openapi: 3.0.3
info:
  title: Credentials
  description: Register and authenticate using WebAuthn APIs
  version: ''
servers:
  - url: https://api.sbx.transmitsecurity.io/cis
    description: Sandbox environment
  - url: https://api.transmitsecurity.io/cis
    description: Production environment (US)
  - url: https://api.eu.transmitsecurity.io/cis
    description: Production environment (EU)
  - url: https://api.ca.transmitsecurity.io/cis
    description: Production environment (CA)
  - url: https://api.au.transmitsecurity.io/cis
    description: Production environment (AU)
security: []
paths:
  /v1/webauthn/register/start:
    post:
      operationId: registration-start
      summary: Start registration
      deprecated: true
      description: >-
        Start a registration of WebAuthn credentials for a specified user. This
        requires an authorized authentication session created by a server side
        call to `/auth-session/start-with-authorization`. If successful, the
        response will contain a `credential_creation_options` field that should
        be passed in the WebAuthn `navigator.credentials.create()` API call.
        Note that some fields (`user.id` and `challenge`) in the
        `credential_creation_options` object are base64 encoded and must first
        be decoded and converted to an array buffer. It is recommended to use
        the [webauthn-json](https://github.com/github/webauthn-json) library
        that handles this.
      parameters:
        - name: x-ts-device-binding-token
          in: header
          description: >-
            Device binding token, returned by the first client-side request from
            a device in the session (in the `set-device-binding-token` response
            header)
          schema:
            type: string
        - name: User-Agent
          in: header
          description: >-
            Browser user agent. Allows adding device info to sessions if
            provided
          required: false
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiWebAuthnRegisterStartDto'
      responses:
        '200':
          description: Active WebAuthn session info
          headers:
            set-device-binding-token:
              description: A token that binds the device to the session
              example: 8ac0bdca-affb-4b1b-af50-2f834ad266b3
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebAuthnRegisterStartResponseDto'
        '400':
          content:
            application/json:
              examples:
                InvalidRequest:
                  value:
                    error_code: invalid_request
                    message: 'Invalid request: property should not be null or undefined'
                InvalidAuthSession:
                  value:
                    error_code: invalid_auth_session
                    message: Requested action can't be performed for the given session
          description: ''
        '401':
          content:
            application/json:
              examples:
                InvalidDeviceBindingToken:
                  value:
                    error_code: invalid_device_binding_token
                    message: Invalid token
          description: ''
        '404':
          content:
            application/json:
              examples:
                ClientNotFound:
                  value:
                    error_code: client_not_found
                    message: Client not found
                UserNotFound:
                  value:
                    error_code: user_not_found
                    message: User not found
                AuthSessionNotFound:
                  value:
                    error_code: auth_session_not_found
                    message: Session not found
          description: ''
        '409':
          content:
            application/json:
              examples:
                UsernameMismatch:
                  value:
                    error_code: auth_session_registration_username_mismatch
                    message: Request contains conflicting information
                UserIdMismatch:
                  value:
                    error_code: user_id_mismatch
                    message: Request contains conflicting information
          description: ''
  /v1/webauthn/register/complete:
    post:
      operationId: registration-complete
      summary: Complete registration
      deprecated: true
      description: >-
        Complete the WebAuthn credential registration, and obtain the
        authorization code to exchange for user tokens. It's required to provide
        the `webauthn_session_id` that was recieved in the registration start
        response. Note that some fields (`clientDataJSON` and
        `attestationObject`) must be converted from array buffer to base64
        strings. If [webauthn-json](https://github.com/github/webauthn-json)
        `create()` was used this is already taken care of.
      parameters:
        - name: x-ts-device-binding-token
          in: header
          description: >-
            Device binding token, returned by the first client-side request from
            a device in the session (in the `set-device-binding-token` response
            header)
          schema:
            type: string
        - name: User-Agent
          required: false
          in: header
          description: >-
            Browser user agent. Allows adding device info to sessions if
            provided
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiWebauthnRegisterCompleteDto'
      responses:
        '200':
          description: Complete WebAuthn session info
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiWebAuthnRegisterCompleteResponseDto'
        '400':
          content:
            application/json:
              examples:
                InvalidRequest:
                  value:
                    error_code: invalid_request
                    message: 'Invalid request: property should not be null or undefined'
                InvalidAuthSession:
                  value:
                    error_code: invalid_auth_session
                    message: Requested action can't be performed for the given session
                InvalidWebAuthnSession:
                  value:
                    error_code: invalid_webauthn_session
                    message: Requested action can't be performed for the given session
          description: ''
        '401':
          content:
            application/json:
              examples:
                MissingDeviceBindingToken:
                  value:
                    error_code: device_binding_token_not_provided
                    message: Token is missing
                InvalidDeviceBindingToken:
                  value:
                    error_code: invalid_device_binding_token
                    message: Invalid token
                InvalidCredential:
                  value:
                    error_code: invalid_webauthn_credential
                    message: Invalid credentials
          description: ''
        '404':
          content:
            application/json:
              examples:
                ClientNotFound:
                  value:
                    error_code: client_not_found
                    message: Client not found
                UserNotFound:
                  value:
                    error_code: user_not_found
                    message: User not found
                AuthSessionNotFound:
                  value:
                    error_code: auth_session_not_found
                    message: Session not found
          description: ''
  /v1/webauthn/authenticate/start:
    post:
      operationId: startAuthentication
      summary: Start authentication
      deprecated: true
      description: >-
        Start a new webauthn authentication. This requires an authentication
        session, but it can be created from the client side without
        authorization by calling `/auth-session/start-restricted`. If
        successful, the response will contain a `credential_request_options`
        field that should be passed in the WebAuthn
        `navigator.credentials.get()` API call. Note that some fields
        (`challenge` and each `id` in the `allowCredentials` list) in the
        `credential_request_options` object are base64 encoded and must first be
        decoded and converted to array buffer, it is recommended to use the
        [webauthn-json](https://github.com/github/webauthn-json) library that
        handles this.
      parameters:
        - name: x-ts-device-binding-token
          required: true
          in: header
          description: >-
            Device binding token, returned by the first client-side request from
            a device in the session (in the `set-device-binding-token` response
            header)
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiWebAuthnAuthenticateStartDto'
      responses:
        '200':
          description: Active WebAuthn session info
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiWebAuthnAuthenticateStartResponse'
        '400':
          content:
            application/json:
              examples:
                InvalidRequest:
                  value:
                    error_code: invalid_request
                    message: 'Invalid request: property should not be null or undefined'
                InvalidAuthSession:
                  value:
                    error_code: invalid_auth_session
                    message: Requested action can't be performed for the given session
          description: ''
        '401':
          content:
            application/json:
              examples:
                MissingDeviceBindingToken:
                  value:
                    error_code: device_binding_token_not_provided
                    message: Token is missing
                InvalidDeviceBindingToken:
                  value:
                    error_code: invalid_device_binding_token
                    message: Invalid token
                NoRegisteredCredentials:
                  value:
                    error_code: no_credentials_registered
                    message: Invalid credentials
          description: ''
        '404':
          content:
            application/json:
              examples:
                ClientNotFound:
                  value:
                    error_code: client_not_found
                    message: Client not found
                UserNotFound:
                  value:
                    error_code: user_not_found
                    message: User not found
                AuthSessionNotFound:
                  value:
                    error_code: auth_session_not_found
                    message: Session not found
          description: ''
  /v1/webauthn/authenticate/complete:
    post:
      operationId: authentication-complete
      summary: Complete authentication
      deprecated: true
      description: >-
        Complete the WebAuthn credential assertion, and obtain the authorization
        code to exchange for user tokens. It's required to provide the
        `webauthn_session_id` that was received in the authentication start
        response. Note that some fields in the `public_key_credential.response`
        object must be converted from array buffer to base64 strings
        (`clientDataJSON`, `authenticatorData`, `signature` and `userHandle`).
        If [webauthn-json](https://github.com/github/webauthn-json) `get()` was
        used this is already taken care of.
      parameters:
        - name: x-ts-device-binding-token
          required: true
          in: header
          description: >-
            Device binding token, returned by the first client-side request from
            a device in the session (in the `set-device-binding-token` response
            header)
          schema:
            type: string
        - name: User-Agent
          required: false
          in: header
          description: >-
            Browser user agent. Allows adding device info to sessions if
            provided
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiWebauthnAuthenticateCompleteDto'
      responses:
        '200':
          description: Complete WebAuthn session info
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationCompleteResponseDto'
        '400':
          content:
            application/json:
              examples:
                InvalidRequest:
                  value:
                    error_code: invalid_request
                    message: 'Invalid request: property should not be null or undefined'
                InvalidAuthSession:
                  value:
                    error_code: invalid_auth_session
                    message: Requested action can't be performed for the given session
                InvalidWebAuthnSession:
                  value:
                    error_code: invalid_webauthn_session
                    message: Requested action can't be performed for the given session
          description: ''
        '401':
          content:
            application/json:
              examples:
                MissingDeviceBindingToken:
                  value:
                    error_code: device_binding_token_not_provided
                    message: Token is missing
                InvalidDeviceBindingToken:
                  value:
                    error_code: invalid_device_binding_token
                    message: Invalid token
                NoRegisteredCredentials:
                  value:
                    error_code: no_credentials_registered
                    message: Invalid credentials
                InvalidCredential:
                  value:
                    error_code: invalid_webauthn_credential
                    message: Invalid credentials
          description: ''
        '404':
          content:
            application/json:
              examples:
                ClientNotFound:
                  value:
                    error_code: client_not_found
                    message: Client not found
                UserNotFound:
                  value:
                    error_code: user_not_found
                    message: User not found
                AuthSessionNotFound:
                  value:
                    error_code: auth_session_not_found
                    message: Session not found
          description: ''
  /v1/webauthn/authenticate/passkey/start:
    post:
      operationId: passkeyStart
      summary: Start passkey authentication
      deprecated: true
      description: >-
        Start a new webauthn passkey authentication. This requires an
        authentication session, but it can be created from the client side
        without authorization by calling `/auth-session/start-restricted`. If
        successful, the response will contain a `credential_request_options`
        field that should be passed in the WebAuthn
        `navigator.credentials.get()` API call. Note that some fields
        (`challenge` and each `id` in the `allowCredentials` list) in the
        `credential_request_options` object are base64 encoded and must first be
        decoded and converted to array buffer, it is recommended to use the
        [webauthn-json](https://github.com/github/webauthn-json) library that
        handles this.
      parameters:
        - name: x-ts-device-binding-token
          required: true
          in: header
          description: >-
            Device binding token, returned by the first client-side request from
            a device in the session (in the `set-device-binding-token` response
            header)
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiWebAuthnAuthenticatePasskeyStartDto'
      responses:
        '200':
          description: Active WebAuthn session info
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiWebAuthnAuthenticateStartResponse'
        '400':
          content:
            application/json:
              examples:
                InvalidRequest:
                  value:
                    error_code: invalid_request
                    message: 'Invalid request: property should not be null or undefined'
                InvalidAuthSession:
                  value:
                    error_code: invalid_auth_session
                    message: Requested action can't be performed for the given session
          description: ''
        '401':
          content:
            application/json:
              examples:
                MissingDeviceBindingToken:
                  value:
                    error_code: device_binding_token_not_provided
                    message: Token is missing
                InvalidDeviceBindingToken:
                  value:
                    error_code: invalid_device_binding_token
                    message: Invalid token
                NoRegisteredCredentials:
                  value:
                    error_code: no_credentials_registered
                    message: Invalid credentials
          description: ''
        '404':
          content:
            application/json:
              examples:
                ClientNotFound:
                  value:
                    error_code: client_not_found
                    message: Client not found
                UserNotFound:
                  value:
                    error_code: user_not_found
                    message: User not found
                AuthSessionNotFound:
                  value:
                    error_code: auth_session_not_found
                    message: Session not found
          description: ''
  /v1/webauthn/authenticate/passkey/complete:
    post:
      operationId: passkeyComplete
      summary: Complete passkey authentication
      deprecated: true
      description: >-
        Complete the WebAuthn credential assertion, and obtain the authorization
        code to exchange for user tokens. It's required to provide the
        `webauthn_session_id` that was received in the authentication start
        response. Note that some fields in the `public_key_credential.response`
        object must be converted from array buffer to base64 strings
        (`clientDataJSON`, `authenticatorData`, `signature` and `userHandle`).
        If [webauthn-json](https://github.com/github/webauthn-json) `get()` was
        used this is already taken care of.
      parameters:
        - name: x-ts-device-binding-token
          required: true
          in: header
          description: >-
            Device binding token, returned by the first client-side request from
            a device in the session (in the `set-device-binding-token` response
            header)
          schema:
            type: string
        - name: User-Agent
          required: false
          in: header
          description: >-
            Browser user agent. Allows adding device info to sessions if
            provided
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiWebauthnAuthenticatePasskeyCompleteDto'
      responses:
        '200':
          description: Complete WebAuthn session info
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationCompleteResponseDto'
        '400':
          content:
            application/json:
              examples:
                InvalidRequest:
                  value:
                    error_code: invalid_request
                    message: 'Invalid request: property should not be null or undefined'
                InvalidAuthSession:
                  value:
                    error_code: invalid_auth_session
                    message: Requested action can't be performed for the given session
                InvalidWebAuthnSession:
                  value:
                    error_code: invalid_webauthn_session
                    message: Requested action can't be performed for the given session
          description: ''
        '401':
          content:
            application/json:
              examples:
                MissingDeviceBindingToken:
                  value:
                    error_code: device_binding_token_not_provided
                    message: Token is missing
                InvalidDeviceBindingToken:
                  value:
                    error_code: invalid_device_binding_token
                    message: Invalid token
                NoRegisteredCredentials:
                  value:
                    error_code: no_credentials_registered
                    message: Invalid credentials
                InvalidCredential:
                  value:
                    error_code: invalid_webauthn_credential
                    message: Invalid credentials
          description: ''
        '404':
          content:
            application/json:
              examples:
                ClientNotFound:
                  value:
                    error_code: client_not_found
                    message: Client not found
                UserNotFound:
                  value:
                    error_code: user_not_found
                    message: User not found
                AuthSessionNotFound:
                  value:
                    error_code: auth_session_not_found
                    message: Session not found
          description: ''
components:
  schemas:
    ApiWebAuthnRegisterStartDto:
      type: object
      properties:
        auth_session_id:
          type: string
          description: >-
            Session identifier that corresponds to an authorized session
            (created from the backend with an access token)
        user:
          $ref: '#/components/schemas/ApiWebAuthnRegisterStartUserInfo'
      required:
        - auth_session_id
        - user
    WebAuthnRegisterStartResponseDto:
      type: object
      properties:
        webauthn_session_id:
          type: string
          description: WebAuthn session identifier
        credential_creation_options:
          $ref: '#/components/schemas/WebAuthnRegistrationOptions'
      required:
        - webauthn_session_id
        - credential_creation_options
    ApiWebauthnRegisterCompleteDto:
      type: object
      properties:
        auth_session_id:
          type: string
          description: Session identifier
        webauthn_session_id:
          type: string
          description: WebAuthn session identifier
        public_key_credential:
          $ref: >-
            #/components/schemas/ApiWebAuthnRegisterCompleteDtoPublicKeyCredential
        double_signed_challenge:
          type: string
          description: >-
            The WebAuthn challenge signed with the device public key, Encoded as
            Base64. Allowed signing algorithms: SHA-256, SHA-384, SHA-512
      required:
        - auth_session_id
        - webauthn_session_id
        - public_key_credential
    ApiWebAuthnRegisterCompleteResponseDto:
      type: object
      properties:
        credential:
          $ref: '#/components/schemas/ApiCredentialRegistrationDto'
        auth_code:
          type: string
          description: Authorization code to exchange for user tokens
      required:
        - credential
        - auth_code
    ApiWebAuthnAuthenticateStartDto:
      type: object
      properties:
        auth_session_id:
          type: string
          description: Session identifier
        username:
          type: string
          description: Name of user account, as used in the WebAuthn registration
      required:
        - auth_session_id
        - username
    ApiWebAuthnAuthenticateStartResponse:
      type: object
      properties:
        webauthn_session_id:
          type: string
          description: WebAuthn session identifier
        credential_request_options:
          $ref: '#/components/schemas/WebAuthnAuthenticationOptions'
      required:
        - webauthn_session_id
        - credential_request_options
    ApiWebauthnAuthenticateCompleteDto:
      type: object
      properties:
        auth_session_id:
          type: string
          description: Session identifier
        webauthn_session_id:
          type: string
          description: WebAuthn session identifier
        public_key_credential:
          description: Information about the credential used for authentication
          allOf:
            - $ref: >-
                #/components/schemas/ApiWebAuthnAuthenticateCompleteDtoPublicKeyCredential
        double_signed_challenge:
          type: string
          description: >-
            The WebAuthn challenge signed with the device public key, Encoded as
            Base64. Allowed signing algorithms: SHA-256, SHA-384, SHA-512
      required:
        - auth_session_id
        - webauthn_session_id
        - public_key_credential
    AuthenticationCompleteResponseDto:
      type: object
      properties:
        auth_code:
          type: string
          description: Authorization code to exchange for user tokens
        credential:
          $ref: '#/components/schemas/CompleteAuthenticationCredentialDto'
      required:
        - auth_code
        - credential
    ApiWebAuthnAuthenticatePasskeyStartDto:
      type: object
      properties:
        auth_session_id:
          type: string
          description: Session identifier
      required:
        - auth_session_id
    ApiWebauthnAuthenticatePasskeyCompleteDto:
      type: object
      properties:
        auth_session_id:
          type: string
          description: Session identifier
        webauthn_session_id:
          type: string
          description: WebAuthn session identifier
        public_key_credential:
          description: Information about the credential used for authentication
          allOf:
            - $ref: >-
                #/components/schemas/ApiWebAuthnAuthenticateCompleteDtoPublicKeyCredential
      required:
        - auth_session_id
        - webauthn_session_id
        - public_key_credential
    ApiWebAuthnRegisterStartUserInfo:
      type: object
      properties:
        username:
          type: string
          description: >-
            Account name for this Relying Party. This is used both for display
            purposes, as well as during recovery flows where the user is asked
            for the account name. Must match the username in the auth session.
          maxLength: 64
          minLength: 1
        display_name:
          type: string
          description: >-
            Human-palatable name for the user account, only for display (max 64
            characters)
          maxLength: 64
          minLength: 1
      required:
        - username
    WebAuthnRegistrationOptions:
      type: object
      properties:
        attestation:
          type: string
          enum:
            - none
          default: none
        authenticatorSelection:
          $ref: '#/components/schemas/ApiAuthenticatorSelectionCriteria'
        extensions:
          $ref: '#/components/schemas/ApiAuthenticationExtensionsClientInputs'
        excludeCredentials:
          type: array
          items:
            type: string
        pubKeyCredParams:
          type: array
          items:
            $ref: '#/components/schemas/ApiPublicKeyCredentialParameters'
        timeout:
          type: number
        challenge:
          type: string
        user:
          $ref: '#/components/schemas/ApiRegistrationOptionsUser'
        rp:
          $ref: '#/components/schemas/ApiRegistrationOptionsRp'
      required:
        - pubKeyCredParams
        - challenge
        - user
        - rp
    ApiWebAuthnRegisterCompleteDtoPublicKeyCredential:
      type: object
      properties:
        id:
          type: string
          description: The credential ID
        rawId:
          type: string
          description: The credentials ID given as byte array
        response:
          $ref: '#/components/schemas/ApiWebAuthnAttestationResponse'
        type:
          type: string
          example: public-key
          default: public-key
          enum:
            - public-key
          description: Key type. Should always be `public-key`
        authenticatorAttachment:
          type: string
          enum:
            - platform
            - cross-platform
          description: >-
            The authenticators' attachment modalities. Cross-platform
            authenticator are external to the current device, such as a USB
            security key or a different device
      required:
        - id
        - rawId
        - response
        - type
    ApiCredentialRegistrationDto:
      type: object
      properties:
        credential_id:
          type: string
          description: Identifier of the credential generated by Transmit
        public_key:
          type: string
          description: Public credential key for WebAuthn credentials
      required:
        - credential_id
        - public_key
    WebAuthnAuthenticationOptions:
      type: object
      properties:
        allowCredentials:
          type: array
          items:
            $ref: '#/components/schemas/AuthenticationOptionsAllowedCredential'
        rawChallenge:
          type: string
          description: >-
            Represents the natural WebAuthn challenge. Will Only be present in
            approval flows
        challenge:
          type: string
        timeout:
          type: number
        rpId:
          type: string
          description: >-
            Relying Party ID. Must be a valid domain pre-configured in the Admin
            Portal for the application
          pattern: /^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9]\.[a-zA-Z]{2,}$/
        attestation:
          type: string
          enum:
            - none
          example: none
          default: none
        userVerification:
          type: string
          enum:
            - preferred
            - required
          default: preferred
          example: preferred
        extensions:
          type: object
      required:
        - allowCredentials
        - challenge
        - rpId
    CompleteAuthenticationCredentialDto:
      type: object
      properties:
        credential_id:
          type: string
          description: Identifier of the credential generated by Transmit
        public_key:
          type: string
          description: Public credential key for WebAuthn credentials
        registered_at:
          type: string
          description: Date the credential was registered, in ISO 8601
        last_used:
          type: string
          description: >-
            Date the credential was last used to authenticate, in ISO 8601
            (excludes current session)
      required:
        - credential_id
        - public_key
        - registered_at
        - last_used
    ApiWebAuthnAuthenticateCompleteDtoPublicKeyCredential:
      type: object
      properties:
        id:
          type: string
          description: The credential ID
        rawId:
          type: string
          description: The credential ID given as byte array
        response:
          description: Response from the WebAuthn authentication
          allOf:
            - $ref: '#/components/schemas/ApiWebAuthnAssertionResponse'
        type:
          type: string
          example: public-key
          default: public-key
          enum:
            - public-key
          description: Key type. Should always be `public-key`
        authenticatorAttachment:
          type: string
          enum:
            - platform
            - cross-platform
          description: >-
            The authenticators' attachment modalities. Cross-platform
            authenticator are external to the current device, such as a USB
            security key or a different device
      required:
        - id
        - rawId
        - type
    ApiAuthenticatorSelectionCriteria:
      type: object
      properties:
        authenticatorAttachment:
          type: string
          enum:
            - platform
            - cross-platform
          description: >-
            The authenticators' attachment modalities. Cross-platform
            authenticator are external to the current device, such as a USB
            security key or a different device
          default: platform
        requireResidentKey:
          type: boolean
        residentKey:
          type: object
        userVerification:
          type: string
          enum:
            - preferred
            - required
          default: preferred
    ApiAuthenticationExtensionsClientInputs:
      type: object
      properties:
        appid:
          type: string
        credProps:
          type: boolean
        hmacCreateSecret:
          type: boolean
    ApiRegistrationOptionsUser:
      type: object
      properties:
        id:
          type: string
          description: User handle
        name:
          type: string
          description: The webauthn username
        displayName:
          type: string
          description: The user display name
      required:
        - id
        - name
        - displayName
    ApiRegistrationOptionsRp:
      type: object
      properties:
        id:
          type: string
          description: >-
            Relying Party ID. Must be a valid domain pre-configured in the Admin
            Portal for the application
          pattern: /^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9]\.[a-zA-Z]{2,}$/
        name:
          type: string
          description: Relying party displayable name
        icon:
          type: string
      required:
        - id
        - name
        - icon
    ApiWebAuthnAttestationResponse:
      type: object
      properties:
        clientDataJSON:
          type: string
          description: >-
            The client JSON data passed to the authenticator to generate the
            attestation
        attestationObject:
          type: string
          description: >-
            The attestation object containing the attestation statement and the
            authenticator and credential data
      required:
        - clientDataJSON
        - attestationObject
    ApiPublicKeyCredentialParameters:
      type: object
      properties:
        alg:
          type: number
        type:
          type: string
          example: public-key
          default: public-key
          enum:
            - public-key
          description: Key type. Should always be `public-key`
      required:
        - alg
        - type
    AuthenticationOptionsAllowedCredential:
      type: object
      properties:
        type:
          type: string
          description: Key type. Should always be `public-key`
          enum:
            - public-key
          default: public-key
          example: public-key
        id:
          type: string
          description: The credential ID
        transports:
          type: array
          default:
            - internal
          example:
            - internal
          items:
            type: string
            enum:
              - internal
      required:
        - type
        - id
        - transports
    ApiWebAuthnAssertionResponse:
      type: object
      properties:
        authenticatorData:
          type: string
          description: The WebAuthn authenticator data
        clientDataJSON:
          type: string
          description: >-
            The client JSON data passed to the authenticator to generate the
            assertion
        signature:
          type: string
          description: The raw signature ID
        userHandle:
          type: string
          description: The user handle returned by the authenticator
      required:
        - authenticatorData
        - clientDataJSON
        - signature
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
    UserAccessToken:
      type: http
      description: >-
        A token returned upon end-user authentication, which provides access to
        resources and data for the user and app for which it was generated
      scheme: bearer
      bearerFormat: JWT
    AdminAccessToken:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oidc/token
          scopes: {}
      description: >-
        A token generated by a management application using the [token
        endpoint](/openapi/token.openapi/other/getaccesstoken). It provides
        access to all resources for the tenant and its apps
    ClientAccessToken:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oidc/token
          scopes: {}
      description: >-
        A token generated by an end-user application using the [token
        endpoint](/openapi/token.openapi/other/getaccesstoken). It provides
        access to resources and data on the tenant level or associated with the
        specific application (but not other apps in the tenant)
    OrgAdminAccessToken:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oidc/token
          scopes: {}
      description: >-
        A token returned upon B2B authentication for a user that has the
        organizationAdmin or organizationCreator role.
