swagger: '2.0'
info:
  version: 1.3.3.0
  title: Dynamic Client Registration
  description: >-
    The Dynamic Client Registration API provides operations to register and
    manage client applications for use with La Banque Postale's OAuth 2.0 and
    OpenID Connect endpoints. This API largely follows the contract defined in
    RFC7591: OAuth 2.0 Dynamic Client Registration Protocol and OpenID Connect
    Dynamic Client Registration 1.0.


    Note that clients managed via this API are modeled as applications in La
    Banque Postale and appear in the Apps section of the administrator UI.
    Changes made via the API appear in the UI and vice versa. Tokens issued by
    these clients follow the rules for Access Tokens and ID Tokens.
  contact:
    name: La Banque Postale
    url: 'https://developer.labanquepostale.com'
    email: api.support@labanquepostale.fr
  license:
    name: Creative Commons Attribution 3.0 France (CC BY 3.0 FR)
host: api.labanquepostale.com
basePath: /v1
schemes:
  - https
paths:
  /register:
    post:
      operationId: appDynamicClientRegistrationPost
      summary: Add a new Client Application to your account
      consumes:
        - application/json
      produces:
        - application/json
      description: >-
        This endpoint follows the specification for OAuth 2 Dynamic Client
        Registration, as documented in RFC7591 §3 and modified by RFC7592 §3.
      parameters:
        - name: Authorization
          in: header
          required: true
          type: string
          description: >-
            Authorization Basic credentials is composed of your account username
            and password base64 encoded.
        - name: body
          in: body
          description: App that needs to be added to the account
          required: true
          schema:
            $ref: '#/definitions/ClientMetadata'
      responses:
        '201':
          description: Created
          schema:
            $ref: '#/definitions/ClientRegistration'
        '400':
          description: Bad request - invalid body supplied
        '401':
          description: Unauthorized - invalid username/password supplied
        '409':
          description: Conflict - client_name already exists for this account
        '500':
          description: Internal Server Error
  '/register/{client_id}':
    get:
      operationId: appDynamicClientRegistrationGet
      summary: >-
        Retrieve an existing Client Application of your account with all its
        details
      produces:
        - application/json
      parameters:
        - name: client_id
          in: path
          required: true
          type: string
          description: client_id of the APP to retrieve
        - name: Authorization
          in: header
          required: true
          type: string
          description: >-
            Authorization Basic credentials is composed of your account username
            and password base64 encoded.
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ClientRegistration'
        '401':
          description: Unauthorized - invalid username/password supplied
        '404':
          description: Not found - client application not found
        '500':
          description: Internal Server Error
    delete:
      operationId: appDynamicClientRegistrationDelete
      summary: Remove a Client Application from your account
      parameters:
        - name: client_id
          in: path
          required: true
          type: string
          description: client_id of the APP to retrieve
        - name: Authorization
          in: header
          required: true
          type: string
          description: >-
            Authorization Basic credentials is composed of your account username
            and password base64 encoded.
      responses:
        '200':
          description: OK
        '400':
          description: invalid status value
        '401':
          description: Unauthorized - invalid username/password supplied
        '404':
          description: Not found - client application not found
        '500':
          description: Internal Server Error
definitions:
  ClientMetadata:
    type: object
    required:
      - client_name
      - contacts
      - provider_legal_id
      - scope
      - redirect_uris
      - token_endpoint_auth_method
      - grant_types
    properties:
      client_name:
        type: string
        description: Must specify the name of the agent or by default the name of the TPP.
      contacts:
        type: array
        items:
          type: string
          description: Email addresses responsible for this client.
      provider_legal_id:
        type: string
        description: >-
          Authorization number of the TPP according to ETSI specification on
          eIDAS certificates for PSD2
      scope:
        type: string
      redirect_uris:
        type: array
        items:
          type: string
          description: This URL must be HTTPS URL.
      token_endpoint_auth_method:
        type: string
        enum:
          - tls_client_auth
      grant_types:
        type: array
        items:
          type: string
          enum:
            - authorization_code
            - client_credentials
          description: >-
            authorization_code for AISPs and CBPIIs, client_credentials for
            PISPs
      description:
        type: string
      client_legal_id:
        type: string
        description: >-
          Authorization number of the agent. Mandatory in case of an agent which
          is distinct from the TPP
      client_uri:
        type: string
        description: URL of a web page providing information about the client.
      tos_uri:
        type: string
        description: >-
          URL that points to a human-readable terms of service document for the
          client.
      policy_uri:
        type: string
        description: URL that points to a human-readable policy document for the client.
      logo_uri:
        type: string
        description: URL that references a logo for the client.
      response_types:
        type: string
    example:
      client_name: MyTPP-App
      contacts:
        - myTPP-App.support@myTPP-corp.com
      provider_legal_id: PSDFR-ACPR-99999
      scope: aisp cbpii pisp
      redirect_uris:
        - 'https://myTPP-App.fr/dsp2/callback.html'
      token_endpoint_auth_method: tls_client_auth
      grant_types:
        - authorization_code
        - client_credentials
      description: description myTPP APP
      client_legal_id: PSDFR-ACPR-99999-0001
      logo_uri: 'https://myTPPA-App.fr/img/logo.png'
  ClientRegistration:
    allOf:
      - type: object
        properties:
          client_id:
            $ref: '#/definitions/ClientIdentification'
          client_secret:
            $ref: '#/definitions/ClientSecret'
          client_id_issued_at:
            $ref: '#/definitions/ClientIdIssuedAt'
          client_secret_expires_at:
            $ref: '#/definitions/ClientSecretExpiresAt'
        example:
          client_id: d3b00eab-8f8b-4bcb-ae2b-1d69e5eccae8
          client_secret: O5aS4mI0mQ1yO7sW5hI8rW6wF7dT8xM8jE6iI4pC1cF0nH2gX2
          client_id_issued_at: 9999999999000
          client_secret_expires_at: 0
      - $ref: '#/definitions/ClientMetadata'
  ClientIdentification:
    type: string
    description: client_id to be used to request PSD2 APIs
    example: d3b00eab-8f8b-4bcb-ae2b-1d69e5eccae8
  ClientSecret:
    type: string
    description: client_secret to be used to request PSD2 APIs
    example: O5aS4mI0mQ1yO7sW5hI8rW6wF7dT8xM8jE6iI4pC1cF0nH2gX2
  ClientIdIssuedAt:
    type: string
    description: The client registration timestamp.
    example: 9999999999000
  ClientSecretExpiresAt:
    type: string
    description: >-
      The client secret expiration timestamp. Valued at 0 if the registration
      doesn't expires.
    example: 0
externalDocs:
  description: Find out more about RFC7591
  url: 'https://tools.ietf.org/html/rfc7591'
