swagger: '2.0'
info:
  version: 1.0.3
  title: PSD2 LBP oauth2
  description: "The TPP (client) is authorized to access the ASPSP's API (authorization server) through an access token that can be retrieved through the OAUTH2 Authorisation Framework (https://tools.ietf.org/html/rfc6749).<br>

Different authorisation grants can be used, depending on the TPP's role and use case to be applied.<br>
"
  contact:
    name: La Banque Postale
    url: 'https://developer.labanquepostale.com'
    email: api.support@labanquepostale.fr
  license:
    name: Creative Commons Attribution 3.0 France (CC BY 3.0 FR) 
host: oauth2.labanquepostale.com
schemes:
- https
paths:
  /authorize:
    get:
      consumes:
        - application/x-www-form-urlencoded
      produces:
        - application/json
      summary: Endpoint for Authorization Code
      description: This endpoint follows the specification for Authorization Framework, as documented in RFC6749 §4.1.
      parameters:
      - name: response_type
        in: query
        required: true
        type: string
        description: Value MUST be set to "code"
        enum:
          - "code"
      - name: client_id
        in: query
        required: true
        type: string
        description: TPP identification. Must be equal to [client_id] provided by La Banque Postale during the app registration process.
      - name: redirect_uri
        in: query
        required: true
        type: string
        description: <b>Encoded Call-back URL of the TPP.</b> URI where the PSU is redirected to after authorization flow.
      - name: scope
        in: query
        required: true
        type: string
        enum:
          - "aisp"
          - "cbpii"
      - name: state
        in: query
        required: false
        type: string
        description: This string will be echoed back to application when PSU is redirected.
        
      responses:
        302:
          description: Found - Redirect the PSU to the ASPSP authorization URL.
          schema:
            type: object
            example:
              httpCode: "302"
              httpMessage: Found
              moreInformation: "null"
          headers:
            Location:
              type: string
              description: ASPSP authorization URL
        401: 
          description: Unauthorized - invalid client_id supplied
          schema:
            type: object
            example:
              error: invalid_client
          
  /token:
    post:
      consumes:
      - "application/x-www-form-urlencoded"
      produces:
      - "application/json"
      summary: "Request Access Token"
      parameters:
      - name: Authorization
        in: header
        required: true
        type: string
        description: "Authorization Basic credentials is composed of your client_id:client_secret base64 encoded."
      - name: grant_type
        in: formData
        required: true
        type: string
        description: "Value MUST be set to authorization_code for AISP and CBPII and client_credentials for PISP."
        enum:
          - "authorization_code"
          - "client_credentials"
      - name: scope
        in: formData
        required: true
        type: string
        enum:
          - "aisp"
          - "cbpii"
          - "pisp"
      - name: code
        in: formData
        required: false
        type: string
        description: "<b>Required if grant_type is 'authorization_code'</b><br>Authorization code provided by the /oauth2/authorize endpoint."
      - name: redirect_uri
        in: formData
        required: false
        type: string
        description: "<b>Required if grant_type is 'authorization_code'</b><br>MUST be url-encoded."
      responses:
        200:
          description: OK
          schema:
            $ref: "#/definitions/access_token_response"
        401: 
          description: Unauthorized - invalid Authorization supplied
          schema:
            type: object
            example:
              error: invalid_client



definitions:
  access_token_response:
    type: "object"
    required:
    - "token_type"
    - "access_token"
    - "expires_in"
    - "consented_on"
    - "scope"
    properties:
      token_type:
        type: string
      access_token:
        type: string
      expires_in:
        type: integer
      consented_on:
        type: integer
      scope:
        type: string
    example:
      token_type: Bearer
      access_token: AAIkMjhmYTExNTAtYzg3Zi00MmI1LWE2MjgtNTY4ODc0NzE4YmZip6jMNbhhY25FKzYbKwp-Uz1CAiZSTZsptuOTt0JZJ4aHi-a-DvL56XqT4w3g1D7mCKYOIIEzrMHVAwxGaIFw5ElXipp8_dBH7anYHQvIAs_FlJMJMfG7plUZuat-d_TpIkH5D8tEsNKo3AfylUqvGg
      expires_in: 900
      consented_on: 1600335202
      scope: "pisp"