openapi: 3.1.0
info:
  title: OpenID Bridge API
  description: OPENID BRIDGE API documentation
  contact:
    name: Procivis One Docs
    url: https://www.procivis.ch/en/procivis-one#signup
  version: v1.80.0
servers:
- url: ""
- url: https://www.procivis-one.com
  description: Generated server url
security:
- bearer: []
tags:
- name: provider-controller
  description: |
    Create and manage OpenID providers.

    Related guide: [Integrate OpenID Bridge](https://docs.procivis.ch/openid-bridge/integrate)
  x-displayName: Providers
- name: build-info-controller
  description: |
    Retrieve Procivis One version information.
  x-displayName: Version
paths:
  /api/provider/v1:
    get:
      tags:
      - provider-controller
      summary: List OIDC providers
      description: |-
        **Permissions:** `OPENID_PROVIDER_LIST`

        Returns a list of OpenID Connect providers in the system.
      operationId: getProviders
      parameters:
      - name: lastModifiedBefore
        in: query
        description: |
          Return only OIDC providers which were last modified before this time.
          Timestamp in RFC3339 format.
        required: false
        schema:
          type: string
          format: date-time
          description: |
            Return only OIDC providers which were last modified before this time.
            Timestamp in RFC3339 format.
          example: 2023-06-09T14:19:57.000Z
        example: 2023-06-09T14:19:57.000Z
      - name: lastModifiedBAfter
        in: query
        description: |
          Return only OIDC providers which were last modified after this time.
          Timestamp in RFC3339 format.
        required: false
        schema:
          type: string
          format: date-time
          description: |
            Return only OIDC providers which were last modified after this time.
            Timestamp in RFC3339 format.
          example: 2023-06-09T14:19:57.000Z
        example: 2023-06-09T14:19:57.000Z
      - name: ids
        in: query
        description: |
          Specify providers to be returned by their UUID.
        required: false
        schema:
          $ref: "#/components/schemas/ids"
      - name: name
        in: query
        description: |
          Return only providers with a name starting with this string. Not case-sensitive.
        required: false
        schema:
          type: string
          description: |
            Return only providers with a name starting with this string. Not case-sensitive.
      - name: organisationId
        in: query
        required: false
        schema:
          type: string
          format: uuid
      - name: sort
        in: query
        required: false
        schema:
          type: string
          default: createdDate
      - name: sortDirection
        in: query
        required: false
        schema:
          type: string
          default: DESC
          enum:
          - ASC
          - DESC
      - name: page
        in: query
        description: |
          The page number to retrieve (0-based indexing).
        required: false
        schema:
          type: integer
          format: int32
          description: |
            The page number to retrieve (0-based indexing).
          minimum: 0
      - name: pageSize
        in: query
        description: |
          Number of items to return per page. If omitted, defaults to 30.
        required: false
        schema:
          type: integer
          format: int32
          description: |
            Number of items to return per page. If omitted, defaults to 30.
          maximum: 1000
          minimum: 1
      - name: createdDateBefore
        in: query
        description: |
          Return only OIDC providers which were created before this time.
          Timestamp in RFC3339 format.
        required: false
        schema:
          type: string
          format: date-time
          description: |
            Return only OIDC providers which were created before this time.
            Timestamp in RFC3339 format.
          example: 2023-06-09T14:19:57.000Z
        example: 2023-06-09T14:19:57.000Z
      - name: createdDateAfter
        in: query
        description: |
          Return only OIDC providers which were created after this time.
          Timestamp in RFC3339 format.
        required: false
        schema:
          type: string
          format: date-time
          description: |
            Return only OIDC providers which were created after this time.
            Timestamp in RFC3339 format.
          example: 2023-06-09T14:19:57.000Z
        example: 2023-06-09T14:19:57.000Z
      responses:
        "400":
          description: Business rule error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SearchEntityResponseDTOListProviderResponseDTO"
      x-permissions:
      - OPENID_PROVIDER_LIST
    post:
      tags:
      - provider-controller
      summary: Create an OIDC provider
      description: |-
        **Permissions:** `OPENID_PROVIDER_CREATE`

        Creates a new OpenID Connect provider for OpenID Bridge. See the [integration guide](/openid-bridge/integrate).
      operationId: createProvider
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProviderRequestDTO"
        required: true
      responses:
        "400":
          description: Invalid Provider data
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "201":
          description: Created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ProviderResponseDTO"
      x-permissions:
      - OPENID_PROVIDER_CREATE
  /api/provider/v1/{providerId}/regenerate-secret:
    post:
      tags:
      - provider-controller
      summary: Regenerate secret
      description: |-
        **Permissions:** `OPENID_PROVIDER_EDIT`

        Regenerates the client secret for an OpenID Connect provider.
      operationId: regenerateSecretForProvider
      parameters:
      - name: providerId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        "400":
          description: Invalid Provider data
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ProviderResponseDTO"
      x-permissions:
      - OPENID_PROVIDER_EDIT
  /api/provider/v1/{providerId}:
    get:
      tags:
      - provider-controller
      summary: Retrieve an OIDC provider
      description: |-
        **Permissions:** `OPENID_PROVIDER_DETAIL`

        Returns detailed information about an OpenID Connect provider.
      operationId: getProviderById
      parameters:
      - name: providerId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        "400":
          description: Business rule error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "404":
          description: Provider not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DetailProviderResponseDTO"
      x-permissions:
      - OPENID_PROVIDER_DETAIL
    delete:
      tags:
      - provider-controller
      summary: Delete an OIDC provider
      description: |-
        **Permissions:** `OPENID_PROVIDER_DELETE`

        Deletes an OpenID Connect provider.
      operationId: deleteProvider
      parameters:
      - name: providerId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        "400":
          description: Business rule error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "404":
          description: Provider not found
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "204":
          description: No Content
      x-permissions:
      - OPENID_PROVIDER_DELETE
    patch:
      tags:
      - provider-controller
      summary: Update an OIDC provider
      description: |-
        **Permissions:** `OPENID_PROVIDER_EDIT`

        Updates an OpenID Connect provider.
      operationId: updateProvider
      parameters:
      - name: providerId
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdatedProviderRequestDTO"
        required: true
      responses:
        "400":
          description: Invalid Provider data
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "204":
          description: No Content
      x-permissions:
      - OPENID_PROVIDER_EDIT
  /api/build-info/v1:
    get:
      tags:
      - Build info
      summary: Retrieve Procivis One version
      description: Returns the Procivis One version.
      operationId: getBuildInfo
      responses:
        "500":
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponseDTO"
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/BuildInfoResponseDTO"
components:
  schemas:
    ProviderRequestDTO:
      type: object
      properties:
        proofSchemaId:
          type: string
          format: uuid
          description: The schema used to make the request.
        verifier:
          type: string
          format: uuid
          description: Identifier used for verification.
        acceptedIssuerId:
          type: string
          format: uuid
          description: UUID of the issuer's identifier. Shared credentials must be
            signed by this identifier or login will fail.
        redirectUris:
          type: array
          description: Redirect URI from the OIDC provider.
          items:
            type: string
        name:
          type: string
        organisationId:
          type: string
          format: uuid
        subjectMapping:
          type: string
        lastNameMapping:
          type: string
        firstNameMapping:
          type: string
        birthdateMapping:
          type: string
        emailMapping:
          type: string
        phoneNumberMapping:
          type: string
        postLogoutRedirectUris:
          type: array
          items:
            type: string
        displayName:
          type: string
        privacyUrl:
          type: string
        termsUrl:
          type: string
        clientId:
          type: string
          description: |
            If you have configured your OIDC provider first, use the client ID provided
            by that configuration. Otherwise one will be created.
        clientSecret:
          type: string
          description: |
            If you have configured your OIDC provider first, use the client secret
            provided by that configuration. Otherwise one will be created.
        scopes:
          type: array
          default: "[OPENID, PROFILE]"
          description: Specify OpenID scopes.
          items:
            type: string
            enum:
            - ADDRESS
            - EMAIL
            - OPENID
            - PHONE
            - PROFILE
        grantTypes:
          type: array
          default: AUTHORIZATION_CODE
          description: Specify grant types.
          items:
            type: string
            enum:
            - AUTHORIZATION_CODE
            - CLIENT_CREDENTIALS
            - REFRESH_TOKEN
        logo:
          type: string
      required:
      - acceptedIssuerId
      - name
      - proofSchemaId
      - redirectUris
      - verifier
    ErrorResponseDTO:
      type: object
      properties:
        timestamp:
          type: string
          format: date-time
        cause:
          $ref: "#/components/schemas/HttpErrorResponseDTO"
        code:
          type: string
        message:
          type: string
        data: {}
        stackTrace:
          type: string
      required:
      - code
      - message
    HttpErrorResponseDTO:
      type: object
      properties:
        url:
          type: string
        code:
          type: integer
          format: int32
        message:
          type: string
        cause:
          $ref: "#/components/schemas/ProcivisErrorCauseResponseDTO"
    ProcivisErrorCauseResponseDTO:
      type: object
      properties:
        url:
          type: string
        code:
          type: integer
          format: int32
        message:
          type: string
    ProviderResponseDTO:
      type: object
      properties:
        id:
          type: string
        clientId:
          type: string
        clientSecret:
          type: string
    UpdatedProviderRequestDTO:
      type: object
      properties:
        clientSecret:
          type: string
        verifier:
          type: string
          format: uuid
        redirectUris:
          type: array
          items:
            type: string
        scopes:
          type: array
          items:
            type: string
            enum:
            - ADDRESS
            - EMAIL
            - OPENID
            - PHONE
            - PROFILE
        grantTypes:
          type: array
          items:
            type: string
            enum:
            - AUTHORIZATION_CODE
            - CLIENT_CREDENTIALS
            - REFRESH_TOKEN
        subjectMapping:
          type: string
        lastNameMapping:
          type: string
        firstNameMapping:
          type: string
        birthdateMapping:
          type: string
        emailMapping:
          type: string
        phoneNumberMapping:
          type: string
        postLogoutRedirectUris:
          type: array
          items:
            type: string
        displayName:
          type: string
        privacyUrl:
          type: string
        termsUrl:
          type: string
        logo:
          type: string
        acceptedIssuerId:
          type: string
          format: uuid
    ids:
      type: array
      description: |
        Specify providers to be returned by their UUID.
      items:
        type: string
        description: |
          Specify providers to be returned by their UUID.
    ListProviderResponseDTO:
      type: object
      properties:
        proofSchemaId:
          type: string
          format: uuid
          description: The schema used to make the request.
        verifier:
          type: string
          format: uuid
          description: Identifier used for verification.
        acceptedIssuerId:
          type: string
          format: uuid
          description: UUID of the issuer's identifier. Shared credentials must be
            signed by this identifier or login will fail.
        redirectUris:
          type: array
          description: Redirect URI from the OIDC provider.
          items:
            type: string
        name:
          type: string
        organisationId:
          type: string
          format: uuid
        subjectMapping:
          type: string
        lastNameMapping:
          type: string
        firstNameMapping:
          type: string
        birthdateMapping:
          type: string
        emailMapping:
          type: string
        phoneNumberMapping:
          type: string
        postLogoutRedirectUris:
          type: array
          items:
            type: string
        displayName:
          type: string
        privacyUrl:
          type: string
        termsUrl:
          type: string
        id:
          type: string
          format: uuid
        clientId:
          type: string
        scopes:
          type: array
          items:
            type: string
            enum:
            - ADDRESS
            - EMAIL
            - OPENID
            - PHONE
            - PROFILE
        grantTypes:
          type: array
          items:
            type: string
            enum:
            - AUTHORIZATION_CODE
            - CLIENT_CREDENTIALS
            - REFRESH_TOKEN
        createdDate:
          type: string
          format: date-time
        lastModified:
          type: string
          format: date-time
      required:
      - acceptedIssuerId
      - clientId
      - grantTypes
      - id
      - name
      - proofSchemaId
      - redirectUris
      - scopes
      - verifier
    SearchEntityResponseDTOListProviderResponseDTO:
      type: object
      properties:
        values:
          type: array
          items:
            $ref: "#/components/schemas/ListProviderResponseDTO"
        totalItems:
          type: integer
          format: int64
        totalPages:
          type: integer
          format: int32
      required:
      - totalItems
      - totalPages
      - values
    DetailProviderResponseDTO:
      type: object
      properties:
        proofSchemaId:
          type: string
          format: uuid
          description: The schema used to make the request.
        verifier:
          type: string
          format: uuid
          description: Identifier used for verification.
        acceptedIssuerId:
          type: string
          format: uuid
          description: UUID of the issuer's identifier. Shared credentials must be
            signed by this identifier or login will fail.
        redirectUris:
          type: array
          description: Redirect URI from the OIDC provider.
          items:
            type: string
        name:
          type: string
        organisationId:
          type: string
          format: uuid
        subjectMapping:
          type: string
        lastNameMapping:
          type: string
        firstNameMapping:
          type: string
        birthdateMapping:
          type: string
        emailMapping:
          type: string
        phoneNumberMapping:
          type: string
        postLogoutRedirectUris:
          type: array
          items:
            type: string
        displayName:
          type: string
        privacyUrl:
          type: string
        termsUrl:
          type: string
        id:
          type: string
          format: uuid
        clientId:
          type: string
        scopes:
          type: array
          items:
            type: string
            enum:
            - ADDRESS
            - EMAIL
            - OPENID
            - PHONE
            - PROFILE
        grantTypes:
          type: array
          items:
            type: string
            enum:
            - AUTHORIZATION_CODE
            - CLIENT_CREDENTIALS
            - REFRESH_TOKEN
        createdDate:
          type: string
          format: date-time
        lastModified:
          type: string
          format: date-time
        logo:
          type: string
      required:
      - acceptedIssuerId
      - clientId
      - grantTypes
      - id
      - name
      - proofSchemaId
      - redirectUris
      - scopes
      - verifier
    BuildInfoResponseDTO:
      type: object
      properties:
        name:
          type: string
        time:
          type: string
          format: date-time
        version:
          type: string
        group:
          type: string
        artifact:
          type: string
        javaVersion:
          type: string
        description:
          type: string
        commitSha:
          type: string
        pipelineId:
          type: string
        commitBranch:
          type: string
        commitTag:
          type: string
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
