{ "openapi": "3.1.0", "info": { "title": "v-auth Server API", "version": "0.1.0", "description": "Implemented Global backend-only preview API. Management APIs and planned user list endpoints are excluded. User deletion is permanent and requires the separate users:delete scope, an exact external identity confirmation and a stable idempotency key. Validation never refreshes sessions; explicit refresh retains the token and its creation-time lifetime policy. Default lifetime is 7 days, absolute limit 30 days; each App/environment can configure new sessions." }, "servers": [ { "url": "https://auth-api.virtneu.com" } ], "paths": { "/v1/events/query": { "post": { "operationId": "listAuthenticationEvents", "x-required-scope": "auth-events:read", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "from": { "type": "integer", "minimum": 0 }, "to": { "type": "integer", "minimum": 0 }, "action": { "enum": [ "challenge_issue", "challenge_verify", "user_register", "password_reset", "session_create", "session_refresh", "session_revoke", "user_access_change", "user_sessions_revoke", "user_delete" ] }, "outcome": { "enum": [ "unconfirmed", "succeeded", "rejected" ] }, "request_id": { "type": "string", "maxLength": 128 }, "service_credential_id": { "type": "string", "maxLength": 128 }, "page_size": { "type": "integer", "minimum": 1, "maximum": 100 }, "cursor": { "type": "string", "maxLength": 4096 } }, "required": [] } } } }, "responses": { "200": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "events": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string" }, "request_id": { "type": "string" }, "action": { "type": "string" }, "service_credential_id": { "type": "string" }, "outcome": { "enum": [ "unconfirmed", "succeeded", "rejected" ] }, "http_status": { "type": [ "integer", "null" ] }, "error_code": { "type": [ "string", "null" ] }, "started_at": { "type": "integer" }, "finished_at": { "type": [ "integer", "null" ] } }, "required": [ "id", "request_id", "action", "service_credential_id", "outcome", "http_status", "error_code", "started_at", "finished_at" ] } }, "next_cursor": { "type": [ "string", "null" ] }, "range": { "type": "object", "additionalProperties": false, "properties": { "from": { "type": "integer" }, "to": { "type": "integer" } }, "required": [ "from", "to" ] } }, "required": [ "events", "next_cursor", "range" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/challenges": { "post": { "operationId": "createChallenge", "x-required-scope": "auth:challenge", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } }, { "name": "Idempotency-Key", "in": "header", "required": true, "schema": { "type": "string", "pattern": "^[A-Za-z0-9_-]{8,128}$" }, "description": "Persist with the operation and reuse with the same payload after timeout." } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "email": { "type": "string", "format": "email", "maxLength": 254 }, "purpose": { "enum": [ "register", "login", "reset_password" ] } }, "required": [ "external_user_id", "email", "purpose" ] } } } }, "responses": { "202": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "accepted": { "const": true }, "challenge_id": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "required": [ "accepted", "challenge_id" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/challenges/verify": { "post": { "operationId": "verifyChallenge", "x-required-scope": "auth:challenge", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } }, { "name": "Idempotency-Key", "in": "header", "required": true, "schema": { "type": "string", "pattern": "^[A-Za-z0-9_-]{8,128}$" }, "description": "Persist with the operation and reuse with the same payload after timeout." } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "challenge_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "code": { "type": "string", "pattern": "^\\d{6}$" } }, "required": [ "challenge_id", "code" ] } } } }, "responses": { "200": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "authentication_proof": { "type": "string", "minLength": 1, "maxLength": 1024 }, "purpose": { "enum": [ "register", "login", "reset_password" ] }, "expires_at": { "type": "string", "format": "date-time" } }, "required": [ "authentication_proof", "purpose", "expires_at" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/users": { "post": { "operationId": "registerUser", "x-required-scope": "auth:register", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } }, { "name": "Idempotency-Key", "in": "header", "required": true, "schema": { "type": "string", "pattern": "^[A-Za-z0-9_-]{8,128}$" }, "description": "Persist with the operation and reuse with the same payload after timeout." } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "email": { "type": "string", "format": "email", "maxLength": 254 }, "authentication_proof": { "type": "string", "minLength": 1, "maxLength": 1024 }, "password": { "type": "string", "minLength": 8, "maxLength": 128 } }, "required": [ "external_user_id", "email", "authentication_proof" ] } } } }, "responses": { "201": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "email_verified": { "const": true } }, "required": [ "user_id", "external_user_id", "email_verified" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/sessions": { "post": { "operationId": "createSession", "description": "Password sign-in has a per-identity, per-App/environment budget: 10 failed or in-flight attempts per 10-minute window. Successful sign-in releases its own reservation. RATE_LIMITED returns Retry-After; wait and start a new attempt with a new operation key. Session validation, refresh and email-proof login are unaffected.", "x-required-scope": "auth:login", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } }, { "name": "Idempotency-Key", "in": "header", "required": true, "schema": { "type": "string", "pattern": "^[A-Za-z0-9_-]{8,128}$" }, "description": "Persist with the operation and reuse with the same payload after timeout." } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "oneOf": [ { "type": "object", "additionalProperties": false, "properties": { "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "password": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "required": [ "external_user_id", "password" ] }, { "type": "object", "additionalProperties": false, "properties": { "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "authentication_proof": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "required": [ "external_user_id", "authentication_proof" ] } ] } } } }, "responses": { "200": { "description": "Idempotent replay of a password login.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "session_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "expires_at": { "type": "string", "format": "date-time" }, "absolute_expires_at": { "type": "string", "format": "date-time" }, "session_token": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "required": [ "session_id", "user_id", "external_user_id", "expires_at", "absolute_expires_at", "session_token" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "201": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "session_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "expires_at": { "type": "string", "format": "date-time" }, "absolute_expires_at": { "type": "string", "format": "date-time" }, "session_token": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "required": [ "session_id", "user_id", "external_user_id", "expires_at", "absolute_expires_at", "session_token" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/sessions/validate": { "post": { "operationId": "validateSession", "x-required-scope": "sessions:validate", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "session_token": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "required": [ "session_token" ] } } } }, "responses": { "200": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "oneOf": [ { "type": "object", "additionalProperties": false, "properties": { "active": { "const": false } }, "required": [ "active" ] }, { "type": "object", "additionalProperties": false, "properties": { "active": { "const": true }, "session_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "expires_at": { "type": "string", "format": "date-time" }, "absolute_expires_at": { "type": "string", "format": "date-time" } }, "required": [ "active", "session_id", "user_id", "external_user_id", "expires_at", "absolute_expires_at" ] } ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/sessions/refresh": { "post": { "operationId": "refreshSession", "x-required-scope": "sessions:refresh", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } }, { "name": "Idempotency-Key", "in": "header", "required": true, "schema": { "type": "string", "pattern": "^[A-Za-z0-9_-]{8,128}$" }, "description": "Persist with the operation and reuse with the same payload after timeout." } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "session_token": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "required": [ "session_token" ] } } } }, "responses": { "200": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "session_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "expires_at": { "type": "string", "format": "date-time" }, "absolute_expires_at": { "type": "string", "format": "date-time" } }, "required": [ "session_id", "user_id", "external_user_id", "expires_at", "absolute_expires_at" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/sessions/revoke": { "post": { "operationId": "revokeSession", "x-required-scope": "sessions:revoke", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "session_token": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "required": [ "session_token" ] } } } }, "responses": { "200": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "revoked": { "const": true } }, "required": [ "revoked" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/password-resets": { "post": { "operationId": "resetPassword", "x-required-scope": "auth:password_reset", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } }, { "name": "Idempotency-Key", "in": "header", "required": true, "schema": { "type": "string", "pattern": "^[A-Za-z0-9_-]{8,128}$" }, "description": "Persist with the operation and reuse with the same payload after timeout." } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "authentication_proof": { "type": "string", "minLength": 1, "maxLength": 1024 }, "new_password": { "type": "string", "minLength": 8, "maxLength": 128 } }, "required": [ "external_user_id", "authentication_proof", "new_password" ] } } } }, "responses": { "200": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "reset": { "const": true } }, "required": [ "reset" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/users/{userId}": { "delete": { "operationId": "deleteUser", "x-required-scope": "users:delete", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } }, { "name": "Idempotency-Key", "in": "header", "required": true, "schema": { "type": "string", "pattern": "^[A-Za-z0-9_-]{8,128}$" }, "description": "Persist with the operation and reuse with the same payload after timeout." }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "external_user_id": { "type": "string", "minLength": 1, "maxLength": 1024 } }, "required": [ "external_user_id" ] } } } }, "responses": { "200": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "deleted": { "const": true }, "user_id": { "type": "string", "minLength": 1, "maxLength": 1024 }, "deleted_at": { "type": "string", "format": "date-time" } }, "required": [ "deleted", "user_id", "deleted_at" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "patch": { "operationId": "setUserDisabled", "x-required-scope": "users:write", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "disabled": { "type": "boolean" } }, "required": [ "disabled" ] } } } }, "responses": { "200": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "disabled": { "type": "boolean" } }, "required": [ "disabled" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/v1/users/{userId}/sessions/revoke": { "post": { "operationId": "revokeUserSessions", "x-required-scope": "users:sessions:revoke", "security": [ { "serviceCredential": [] } ], "parameters": [ { "name": "X-VAuth-Application", "in": "header", "required": true, "schema": { "type": "string" } }, { "name": "X-VAuth-Environment", "in": "header", "required": true, "schema": { "enum": [ "test", "production" ] } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "all": { "const": true } }, "required": [ "all" ] } } } }, "responses": { "200": { "description": "Success. Cache-Control: no-store.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } } }, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "object", "additionalProperties": false, "properties": { "revoked": { "const": true } }, "required": [ "revoked" ] }, "request_id": { "type": "string" } }, "required": [ "data", "request_id" ] } } } }, "400": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Structured service error. No secrets or raw provider messages. 403 PASSWORD_AUTH_DISABLED means the selected environment disables password registration, sign-in, resets and reset-code issuance.", "headers": { "X-Request-Id": { "schema": { "type": "string", "format": "uuid" }, "description": "Server-generated identifier for this HTTP attempt; incoming IDs are ignored. Matches request_id in the JSON envelope, including errors and 413. Retries receive a new ID; this is not an idempotency key." }, "Cache-Control": { "schema": { "const": "no-store" } }, "Retry-After": { "schema": { "type": "string" }, "description": "Seconds for applicable rate limits." } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } } }, "components": { "securitySchemes": { "serviceCredential": { "type": "http", "scheme": "bearer", "description": "App/environment-scoped backend credential. Never substitute an end-user session token." } }, "schemas": { "Error": { "type": "object", "properties": { "error": { "type": "object", "properties": { "code": { "type": "string" }, "retryable": { "type": "boolean" }, "message": { "type": "string" } }, "required": [ "code" ] }, "request_id": { "type": "string" } }, "required": [ "error" ] } } } }