api.swagger.yaml

consumes:
  - application/json
  - application/x-www-form-urlencoded
produces:
  - application/json
schemes:
  - http
  - https
swagger: '2.0'
info:
  description: >-
    Please refer to the user guide for in-depth documentation:
    https://ory.gitbooks.io/hydra/content/


    Hydra offers OAuth 2.0 and OpenID Connect Core 1.0 capabilities as a
    service. Hydra is different, because it works with any existing
    authentication infrastructure, not just LDAP or SAML. By implementing a
    consent app (works with any programming language) you build a bridge between
    Hydra and your authentication infrastructure.

    Hydra is able to securely manage JSON Web Keys, and has a sophisticated
    policy-based access control you can use if you want to.

    Hydra is suitable for green- (new) and brownfield (existing) projects. If
    you are not familiar with OAuth 2.0 and are working on a greenfield project,
    we recommend evaluating if OAuth 2.0 really serves your purpose. Knowledge
    of OAuth 2.0 is imperative in understanding what Hydra does and how it
    works.


    The official repository is located at https://github.com/ory/hydra
  title: Hydra OAuth2 & OpenID Connect Server
  contact:
    name: ORY
    url: 'https://www.ory.am'
    email: hi@ory.am
  license:
    name: Apache 2.0
    url: 'https://github.com/ory/hydra/blob/master/LICENSE'
  version: Latest
basePath: /
paths:
  /.well-known/jwks.json:
    get:
      description: >-
        Use this method if you do not want to let Hydra generate the JWKs for
        you, but instead save your own.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:keys:hydra.openid.id-token:public"],

        "actions": ["GET"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
        - oauth2
        - openid-connect
      summary: Public JWKs
      operationId: WellKnown
      security:
        - oauth2:
            - hydra.keys.get
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /.well-known/openid-configuration:
    get:
      description: >-
        For more information, please refer to
        https://openid.net/specs/openid-connect-discovery-1_0.html
      consumes:
        - application/x-www-form-urlencoded
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - openid-connect
      summary: Server well known configuration
      operationId: WellKnownHandler
      security:
        - oauth2: []
      responses:
        '200':
          description: WellKnown
          schema:
            $ref: '#/definitions/WellKnown'
        '401':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /clients:
    get:
      description: >-
        Never returns a client's secret.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:clients"],

        "actions": ["get"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Lists OAuth 2.0 Clients
      operationId: listOAuthClients
      security:
        - oauth2:
            - hydra.clients
      responses:
        '200':
          $ref: '#/responses/clientsList'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    post:
      description: >-
        Be aware that an OAuth 2.0 Client may gain highly priviledged access if
        configured that way. This

        endpoint should be well protected and only called by code you trust.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:clients"],

        "actions": ["create"],

        "effect": "allow"

        }

        ```


        Additionally, the context key "owner" is set to the owner of the client,
        allowing policies such as:


        ```

        {

        "resources": ["rn:hydra:clients"],

        "actions": ["create"],

        "effect": "allow",

        "conditions": { "owner": { "type": "EqualsSubjectCondition" } }

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Creates an OAuth 2.0 Client
      operationId: createOAuthClient
      security:
        - oauth2:
            - hydra.clients
      parameters:
        - name: Body
          in: body
          required: true
          schema:
            $ref: '#/definitions/oauthClient'
      responses:
        '200':
          description: oauthClient
          schema:
            $ref: '#/definitions/oauthClient'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/clients/{id}':
    get:
      description: >-
        Never returns the client's secret.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:clients:<some-id>"],

        "actions": ["get"],

        "effect": "allow"

        }

        ```


        Additionally, the context key "owner" is set to the owner of the client,
        allowing policies such as:


        ```

        {

        "resources": ["rn:hydra:clients:<some-id> "],

        "actions": ["get"],

        "effect": "allow",

        "conditions": { "owner": { "type": "EqualsSubjectCondition" } }

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Fetches an OAuth 2.0 Client.
      operationId: getOAuthClient
      security:
        - oauth2:
            - hydra.clients
      parameters:
        - uniqueItems: true
          type: string
          x-go-name: ID
          description: The id of the OAuth 2.0 Client.
          name: id
          in: path
          required: true
      responses:
        '200':
          description: oauthClient
          schema:
            $ref: '#/definitions/oauthClient'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    put:
      description: >-
        Be aware that an OAuth 2.0 Client may gain highly priviledged access if
        configured that way. This

        endpoint should be well protected and only called by code you trust.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:clients"],

        "actions": ["update"],

        "effect": "allow"

        }

        ```


        Additionally, the context key "owner" is set to the owner of the client,
        allowing policies such as:


        ```

        {

        "resources": ["rn:hydra:clients"],

        "actions": ["update"],

        "effect": "allow",

        "conditions": { "owner": { "type": "EqualsSubjectCondition" } }

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Updates an OAuth 2.0 Client
      operationId: updateOAuthClient
      security:
        - oauth2:
            - hydra.clients
      parameters:
        - type: string
          x-go-name: ID
          name: id
          in: path
          required: true
        - name: Body
          in: body
          required: true
          schema:
            $ref: '#/definitions/oauthClient'
      responses:
        '200':
          description: oauthClient
          schema:
            $ref: '#/definitions/oauthClient'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:clients:<some-id>"],

        "actions": ["delete"],

        "effect": "allow"

        }

        ```


        Additionally, the context key "owner" is set to the owner of the client,
        allowing policies such as:


        ```

        {

        "resources": ["rn:hydra:clients:<some-id>"],

        "actions": ["delete"],

        "effect": "allow",

        "conditions": { "owner": { "type": "EqualsSubjectCondition" } }

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Deletes an OAuth 2.0 Client
      operationId: deleteOAuthClient
      security:
        - oauth2:
            - hydra.clients
      parameters:
        - uniqueItems: true
          type: string
          x-go-name: ID
          description: The id of the OAuth 2.0 Client.
          name: id
          in: path
          required: true
      responses:
        '204':
          $ref: '#/responses/emptyResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /health:
    get:
      description: Check health status of instance
      operationId: health
      responses:
        '204':
          $ref: '#/responses/emptyResponse'
        '500':
          $ref: '#/responses/genericError'
  '/keys/{set}':
    get:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:keys:<set>:<kid>"],

        "actions": ["get"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Retrieves a JSON Web Key Set matching the set
      operationId: getJwkSet
      security:
        - oauth2:
            - hydra.keys.get
      parameters:
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    put:
      description: >-
        Use this method if you do not want to let Hydra generate the JWKs for
        you, but instead save your own.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:keys:<set>"],

        "actions": ["update"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Updates a JSON Web Key Set
      operationId: updateJwkSet
      security:
        - oauth2:
            - hydra.keys.update
      parameters:
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/jwkSet'
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    post:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:keys:<set>:<kid>"],

        "actions": ["create"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Generate a new JSON Web Key
      operationId: createJwkKey
      security:
        - oauth2:
            - hydra.keys.create
      parameters:
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/createRequest'
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:keys:<set>"],

        "actions": ["delete"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Delete a JSON Web Key
      operationId: deleteJwkSet
      security:
        - oauth2:
            - hydra.keys.delete
      parameters:
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
      responses:
        '204':
          $ref: '#/responses/emptyResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/keys/{set}/{kid}':
    get:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:keys:<set>:<kid>"],

        "actions": ["get"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Retrieves a JSON Web Key Set matching the set and the kid
      operationId: getJwkSetKey
      security:
        - oauth2:
            - hydra.keys.get
      parameters:
        - type: string
          x-go-name: KID
          description: The kid of the desired key
          name: kid
          in: path
          required: true
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    put:
      description: >-
        Use this method if you do not want to let Hydra generate the JWKs for
        you, but instead save your own.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:keys:<set>:<kid>"],

        "actions": ["update"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Updates a JSON Web Key
      operationId: updateJwkKey
      security:
        - oauth2:
            - hydra.keys.update
      parameters:
        - type: string
          x-go-name: KID
          description: The kid of the desired key
          name: kid
          in: path
          required: true
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/jwkSet'
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:keys:<set>:<kid>"],

        "actions": ["delete"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Delete a JSON Web Key
      operationId: deleteJwkKey
      security:
        - oauth2:
            - hydra.keys.delete
      parameters:
        - type: string
          x-go-name: KID
          description: The kid of the desired key
          name: kid
          in: path
          required: true
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
      responses:
        '204':
          $ref: '#/responses/emptyResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /oauth2/auth:
    get:
      description: >-
        For more information, please refer to
        https://tools.ietf.org/html/rfc6749#section-4
      consumes:
        - application/x-www-form-urlencoded
      schemes:
        - http
        - https
      tags:
        - oauth2
      summary: The OAuth 2.0 Auth endpoint
      operationId: oauthAuth
      responses:
        '302':
          $ref: '#/responses/emptyResponse'
        '401':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /oauth2/introspect:
    post:
      description: >-
        For more information, please refer to
        https://tools.ietf.org/html/rfc7662
      consumes:
        - application/x-www-form-urlencoded
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
      summary: Introspect an OAuth2 access token
      operationId: introspectOAuthToken
      security:
        - oauth2: []
      responses:
        '200':
          $ref: '#/responses/introspectOAuthTokenResponse'
        '401':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /oauth2/revoke:
    post:
      description: >-
        For more information, please refer to
        https://tools.ietf.org/html/rfc7009
      consumes:
        - application/x-www-form-urlencoded
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
      summary: Revoke an OAuth2 access token
      operationId: revokeOAuthToken
      security:
        - oauth2: []
      parameters:
        - name: Body
          in: body
          required: true
          schema:
            type: object
            properties:
              access_token:
                type: string
                x-go-name: AccessToken
              refresh_token:
                type: string
                x-go-name: RefreshToken
      responses:
        '200':
          $ref: '#/responses/emptyResponse'
        '401':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /oauth2/token:
    post:
      description: >-
        For more information, please refer to
        https://tools.ietf.org/html/rfc6749#section-4
      consumes:
        - application/x-www-form-urlencoded
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
      summary: The OAuth 2.0 Token endpoint
      operationId: oauthToken
      security:
        - basic: []
      responses:
        '200':
          $ref: '#/responses/oauthTokenResponse'
        '401':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /policies:
    get:
      description: >-
        Visit https://github.com/ory/ladon#usage for more information on policy
        usage.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:policies"],

        "actions": ["list"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: List access control policies
      operationId: listPolicies
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - type: integer
          format: int64
          x-go-name: Offset
          description: The offset from where to start looking.
          name: offset
          in: query
        - type: integer
          format: int64
          x-go-name: Limit
          description: The maximum amount of policies returned.
          name: limit
          in: query
      responses:
        '200':
          $ref: '#/responses/listPolicyResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    post:
      description: >-
        Visit https://github.com/ory/ladon#usage for more information on policy
        usage.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:policies"],

        "actions": ["create"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: Create an access control policy
      operationId: createPolicy
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/policy'
      responses:
        '201':
          description: policy
          schema:
            $ref: '#/definitions/policy'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/policies/{id}':
    get:
      description: >-
        Visit https://github.com/ory/ladon#usage for more information on policy
        usage.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:policies:<id>"],

        "actions": ["get"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: Get an access control policy
      operationId: getPolicy
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the policy.
          name: id
          in: path
          required: true
      responses:
        '200':
          description: policy
          schema:
            $ref: '#/definitions/policy'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    put:
      description: >-
        Visit https://github.com/ory/ladon#usage for more information on policy
        usage.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:policies"],

        "actions": ["update"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: Update an access control policy
      operationId: updatePolicy
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the policy.
          name: id
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/policy'
      responses:
        '200':
          description: policy
          schema:
            $ref: '#/definitions/policy'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: >-
        Visit https://github.com/ory/ladon#usage for more information on policy
        usage.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:policies:<id>"],

        "actions": ["delete"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: Delete an access control policy
      operationId: deletePolicy
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the policy.
          name: id
          in: path
          required: true
      responses:
        '204':
          $ref: '#/responses/emptyResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /warden/allowed:
    post:
      description: >-
        Checks if an arbitrary subject is allowed to perform an action on a
        resource. This endpoint requires a subject,

        a resource name, an action name and a context.If the subject is not
        allowed to perform the action on the resource,

        this endpoint returns a 200 response with `{ "allowed": false} }`.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:warden:allowed"],

        "actions": ["decide"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
      summary: Check if a subject is allowed to do something
      operationId: wardenAllowed
      security:
        - oauth2:
            - hydra.warden
      parameters:
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/allowedRequest'
      responses:
        '200':
          $ref: '#/responses/wardenAllowedResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /warden/groups:
    get:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:warden:groups:<member>"],

        "actions": ["get"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Find group IDs by member
      operationId: findGroupsByMember
      security:
        - oauth2:
            - hydra.groups
      parameters:
        - type: integer
          format: int64
          x-go-name: Member
          description: The id of the member to look up.
          name: member
          in: query
      responses:
        '200':
          $ref: '#/responses/findGroupsByMemberResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    post:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:warden:groups"],

        "actions": ["create"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Create a group
      operationId: createGroup
      security:
        - oauth2:
            - hydra.groups
      responses:
        '201':
          $ref: '#/responses/groupResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/warden/groups/{id}':
    get:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:warden:groups:<id>"],

        "actions": ["create"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Get a group by id
      operationId: getGroup
      security:
        - oauth2:
            - hydra.groups
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the group to look up.
          name: id
          in: path
          required: true
      responses:
        '201':
          $ref: '#/responses/groupResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:warden:groups:<id>"],

        "actions": ["delete"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Delete a group by id
      operationId: deleteGroup
      security:
        - oauth2:
            - hydra.groups
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the group to look up.
          name: id
          in: path
          required: true
      responses:
        '204':
          $ref: '#/responses/emptyResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/warden/groups/{id}/members':
    post:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:warden:groups:<id>"],

        "actions": ["members.add"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Add members to a group
      operationId: addMembersToGroup
      security:
        - oauth2:
            - hydra.groups
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the group to modify.
          name: id
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/membersRequest'
      responses:
        '204':
          $ref: '#/responses/emptyResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: >-
        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:warden:groups:<id>"],

        "actions": ["members.remove"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Remove members from a group
      operationId: removeMembersFromGroup
      security:
        - oauth2:
            - hydra.groups
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the group to modify.
          name: id
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/membersRequest'
      responses:
        '204':
          $ref: '#/responses/emptyResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /warden/token/allowed:
    post:
      description: >-
        Checks if a token is valid and if the token owner is allowed to perform
        an action on a resource.

        This endpoint requires a token, a scope, a resource name, an action name
        and a context.


        If a token is expired/invalid, has not been granted the requested scope
        or the subject is not allowed to

        perform the action on the resource, this endpoint returns a 200 response
        with `{ "allowed": false} }`.


        Extra data set through the `at_ext` claim in the consent response will
        be included in the response.

        The `id_ext` claim will never be returned by this endpoint.


        The subject making the request needs to be assigned to a policy
        containing:


        ```

        {

        "resources": ["rn:hydra:warden:token:allowed"],

        "actions": ["decide"],

        "effect": "allow"

        }

        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
      summary: Check if the subject of a token is allowed to do something
      operationId: wardenTokenAllowed
      security:
        - oauth2:
            - hydra.warden
      parameters:
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/wardenTokenAllowedBody'
      responses:
        '200':
          $ref: '#/responses/wardenTokenAllowedResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
definitions:
  ConsentStrategy:
    type: object
    x-go-package: github.com/ory/hydra/oauth2
  Context:
    description: Context contains an access token's session data
    type: object
    properties:
      aud:
        description: >-
          Audience is who the token was issued for. This is an OAuth2 app
          usually.
        type: string
        x-go-name: Audience
      exp:
        description: ExpiresAt is the expiry timestamp.
        x-go-name: ExpiresAt
      ext:
        description: Extra represents arbitrary session data.
        type: object
        additionalProperties:
          type: object
        x-go-name: Extra
      iat:
        description: IssuedAt is the token creation time stamp.
        x-go-name: IssuedAt
      iss:
        description: 'Issuer is the id of the issuer, typically an hydra instance.'
        type: string
        x-go-name: Issuer
      scopes:
        description: >-
          GrantedScopes is a list of scopes that the subject authorized when
          asked for consent.
        type: array
        items:
          type: string
        x-go-name: GrantedScopes
      sub:
        description: >-
          Subject is the identity that authorized issuing the token, for example
          a user or an OAuth2 app.

          This is usually a uuid but you can choose a urn or some other id too.
        type: string
        x-go-name: Subject
    x-go-package: github.com/ory/hydra/firewall
  Duration:
    description: |-
      A Duration represents the elapsed time between two instants
      as an int64 nanosecond count. The representation limits the
      largest representable duration to approximately 290 years.
    type: integer
    format: int64
    x-go-package: time
  FieldLogger:
    description: The FieldLogger interface generalizes the Entry and Logger types
    type: object
    x-go-package: github.com/ory/hydra/vendor/github.com/Sirupsen/logrus
  Firewall:
    type: object
    title: Firewall offers various validation strategies for access tokens.
    x-go-package: github.com/ory/hydra/firewall
  Handler:
    type: object
    properties:
      AccessTokenLifespan:
        $ref: '#/definitions/Duration'
      Consent:
        $ref: '#/definitions/ConsentStrategy'
      ConsentURL:
        $ref: '#/definitions/URL'
      CookieStore:
        $ref: '#/definitions/Store'
      ForcedHTTP:
        type: boolean
      H:
        $ref: '#/definitions/Writer'
      Issuer:
        type: string
      L:
        $ref: '#/definitions/FieldLogger'
      OAuth2:
        $ref: '#/definitions/OAuth2Provider'
    x-go-package: github.com/ory/hydra/oauth2
  Headers:
    description: Headers is the jwt headers
    type: object
    properties:
      Extra:
        type: object
        additionalProperties:
          type: object
    x-go-package: github.com/ory/hydra/vendor/github.com/ory/fosite/token/jwt
  IDTokenClaims:
    description: IDTokenClaims represent the claims used in open id connect requests
    type: object
    properties:
      AccessTokenHash:
        type: string
      Audience:
        type: string
      AuthTime: {}
      CodeHash:
        type: string
      ExpiresAt: {}
      Extra:
        type: object
        additionalProperties:
          type: object
      IssuedAt: {}
      Issuer:
        type: string
      Nonce:
        type: string
      Subject:
        type: string
    x-go-package: github.com/ory/hydra/vendor/github.com/ory/fosite/token/jwt
  Manager:
    type: object
    x-go-package: github.com/ory/hydra/warden/group
  OAuth2Provider:
    description: Check fosite.Fosite for an implementation of this interface.
    type: object
    title: >-
      OAuth2Provider is an interface that enables you to write OAuth2 handlers
      with only a few lines of code.
    x-go-package: github.com/ory/hydra/vendor/github.com/ory/fosite
  Session:
    type: object
    properties:
      Claims:
        $ref: '#/definitions/IDTokenClaims'
      ExpiresAt: {}
      Headers:
        $ref: '#/definitions/Headers'
      Subject:
        type: string
      Username:
        type: string
      extra:
        type: object
        additionalProperties:
          type: object
        x-go-name: Extra
    x-go-package: github.com/ory/hydra/oauth2
  Store:
    description: See CookieStore and FilesystemStore for examples.
    type: object
    title: Store is an interface for custom session stores.
    x-go-package: github.com/ory/hydra/vendor/github.com/gorilla/sessions
  URL:
    description: >-
      scheme://[userinfo@]host/path[?query][#fragment]


      URLs that do not start with a slash after the scheme are interpreted as:


      scheme:opaque[?query][#fragment]


      Note that the Path field is stored in decoded form: /%47%6f%2f becomes
      /Go/.

      A consequence is that it is impossible to tell which slashes in the Path
      were

      slashes in the raw URL and which were %2f. This distinction is rarely
      important,

      but when it is, code must not use Path directly.


      Go 1.5 introduced the RawPath field to hold the encoded form of Path.

      The Parse function sets both Path and RawPath in the URL it returns,

      and URL's String method uses RawPath if it is a valid encoding of Path,

      by calling the EscapedPath method.


      In earlier versions of Go, the more indirect workarounds were that an

      HTTP server could consult req.RequestURI and an HTTP client could

      construct a URL struct directly and set the Opaque field instead of Path.

      These still work as well.
    type: object
    title: |-
      A URL represents a parsed URL (technically, a URI reference).
      The general form represented is:
    properties:
      ForceQuery:
        type: boolean
      Fragment:
        type: string
      Host:
        type: string
      Opaque:
        type: string
      Path:
        type: string
      RawPath:
        type: string
      RawQuery:
        type: string
      Scheme:
        type: string
      User:
        $ref: '#/definitions/Userinfo'
    x-go-package: net/url
  Userinfo:
    description: |-
      The Userinfo type is an immutable encapsulation of username and
      password details for a URL. An existing Userinfo value is guaranteed
      to have a username set (potentially empty, as allowed by RFC 2396),
      and optionally a password.
    type: object
    x-go-package: net/url
  WellKnown:
    type: object
    required:
      - issuer
      - authorization_endpoint
      - token_endpoint
      - jwks_uri
      - subject_types_supported
      - id_token_signing_alg_values_supported
      - response_types_supported
    properties:
      authorization_endpoint:
        description: URL of the OP's OAuth 2.0 Authorization Endpoint
        type: string
        x-go-name: AuthURL
      id_token_signing_alg_values_supported:
        description: >-
          JSON array containing a list of the JWS signing algorithms (alg
          values) supported by the OP for the ID Token

          to encode the Claims in a JWT [JWT]. The algorithm RS256 MUST be
          included. The value none MAY be supported,

          but MUST NOT be used unless the Response Type used returns no ID Token
          from the Authorization Endpoint

          (such as when using the Authorization Code Flow).
        type: array
        items:
          type: string
        x-go-name: SigningAlgs
      issuer:
        description: >-
          URL using the https scheme with no query or fragment component that
          the OP asserts as its Issuer Identifier.

          If Issuer discovery is supported , this value MUST be identical to the
          issuer value returned

          by WebFinger. This also MUST be identical to the iss Claim value in ID
          Tokens issued from this Issuer.
        type: string
        x-go-name: Issuer
      jwks_uri:
        description: >-
          URL of the OP's JSON Web Key Set [JWK] document. This contains the
          signing key(s) the RP uses to validate

          signatures from the OP. The JWK Set MAY also contain the Server's
          encryption key(s), which are used by RPs

          to encrypt requests to the Server. When both signing and encryption
          keys are made available, a use (Key Use)

          parameter value is REQUIRED for all keys in the referenced JWK Set to
          indicate each key's intended usage.

          Although some algorithms allow the same key to be used for both
          signatures and encryption, doing so is

          NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be
          used to provide X.509 representations of

          keys provided. When used, the bare key values MUST still be present
          and MUST match those in the certificate.
        type: string
        x-go-name: JWKsURI
      response_types_supported:
        description: >-
          JSON array containing a list of the OAuth 2.0 response_type values
          that this OP supports. Dynamic OpenID

          Providers MUST support the code, id_token, and the token id_token
          Response Type values.
        type: array
        items:
          type: string
        x-go-name: ResponseTypes
      subject_types_supported:
        description: >-
          JSON array containing a list of the Subject Identifier types that this
          OP supports. Valid types include

          pairwise and public.
        type: array
        items:
          type: string
        x-go-name: SubjectTypes
      token_endpoint:
        description: URL of the OP's OAuth 2.0 Token Endpoint
        type: string
        x-go-name: TokenURL
    x-go-package: github.com/ory/hydra/oauth2
  Writer:
    description: Writer is a helper to write arbitrary data to a ResponseWriter
    type: object
    x-go-package: github.com/ory/hydra/vendor/github.com/ory/herodot
  allowedRequest:
    type: object
    title: AccessRequest is the warden's request object.
    properties:
      action:
        description: Action is the action that is requested on the resource.
        type: string
        x-go-name: Action
      context:
        description: Context is the request's environmental context.
        type: object
        additionalProperties:
          type: object
        x-go-name: Context
      resource:
        description: Resource is the resource that access is requested to.
        type: string
        x-go-name: Resource
      subject:
        description: Subejct is the subject that is requesting access.
        type: string
        x-go-name: Subject
    x-go-name: AccessRequest
    x-go-package: github.com/ory/hydra/firewall
  createRequest:
    type: object
    required:
      - alg
      - kid
    properties:
      alg:
        description: >-
          The algorithm to be used for creating the key. Supports "RS256",
          "ES521" and "HS256"
        type: string
        x-go-name: Algorithm
      kid:
        description: The kid of the key to be created
        type: string
        x-go-name: KeyID
    x-go-package: github.com/ory/hydra/jwk
  group:
    description: Group represents a warden group
    type: object
    properties:
      id:
        description: ID is the groups id.
        type: string
        x-go-name: ID
      members:
        description: Members is who belongs to the group.
        type: array
        items:
          type: string
        x-go-name: Members
    x-go-name: Group
    x-go-package: github.com/ory/hydra/warden/group
  jwk:
    type: object
    properties:
      alg:
        description: |-
          The "alg" (algorithm) parameter identifies the algorithm intended for
          use with the key.  The values used should either be registered in the
          IANA "JSON Web Signature and Encryption Algorithms" registry
          established by [JWA] or be a value that contains a Collision-
          Resistant Name.
        type: string
        x-go-name: Alg
      crv:
        type: string
        x-go-name: Crv
      d:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: D
      dp:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: Dp
      dq:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: Dq
      e:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: E
      k:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: K
      kid:
        description: |-
          The "kid" (key ID) parameter is used to match a specific key.  This
          is used, for instance, to choose among a set of keys within a JWK Set
          during key rollover.  The structure of the "kid" value is
          unspecified.  When "kid" values are used within a JWK Set, different
          keys within the JWK Set SHOULD use distinct "kid" values.  (One
          example in which different keys might use the same "kid" value is if
          they have different "kty" (key type) values but are considered to be
          equivalent alternatives by the application using them.)  The "kid"
          value is a case-sensitive string.
        type: string
        x-go-name: Kid
      kty:
        description: |-
          The "kty" (key type) parameter identifies the cryptographic algorithm
          family used with the key, such as "RSA" or "EC". "kty" values should
          either be registered in the IANA "JSON Web Key Types" registry
          established by [JWA] or be a value that contains a Collision-
          Resistant Name.  The "kty" value is a case-sensitive string.
        type: string
        x-go-name: Kty
      'n':
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: 'N'
      p:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: P
      q:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: Q
      qi:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: Qi
      use:
        description: |-
          The "use" (public key use) parameter identifies the intended use of
          the public key. The "use" parameter is employed to indicate whether
          a public key is used for encrypting data or verifying the signature
          on data. Values are commonly "sig" (signature) or "enc" (encryption).
        type: string
        x-go-name: Use
      x:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: X
      x5c:
        description: |-
          The "x5c" (X.509 certificate chain) parameter contains a chain of one
          or more PKIX certificates [RFC5280].  The certificate chain is
          represented as a JSON array of certificate value strings.  Each
          string in the array is a base64-encoded (Section 4 of [RFC4648] --
          not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value.
          The PKIX certificate containing the key value MUST be the first
          certificate.
        type: array
        items:
          type: string
        x-go-name: X5c
      'y':
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: 'Y'
    x-go-name: swaggerJSONWebKey
    x-go-package: github.com/ory/hydra/jwk
  jwkSet:
    type: object
    properties:
      keys:
        description: |-
          The value of the "keys" parameter is an array of JWK values.  By
          default, the order of the JWK values within the array does not imply
          an order of preference among them, although applications of JWK Sets
          can choose to assign a meaning to the order for their purposes, if
          desired.
        type: array
        items:
          $ref: '#/definitions/jwk'
        x-go-name: Keys
    x-go-name: swaggerJSONWebKeySet
    x-go-package: github.com/ory/hydra/jwk
  membersRequest:
    type: object
    properties:
      members:
        type: array
        items:
          type: string
        x-go-name: Members
    x-go-package: github.com/ory/hydra/warden/group
  oauthClient:
    type: object
    title: Client represents an OAuth 2.0 Client.
    properties:
      client_name:
        description: >-
          Name is the human-readable string name of the client to be presented
          to the

          end-user during authorization.
        type: string
        x-go-name: Name
      client_secret:
        description: >-
          Secret is the client's secret. The secret will be included in the
          create request as cleartext, and then

          never again. The secret is stored using BCrypt so it is impossible to
          recover it. Tell your users

          that they need to write the secret down as it will not be made
          available again.
        type: string
        x-go-name: Secret
      client_uri:
        description: >-
          ClientURI is an URL string of a web page providing information about
          the client.

          If present, the server SHOULD display this URL to the end-user in

          a clickable fashion.
        type: string
        x-go-name: ClientURI
      contacts:
        description: >-
          Contacts is a array of strings representing ways to contact people
          responsible

          for this client, typically email addresses.
        type: array
        items:
          type: string
        x-go-name: Contacts
      grant_types:
        description: GrantTypes is an array of grant types the client is allowed to use.
        type: array
        pattern: client_credentials|authorize_code|implicit|refresh_token
        items:
          type: string
        x-go-name: GrantTypes
      id:
        description: ID is the id for this client.
        type: string
        x-go-name: ID
      logo_uri:
        description: LogoURI is an URL string that references a logo for the client.
        type: string
        x-go-name: LogoURI
      owner:
        description: Owner is a string identifying the owner of the OAuth 2.0 Client.
        type: string
        x-go-name: Owner
      policy_uri:
        description: >-
          PolicyURI is a URL string that points to a human-readable privacy
          policy document

          that describes how the deployment organization collects, uses,

          retains, and discloses personal data.
        type: string
        x-go-name: PolicyURI
      public:
        description: >-
          Public is a boolean that identifies this client as public, meaning
          that it

          does not have a secret. It will disable the client_credentials grant
          type for this client if set.
        type: boolean
        x-go-name: Public
      redirect_uris:
        description: >-
          RedirectURIs is an array of allowed redirect urls for the client, for
          example: http://mydomain/oauth/callback .
        type: array
        items:
          type: string
        x-go-name: RedirectURIs
      response_types:
        description: >-
          ResponseTypes is an array of the OAuth 2.0 response type strings that
          the client can

          use at the authorization endpoint.
        type: array
        pattern: id_token|code|token
        items:
          type: string
        x-go-name: ResponseTypes
      scope:
        description: >-
          Scope is a string containing a space-separated list of scope values
          (as

          described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client

          can use when requesting access tokens.
        type: string
        pattern: '([a-zA-Z0-9\.]+\s)+'
        x-go-name: Scope
      tos_uri:
        description: >-
          TermsOfServiceURI is a URL string that points to a human-readable
          terms of service

          document for the client that describes a contractual relationship

          between the end-user and the client that the end-user accepts when

          authorizing the client.
        type: string
        x-go-name: TermsOfServiceURI
    x-go-name: Client
    x-go-package: github.com/ory/hydra/client
  policy:
    type: object
    properties:
      Conditions:
        description: Conditions under which the policy is active.
        type: object
        additionalProperties:
          type: object
          properties:
            options:
              type: object
              x-go-name: Options
            type:
              type: string
              x-go-name: Type
      actions:
        description: Actions impacted by the policy.
        type: array
        items:
          type: string
        x-go-name: Actions
      description:
        description: Description of the policy.
        type: string
        x-go-name: Description
      effect:
        description: Effect of the policy
        type: string
        x-go-name: Effect
      id:
        description: ID of the policy.
        type: string
        x-go-name: ID
      resources:
        description: Resources impacted by the policy.
        type: array
        items:
          type: string
        x-go-name: Resources
      subjects:
        description: Subjects impacted by the policy.
        type: array
        items:
          type: string
        x-go-name: Subjects
    x-go-name: swaggerPolicy
    x-go-package: github.com/ory/hydra/policy
  swaggerCreatePolicyParameters:
    type: object
    properties:
      Body:
        $ref: '#/definitions/policy'
    x-go-package: github.com/ory/hydra/policy
  swaggerGetPolicyParameters:
    type: object
    properties:
      id:
        description: |-
          The id of the policy.
          in: path
        type: integer
        format: int64
        x-go-name: ID
    x-go-package: github.com/ory/hydra/policy
  swaggerJwkCreateKey:
    type: object
    required:
      - set
    properties:
      Body:
        $ref: '#/definitions/createRequest'
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerJwkSetKeyQuery:
    type: object
    required:
      - kid
      - set
    properties:
      kid:
        description: |-
          The kid of the desired key
          in: path
        type: string
        x-go-name: KID
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerJwkSetQuery:
    type: object
    required:
      - set
    properties:
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerJwkUpdateKey:
    type: object
    required:
      - kid
      - set
    properties:
      Body:
        $ref: '#/definitions/jwkSet'
      kid:
        description: |-
          The kid of the desired key
          in: path
        type: string
        x-go-name: KID
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerJwkUpdateSet:
    type: object
    required:
      - set
    properties:
      Body:
        $ref: '#/definitions/jwkSet'
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerListPolicyParameters:
    type: object
    properties:
      limit:
        description: |-
          The maximum amount of policies returned.
          in: query
        type: integer
        format: int64
        x-go-name: Limit
      offset:
        description: |-
          The offset from where to start looking.
          in: query
        type: integer
        format: int64
        x-go-name: Offset
    x-go-package: github.com/ory/hydra/policy
  swaggerListPolicyResponse:
    description: A policy
    type: object
    properties:
      Body:
        $ref: '#/definitions/policy'
    x-go-package: github.com/ory/hydra/policy
  swaggerUpdatePolicyParameters:
    type: object
    properties:
      Body:
        $ref: '#/definitions/policy'
      id:
        description: |-
          The id of the policy.
          in: path
        type: integer
        format: int64
        x-go-name: ID
    x-go-package: github.com/ory/hydra/policy
  swaggerWardenAllowedParameters:
    type: object
    properties:
      Body:
        $ref: '#/definitions/allowedRequest'
    x-go-package: github.com/ory/hydra/warden
  swaggerWardenAllowedResponse:
    description: The allowed response
    type: object
    properties:
      Body:
        description: 'in: body'
        type: object
        properties:
          allowed:
            description: Allowed is true if the request is allowed or false otherwise
            type: boolean
            x-go-name: Allowed
    x-go-package: github.com/ory/hydra/warden
  swaggerWardenTokenAllowedParameters:
    type: object
    properties:
      Body:
        $ref: '#/definitions/wardenTokenAllowedBody'
    x-go-package: github.com/ory/hydra/warden
  swaggerWardenTokenAllowedResponse:
    description: The token allowed response
    type: object
    properties:
      Body:
        description: 'in: body'
        type: object
        properties:
          allowed:
            description: Allowed is true if the request is allowed or false otherwise
            type: boolean
            x-go-name: Allowed
          aud:
            description: >-
              Audience is who the token was issued for. This is an OAuth2 app
              usually.
            type: string
            x-go-name: Audience
          exp:
            description: ExpiresAt is the expiry timestamp.
            x-go-name: ExpiresAt
          ext:
            description: Extra represents arbitrary session data.
            type: object
            additionalProperties:
              type: object
            x-go-name: Extra
          iat:
            description: IssuedAt is the token creation time stamp.
            x-go-name: IssuedAt
          iss:
            description: 'Issuer is the id of the issuer, typically an hydra instance.'
            type: string
            x-go-name: Issuer
          scopes:
            description: >-
              GrantedScopes is a list of scopes that the subject authorized when
              asked for consent.
            type: array
            items:
              type: string
            x-go-name: GrantedScopes
          sub:
            description: >-
              Subject is the identity that authorized issuing the token, for
              example a user or an OAuth2 app.

              This is usually a uuid but you can choose a urn or some other id
              too.
            type: string
            x-go-name: Subject
    x-go-package: github.com/ory/hydra/warden
  tokenAllowedRequest:
    type: object
    properties:
      action:
        description: Action is the action that is requested on the resource.
        type: string
        x-go-name: Action
      context:
        description: Context is the request's environmental context.
        type: object
        additionalProperties:
          type: object
        x-go-name: Context
      resource:
        description: Resource is the resource that access is requested to.
        type: string
        x-go-name: Resource
    x-go-name: TokenAccessRequest
    x-go-package: github.com/ory/hydra/firewall
  wardenTokenAllowedBody:
    type: object
    properties:
      action:
        description: Action is the action that is requested on the resource.
        type: string
        x-go-name: Action
      context:
        description: Context is the request's environmental context.
        type: object
        additionalProperties:
          type: object
        x-go-name: Context
      resource:
        description: Resource is the resource that access is requested to.
        type: string
        x-go-name: Resource
      scopes:
        description: Scopes is an array of scopes that are requried.
        type: array
        items:
          type: string
        x-go-name: Scopes
      token:
        description: Token is the token to introspect.
        type: string
        x-go-name: Token
    x-go-name: swaggerWardenTokenAllowedBody
    x-go-package: github.com/ory/hydra/warden
responses:
  clientsList:
    description: A list of clients.
    schema:
      type: array
      items:
        $ref: '#/definitions/oauthClient'
  emptyResponse:
    description: The standard error format
    headers:
      description:
        type: string
  findGroupsByMemberResponse:
    description: A list of groups the member is belonging to
    schema:
      type: array
      items:
        type: string
  genericError:
    description: The standard error format
    schema:
      type: object
      properties:
        code:
          type: integer
          format: int64
          x-go-name: Code
        details:
          type: array
          items:
            type: object
            additionalProperties:
              type: object
          x-go-name: Details
        message:
          type: string
          x-go-name: Message
        reason:
          type: string
          x-go-name: Reason
        request:
          type: string
          x-go-name: Request
        status:
          type: string
          x-go-name: Status
  groupResponse:
    description: A group
    schema:
      $ref: '#/definitions/group'
  introspectOAuthTokenResponse:
    description: The token introspection response
    schema:
      type: object
      properties:
        active:
          description: |-
            Boolean indicator of whether or not the presented token
            is currently active.  The specifics of a token's "active" state
            will vary depending on the implementation of the authorization
            server and the information it keeps about its tokens, but a "true"
            value return for the "active" property will generally indicate
            that a given token has been issued by this authorization server,
            has not been revoked by the resource owner, and is within its
            given time window of validity (e.g., after its issuance time and
            before its expiration time).
          type: boolean
          x-go-name: Active
        client_id:
          description: |-
            Client identifier for the OAuth 2.0 client that
            requested this token.
          type: string
          x-go-name: ClientID
        exp:
          description: |-
            Integer timestamp, measured in the number of seconds
            since January 1 1970 UTC, indicating when this token will expire
          type: integer
          format: int64
          x-go-name: ExpiresAt
        iat:
          description: |-
            Integer timestamp, measured in the number of seconds
            since January 1 1970 UTC, indicating when this token was
            originally issued
          type: integer
          format: int64
          x-go-name: IssuedAt
        scope:
          description: |-
            A JSON string containing a space-separated list of
            scopes associated with this token
          type: string
          x-go-name: Scope
        sess:
          $ref: '#/definitions/Session'
        sub:
          description: |-
            Subject of the token, as defined in JWT [RFC7519].
            Usually a machine-readable identifier of the resource owner who
            authorized this token.
          type: string
          x-go-name: Subject
        username:
          description: |-
            Human-readable identifier for the resource owner who
            authorized this token. Currently not supported by Hydra.
          type: string
          x-go-name: Username
  listPolicyResponse:
    description: A policy
    schema:
      $ref: '#/definitions/policy'
  oauthTokenResponse:
    description: The token response
    schema:
      type: object
      properties:
        access_token:
          description: The access token issued by the authorization server.
          type: string
          x-go-name: AccessToken
        expires_in:
          description: |-
            The lifetime in seconds of the access token.  For
            example, the value "3600" denotes that the access token will
            expire in one hour from the time the response was generated.
          type: integer
          format: int64
          x-go-name: ExpiresIn
        id_token:
          description: To retrieve a refresh token request the id_token scope.
          type: integer
          format: int64
          x-go-name: IDToken
        refresh_token:
          description: >-
            The refresh token, which can be used to obtain new

            access tokens. To retrieve it add the scope "offline" to your access
            token request.
          type: string
          x-go-name: RefreshToken
        scope:
          description: The scope of the access token
          type: integer
          format: int64
          x-go-name: Scope
        token_type:
          description: The type of the token issued
          type: string
          x-go-name: TokenType
  wardenAllowedResponse:
    description: The allowed response
    schema:
      type: object
      properties:
        allowed:
          description: Allowed is true if the request is allowed or false otherwise
          type: boolean
          x-go-name: Allowed
  wardenTokenAllowedResponse:
    description: The token allowed response
    schema:
      type: object
      properties:
        allowed:
          description: Allowed is true if the request is allowed or false otherwise
          type: boolean
          x-go-name: Allowed
        aud:
          description: >-
            Audience is who the token was issued for. This is an OAuth2 app
            usually.
          type: string
          x-go-name: Audience
        exp:
          description: ExpiresAt is the expiry timestamp.
          x-go-name: ExpiresAt
        ext:
          description: Extra represents arbitrary session data.
          type: object
          additionalProperties:
            type: object
          x-go-name: Extra
        iat:
          description: IssuedAt is the token creation time stamp.
          x-go-name: IssuedAt
        iss:
          description: 'Issuer is the id of the issuer, typically an hydra instance.'
          type: string
          x-go-name: Issuer
        scopes:
          description: >-
            GrantedScopes is a list of scopes that the subject authorized when
            asked for consent.
          type: array
          items:
            type: string
          x-go-name: GrantedScopes
        sub:
          description: >-
            Subject is the identity that authorized issuing the token, for
            example a user or an OAuth2 app.

            This is usually a uuid but you can choose a urn or some other id
            too.
          type: string
          x-go-name: Subject
securityDefinitions:
  oauth2:
    type: oauth2
    flow: accessCode
    authorizationUrl: /oauth2/auth
    tokenUrl: /oauth2/token
    scopes:
      hydra.clients: A scope required to manage OAuth 2.0 Clients
      hydra.groups: A scope required to manage warden groups
      hydra.keys.create: A scope required to create JSON Web Keys
      hydra.keys.delete: A scope required to delete JSON Web Keys
      hydra.keys.get: A scope required to fetch JSON Web Keys
      hydra.keys.update: A scope required to get JSON Web Keys
      hydra.policies: A scope required to manage access control policies
      hydra.warden: A scope required to make access control inquiries
      offline: A scope required when requesting refresh tokens
      openid: Request an OpenID Connect ID Token
x-forwarded-proto: string
x-request-id: string