summary: Allows a user to view a single notification that was sent to them only
      description: Allows a user to view a notification by id if the recipientUserId is their own user id
      operationId: getMyNotification
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: Id of the notification
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Notification
                  data:
                    $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Product Keys
  /api/{group}/access/product/{product}/key/service:
    post:
      tags:
        - Product Keys
      summary: Define a Service (oAuth Client) that can be used to generate and group product keys.
      description: Define a Service (oAuth Client) that can be used to generate and group long-lived client-credential tokens for various integration and marketplace applications.
      operationId: createKeyService
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product ID
          required: true
          schema:
            type: string
        - $ref: '#/components/parameters/OrgContext'
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Product Key
                  data:
                    $ref: '#/components/schemas/productKeyService'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeProductKeyService'
        required: true
    get:
      tags:
        - Product Keys
      summary: View all Services (oAuth Clients) that are used to group product keys for a specific product.
      description: View all Services (oAuth Clients) that are used to group product keys for a specific product.
      operationId: viewKeyServices
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product ID
          required: true
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: string
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: string
        - $ref: '#/components/parameters/OrgContext'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Product Key
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/productKeyService'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/access/product/{product}/key/service/{clientId}:
    delete:
      tags:
        - Product Keys
      summary: Delete a Services (oAuth Clients) that is used to group product keys for a specific product.
      description: Delete a Services (oAuth Clients) that is used to group product keys for a specific product. This will disable all tokens associated to the service.
      operationId: deleteKeyService
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product ID
          required: true
          schema:
            type: string
        - name: clientId
          in: path
          description: Each service has a clientId, this is that value
          required: true
          schema:
            type: string
            format: uuid
        - $ref: '#/components/parameters/OrgContext'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Product Key
                  data:
                    $ref: '#/components/schemas/productKeyService'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    put:
      tags:
        - Product Keys
      summary: Update the roles and permissions associated with a key grouping.
      description: This will update the roles associated to the key grouping (client access). It will overwrite existing roles.
      operationId: updateKeyServiceRoles
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product ID
          required: true
          schema:
            type: string
        - name: clientId
          in: path
          description: Each service has a clientId, this is that value
          required: true
          schema:
            type: string
            format: uuid
        - $ref: '#/components/parameters/OrgContext'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Product Key
                  data:
                    $ref: '#/components/schemas/productKeyService'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/updateProductKeyServiceRoles'
        required: true

  /api/{group}/access/product/{product}/key:
    post:
      tags:
        - Product Keys
      summary: Create a product key.
      description: Product keys are long-lived client-credential tokens that can be created and managed. They can be used to create secure integrations between distinct systems when a more robust solution like OAuth token flows are not possible. They are a good option to secure webhooks, create marketplace style token management, or other external system integrations.
      operationId: createProductKey
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product ID
          required: true
          schema:
            type: string
        - $ref: '#/components/parameters/OrgContext'
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Product Key
                  data:
                    $ref: '#/components/schemas/productKeyCreated'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeProductKey'
        required: true
    get:
      tags:
        - Product Keys
      summary: Retrieve all product keys associated to a product.
      description: This API will include security features to ensure there is no cross-organization data leakage. Typically, it will be easier to query using the filters to specify a service (client) grouping of tokens.
      operationId: getProductKeys
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product ID
          required: true
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: string
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: string
        - $ref: '#/components/parameters/OrgContext'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Product Key
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/productKey'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/access/product/{product}/key/{id}:
    get:
      tags:
        - Product Keys
      summary: Retrieve a single product key.
      description: This will retrieve a single product key to view.
      operationId: getKey
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product ID
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: product key ID
          required: true
          schema:
            type: string
            format: uuid
        - $ref: '#/components/parameters/OrgContext'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Product Key
                  data:
                    $ref: '#/components/schemas/productKey'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
        - openId: [ ]
    put:
      tags:
        - Product Keys
      summary: Rotate product key.
      description: Product key records are themselves generally immutable; however, you can use this api to rotate a product key if you believe the key itself has been compromised or if it has expired.
      operationId: rotateKey
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product ID
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: product key ID
          required: true
          schema:
            type: string
            format: uuid
        - $ref: '#/components/parameters/OrgContext'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Product Key
                  data:
                    $ref: '#/components/schemas/productKeyCreated'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: [ ]
        - openId: [ ]
    delete:
      tags:
        - Product Keys
      summary: Delete a product key.
      description: This will remove a product key. Warning, all integrations depending on this key will be disabled from a UE Auth security perspective (i.e., unauthorized).
      operationId: removeKey
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product ID
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: product key ID
          required: true
          schema:
            type: string
            format: uuid
        - $ref: '#/components/parameters/OrgContext'
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Product Key
                  data:
                    $ref: '#/components/schemas/productKey'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Client Access
  /api/{group}/access/client/{id}:
    get:
      tags:
        - Client Access
      summary: Return the product and roles associated to a client
      description: Clients can be associated with a single Product and assigned roles from that product. This API returns the defined access of a specified client and product combination.
      operationId: getClientAccess
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: client_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: User Access
                  data:
                    $ref: '#/components/schemas/clientAccess'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/access/client/{id}/product/{product}:
    delete:
      tags:
        - Client Access
      summary: Completely dissassociate a product from the client and remove the attributed roles
      description: Clients can be associated with a single Product and assigned roles from that product. This API removes that access by deleting the product and associated roles form the Client's access object. This will NOT remove the client ID from the associatedClients array of the product object.
      operationId: removeClientAccess
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: client_id
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: the id of the product associated
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: User Access
                  data:
                    $ref: '#/components/schemas/clientAccess'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    put:
      tags:
        - Client Access
      summary: Add a Product and Roles to a Client so that it can act with permissions using a client_credential token
      description: Clients can be associated with a single Product and assigned roles from that product. This API associates a Product and Roles to the client. It will also update the associatedClients object of the Product in question.
      operationId: applyClientAccess
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: client_id
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: the id of the product associated
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: User Access
                  data:
                    $ref: '#/components/schemas/clientAccess'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeClientAccess'
        description: Account data to be written
        required: true

  # Non-OIDC Specific Client APIs
  /api/{group}/clients:
    get:
      tags:
        - Clients
      summary: Retrieve all clients in your AuthGroup
      description: Allows the caller to get a list of every registered Client in the AuthGroup. Sensative information like the client_secret is ommitted.
      operationId: getClients
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: search
          in: query
          description: additional search key - not part of oData
          required: false
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: string
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getClients'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  '/api/{group}/client/{id}':
    get:
      tags:
        - Clients
      summary: Returns a single Client from within the AuthGroup
      description: This will bypass the normally protected GET /reg/{id} as long as the caller has the correct permissions. This is a convenience API and not the same as the OIDC call on the /reg endpoint which may require a registration access token. This API will sanitize the response.
      operationId: getOneClient
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of account type to return
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getClient'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Clients
      summary: This will delete a Client
      description: This API will bypass the OIDC /reg endpoint and allow an authorized caller from the AuthGroup to delete a Client.
      operationId: deleteOneClient
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of account type to return
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getClient'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Operation APIs for security update commands
  /api/{group}/operations:
    post:
      tags:
        - Operations
      summary: Execute operations against a auth group (only rotate_keys and rotate_cookie_keys are currently supported)
      description: Execute operations against a auth group (only rotate_keys and rotate_cookie_keys are currently supported)
      operationId: groupOperations
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getGroup'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/operations'
        description: Account data to be written
        required: true

  /api/{group}/operations/resend-verify-email:
    post:
      tags:
        - Operations
      summary: Resends a verification email to the user. API does not return anything. Requires Notification Plugin to be working.
      description: Resends a verification email to the user. Requires that the account have a valid matching email or phone number associated. API does not return anything on success. Requires Notification Plugin to be working. Token not required for this endpoint.
      operationId: userVerifyEmail
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '204':
          description: successful operation
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/verifyEmail'
        description: Account data to be written

  /api/{group}/operations/reset-user-password:
    post:
      tags:
        - Operations
      summary: Initiate password reset for an account. API does not return anything. Requires Notification Plugin to be working.
      description: Initiate password reset for an account. Requires that the account have a valid matching email or phone number associated. API does not return anything on success. Requires Notification Plugin to be working. Token not required for this endpoint.
      operationId: userPasswordReset
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '204':
          description: successful operation
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/passwordReset'
        description: Account data to be written
        required: true

  /api/{group}/operations/organization/{org}/user/{id}:
    post:
      tags:
        - Operations
      summary: Execute operations against a user within an organization
      description: Execute operations against a user within an organization. Currently supports - verify_account, reset_password
      operationId: userOperationsByOrg
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization id
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the user/account id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful update operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAccount'
        '204':
          description: successful operation
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/userOperations'
        description: Account data to be written
        required: true

  /api/{group}/operations/user/{id}:
    post:
      tags:
        - Operations
      summary: Execute operations against a user
      description: Execute operations against a user. Currently supports - verify_account, reset_password, generate_password
      operationId: userOperations
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the user/account id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful update operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAccount'
        '204':
          description: successful operation
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/userOperations'
        description: Account data to be written
        required: true

  /api/{group}/operations/client/{id}:
    post:
      tags:
        - Operations
      summary: Execute operations against a client
      description: Execute operations against a client. Currently supports - rotate_secret & rotate_registration_access_token
      operationId: clientOperations
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the client id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getClient'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/operations'
        description: Account data to be written
        required: true


  # Notifications APIs
  /api/{group}/notification/process:
    post:
      tags:
        - Notification
      summary: Process up to 25 currently unprocessed notifications
      description: This is a stateless way to processes old notifications that may not be processed yet. You should build a cronjob to make this requet on a cadence of your choosing.
      operationId: processBulkNotifications
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  '/api/{group}/notification/{id}/process':
    put:
      tags:
        - Notification
      summary: Process a specific notification that is currently not processed.
      description: Process a specific notification that is currently not processed. If the notification is already processed, it will simply return that notification but take no action. Keep in mind notifications have a 30 day TTL
      operationId: processNotification
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of notification to process
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/notification:
    post:
      tags:
        - Notification
      summary: Define a new notification
      description: Define a new notification to be processed. Only possible if global & auth group notifications are enabled
      operationId: writeNotification
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeNotification'
        description: the notification as stored in ue auth system
        required: true

  /api/{group}/notifications:
    get:
      tags:
        - Notification
      summary: Retrieve all notifications in the group
      description: Retrieve all notifications in the group. Keep in mind notifications have a 30 day TTL
      operationId: getNotifications
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: string
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  '/api/{group}/notification/{id}':
    get:
      tags:
        - Notification
      summary: Return a specific notification
      description: Return a specific notification. Keep in mind notification records only have a 30 day TTL
      operationId: getNotification
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of notification to return
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Notification
      summary: Hard delete a notification
      description: Hard delete a notification. Notifications can not be updated once created, they can only be deleted. Keep in mind that if the notification was already processed, this will not change how that processing communicated the notification to the recipient.
      operationId: deleteNotification
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of notification to delete
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Organization Context Notifications
  /api/{group}/organization/{org}/notification:
    post:
      tags:
        - Organization Notification
      summary: Define a new notification within the context of an Organization
      description: Define a new notification to be processed. Only possible if global & auth group notifications are enabled
      operationId: writeOrgNotification
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization context
          schema:
            type: string
          required: true
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeNotification'
        description: the notification as stored in ue auth system
        required: true

  /api/{group}/organization/{org}/notifications:
    get:
      tags:
        - Organization Notification
      summary: Retrieve all notifications in the Organization
      description: Retrieve all notifications in the group. Keep in mind notifications have a 30 day TTL
      operationId: getOrgNotifications
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization context
          schema:
            type: string
          required: true
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: string
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  '/api/{group}/organization/{org}/notification/{id}':
    get:
      tags:
        - Organization Notification
      summary: Return a specific notification from the Organization
      description: Return a specific notification. Keep in mind notification records only have a 30 day TTL
      operationId: getOrgNotification
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization context
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of notification to return
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Organization Notification
      summary: Hard delete a notification from the Organization (and AuthGroup)
      description: Hard delete a notification. Notifications can not be updated once created, they can only be deleted. Keep in mind that if the notification was already processed, this will not change how that processing communicated the notification to the recipient.
      operationId: deleteOrgNotification
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: org
          in: path
          description: the organization context
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: id of notification to delete
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Plugins
                  data:
                    $ref: '#/components/schemas/notification'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # A few of the OIDC specific API Endpoints
  /{group}/token:
    post:
      tags:
        - OIDC
      summary: Request a token code provided via code authorization flow
      description: Request a token code provided via code authorization flow
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/accessTokens'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/codeAuthorizationTokenRequest'
            encoding:
              grant_type:
                style: form
              client_secret:
                style: form
              redirect_uri:
                style: form
              format:
                style: form
              code:
                style: form
              client_id:
                style: form
              scope:
                style: form
              x_organization_context:
                style: form
              x_access_filter_organization:
                style: form
              x_access_filter_domain:
                style: form
              x_access_filter_product:
                style: form
        required: true
  /{group}/token/simple-iat:
    post:
      tags:
        - OIDC
      summary: Request an initial access token (IAT) tied to your account and a state using basic auth or bearer token
      description: Request an initial access token (IAT) tied to your account and a state using basic auth or bearer token. This is primarily used for out of band authorizations for account settings.
      operationId: getSimpleIAT
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/initialAccessToken'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
        - basic: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/simpleIAT'
        required: false

  /{group}/token/initial-access:
    post:
      tags:
        - OIDC
      summary: Request an OIDC initial access token (IAT)
      description: Request an OIDC initial access token (IAT). There are many uses for an IAT; however, one primary use in this API is to create new clients. Use this endpoint to request the IAT and then use that as your bearer token to create a new client. This only applies if open registration is disabled.
      operationId: getInitialAccessToken
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/initialAccessToken'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/initialAccessTokenRequest'
        required: false

  /{group}/reg:
    post:
      tags:
        - OIDC
      summary: Register a new client - may require an initial access token depending on config
      description: Register a new client - may require an initial access token depending on config
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/clientObject'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeClientObject'
        required: true

  /{group}/reg/{id}:
    put:
      tags:
        - OIDC
      summary: Update a new client - may require a registration access token
      description: Update a new client - may require a registration access (RAI) token. If the RAI is required (configuration) it will rotate on each update and you will need to keep track of it. If you have lost your token, you can request a new one from the operations/client endpoint.
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the client id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/clientObject'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/clientObjectUpdate'
        required: true
    get:
      tags:
        - OIDC
      summary: Get a registerd lient - may require a registration access token
      description: Get a registered client - may require a registration access (RAI) token. If the RAI is required (configuration) it will rotate on each update and you will need to keep track of it. If you have lost your token, you can request a new one from the operations/client endpoint.
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
        - name: id
          in: path
          description: the client id
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/clientObject'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /{group}/me:
    get:
      tags:
        - OIDC
      summary: Standard OIDC UserInfo endpoint
      description: UserInfo endpoint will not work with a JWT token. It must be opaque.
      parameters:
        - name: group
          in: path
          description: the auth group ID associated to your business account
          schema:
            type: string
          required: true
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/userInfoObject'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Organization Products
  /api/{group}/organization/{org}/products:
    get:
      tags:
        - Organization Products
      summary: Get all Products associated to an Organization
      description: Return all Products defined as part of your Organization
      operationId: getOrgProducts
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization context
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/product'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/organization/{org}/products/{id}:
    get:
      tags:
        - Organization Products
      summary: Get an organization associated Product's Info
      description: Query a single Product by ID within an Organization
      operationId: getOrgProduct
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization context
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: >-
            Unique product identifier
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    $ref: '#/components/schemas/product'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/organization/{org}/domain/{domain}/products:
    get:
      tags:
        - Organization Products
      summary: Get all Products associated to an Organization's Domain
      description: Return all Products defined as part of an Organization's Domain
      operationId: getOrgDomainProducts
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization context
          required: true
          schema:
            type: string
        - name: domain
          in: path
          description: domain context
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/product'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/organization/{org}/domain/{domain}/products/{id}:
    get:
      tags:
        - Organization Products
      summary: Get a domain associated Product's Info
      description: Query a single Product by ID within a domain
      operationId: getOrgDomainProduct
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization context
          required: true
          schema:
            type: string
        - name: domain
          in: path
          description: domain context
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: >-
            Unique product identifier
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    $ref: '#/components/schemas/product'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Product CRUD
  /api/{group}/products:
    get:
      tags:
        - Products
      summary: Get all Products
      description: Return all Products defined as part of your AuthGroup
      operationId: getProducts
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/product'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    post:
      tags:
        - Products
      summary: Define a Products in your AuthGroup
      description: In this API, the concept of a Product is a business level entity that represents software your company creates or otherwise manages to which access must be provided to Accounts, Organizations, and Domains. Products are not the same thing as an OIDC Client, but you may wish to have a one to many relationship between Products and OIDC Clients, something which can be managed on the Product object with the asssociatedClients array. This system does not enforce access to a Product in any way, we are simply recording and categorizing the relationship of the Product to the AuthGroup, Organizatin, Domains and ultimately Accounts (Users). It is the responsibility of the Product software itself (that is to say, not the responsibility of UE Auth or United Effects) to appropriately request tokens, scopes, and other information from this system (UE Auth) to then determine and enforce access.
      operationId: createProduct
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/product'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeProduct'
        description: Updated user object
        required: true

  /api/{group}/products/{id}:
    get:
      tags:
        - Products
      summary: Get a Product's Info
      description: Query a single Product by ID
      operationId: getProduct
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: >-
            Unique user identifier
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    $ref: '#/components/schemas/product'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    patch:
      tags:
        - Products
      summary: Update a Product's information
      description: Change information about your Product
      operationId: updateProduct
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: >-
            Unique user identifier
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    $ref: '#/components/schemas/product'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonPatch'
        description: Updated user object
        required: true
    delete:
      tags:
        - Products
      summary: Delete a Product
      description: This will completely delete a product. There are limits to deleting a Product if it associated to Organizations and Domains. You may need to dissassociate them first as those associations potentially represent internal (internal to your company) licenses or agreements. Once cleared of assocations, deleting a product will delete all associated permissions.
      operationId: deleteProduct
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: >-
            Unique user identifier
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    $ref: '#/components/schemas/product'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/products/{product}/reference-check/permissions:
    get:
      tags:
        - Products
      summary: Find out how many permissions reference this product
      description: Find out how many permissions reference this product. Useful to run before a delete operation.
      operationId: checkPermissionsForProduct
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Products
                  data:
                    properties:
                      totalReferences:
                        type: number
                      permissionIds:
                        type: array
                        items:
                          type: string
                          format: uuid
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/roles:
    get:
      tags:
        - Roles
      summary: Get all Roles across Products in your AuthGroup
      description: Scoped to an AuthGroup and available across Organizations and Products. This will return custom Role data specific to individual Organizations as well. Be very careful who has access to this API.
      operationId: getAllRolesAcrossProducts
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: search
          in: query
          description: keyword search across roles - not part of oData
          required: false
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    type: array
                    items:
                      oneOf:
                        - $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/organization/{org}/roles:
    get:
      tags:
        - Organization Roles
      description: Scoped to this specific Organization - returns available global Roles along with Organization specific Roles across all associated Organization Products
      summary: Get all roles across Products in your Organization
      operationId: getAllRolesAcrossProductsByOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization Id
          required: true
          schema:
            type: string
        - name: search
          in: query
          description: keyword search across roles - not part of oData
          required: false
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    type: array
                    items:
                      oneOf:
                        - $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/organizations/{org}/products/{product}/roles:
    get:
      tags:
        - Organization Roles
      description: Scoped to this specific Organization - returns global Roles and thos Roles specific to the provided organization for a given product. If the product requested is not associated to the Organization it will return a 404.
      summary: Get Roles in a single Product
      operationId: getProductRolesByOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization Id
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: >-
            Unique user identifier
          required: true
          schema:
            type: string
        - name: search
          in: query
          description: keyword search across roles - not part of oData
          required: false
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    type: array
                    items:
                      oneOf:
                        - $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    put:
      tags:
        - Organization Roles
      description: Scoped to this specific organization for a given Product, this API allows you to create custom Roles that only those in the Organization will be able to see. Be careful not to use this API when you intend to create a Global Role. If the specified product is not associated to the Organization, this returns a 404. There is a non-standard way of associating a permission to a Role. The property "permissions" takes an array of strings comprised of a concat of the Permission Ids and the Permission code. As an example, "3fa85f64-5717-4562-b3fc-2c963f66afa6 user::read:own" would be one string entry.
      summary: Define new roles specific to this Organization.
      operationId: createRoleByOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization Id
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Unique product identifier
          required: true
          schema:
            type: string
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/roleWrite'
        description: Create a new role
        required: true
      security:
        - bearer: []
        - openId: []

  /api/{group}/organizations/{org}/products/{product}/roles/{id}:
    delete:
      tags:
        - Organization Roles
      description: Scoped to this specific organization - delete a Role specific to this Organization. If the Product specified is not associated to the Organization, you will get a 404.
      summary: Remove a custom Role specific to this Organization and Product
      operationId: deleteProductRoleByOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization Id
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: >-
            Unique user identifier
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: Unique role identifier
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    get:
      tags:
        - Organization Roles
      description: Scoped to this specific Organization - returns a Role, either globally available or specific to this Organization. If the product specified is not assocaited to the Organization, a 404 is returned.
      summary: Get Role information for a Product in your Organization
      operationId: getProductRoleByOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization Id
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: >-
            Unique user identifier
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: Unique role identifier
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    patch:
      tags:
        - Organization Roles
      description: Scoped to this specific Organization - updates a role specific to this Organization. This API is specific to custom roles (custom=true) created by the Organization. If you are an AuthGroup Admin and you wish to update a globally available Role, use the other PATCH Role endpoint. If the specified product is not associated to the Organization, you will recieve a 404. There is a non-standard way of associating a permission to a Role. The property "permissions" takes an array of strings comprised of a concat of the Permission Ids and the Permission code. As an example, "3fa85f64-5717-4562-b3fc-2c963f66afa6 user::read:own" would be one string entry.
      summary: Update a Role specific to the Organization
      operationId: updateRoleByOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization Id
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Unique product identifier
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: Unique role identifier
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonPatch'
        description: Create a new role
        required: true
      security:
        - bearer: []
        - openId: []

  /api/{group}/products/{product}/roles:
    get:
      tags:
        - Roles
      description: Scoped to authgroup - this API will return Roles data across Organizations including custom Role information scoped to single Organizations. Be very careful who has access to this API endpoint.
      summary: Get all available Roles for a given Product in your AuthGroup
      operationId: getProductRoles
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: >-
            Unique user identifier
          required: true
          schema:
            type: string
        - name: search
          in: query
          description: keyword search across roles - not part of oData
          required: false
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    post:
      tags:
        - Roles
      description: Scoped to AuthGroup and available across all organizations when the applicable Product is assocaited to them. In other words, all organizations will see this role in their list of product roles. Roles associate Permissions to Users. There is a non-standard way of associating a permission to a Role. The property "permissions" takes an array of strings comprised of a concat of the Permission Ids and the Permission code. As an example, "3fa85f64-5717-4562-b3fc-2c963f66afa6 user::read:own" would be one string entry.
      summary: Create a new globally available Role
      operationId: createRole
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Unique product identifier
          required: true
          schema:
            type: string
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/roleWrite'
        description: Create a new role
        required: true
      security:
        - bearer: []
        - openId: []
  /api/{group}/products/{product}/roles/{id}:
    get:
      tags:
        - Roles
      description: Scoped to the AuthGroup and available across Organizations - it is possible to request any Role.
      summary: Return any Role by ID
      operationId: getRole
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Id of the associated product
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: Id of the role in question
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    patch:
      tags:
        - Roles
      description: This API will let you update any Role, including its assocaited permissions. All organizations in the AuthGroup will be affected by this API, be careful. There is a non-standard way of associating a permission to a Role. The property "permissions" takes an array of strings comprised of a concat of the Permission Ids and the Permission code. As an example, "3fa85f64-5717-4562-b3fc-2c963f66afa6 user::read:own" would be one string entry.
      summary: Update any Role regardless of scope (AuthGroup or Organization)
      operationId: updateRole
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Id of the associated product
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: Id of the role in question
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonPatch'
        description: Created user object
        required: true
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Roles
      description: This will allow you to delete any Role and will impact all Organizations in the AuthGroup, be careful. There are limits on Role deletions when the Accounts (users) have been assigned Roles. You may need to clear those assignments before you can delete.
      summary: Delete any Role in your AuthGroup associated to a Product
      operationId: deleteRole
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Id of the associated product
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: Id of the role in question
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/organizations:
    get:
      tags:
        - Organizations
      summary: Get all Organizations
      description: Returns all organizations (customers, departments, etc...) in an AuthGroup
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: search
          in: query
          description: keyword search across records - not part of oData
          schema:
            type: string
          required: false
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Organization
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/organization'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    post:
      tags:
        - Organizations
      summary: Create an Organization inside your AuthGroup
      description: Organizations allow you to create subsets of the AuthGroup users for access to specific products and domains. The most common use case for an Organization would be to represent your Customers. You can also create Organizations to define subsets of users for internal departments or other groupings. Organizations represent the primary mechanism to determine product access. In the example of defining a Customer as an Organization, you can select which of your products that Customer has licensed and associate them to the Organization through the associatedProducts property. Every Organization automatically has an Administrative Domain created to allow access to the UEAuth product. It is not recommended that you (or the organizatino admin) add users to this Administrative Domain other than those who you wish to manage users, domains and roles for the Organization.
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Organization
                  data:
                    $ref: '#/components/schemas/organization'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeOrganization'
        description: Create a new role
        required: true
      security:
        - bearer: []
        - openId: []
  /api/{group}/organizations/{id}:
    get:
      tags:
        - Organizations
      summary: Get Organization by Id
      description: Return a single Organization using its ID
      operationId: getOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: organization id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Organization
                  data:
                    $ref: '#/components/schemas/organization'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    patch:
      tags:
        - Organizations
      summary: Update an organization
      description: Update an organization's information.
      operationId: updateOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: organization id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Organization
                  data:
                    $ref: '#/components/schemas/organization'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonPatch'
        description: JSON Patch specific to your account object
        required: true
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Organizations
      summary: Delete an Organization
      description: There are limits on the ability to delete an organization that has already been assigned to users.
      operationId: deleteOrg
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: organization id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Organization
                  data:
                    $ref: '#/components/schemas/organization'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/organizations/{org}/domains/{id}:
    get:
      tags:
        - Organization Domains 
      summary: Get Domain by ID
      description: Return a single Domain from within an Organization
      operationId: getDomain
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization id guid
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: domain id guid
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Domain
                  data:
                    $ref: '#/components/schemas/domain'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    patch:
      tags:
        - Organization Domains 
      summary: Update a Domain
      description: Update a Domain's data
      operationId: updateDomain
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization id guid
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: domain id guid
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Domain
                  data:
                    $ref: '#/components/schemas/domain'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonPatch'
        description: Create a new role
        required: true
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Organization Domains 
      summary: Delete a Domain
      description: This will hard delete your Domain. There are limits on delete when a domain has been associated to a user. You may need to remove users first.
      operationId: deleteDomain
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization id guid
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: domain id guid
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Domain
                  data:
                    $ref: '#/components/schemas/domain'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/organizations/{org}/domains:
    get:
      tags:
        - Organization Domains 
      summary: Get all Domains by Organizations Id
      description: Returns all Domains within an Organization
      operationId: getDomains
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization id
          required: true
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Domain
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/domain'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    post:
      tags:
        - Organization Domains 
      summary: Create a Domain in a specified Organizations
      description: Domains allow you to further refine access within the context of an Organization. Domains are used as the primary association mechanism of Products to Users. In other words, if you wish a User to have access to a product, that user must be added to a Domain which already has that Product associated (the property is called associatedOrgProducts). Only those Products associated to the parent Organization are available to be associated to a child Domain. Every Organization automatically has an Administrative Domain created to allow access to the UEAuth product. It is not recommended that you add users to this Domain other than those who you wish to manage users, domains and roles.
      operationId: createDomain
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: organization id
          required: true
          schema:
            type: string
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Domain
                  data:
                    $ref: '#/components/schemas/domain'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writeDomain'
        description: Create a new role
        required: true
      security:
        - bearer: []
        - openId: []

  # Organization Permissions
  /api/{group}/organization/{org}/products/{product}/permissions:
    get:
      tags:
        - Organization Permissions
      summary: Get all Permissions for a Product which is associated to your Organization
      description: Returns all of the Permissions assocaited to this Product
      operationId: getOrgPermissions
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Organization context
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/organization/{org}/products/{product}/permissions/{id}:
    get:
      tags:
        - Organization Permissions
      summary: Get a permission by Id if the associated product is associated to your Organization
      description: Query a single Permission for its description, code and other meta data
      operationId: getOrgPermission
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Organization context
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: permission id guid
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/organization/{org}/products/{product}/roles/{role}/permissions:
    get:
      tags:
        - Organization Permissions
      description: Query and search the permissions tied to a specific role within a product and organization context.
      summary: Query and search the permissions tied to a specific role
      operationId: getOrgRolePermissions
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Unique product identifier
          required: true
          schema:
            type: string
        - name: org
          in: path
          description: Unique organization identifier
          required: true
          schema:
            type: string
        - name: role
          in: path
          description: Unique id of the role
          required: true
          schema:
            type: string
        - name: search
          in: query
          description: keyword search across roles - not part of oData
          required: false
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Permissions CRUD
  /api/{group}/products/{product}/permission:
    post:
      tags:
        - Permissions
      summary: Create a permission.
      description: Permissions have a many to one relationship to Products, meaning all Permissions must specify exactly one Product. Once created, a Permission can't be updated... you must delete it and create a new one. You will see references to a Permission's code in this and other UE Auth docs. This is refering to the shorthand and unique (within the AuthGroup and Product) encoding that UE Auth automatically creates for each permission object in the format of target::action:ownership. For a detailed explanation of Permissions in UE Auth, you may review this <a href='https://github.com/UnitedEffects/ueauth/wiki/UE-Auth-Permissions'>Wiki Document</a>.
      operationId: createPermission
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/writePermission'
        description: Create a new permission
        required: true
      security:
        - bearer: [ ]
        - openId: [ ]
  /api/{group}/products/{product}/permissions:
    get:
      tags:
        - Permissions
      summary: Get all Permissions for a Product
      description: Returns all of the Permissions assocaited to this Product
      operationId: getPermissions
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
        - name: search
          in: query
          description: this performs a standard keyword search - not part of odata
          required: false
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    post:
      tags:
        - Permissions
      summary: Create many permissions.
      description: Permissions have a many to one relationship to Products, meaning all Permissions must specify exactly one Product. Once created, a Permission can't be updated... you must delete it and create a new one. This API creates multiple permissions for a single product. For a detailed explanation of Permissions in UE Auth, you may review this <a href='https://github.com/UnitedEffects/ueauth/wiki/UE-Auth-Permissions'>Wiki Document</a>.
      operationId: createManyPermission
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
      responses:
        '201':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/writePermission'
        description: Create new pemrissions
        required: true
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Permissions
      summary: Bulk Delete Permissions
      description: Bulk delete permissions will remove all permissions identified by the array of UUIDs provided in the body as long as those permissions are not core=true (i.e. created by UE Auth itself). WARNING - this will not clear roles and can create orphan role references. This will be addressed in a future release but for now you must ensure this endpoint is not used on Ids with role references.
      operationId: bulkDeletePermissions
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
                format: uuid
        description: Remove all permissions by id in the array
        required: true

  /api/{group}/products/{product}/permissions/{id}:
    get:
      tags:
        - Permissions
      summary: Get a permission by Id
      description: Query a single Permission for its description, code and other meta data
      operationId: getPermission
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: permission id guid
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
    delete:
      tags:
        - Permissions
      summary: Delete a Permission
      description: Delete Permission will automatically clear all references from roles. Use /permissions/check/role to see which
      operationId: deletePermission
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: permission id guid
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/products/{product}/permissions/{id}/reference-check/role:
    get:
      tags:
        - Permissions
      summary: Find out how many roles reference this permission
      description: Find out how many roles reference this permission. Useful to run before a delete operation.
      operationId: checkRolesForPermission
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
        - name: id
          in: path
          description: permission id guid
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    type: object
                    properties:
                      totalReferences:
                        type: number
                      roleIds:
                        type: array
                        items:
                          type: string
                          format: uuid
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/products/{product}/roles/{role}/permissions:
    get:
      tags:
        - Permissions
      description: Query and search the permissions tied to a specific role within a product context.
      summary: Query and search the permissions tied to a specific role
      operationId: getRolePermissions
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Unique user identifier
          required: true
          schema:
            type: string
        - name: role
          in: path
          description: Unique id of the role
          required: true
          schema:
            type: string
        - name: search
          in: query
          description: keyword search across roles - not part of oData
          required: false
          schema:
            type: string
        - name: $filter
          in: query
          description: oData filter Query
          required: false
          schema:
            type: string
        - name: $select
          in: query
          description: oData select Query
          required: false
          schema:
            type: string
        - name: $orderby
          in: query
          description: oData orderby Query
          required: false
          schema:
            type: string
        - name: $skip
          in: query
          description: oData skip Query
          required: false
          schema:
            type: integer
        - name: $top
          in: query
          description: oData top Query
          required: false
          schema:
            type: integer
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Role
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/permission'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  /api/{group}/products/{product}/permission/actions:
    get:
      tags:
        - Permissions
      summary: Get all of the available Permission Actions for a Product
      description: Get all of the available Permission actions for a product. Note, there is no separate Actions table or collection. This API aggregates all Actions used across an AuthGroup and Product and returns them as a reference. To add new Actions, simply specify a previously unused Action when creating a Permission.
      operationId: getPermissionActions
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    type: object
                    properties:
                      id:
                        type: string
                        default: 'actions'
                      values:
                        type: array
                        items:
                          type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/products/{product}/permission/targets:
    get:
      tags:
        - Permissions
      summary: Get all of the available Permission Targets for a Product
      description: Get all of the available Permission targets for a product. Note, there is no separate Targets table or collection. This API aggregates all Targets used across an AuthGroup and Product and returns them as a reference. To add new Targets, simply specify a previously unused Target when creating a Permission.
      operationId: getPermissionTargets
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    type: object
                    properties:
                      id:
                        type: string
                        default: 'targets'
                      values:
                        type: array
                        items:
                          type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []
  /api/{group}/products/{product}/permission/tags:
    get:
      tags:
        - Permissions
      summary: Get all of the available Permission Tags for a Product
      description: Get all of the available Permission Tags for a product. Note, there is no separate Tags table or collection. This API aggregates all Tags used across an AuthGroup and Product and returns them as a reference. To add new Tags, simply specify a previously unused Tag when creating a Permission.
      operationId: getPermissionTags
      parameters:
        - name: group
          in: path
          description: Auth Group Id or name
          required: true
          schema:
            type: string
        - name: product
          in: path
          description: Product Id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                properties:
                  type:
                    type: string
                    example: Permission
                  data:
                    type: object
                    properties:
                      id:
                        type: string
                        default: 'targets'
                      values:
                        type: array
                        items:
                          type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/InvalidInput'
        '417':
          $ref: '#/components/responses/ExpectationFailed'
      security:
        - bearer: []
        - openId: []

  # Health Check Endpoint
  /api/health:
    get:
      tags:
        - System
      summary: Health check
      description: Health check
      responses:
        '200':
          description: GET successful
        '500':
          $ref: '#/components/responses/UnknownError'


servers:
  - url: http://localhost:3000
components:
  parameters:
    OrgContext:
      in: header
      name: x-org-context
      description: NOTE, HEADER PARAMETER - provides context to validate permissions. if left blank, the service will attempt to query the primary org of the user's AG and use that as the context. If an org context cannot be resolved, the request will be denied with a 403 forbidden
      schema:
        type: string
        format: uuid
      required: false
  responses:
    Forbidden:
      description: Request is forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/defaultError'
    BadRequest:
      description: Bad Request, try again
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/defaultError'
    NotFound:
      description: Requested object not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/defaultError'
    InvalidInput:
      description: Request is correct but one of your inputs is wrong
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/defaultError'
    ExpectationFailed:
      description: An expectation associated to the request failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/defaultError'
    Unauthorized:
      description: Unauthorized Access
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/defaultError'
    UnknownError:
      description: Unknown Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/defaultError'

  securitySchemes:
    basic:
      type: http
      description: email/username and password of the account
      scheme: basic
    bearer:
      type: http
      scheme: bearer
      description: 'For Bearer based tokens, simply enter the token (prefixing with "bearer" is not required).'
    openId:
      type: openIdConnect
      description: OIDC specific OAuth2 implementation. You should be accessing swagger or the api docs specific to your group to use this - /{group}/swagger or /{group}/api.
      openIdConnectUrl: http://example.com/group/.well-known/openid-configuration

  schemas:
    defaultError:
      required:
        - error
        - message
        - id
      properties:
        error:
          type: string
          description: Type of error
        message:
          type: string
          description: Additional information regarding the error
        id:
          type: string
          format: uuid
          description: Unique ID to help find the error in a logging stack

    operations:
      type: object
      required:
        - operation
      properties:
        operation:
          type: string
          enum:
            - rotate_secret
            - rotate_keys
            - rotate_cookie_keys
            - rotate_registration_access_token

    userOperations:
      type: object
      required:
        - operation
      properties:
        operation:
          type: string
          enum:
            - verify_account
            - password_reset
            - generate_password
            - clear_timeouts

    initialAccessTokenRequest:
      properties:
        email:
          type: string
          description: This adds an email address to the token, locking its use to a user with that email address only. useful when providing a token as part of an invite; however, this is not required in all cases. For example, you do not need this to use an IAT for OIDC client creation.
        sub:
          type: string
          description: This adds a userId to the token, locking its use to a user with that id only.
        expires:
          type: number
          description: Number of seconds after which this token expires. Default is 604800 (7 days).

    simpleIAT:
      type: object
      properties:
        state:
          type: string
          description: a value to tie the token to an external state

    initialAccessToken:
      properties:
        iat:
          type: number
          description: issue time
        exp:
          type: number
          description: expiration time
        kind:
          type: string
          default: "InitialAccessToken"
        jti:
          type: string
          description: the token
        email:
          type: string
          format: email
          description: if provided, this is the locked user email
        sub:
          type: string
          format: uuid
          description: if provided, this is the locked user id

    codeAuthorizationTokenRequest:
      type: object
      properties:
        grant_type:
          type: string
          description: Type of grant being requested, of which authorization_code is an example
          default: "authorization_code"
        client_secret:
          type: string
        redirect_uri:
          type: string
          format: uri
        code:
          type: string
          description: code recieved from authorization redirect
        client_id:
          type: string
        scope:
          type: string
        audience:
          type: string
        code_verifier:
          type: string
        resource:
          type: string
        client_assertion:
          type: string
        client_assertion_type:
          type: string
        x_organization_context:
          type: string
          description: Explicitly state which org the user is logging into regardless of overall access using the organization ID or associated externalID. Not part of the OIDC specification - used for UEAuth
        x_access_filter_organization:
          type: string
          description: Filter the response of the access scope to a single organization. Not part of the OIDC specification - used for UEAuth
        x_access_filter_domain:
          type: string
          description: Filter the response of the access scope to a single domain. Not part of the OIDC specification - used for UEAuth
        x_access_filter_product:
          type: string
          description: Filter the response of the access scope to a single product. Not part of the OIDC specification - used for UEAuth

    accessTokens:
      properties:
        access_token:
          type: string
          description: this is an access_token and is primarily used for API access
        expires_in:
          type: number
          description: when tokens expire
        id_token:
          type: string
          description: this is an id_token and is primarily used to idenitify a user via claims, not for use with APIs
        scope:
          type: string
          description: requested scopes delimited by spaces
        token_type:
          type: string

    getAccounts:
      properties:
        type:
          type: string
          enum: ['Account']
        data:
          type: array
          items:
            $ref: '#/components/schemas/accountObject'

    firstAccountWrite:
      description: the first account on a new auth group activates the group and creates a client
      properties:
        type:
          type: string
          enum: ['Account']
        data:
          $ref: '#/components/schemas/accountObject'
        authGroup:
          $ref: '#/components/schemas/authGroup'
        client:
          $ref: '#/components/schemas/clientObject'

    recoverAccountResponse:
      type: object
      properties:
        type:
          type: string
          enum: ['Account']
        data:
          $ref: '#/components/schemas/accountPlusCodes'


    getAccount:
      description: if the auth group is active, this is the response
      properties:
        type:
          type: string
          enum: ['Account']
        data:
          $ref: '#/components/schemas/accountObject'

    getClients:
      type: object
      properties:
        type:
          type: string
          enum: ['Client']
        data:
          type: array
          items:
            $ref: '#/components/schemas/clientObject'

    getClient:
      type: object
      properties:
        type:
          type: string
          enum: ['Client']
        data:
          $ref: '#/components/schemas/clientObject'

    writeClientObject:
      type: object
      required:
      - grant_types
      - response_types
      - redirect_uris
      properties:
        application_type:
          type: string
          default: web
          enum:
            - web
            - native
        grant_types:
          type: array
          default: []
          items:
            type: string
            enum:
             - authorization_code
             - implicit
             - refresh_token
             - client_credentials
        id_token_signed_response_alg:
          type: string
        post_logout_redirect_uris:
          type: array
          default: []
          items:
            type: string
            format: uri
        require_auth_time:
          type: boolean
          default: false
        response_types:
          type: array
          default: []
          items:
            type: string
            default: code
            enum:
              - code
              - id_token
              - token
        subject_type:
          type: string
        token_endpoint_auth_method:
          type: string
        introspection_endpoint_auth_method:
          type: string
        revocation_endpoint_auth_method:
          type: string
        client_name:
          type: string
          description: A name for the client that is unique within the authGroup
        client_label:
          type: string
          enum:
            - login
            - api
            - app
            - custom
            - product-key
        redirect_uris:
          type: array
          default: []
          items:
            type: string
            format: uri
        client_skip_consent:
          type: boolean
          default: false
          description: only use this for first-party clients (those you control directly)
        client_optional_skip_logout_prompt:
          type: boolean
          default: false
          description: this will skip the logout prompt and immediately logout
        associated_product:
          type: string
          format: uuid
          description: the Product associated to this Client
        register_url:
          type: string
          format: uri
          description: used to populate the href for the register link on login using this client
        tos_url:
          type: string
        policy_url:
          type: string
        client_federation_options:
          type: array
          items:
            type: string
            example: 'oidc.google.my_google_connection'
            description: a representation of the AuthGroup federation option as specification.provider.name
        client_allow_org_federation:
          type: boolean
          default: false
          description: when enabled, this allows an organization to issue their own custom SSO to login
        client_allow_org_self_identify:
          type: boolean
          default: false
          description: when enabled, login starts with a form that asks the user to enter an org id or alias

    clientObject:
      type: object
      required:
        - application_type
        - grant_types
        - response_types
        - client_id
        - client_name
        - client_secret
        - redirect_uris
        - auth_group
      description: this may not be all inclusive, consult the most current oidc specification
      allOf:
        - $ref: '#/components/schemas/writeClientObject'
      properties:
        request_uris:
          type: array
          default: []
          items:
            type: string
            format: uri
        client_id_issued_at:
          type: integer
        client_id:
          type: string
          description: GUID
        client_secret_expires_at:
          type: integer
          default: 0
        client_secret:
          type: string
          format: password
          description: Auto Generated Secret
        auth_group:
          type: string
          description: the tenant ID (or prettyName) for the authorization group of clients, accounts and oidc configs
        registration_client_uri:
          type: string
          description: the oidc spec client access url for api calls
          format: uri
        registration_access_token:
          type: string
          description: Required to POST or PUT updates to clients if not the authGroup owner. Rotates on each call.

    clientObjectUpdate:
      type: object
      required:
      - application_type
      - grant_types
      - response_types
      - client_id
      - client_name
      - redirect_uris
      - auth_group
      description: this may not be all inclusive, consult the most current oidc specification
      allOf:
        - $ref: '#/components/schemas/writeClientObject'
      properties:
        request_uris:
          type: array
          default: []
          items:
            type: string
            format: uri
        client_id_issued_at:
          type: integer
        client_id:
          type: string
          description: GUID
        client_secret_expires_at:
          type: integer
          default: 0
        client_secret:
          type: string
          format: password
          description: Auto Generated Secret
        auth_group:
          type: string
          description: the tenant ID (or prettyName) for the authorization group of clients, accounts and oidc configs

    userInfoObject:
      type: object
      additionalProperties: true
      required:
        - sub
        - group
        - email
      properties:
        sub:
          type: string
          description: the userId of the account
        group:
          type: string
          description: the auth group id the account belongs to
        email:
          type: string
          format: email
        username:
          type: string
        verified:
          type: boolean
          description: if the account has been verified via external email or text message

    minimalAccountsInfo:
      type: array
      items:
        type: object
        properties:
          id:
            type: string
            format: uuid
          email:
            type: string
            format: email

    searchAccounts:
      type: object
      properties:
        exact:
          $ref: '#/components/schemas/minimalAccountsInfo'
        like:
          $ref: '#/components/schemas/minimalAccountsInfo'

    accountPlusCodes:
      type: object
      allOf:
        - $ref: '#/components/schemas/accountObject'
      properties:
        codes:
          type: array
          items:
            type: string
            description: these are your new recovery codes, do not lose them


    accountObject:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          format: uuid
          description: guid for this account
        createdAt:
          type: string
          format: date-time
          description: when the account was created
        modifiedAt:
          type: string
          format: date-time
          description: when was the account last modified
        modifiedBy:
          type: string
          description: Id of last modifier
        authGroup:
          type: string
          description: group ID for this account. email addresses are unique to auth groups.
        verified:
          type: boolean
          description: whether or not the account was verified
        blocked:
          type: boolean
          description: root level block of the user from access to the authGroup
        mfa:
          type: object
          properties:
            enabled:
              type: boolean
        acceptingProfileRequests:
          type: boolean
        myNotifications:
          type: object
          properties:
            profileRequests:
              type: boolean
              description: You can silence device notifications for profile requests
              default: true
        active:
          type: boolean
          description: status of the account
      allOf:
        - $ref: '#/components/schemas/refWriteAccount'

    refWriteAccount:
      type: object
      properties:
        username:
          type: string
          description: optional identifier, must be unique in the authGroup. If not provided, set to email.
        email:
          type: string
          description: email address
        password:
          type: string
          description: this is a password
        phone:
          type: object
          properties:
            txt:
              type: string
              pattern: '\+(9[976]\d|8[987530]\d|6[987]\d|5[90]\d|42\d|3[875]\d|2[98654321]\d|9[8543210]|8[6421]|6[6543210]|5[87654321]|4[987654310]|3[9643210]|2[70]|7|1)\d{1,14}$'
              description: used for notifications. only visible to the user in question.
        metadata:
          type: object
          description: additional context provided by the implementer.

    writeAccountByOrg:
      type: object
      additionalProperties: false
      required:
        - email
      properties:
        email:
          type: string
          format: email
        username:
          type: string
        profile:
          description: you can use profile data to initilize an organization profile for this Account
          allOf:
            - $ref: '#/components/schemas/refSecuredProfileWrite'
          properties:
            externalId:
              type: string
              description: used to associate this Organization User to an internal record of the user in an HCM or other system

    writeAccountProfile:
      type: object
      additionalProperties: false
      properties:
        profile:
          type: object
          description: These are used to initialize a secured profile. Access is restricted to the Account holder after creation.
          properties:
            givenName:
              type: string
            familyName:
              type: string
            displayName:
              type: string
            picture:
              type: string
              format: uri

    importAccount:
      type: object
      additionalProperties: false
      required:
        - email
      properties:
        id:
          type: string
          format: uuid
          description: if provided, the system will attempt to use this ID as long as it is unique.
        username:
          type: string
          description: optional identifier, must be unique in the authGroup. If not provided, set to email.
        email:
          type: string
          description: email address
        phone:
          type: object
          properties:
            txt:
              type: string
              pattern: '\+(9[976]\d|8[987530]\d|6[987]\d|5[90]\d|42\d|3[875]\d|2[98654321]\d|9[8543210]|8[6421]|6[6543210]|5[87654321]|4[987654310]|3[9643210]|2[70]|7|1)\d{1,14}$'
              description: used for notifications. only visible to the user in question.

    writeAccount:
      type: object
      additionalProperties: false
      required:
        - email
      allOf:
        - $ref: '#/components/schemas/refWriteAccount'
        - $ref: '#/components/schemas/writeAccountProfile'
      properties:
        generatePassword:
          type: boolean
          description: if false, password field is required; otherwise, a 32 char password is generated
        profile:
          type: object
          description: These are used to initialize a secured profile. Access is restricted to the Account holder after creation.
          properties:
            givenName:
              type: string
            familyName:
              type: string
            displayName:
              type: string
            picture:
              type: string
              format: uri

    writeAuthGroup:
      type: object
      additionalProperties: false
      required:
        - name
        - owner
        - prettyName
        - primaryDomain
        - primaryEmail
      properties:
        name:
          type: string
          description: name of the entity, org, or company creating this group
        prettyName:
          type: string
          description: URL friendly alternative name that can be used instead of the id when referencing the group
          pattern: '^[a-zA-Z0-9-_]*$'
        owner:
          type: string
          format: email
          description: Required to match to the first account added. Will be changed to account uuid after connection.
        locked:
          type: boolean
          default: false
          description: If true, no one can self register an account without an initial access code provided by an admin of the group.
        metadata:
          type: object
          description: extend this with additional data if needed
        config:
          $ref: '#/components/schemas/agConfigOptions'
        pluginOptions:
          $ref: '#/components/schemas/agPluginOptions'
        primaryDomain:
          type: string
          format: uri
          description: primary domain url
        primaryTOS:
          type: string
          format: uri
          description: link to your company terms of service
        primaryPrivacyPolicy:
          type: string
          format: uri
          description: link to your company privacty policy
        primaryEmail:
          type: string
          format: email
          description: this should be a contact email for your authgroup for assistance or inquiry
        registerUrl:
          type: string
          format: uri
          description: link to your company primary registration link, if one exists. This will be overrided by client registration links.

    agPluginOptions:
      type: object
      description: these are plugin configurations
      additionalProperties: false
      properties:
        webAuthN:
          type: object
          properties:
            enable:
              type: boolean
            type:
              type: string
            meta:
              type: object
        externalStreaming:
          type: object
          properties:
            enabled:
              type: boolean
              default: false
        notification:
          type: object
          properties:
            enabled:
              type: boolean
              default: false
              description: allows notifications to be sent from the authgroup
            ackRequiredOnOptional:
              type: boolean
              default: false
              description: some notifications are not absolutely required for functionality, if this is false, that functionality will continue and a warning will be sent on notificiation failure. If this is true, the functionality will fail on a notification fail.

    agConfigOptions:
      type: object
      description: these configurations alter how OIDC is processed
      additionalProperties: false
      properties:
        #keys:
        #  type: array
        #  description: These are the encryption keys of the authgroup. Manual entry is not recommended.
        logEventGroups:
          type: object
          description: these groupings represent events that will either be written to console or streamed (depending on config) when true
          properties:
            general:
              type: boolean
            accessToken:
              type: boolean
            authorization:
              type: boolean
            backchannel:
              type: boolean
            clientCredentials:
              type: boolean
            deviceCode:
              type: boolean
            session:
              type: boolean
            grant:
              type: boolean
            iat:
              type: boolean
            uiInteraction:
              type: boolean
            replayDetection:
              type: boolean
            pushedAuthorization:
              type: boolean
            refreshToken:
              type: boolean
            registration:
              type: boolean
            account:
              type: boolean
            group:
              type: boolean
            pluginNotification:
              type: boolean
            organization:
              type: boolean
            domain:
              type: boolean
            product:
              type: boolean
            access:
              type: boolean
            role:
              type: boolean
            permission:
              type: boolean
            orgProfile:
              type: boolean
            securedProfile:
              type: boolean
        ttl:
          type: object
          description: milliseconds before expiration on all properties
          properties:
            accessToken:
              type: number
              default: 3600
            authorizationCode:
              type: number
              default: 600
            clientCredentials:
              type: number
              default: 3600
            deviceCode:
              type: number
              default: 3600
            idToken:
              type: number
              default: 3600
            refreshToken:
              type: number
              default: 86400
            interaction:
              type: number
              default: 3600
            session:
              type: number
              default: 864000
            grant:
              type: number
              default: 864000
        defaultLogoutRedirect:
          type: string
          description: when clients logout of any app, if a redirect for the logout is not defined, this is the default.
        defaultLogoutName:
          type: string
          description: text to display with default logout redirect
        globalSkipLogoutConfirm:
          type: boolean
          default: false
        globalSkipAuthorize:
          type: boolean
          default: false
        requireVerified:
          type: boolean
          default: false
          description: when true, this ensures that only verified accounts can complete a login
        autoVerify:
          type: boolean
          default: false
          description: when true, this sends a notification to a new account to verify automatically - MUST have notifications enabled first
        passwordLessSupport:
          type: boolean
          default: false
          description: when true, this allows magic link emails for login - MUST have notification enabled first
        centralPasswordReset:
          type: boolean
          default: true
          description: when true, this allows enables the centrally served password reset UI to be accessed publicaly
        scopes:
          type: array
          description: these are scopes that will be availabl to all clients within your authgroup oidc provider
          items:
            type: string
        acrValues:
          type: array
          items:
            type: string
        deviceFlow:
          type: boolean
          description: activates device flow for devices without browsers. EXPERIENCE NOT FULLY IMPLEMENTED
        pkceRequired:
          type: boolean
          description: when this is true, only pkce logins are possible
          example: false
          default: false
        mfaChallenge:
          type: object
          properties:
            enable:
              type: boolean
              default: false
              description: This enables MFA for the AuthGroup assuming it has been enabled for the Platform
            required:
              type: boolean
              default: false
              description: If this is true, all logins must have MFA enabled and will be onboarded at the first opportunity
            noPassLogin:
              type: boolean
              default: true
              description: If this is true, the challenge app can be used to sign-in without a password. When false, it is only used for MFA.
            type:
              type: string
              description: This is an indication of the MFA provider and must be the same as what is availble from global plugins
              example: privakey
              enum:
                - http-proxy
                - privakeysuper
            meta:
              type: object
              description: This is an area designated for metadata such as provider ids, secrets, etc. As an example, for the privakey integration, use meta to store 'privakeyLoginId', 'privakeyClient' and 'privakeySecret'.
        federate:
          type: object
          properties:
            saml:
              type: array
              items:
                $ref: '#/components/schemas/federatedSAML'
            oidc:
              type: array
              items:
                $ref: '#/components/schemas/federatedOIDC'
            oauth2:
              type: array
              items:
                $ref: '#/components/schemas/federatedOAuth2'
        restrictPasswordRepeats:
          type: boolean
          default: false
        failedLoginThresholds:
          type: object
          properties:
            enabled:
              type: boolean
              default: false
            threshold:
              type: number
              default: 5
            duration:
              type: number
              description: how many hours should the account be temporarily locked?
              default: 2
        passwordPolicy:
          type: object
          description: this will be enforced for all password creates and updates in your authgroup
          properties:
            enabled:
              type: boolean
            pattern:
              type: object
              properties:
                characters:
                  type: number
                  example: 6
                special:
                  type: boolean
                  example: true
                number:
                  type: boolean
                  example: false
                caps:
                  type: boolean
                  example: false
                custom:
                  type: string
                  description: a regular expression. make sure it will compile
        ui:
          type: object
          properties:
            meta:
              type: object
              description: this object can be used to define customization of any specific UI implementation
            skin:
              type: object
              properties:
                backgroundImage:
                  type: string
                  description: this is a placeholder for a UI backdrop but is not directly used by this library aside from providing the reference
                  format: uri
                splashImage:
                  type: string
                  description: this is the splash image used on login and authorization screens. there is a system default
                  format: uri
                logo:
                  type: string
                  description: a logo for the top of the login and authorize screens. best at 40x40 pixels
                  format: uri
                favicon:
                  type: string
                  description: a favicon to use with the portal specific to the AG brand. Must be square and no more than 500px
                  format: uri
                loginOrientation:
                  type: string
                  enum:
                    - right
                    - left
                    - middle
                  description: choose which way the screen inputs are oriented
                bgGradientLow:
                  type: string
                  description: this is the background color lower end gradient color
                bgGradientHigh:
                  type: string
                  description: this is the background color higher end gradient color

    authGroup:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          example: V1StGXR8_Z5jdHi6B-myT
          description: nanoid for this account
        createdAt:
          type: string
          format: date-time
          description: when the account was created
        modifiedAt:
          type: string
          format: date-time
          description: when was the account last modified
        modifiedBy:
          type: string
          description: id of last modifier
        active:
          type: string
      allOf:
        - $ref: '#/components/schemas/writeAuthGroup'
        - $ref: '#/components/schemas/agAliasDns'

    authGroupInitial:
      type: object
      allOf:
        - $ref: '#/components/schemas/authGroup'
      properties:
        securityExpiration:
          type: string
          format: date-time
          description: when this auth group will expire if it is not connected to the owner account and activated
        initialAccessToken:
          type: string
          description: bearer token to use when first connecting an account

    agAliasDns:
      type: object
      additionalProperties: false
      properties:
        aliasDnsUi:
          type: string
          description: an alias DNS domain (example.com) that the authgroup may claim. This simply provides a record and does not actually implement custom domain check and dns registration functionality.
          format: uri
        aliasDnsOIDC:
          type: string
          description: an alias DNS domain other than the aliasDnsUi (oidc.example.com) that the authgrup may claim for centralized UI interactions of the OIDC provider. This alias only applies to UI interactions and centralized screens, API calls will not work. This simply provides a record and does not actually implement custom domain check and dns registration functionality.
          format: uri


    getGroup:
      properties:
        type:
          type: string
          enum:
            - Auth Group
        data:
          $ref: '#/components/schemas/authGroup'

    getGroups:
      properties:
        type:
          type: string
          enum:
            - Auth Group
        data:
          $ref: '#/components/schemas/authGroup'

    globalPlugins:
      type: object
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          type: string
          format: date-time
        createdBy:
          type: string
          description: User Id of the person who created latest update config
        notifications:
          type: object
          properties:
            enabled:
              type: boolean
            notificationServiceUri:
              type: string
              description: the url of your service to which we post
            registeredClientId:
              type: string
        eventStream:
          type: object
          properties:
            enabled:
              type: boolean
            provider:
              type: object
              properties:
                type:
                  type: string
                  enum:
                    - pulsar
                restAuth:
                  type: boolean
                streamAuth:
                  type: boolean
                masterAuth:
                  type: boolean
                  default: false
                  description: will you need auth to publish to the master stream?
                masterStream:
                  type: object
                  description: the master stream is a data stream that UEAuth can write transaction information to that exists outside the context of any one authgroup. For example, when a new Auth Group is created, it would be published to this stream so that other systems can react to the creation.
                  properties:
                    enabled:
                      type: boolean
                      default: false
                    streamPath:
                      type: string
                      description: this is the topic or stream address to publish master stream content
                auth:
                  type: object
                  description: information about the oauth2 resource client generated for this plugin
                adminUrl:
                  type: string
                  format: uri
                streamUrl:
                  type: string
                  format: uri
                lockStreamingOnceActive:
                  type: boolean
                  example: false
                  description: when this is active, an AG admin can turn on event streaming but is unable to deactivate without a root user
                enableValidation:
                  type: boolean
                  description: if active, every message sent is validated for correct schema
                  default: false
                externalEventBodySchemaUrl:
                  type: string
                  format: uri
                  description: if you are using an external json schema provider to validate schema. only applicable if enableValidation is set to true
                setupConfig:
                  type: object
                  description: the example is pulsar specific and for pulsar, clusterList is required
                  example:
                    adminRoles: []
                    clusterList: ['dev-cluster']
                clientConfig:
                  type: object
                  description: the example is pulsar specific - this is not a required input as defaults are present
                  example:
                    operationTimeoutSeconds: 30
                    ioThreads: 1
                    tlsTrustCertsFilePath: /my/path
                    tlsValidateHostname: false
                    tlsAllowInsecureConnection: false

        mfaChallenge:
          type: object
          properties:
            enabled:
              type: boolean
            providers:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    enum:
                      - http-proxy
                      - privakey
                  api:
                    type: object
                    description: endpoints for the interface functions
                    properties:
                      domain:
                        type: string
                        format: uri
                        description: This is the domain of your mfa provider proxy
                        example: "https://yourproviderendpoint.com"
                      challenge:
                        type: string
                        description: This is the endpoint path used to send the mfa challenge to the end user
                        example: "/challenge/path"
                      validate:
                        type: string
                        description: This is an endpoint path used to validate callback requests from the provider
                        example: "/validate/path"
                      bind:
                        type: string
                        description: This is an endpoint path used to map the account ID of the user to the MFA account/device
                        example: "/bind/path"
                      devices:
                        type: string
                        description: This is an endpoint path used to return all registered devices of the MFA account
                        example: "/devices/path"
                      revoke:
                        type: string
                        description: This is an endpoint path used to revoke a device identified by ID of the MFA account
                        example: "/revoke/path"
                  proxyClientId:
                    type: string
                    format: uuid
                    description: this is only present if the configuration is http-proxy
                  proxyEnableScreen:
                    type: string
                    format: uri
                    description: If this is an http-proxy mfa setup, you will need to open a web page where you handle the device connection, through your proxy service. This is usually presented as instructions and a QR code. UE Auth will send the JSON results of the bind API call to this request via query parameters.
                    example: 'https://example.com/complete/setup'
                  proxyEnableScreenButtonText:
                    type: string
                    description: This is the text used on the button that links to the enablement screen
                  proxyEnableInstructions:
                    type: string
                    description: UE Auth will display this text as instructions if desired. New lines can be represented with '--'

    notification:
      type: object
      allOf:
        - $ref: '#/components/schemas/writeNotification'
      properties:
        id:
          type: string
          format: uuid
          description: system generated id of the notification
        createdAt:
          type: string
          format: date-time
          description: when the notification was created
        createdBy:
          type: string
          description: userId of the creator
        processed:
          type: boolean
          description: indicates whether or not this notification was successfully sent to the plugin service
        iss:
          type: string
          description: a record of the UE Auth issuer address
        authGroupId:
          type: string
          description: Auth Group ID (not prettyName) associated to the notification
        destinationUri:
          type: string
          description: plugin service http address the request was sent to
        organization:
          type: string
          description: the organization context that the notification was created

    writeNotification:
      type: object
      additionalProperties: false
      description: This will result in a request to an external notification processing service of your choice (see README for notification Plugin)
      required:
        - type
      properties:
        type:
          type: string
          description: supported notification types
          enum:
            - general
            - forgotPassword
            - passwordless
            - verify
        formats:
          type: array
          description: intended formats for this notification - sent to the plugin service
          items:
            type: string
            enum:
              - email
              - sms
        recipientUserId:
          type: string
          description: userId of the intended recipient
        recipientEmail:
          type: string
          description: email address of the intended recipient
        recipientSms:
          type: string
          description: mobile phone number of the intended recipient
        screenUrl:
          type: string
          description: optional field to direct the recipient to a specific screen - automatically populated based on type if not provided
          format: uri
        subject:
          type: string
          description: a subject line for the recipient
        message:
          type: string
          description: a message for the recipient
        meta:
          type: object
          description: any addtional metadata that should go with this

    verifyEmail:
      additionalProperties: false
      required:
        - email
      properties:
        email:
          type: string
          format: email
          description: the unique email address

    passwordReset:
      additionalProperties: false
      description: Send a unique email address and choose email, sms or both for the reset link to be sent. Email must already be associated to the account. If no preference is picked, all associated data is used. This must be associated with the AuthGroup in the url.
      required:
        - email
      properties:
        email:
          type: string
          format: email
          description: the unique email address
        formats:
          type: array
          items:
            type: string
            enum: ['email', 'sms']

    jsonPatch:
      additionalProperties: false
      description: Details for JSONPatch can be found at http://jsonpatch.com/
      type: array
      items:
        type: object
        description: Reference the update model for the full paths to update
        oneOf:
          - required:
            - op
            - path
            - value
            properties:
              op:
                type: string
                enum: ['replace', 'add', 'remove', 'test']
              path:
                type: string
                description: 'A path to the property in the data model. For example /name/firstName or /emails/-'
              value:
                type: object
                description: 'The object to set the property at the above path to'
          - required:
              - op
              - path
              - value
            properties:
              op:
                type: string
                enum: [ 'replace', 'add', 'remove', 'test' ]
              path:
                type: string
                description: 'A path to the property in the data model. For example /name/firstName or /emails/-'
              value:
                type: array
                description: 'The array to set the property at the above path to'
                items:
                  oneOf:
                    - type: string
                    - type: object
                    - type: number
          - required:
            - op
            - path
            - value
            properties:
              op:
                type: string
                enum: ['replace', 'add', 'remove', 'test']
              path:
                type: string
                description: 'A path to the property in the data model. For example /name/firstName or /emails/-'
              value:
                type: string
                description: 'The string, array or object to set the property at the above path to'
          - required:
            - op
            - path
            - value
            properties:
              op:
                type: string
                enum: ['replace', 'add', 'remove', 'test']
              path:
                type: string
                description: 'A path to the property in the data model. For example /name/firstName or /emails/-'
              value:
                type: boolean
          - required:
            - op
            - path
            - value
            properties:
              op:
                type: string
                enum: ['replace', 'add', 'remove', 'test']
              path:
                type: string
                description: 'A path to the property in the data model. For example /name/firstName or /emails/-'
              value:
                type: integer
                description: 'The integer, array or object to set the property at the above path to'
          - required:
            - op
            - path
            properties:
              op:
                type: string
                enum: ['remove']
              path:
                type: string
                description: 'A path to the property in the data model. For example /name/firstName or /emails/-'
          - required:
            - op
            - from
            - path
            properties:
              op:
                type: string
                enum: ['copy', 'move']
              from:
                type: string
                description: 'Path to copy or move from'
              path:
                type: string
                description: 'Path to copy or move to'

    writeOrgUserProfile:
      type: object
      additionalProperties: false
      allOf:
        - $ref: '#/components/schemas/securedProfileWrite'
      properties:
        externalId:
          type: string
          description: used to associate this Organization User to an internal record of the user in an HCM or other system

    orgUserProfile:
      type: object
      description: Organization User Profiles are unique only to the Organization but reference a single unique Account in the AuthGroup. One Account could have as many Organization User Profiles as there are Organizations to which the Account has been given access.
      allOf:
        - $ref: '#/components/schemas/securedProfile'
      properties:
        externalId:
          type: string
          description: used to associate this Organization User to an internal record of the user in an HCM or other system
        organization:
          type: string
          format: uuid
          description: organization id this profile is associated to

    refSecuredProfileWrite:
      type: object
      additionalProperties: false
      properties:
        givenName:
          type: string
          description: the User's given name
        familyName:
          type: string
          description: often the last name or equivalent
        displayName:
          type: string
          description: preferred display name of the user - sometimes a nickname
        personalHeader:
          type: string
        bio:
          type: string
          description: optional block of text about the user
        picture:
          type: string
          description: URI to an image for profile use
          example: https://example-cdn.com/id-of-your-image.jpeg
        address:
          type: object
          description: primary address of the account
          properties:
            street1:
              type: string
            street2:
              type: string
            city:
              type: string
            state:
              type: string
            postalCode:
              type: string
            country:
              type: string
        employer:
          type: string
        title:
          type: string
        position:
          type: string
        additionalEmails:
          type: array
          items:
            type: object
            properties:
              label:
                type: string
              email:
                type: string
                format: email
        contactNumbers:
          type: array
          items:
            type: object
            properties:
              label:
                type: string
              number:
                type: string

    securedProfileWrite:
      type: object
      required:
        - accountId
      allOf:
        - $ref: '#/components/schemas/refSecuredProfileWrite'
      additionalProperties: false
      properties:
        accountId:
          type: string
          format: uuid
          description: user ID

    securedProfile:
      type: object
      allOf:
        - $ref: '#/components/schemas/securedProfileWrite'
      properties:
        id:
          type: string
          format: uuid
          description: id of the profile (NOT THE ACCOUNT)
        authGroup:
          type: string
          description: reference to the UEAuth Auth Group
        modifiedAt:
          type: string
          format: date-time
        createdAt:
          type: string
          format: date-time
        createdBy:
          type: string
        modifiedBy:
          type: string

    writeAccess:
      type: object
      properties:
        domains:
          type: array
          items:
            type: string
            format: uuid
        roles:
          type: array
          items:
            type: string
            format: uuid

    access:
      type: array
      items:
        type: object
        properties:
          organization:
            type: object
            allOf:
              - $ref: '#/components/schemas/writeAccess'
            properties:
              id:
                type: string
                format: uuid

    updateUserAccess:
      properties:
        id:
          type: string
          description: user/account id
          format: uuid
        access:
          $ref: '#/components/schemas/access'

    userAccessAction:
      allOf:
        - $ref: '#/components/schemas/updateUserAccess'
      properties:
        organization:
          type: string
          format: uuid
          description: organization that action occurred against
        action:
          type: string
          description: what happened

    writeClientAccess:
      type: object
      description: array of roles to assocaite to the client
      additionalProperties: false
      properties:
        roles:
          type: array
          items:
            type: string
            format: uuid


    clientAccess:
      properties:
        id:
          type: string
          format: uuid
          description: the ID fo the client
        authGroup:
          type: string
          description: the ID of the AuthGroup
        access:
          type: object
          properties:
            product:
              type: string
              format: uuid
              description: the associated product
            roles:
              type: array
              items:
                type: string
                format: uuid
                description: role ids

    valClientAccess:
      properties:
        sub:
          type: string
          description: client Id
          format: uuid
        type:
          type: string
          example: client
        authGroup:
          type: object
          properties:
            id:
              type: string
            member:
              type: boolean
              example: true
        access:
          type: object

    userAccess:
      properties:
        sub:
          type: string
          description: user/account id
          format: uuid
        type:
          type: string
          example: user
        authGroup:
          type: object
          properties:
            id:
              type: string
            owner:
              type: boolean
              example: false
              description: if true, this person owns the authgroup
            member:
              type: boolean
              example: true
              description: if true, this person belongs to this authgroup - expect this to usually be true
        access:
          $ref: '#/components/schemas/access'

    writeProduct:
      type: object
      additionalProperties: false
      required:
        - name
      properties:
        name:
          type: string
          description: name of the product
        description:
          type: string
          description: explain what the product does
        associatedClients:
          type: array
          items:
            type: string
            format: uuid
          description: array of OIDC client Ids that may be associated to this business definition of a product
        b2c:
          type: boolean
          description: if this is true, the product is concidered b2c and it will show up on all user "my products" lists
        url:
          type: string
          format: uri
          description: the url of this product
        core:
          type: boolean
          default: false
          description: only root users are allowed to set this true
        type:
          type: string
          description: optional categorization of the product
          enum:
            - global
            - app
            - service
            - module
            - domain
            - entity
            - other

    myProducts:
      type: object
      properties:
        id:
          type: string
          format: uuid
        codedId:
          type: string
        name:
          type: string
          description: the name of the product
        description:
          type: string
          description: an overview of the product, if provided
        url:
          type: string
          description: the url of the product

    product:
      type: object
      allOf:
        - $ref: '#/components/schemas/writeProduct'
      properties:
        id:
          type: string
          format: uuid
          description: unique id of the product - globally unique
        codedId:
          type: string
          description: this is a 10 character small id that is unique to the authgroup and can be used in place of id
        modifiedAt:
          type: string
          format: date-time
        createdAt:
          type: string
          format: date-time
        createdBy:
          type: string
        modifiedBy:
          type: string

    role:
      type: object
      oneOf:
        - $ref: '#/components/schemas/roleWrite'
      properties:
        id:
          type: string
          format: uuid
        codedId:
          type: string
          description: this is a small 10 char id unique to authgroup/product that can be used in place of id
        updateAt:
          type: string
          format: date-time
        createdAt:
          type: string
          format: date-time
        modifiedBy:
          type: string
        createdBy:
          type: string
        product:
          type: string
          format: uuid
          description: product associated
        productCodedId:
          type: string
          description: this is the codedId of the product
        custom:
          type: boolean
          default: false
        organization:
          type: string
          format: uuid
          description: organization this role is associated to if this is custom
        authGroup:
          type: string

    roleWrite:
      type: object
      additionalProperties: false
      required:
        - name
      properties:
        name:
          type: string
          description: roles name
        description:
          type: string
          description: roles description
        core:
          type: boolean
          default: false
          description: must be a root user to set core true
        permissions:
          type: array
          items:
            type: string
            example: "3fa85f64-5717-4562-b3fc-2c963f66afa6 target::action:own"
            description: this is a concatenation of the permission ID and its code

    organization:
      type: object
      allOf:
        - $ref: '#/components/schemas/writeOrganization'
      properties:
        id:
          type: string
          format: uuid
        modifiedAt:
          type: string
          format: date-time
        createdAt:
          type: string
          format: date-time
        modifiedBy:
          type: string
        createdBy:
          type: string
        authGroup:
          type: string
        active:
          type: boolean
        associatedProducts:
          description: these are products for which the organization has purchased a license
          type: array
          items:
            type: string
            description: unique IDs of the product from the global list associated to the authgroup

    writeOrganization:
      type: object
      additionalProperties: false
      required:
        - name
        - description
        - contactEmail
      description: An organization is a tenant within an AuthGroup
      properties:
        externalId:
          type: string
          description: If an external system manages sales/billing of organizations, you can link with this
        alias:
          type: string
          description: human readable word that represents the organization - e.g. slug
        name:
          type: string
          description: organization name
        description:
          type: string
          description: brief overview of the org in question
        type:
          type: string
          description: what kind of organization is this?
          default: customer
          example: customer
          enum:
            - external
            - customer
            - internal
            - other
        contactName:
          type: string
          description: full name of the contact
        contactAddress:
          type: string
        contactPhone:
          type: string
        contactEmail:
          type: string
          format: email
        restrictEmailDomains:
          type: boolean
          description: toggle restrictions on email domains in emailDomain list
        emailDomains:
          type: array
          items:
            type: string
            description: email domains that are allowed
            example: example.com
        access:
          type: object
          properties:
            required:
              type: boolean
              default: false
              description: if set to true, users which are added must agree to terms of access
            terms:
              type: string
              description: the terms of access which must be accepted. this should be either a text block or a url
            termsVersion:
              type: string
              description: optional method to version your terms. recommended if you want to update them later
            disableAccessOnChange:
              type: boolean
              description: if this is true, everytime the termsVersion changes, everyone loses access until they accept. Otherwise, a simple notification is created.
        profileNotifications:
          type: boolean
          description: When this is set to true, any Organization User Profile creation or update events result in a notification to the associated Account (user)
          default: false
        ssoLimit:
          type: boolean
          description: when true, all other login options are removed from the screen in favor of the sso option provided
        ssoAddAccountToOrg:
          type: boolean
          description: when true, a user logging in to a product with org specified is automatically added to the organization, assuming email domain restrictions do not prevent the add
        ssoEmailDomain:
          type: string
          example: example.com
          description: this is a unique SSO email domain for the organization
        sso:
          type: object
          description: while the API may define multiple options, you can only ever have one of these at a time on an organization
          properties:
            saml:
              $ref: '#/components/schemas/ssoSamlSpec'
            oidc:
              $ref: '#/components/schemas/ssoOidcSpec'
            oauth2:
              $ref: '#/components/schemas/ssoOAuth2Spec'
        meta:
          type: string
          description: additional custom structured information

    domain:
      type: object
      additionalProperties: false
      allOf:
        - $ref: '#/components/schemas/writeDomain'
      properties:
        id:
          type: string
          format: uuid
        modifiedAt:
          type: string
          format: date-time
        createdAt:
          type: string
          format: date-time
        modifiedBy:
          type: string
        createdBy:
          type: string
        authGroup:
          type: string
        organization:
          type: string
        active:
          type: boolean
          example: true
        associatedOrgProducts:
          type: array
          items:
            type: string
            description: products associated to the org, now associated to the domain

    writeDomain:
      type: object
      additionalProperties: false
      required:
        - name
      properties:
        name:
          type: string
        description:
          type: string
        externalId:
          type: string
          description: linking to external systems

    permission:
      type: object
      additionalProperties: false
      allOf:
        - $ref: '#/components/schemas/writePermission'
      properties:
        id:
          type: string
          format: uuid
        codedId:
          type: string
          description: small nano id for easy reference. unique to authgroup and product
        product:
          type: string
          description: the id of the associated product
          format: uuid
        createdAt:
          type: string
          format: date-time
        createdBy:
          type: string

    writePermission:
      type: object
      additionalProperties: false
      required:
        - target
        - action
      properties:
        target:
          type: string
          description: the target in the system to which an action is attributed
          example: user
        action:
          type: string
          description: the action allowed by this permission
          example: write
        ownershipRequired:
          type: boolean
          description: if true, this means the action is only possible on the target if the target is owned by the user
          example: false
        description:
          type: string
          description: something to present on the screen explaining what this is for
        tags:
          type: array
          description: descriptive labels to aid in search and general categorization
          example:
            - 'api'
            - 'ui'
          items:
            type: string

    checkForUpdate:
      type: object
      properties:
        id:
          type: string
          example: V1StGXR8_Z5jdHi6B-myT
        prettyName:
          type: string
        coreProducts:
          type: array
          items:
            type: object
        availableVersion:
          type: string
        updateRequired:
          type: boolean
        force:
          type: boolean
          description: if this is true, you should force the update ASAP

    updateCore:
      type: array
      items:
        type: object
        properties:
          UEAuthCoreProductName:
            type: object
            description: 'This is actually a dynamic property name which will represent your auto-generated Product: Organization Admin Portal'
            properties:
              id:
                type: string
                format: uuid
                description: ID of the product
              added:
                type: array
                description: permissions which were added to the product on this update
                items:
                  type: object
              removed:
                type: array
                description: ids of the permissions that were removed
                items:
                  type: string
                  format: uuid
              roles:
                type: array
                description: the roles updated associated to the product
                items:
                  type: object

    ssoSamlSpec:
      type: object
      additionalProperties: false
      required:
        - name
        - idpCertificates
        - ssoLoginUrl
        - ssoLogoutUrl
      properties:
        name:
          type: string
          description: unique name to label this federated SAML connection
        buttonText:
          type: string
        idpCertificates:
          type: array
          description: these are pem certificate contents provided by the SAML IdP. Make sure to escape all new lines (\n) with a double backslash (\\n) before attempting to write to API.
          items:
            type: string
        ssoLoginUrl:
          type: string
          format: uri
        ssoLogoutUrl:
          type: string
          format: uri
        idpEntityId:
          type: string
        forceLogin:
          type: boolean
          default: false
        signRequest:
          type: boolean
          default: false
        allowUnencryptedAssertion:
          type: boolean
          default: true

    ssoOidcSpec:
      type: object
      additionalProperties: false
      required:
        - name
        - client_id
        - discovery_url
      properties:
        name:
          type: string
          description: unique name to label this federated OIDC connection
        buttonText:
          type: string
        PKCE:
          type: boolean
          description: does this OIDC connection require PKCE? Some standard social connections have this and others do not. For example, for Google, this should be false
          default: false
        client_id:
          type: string
          description: this is the OIDC client id, sometimes referred to as an App ID depending on the platform
        client_secret:
          type: string
          description: if you are not using PKCE, this is a required field
        response_type:
          type: string
          example: code
        grant_type:
          type: string
          example: authorization_code
        discovery_url:
          type: string
          format: uri
          description: this is the discovery oidc .well-known url usually ending in "/.well-known/openid-configuration"
        scopes:
          type: array
          description: UE Auth will automatically request openid and email scopes. You can specificy additional scopes here if required for security
          items:
            type: string

    federatedOAuth2:
      type: object
      required:
        - name
        - provider
        - client_id
        - accessTokenUri
        - authorizationUri
        - profileUri
      allOf:
        - $ref: '#/components/schemas/ssoOAuth2Spec'
      properties:
        provider:
          type: string
          enum:
          - linkedin
          - custom
        buttonType:
          type: string
          enum:
            - linkedin
            - standard

    ssoOAuth2Spec:
      type: object
      required:
        - name
        - client_id
        - accessTokenUri
        - authorizationUri
        - profileUri
      properties:
        name:
          type: string
        buttonText:
          type: string
        PKCE:
          type: boolean
          default: false
        client_id:
          type: string
        client_secret:
          type: string
        response_type:
          type: string
          default: code
          enum:
          - code
          description: only authorization code is supported at this time
        grant_type:
          type: string
          default: authorization_code
          enum:
          - authorization_code
          description: only authorization code is supported at this time
        scopes:
          type: array
          items:
            type: string
        accessTokenUri:
          type: string
          format: uri
        authorizationUri:
          type: string
          format: uri
        profileUri:
          type: string
          format: uri

    federatedSAML:
      type: object
      additionalProperties: false
      allOf:
        - $ref: '#/components/schemas/ssoSamlSpec'
      required:
        - name
        - provider
        - idpCertificates
        - ssoLoginUrl
        - ssoLogoutUrl
      properties:
        provider:
          type: string
          description: is this a social provider like google or a custom OP you're connecting to?
          enum: # as we add more standards, add them here...
            - google
            - microsoft
            - custom
        buttonType:
          type: string
          description: if this is a social connection, we can use that platform's logo if desired. standard means its a default system button with your text
          default: standard
          enum:
            - google
            - microsoft
            - standard

    federatedOIDC:
      type: object
      additionalProperties: false
      allOf:
        - $ref: '#/components/schemas/ssoOidcSpec'
      required:
        - name
        - provider
        - client_id
        - discovery_url
      properties:
        provider:
          type: string
          description: is this a social provider like google or a custom OP you're connecting to?
          enum: # as we add more standards, add them here...
            - google
            - custom
        buttonType:
          type: string
          description: if this is a social connection, we can use that platform's logo if desired. standard means its a default system button with your text
          default: standard
          enum:
            - google
            - standard

# Account Recovery
    recoveryRequestObject:
      type: object
      required:
        - codes
        - email
      properties:
        email:
          type: string
          format: email
          description: your email address
        codes:
          type: array
          minItems: 10
          maxItems: 10
          items:
            type: string
            description: these are the recovery codes. All 10 must be input. 7 out of 10 must match - there is some room for error

    recoverAccountRequest:
      type: object
      required:
        - email
      properties:
        email:
          type: string
          format: email
        password:
          type: string
          description: your new password. If left off the request, one will be generated for you

# Event Stream Plugin
    writeEventStream:
      type: object
      required:
        - enabled
      properties:
        enabled:
          type: boolean
        currentVersion:
          type: number
        provider:
          type: object
          properties:
            type:
              type: string
              enum:
                - pulsar
                - nats
            oauthRequired:
              type: boolean
              description: should an oauth client be created for this configuration?
            auth:
              type: object
              description: if there are specific authorizations required beyond ueauth for the interface, add them here. Not all of the examples are applicable to the providers offered. Please note that if you specific 'oauthRequired' the following values will be overwritten if you provide them in this object - clientId, audience, scope, rootRef, issueUrl
              example:
                jwt: 'your-big-jwt'
                userSeed: 'your-account-seed (nats)'
                userPublicKey: 'your-public-key (nats)'
                apiKey: 'your-api-key'
                clientId: 'Your client ID'
                audience: 'Your audience'
                jwtIssuer: 'https://streams.uecore.io'
                expires: 3600
            adminUrl:
              type: string
              format: uri
            streamUrl:
              type: string
              format: uri
            lockStreamingOnceActive:
              type: boolean
              example: false
              description: when this is active, an AG admin can turn on event streaming but is unable to deactivate without a root user
            enableValidation:
              type: boolean
              description: if active, every message sent is validated for correct schema
              default: false
            externalEventBodySchemaUrl:
              type: string
              format: uri
              description: if you are using an external json schema provider to validate schema. only applicable if enableValidation is set to true
            restAuth:
              type: boolean
              default: false
              description: will calls to the REST API require a client_credential token?
            streamAuth:
              type: boolean
              default: false
              description: will publishing events require a client_credential token?
            authScopes:
              type: string
              description: if specific scopes are required for the client credential authorizer add them here as space delimited strings
            masterAuth:
              type: boolean
              default: false
              description: will you need auth to publish to the master stream?
            masterStream:
              type: object
              description: the master stream is a data stream that UEAuth can write transaction information to that exists outside the context of any one authgroup. For example, when a new Auth Group is created, it would be published to this stream so that other systems can react to the creation.
              properties:
                enabled:
                  type: boolean
                  default: false
                streamPath:
                  type: string
                  description: this is the topic or stream address to publish master stream content. For NATS use 'stream::subject'
            setupConfig:
              type: object
              description: any initialization configs required for the specific streaming solution - see documentation
              # NOT NEEDED FOR NATS
              # PULSAR EXAMPLE
              #example:
              #  adminRoles: []
              #  clusterList: ['dev-cluster']
            clientConfig:
              type: object
              description: any client configurations required for the specific streaming solution - see documentation
              # NATS EXAMPLE
              example:
                stream: 'your-stream'
                subject: 'sub.{authGroup}.logs'
                coreSimpleStream: true
              # PULSAR EXAMPLE
              #example:
              #  operationTimeoutSeconds: 30
              #  ioThreads: 1
              #  tlsTrustCertsFilePath: /my/path
              #  tlsValidateHostname: false
              #  tlsAllowInsecureConnection: false

# MFA CHALLENGE
    writeMfaChallenge:
      type: object
      required:
        - enabled
        - currentVersion
      properties:
        enabled:
          type: boolean
        currentVersion:
          type: number
        type:
          type: string
          description: must be either 'http-proxy' or 'privakey'. Other options will be added when they are supported.
          enum:
            - http-proxy
            - privakey
        api:
          type: object
          description: required for the proxy configuration. Do not include for privakey configuration.
          properties:
            domain:
              type: string
              format: uri
              description: This is the endpoint domain used for your mfa proxy
              example: "https://yourproxyendpoint.com"
            challenge:
              type: string
              description: This is the endpoint path used to send the mfa challenge to the end user
              example: "/challenge/path"
            validate:
              type: string
              description: This is an endpoint path used to validate callback requests from the provider
              example: "/validate/path"
            bind:
              type: string
              description: This is an endpoint path used to map the account ID of the user to the MFA account/device
              example: "/bind/path"
            devices:
              type: string
              description: This is an endpoint path used to return all registered devices of the MFA account
              example: "/devices/path"
            revoke:
              type: string
              description: This is an endpoint path used to revoke a device identified by ID of the MFA account
              example: "/revoke/path"
        proxyEnableScreen:
          type: string
          format: uri
          description: If this is an http-proxy mfa setup, you will need to open a web page where you handle the device connection, through your proxy service. This is usually presented as instructions and a QR code. UE Auth will send the JSON results of the bind API call to this request via query parameters.
          example: 'https://example.com/complete/setup'
        proxyEnableScreenButtonText:
          type: string
          description: This is the text used on the button that links to the enablement screen
        proxyEnableInstructions:
          type: string
          description: UE Auth will display this text as instructions if desired. New lines can be represented with '--'

    mfaSafeRecovery:
      oneOf:
        - type: object
          properties:
            selection:
              type: string
              enum:
                - email
              example: email
            sent:
              type: boolean
        - type: object
          properties:
            selection:
              type: string
              enum:
                - device
              example: device
            id:
              type: string
              format: uuid
              description: the provider key returned by the MFA provider
            provider:
              type: string
              description: i.e. privakey, http-proxy, etc.
            response:
              type: object
              description: response from the provider

    sendMfaSafeRecovery:
      type: object
      additionalProperties: false
      properties:
        selection:
          type: string
          description: selection determines where the notification will be sent to validate identity
          enum:
            - email
            - device
        state:
          type: string
          description: must match the state encoded in the access token

    mfaRequestBind:
      type: object
      additionalProperties: false
      description: This API is multi purpose and will usually be requested at least twice in an MFA recovery workflow. The first time you would just send state to initiate the process using basic auth or a logged in bearer token. This will respond with an Initial Access Token that can be used to request a device for validation of idenity (assuming it is required to validate identity). You would then call this API again with the results of the identity validation request to rebind the user and see instructions for MFA setup on a device. If on the first call of this API it is determined that the user is not currently MFA enabled, the system will do a protective revoke of all possible devices and immediately bind the user and respond with instructions.
      properties:
        state:
          type: string
          description: This is used to bind together a series of transactions. When beginning a recovery flow, you must send a unique and url safe generated string. All other requests pertaining to this recovery will need to include this state. When the user is recoverying MFA via the UI wizard, this state is auto generated by the server.
        code:
          type: string
          description: Initial access token used when the mechanism for identity validation is email. Do not include if initiating the flow or if validating user with device rather than email.
        method:
          type: string
          enum:
            - device
            - email
          description: This would be used on a second call where identity has already been validated either by email or device challenge. On the second call you must explicitly state which method you used to validate identity so that this can be verified on the backend before rebinding the user.
        providerKey:
          type: string
          description: This would be used on a second call where the identity has already been validated by a device. When creating the challenge, the provider should return an id for the transaction. This is the providerKey.

    mfaInstructions:
      oneOf:
        - type: object
          description: This response happens in the flow when the user is mfaEnabled but a reset is being requested. It allows the user to validate their identity and then make the request again.
          additionalProperties: false
          properties:
            token:
              type: string
              description: an initial access token to be used for safe-recovery identity verification
            uri:
              type: string
              format: uri
              description: the API endpoint to send an identity validation request
            requestInstructions:
              type: string
              description: brief instructions on what to do
        - type: object
          description: This response happens when the user identity is valid or the user was not perviously mfaEnabled.
          additionalProperties: false
          properties:
            instructions:
              type: array
              items:
                type: string
                description: each line of a set of instructions to be displayed in a numbered list
            qrCode:
              type: string
              description: if included, the uri to be encoded as a QR code on a UI. otherwise false is returned.
            setupScreen:
              type: string
              description: if included, this is a url to an external UI page where setup instructions are provided
            setupScreenButtonText:
              type: string
              description: if included, this is the button text that should be used for the external setupScreen UI page link
            warnings:
              type: array
              items:
                type: object
                description: Any errors that prevented the system from revoking previous devices or similar

    callbackRequest:
      oneOf:
        - type: object
          description: for http-proxy callbacks, this would be the expected data.
          properties:
            id:
              type: string
              description: provider id for the challenge request
            interactionDetails:
              type: object
              properties:
                uid:
                  type: string
                  description: the interaction id provided by UE Auth - can be interchanged for a generated state as well
                accountId:
                  type: string
                  description: the account being challenged
            action:
              type: number
              description: Any number other than zero is approved
        - type: object
          description: For the privakey custom plugin, the following is the minimum equivalent data expected
          properties:
            guid:
              type: string
              description: privakey plugin specific - provider id for the challenge request
            tranactionId:
              type: object
              description: privakey plugin specific. NOTE - this is stringified object containing the following
              properties:
                uid:
                  type: string
                  description: the interaction id provided by UE Auth - can be interchanged for a generated state as well
                accountId:
                  type: string
                  description: the account being challenged
            buttonSelected:
              type: number
              description: privakey plugin specific - Any number other than zero is approved

    profileRequestUpdate:
      type: object
      additionalProperties: false
      properties:
        action:
          type: string
          example: approved
          enum:
            - new
            - approved
            - denied

    profileRequest:
      type: object
      description: Requests expire after 7 days
      additionalProperties: false
      allOf:
        - $ref: '#/components/schemas/writeProfileRequest'
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          type: string
          format: date-time
        createdBy:
          type: string
        modifiedAt:
          type: string
          format: date-time
        modifiedBy:
          type: string
        authGroup:
          type: string
        requestingAccountId:
          type: string
          format: uuid
        requestingEmail:
          type: string
          format: email
        targetAccountId:
          type: string
          format: uuid
          description: the ID of the Account holder you are request profile data from
        state:
          type: string
          default: new
          example: new
          enum:
            - new
            - approved
            - denied

    writeProfileRequest:
      type: object
      required:
        - type
        - requestDetails
      additionalProperties: false
      properties:
        type:
          type: string
          default: copy
          enum:
            - copy
            - sync
            - access
        requestDetails:
          type: string
          description: brief explanation of who is making the request and why
        dataCallback:
          type: string
          format: uri
          description: if this is a copy request, you can provide a callback url for the data to be sent to on approval
        accessExpirationTime:
          type: string
          default: '30'
          description: if this is an access request, how long would you like the access to last in days?
          enum:
            - '1'
            - '7'
            - '30'
            - '90'
            - '180'
            - '360'
            - 'unlimited'
        orgId:
          type: string
          format: uuid
          description: if this is a sync request, which organization?

    viewAccessObject:
      type: object
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          type: string
          format: date-time
        createdBy:
          type: string
          format: uuid
        expiresAt:
          type: string
          format: date-time
        authGroup:
          type: string
        viewingAccountId:
          type: string
          description: the ID of the person able to view the targetAccountId Secured Profile
          format: uuid
        viewingEmail:
          type: string
          format: email
          description: the email address of the person able to view the targetAccountId Secured Profile
        accessDetails:
          type: string
          description: an explanation of why this access was requested
        targetAccountId:
          type: string
          format: uuid
          description: the account Id of the secured profile being shared

    updateProductKeyServiceRoles:
      type: object
      additionalProperties: false
      properties:
        roles:
          type: array
          description: the IDs of the roles (and associated permissions) for this product that you wish to associate to this key. This will overwrite existing roles.
          items:
            type: string
            format: uuid

    writeProductKeyService:
      type: object
      additionalProperties: false
      required:
        - name
      properties:
        name:
          type: string
          description: Grouping identifier
        organizationId:
          type: string
          format: uuid
          description: orgId if applicable
        roles:
          type: array
          description: the IDs of the roles (and associated permissions) for this product that you wish to associate to this key
          items:
            type: string
            format: uuid

    productKeyService:
      type: object
      allOf:
        - $ref: '#/components/schemas/writeProductKeyService'
      properties:
        authGroup:
          type: string
        clientId:
          type: string
          format: uuid
        productId:
          type: string
          format: uuid

    writeProductKey:
      type: object
      additionalProperties: false
      required:
        - name
        - clientId
      properties:
        name:
          type: string
        description:
          type: string
        clientId:
          type: string
          format: uuid
        expires:
          type: number
          example: 2592000
          description: how long in seconds should the key remain active? Default is 2592000 (30 days).

    productKey:
      type: object
      allOf:
        - $ref: '#/components/schemas/writeProductKey'
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          type: string
          format: date-time
        expiresOn:
          type: string
          format: date-time
        createdBy:
          type: string
          format: uuid
        modifiedAt:
          type: string
          format: date-time
        modifiedBy:
          type: string
          format: uuid
        authGroup:
          type: string
        productId:
          type: string
          format: uuid
        organizationId:
          type: string
          format: uuid

    productKeyCreated:
      type: object
      allOf:
        - $ref: '#/components/schemas/productKey'
      properties:
        key:
          type: string
          description: This is the access token to use. It will never show again.