api.swagger.yaml

consumes:
  - application/json
  - application/x-www-form-urlencoded
produces:
  - application/json
schemes:
  - http
  - https
swagger: '2.0'
info:
  description: |-
    Please refer to the user guide for in-depth documentation: https://ory.gitbooks.io/hydra/content/

    Hydra offers OAuth 2.0 and OpenID Connect Core 1.0 capabilities as a service. Hydra is different, because it works with any existing authentication infrastructure, not just LDAP or SAML. By implementing a consent app (works with any programming language) you build a bridge between Hydra and your authentication infrastructure.
    Hydra is able to securely manage JSON Web Keys, and has a sophisticated policy-based access control you can use if you want to.
    Hydra is suitable for green- (new) and brownfield (existing) projects. If you are not familiar with OAuth 2.0 and are working on a greenfield project, we recommend evaluating if OAuth 2.0 really serves your purpose. Knowledge of OAuth 2.0 is imperative in understanding what Hydra does and how it works.

    The official repository is located at https://github.com/ory/hydra
  title: Hydra OAuth2 & OpenID Connect Server
  contact:
    name: ORY
    url: 'https://www.ory.am'
    email: hi@ory.am
  license:
    name: Apache 2.0
    url: 'https://github.com/ory/hydra/blob/master/LICENSE'
  version: Latest
basePath: /
paths:
  /clients:
    get:
      description: |-
        Never returns a client's secret.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:clients"],
        "actions": ["get"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Lists OAuth 2.0 Clients
      operationId: listOAuthClients
      security:
        - oauth2:
            - hydra.clients
      responses:
        '200':
          $ref: '#/responses/clientsList'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    post:
      description: |-
        Be aware that an OAuth 2.0 Client may gain highly priviledged access if configured that way. This
        endpoint should be well protected and only called by code you trust.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:clients"],
        "actions": ["create"],
        "effect": "allow"
        }
        ```

        Additionally, the context key "owner" is set to the owner of the client, allowing policies such as:

        ```
        {
        "resources": ["rn:hydra:clients"],
        "actions": ["create"],
        "effect": "allow",
        "conditions": { "owner": { "type": "EqualsSubjectCondition" } }
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Creates an OAuth 2.0 Client
      operationId: createOAuthClient
      security:
        - oauth2:
            - hydra.clients
      parameters:
        - name: Body
          in: body
          required: true
          schema:
            $ref: '#/definitions/oauthClient'
      responses:
        '200':
          description: oauthClient
          schema:
            $ref: '#/definitions/oauthClient'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/clients/{id}':
    get:
      description: |-
        Never returns the client's secret.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:clients:<some-id>"],
        "actions": ["get"],
        "effect": "allow"
        }
        ```

        Additionally, the context key "owner" is set to the owner of the client, allowing policies such as:

        ```
        {
        "resources": ["rn:hydra:clients:<some-id> "],
        "actions": ["get"],
        "effect": "allow",
        "conditions": { "owner": { "type": "EqualsSubjectCondition" } }
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Fetches an OAuth 2.0 Client.
      operationId: getOAuthClient
      security:
        - oauth2:
            - hydra.clients
      parameters:
        - uniqueItems: true
          type: string
          x-go-name: ID
          description: The id of the OAuth 2.0 Client.
          name: id
          in: path
          required: true
      responses:
        '200':
          description: oauthClient
          schema:
            $ref: '#/definitions/oauthClient'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    put:
      description: |-
        Be aware that an OAuth 2.0 Client may gain highly priviledged access if configured that way. This
        endpoint should be well protected and only called by code you trust.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:clients"],
        "actions": ["update"],
        "effect": "allow"
        }
        ```

        Additionally, the context key "owner" is set to the owner of the client, allowing policies such as:

        ```
        {
        "resources": ["rn:hydra:clients"],
        "actions": ["update"],
        "effect": "allow",
        "conditions": { "owner": { "type": "EqualsSubjectCondition" } }
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Updates an OAuth 2.0 Client
      operationId: updateOAuthClient
      security:
        - oauth2:
            - hydra.clients
      parameters:
        - type: string
          x-go-name: ID
          name: id
          in: path
          required: true
        - name: Body
          in: body
          required: true
          schema:
            $ref: '#/definitions/oauthClient'
      responses:
        '200':
          description: oauthClient
          schema:
            $ref: '#/definitions/oauthClient'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:clients:<some-id>"],
        "actions": ["delete"],
        "effect": "allow"
        }
        ```

        Additionally, the context key "owner" is set to the owner of the client, allowing policies such as:

        ```
        {
        "resources": ["rn:hydra:clients:<some-id>"],
        "actions": ["delete"],
        "effect": "allow",
        "conditions": { "owner": { "type": "EqualsSubjectCondition" } }
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
        - clients
      summary: Deletes an OAuth 2.0 Client
      operationId: deleteOAuthClient
      security:
        - oauth2:
            - hydra.clients
      parameters:
        - uniqueItems: true
          type: string
          x-go-name: ID
          description: The id of the OAuth 2.0 Client.
          name: id
          in: path
          required: true
      responses:
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/keys/{set}':
    get:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:keys:<set>:<kid>"],
        "actions": ["get"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Retrieves a JSON Web Key Set matching the set
      operationId: getJwkSet
      security:
        - oauth2:
            - hydra.keys.get
      parameters:
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    put:
      description: |-
        Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:keys:<set>"],
        "actions": ["update"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Updates a JSON Web Key Set
      operationId: updateJwkSet
      security:
        - oauth2:
            - hydra.keys.update
      parameters:
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/jwkSet'
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    post:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:keys:<set>:<kid>"],
        "actions": ["create"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Generate a new JSON Web Key
      operationId: createJwkKey
      security:
        - oauth2:
            - hydra.keys.create
      parameters:
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/createRequest'
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:keys:<set>"],
        "actions": ["delete"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Delete a JSON Web Key
      operationId: deleteJwkSet
      security:
        - oauth2:
            - hydra.keys.delete
      parameters:
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
      responses:
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/keys/{set}/{kid}':
    get:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:keys:<set>:<kid>"],
        "actions": ["get"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Retrieves a JSON Web Key Set matching the set and the kid
      operationId: getJwkSetKey
      security:
        - oauth2:
            - hydra.keys.get
      parameters:
        - type: string
          x-go-name: KID
          description: The kid of the desired key
          name: kid
          in: path
          required: true
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    put:
      description: |-
        Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:keys:<set>:<kid>"],
        "actions": ["update"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Updates a JSON Web Key
      operationId: updateJwkKey
      security:
        - oauth2:
            - hydra.keys.update
      parameters:
        - type: string
          x-go-name: KID
          description: The kid of the desired key
          name: kid
          in: path
          required: true
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/jwkSet'
      responses:
        '200':
          description: jwkSet
          schema:
            $ref: '#/definitions/jwkSet'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:keys:<set>:<kid>"],
        "actions": ["delete"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - jwks
      summary: Delete a JSON Web Key
      operationId: deleteJwkKey
      security:
        - oauth2:
            - hydra.keys.delete
      parameters:
        - type: string
          x-go-name: KID
          description: The kid of the desired key
          name: kid
          in: path
          required: true
        - type: string
          x-go-name: Set
          description: The set
          name: set
          in: path
          required: true
      responses:
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /oauth2/auth:
    get:
      description: 'For more information, please refer to https://tools.ietf.org/html/rfc6749#section-4'
      consumes:
        - application/x-www-form-urlencoded
      schemes:
        - http
        - https
      tags:
        - oauth2
      summary: The OAuth 2.0 Auth endpoint
      operationId: oauthAuth
      responses:
        '302': {
          description: "found"
        }
        '401':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /oauth2/introspect:
    post:
      description: 'For more information, please refer to https://tools.ietf.org/html/rfc7662'
      consumes:
        - application/x-www-form-urlencoded
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
      summary: Introspect an OAuth2 access token
      operationId: introspectOAuthToken
      security:
        - oauth2: []
      responses:
        '200':
          $ref: '#/responses/introspectOAuthTokenResponse'
        '401':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /oauth2/revoke:
    post:
      description: 'For more information, please refer to https://tools.ietf.org/html/rfc7009'
      consumes:
        - application/x-www-form-urlencoded
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
      summary: Revoke an OAuth2 access token
      operationId: revokeOAuthToken
      security:
        - oauth2: []
      parameters:
        - name: Body
          in: body
          required: true
          schema:
            type: object
            properties:
              access_token:
                type: string
                x-go-name: AccessToken
              refresh_token:
                type: string
                x-go-name: RefreshToken
      responses:
        '200':
          description: "ok"
        '401':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /oauth2/token:
    post:
      description: 'For more information, please refer to https://tools.ietf.org/html/rfc6749#section-4'
      consumes:
        - application/x-www-form-urlencoded
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - oauth2
      summary: The OAuth 2.0 Token endpoint
      operationId: oauthToken
      security:
        - basic: []
      responses:
        '200':
          $ref: '#/responses/oauthTokenResponse'
        '401':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /policies:
    get:
      description: |-
        Visit https://github.com/ory/ladon#usage for more information on policy usage.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:policies"],
        "actions": ["list"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: List access control policies
      operationId: listPolicies
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - type: integer
          format: int64
          x-go-name: Offset
          description: The offset from where to start looking.
          name: offset
          in: query
        - type: integer
          format: int64
          x-go-name: Limit
          description: The maximum amount of policies returned.
          name: limit
          in: query
      responses:
        '200':
          $ref: '#/responses/listPolicyResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    post:
      description: |-
        Visit https://github.com/ory/ladon#usage for more information on policy usage.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:policies"],
        "actions": ["create"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: Create an access control policy
      operationId: createPolicy
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/policy'
      responses:
        '201':
          description: policy
          schema:
            $ref: '#/definitions/policy'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/policies/{id}':
    get:
      description: |-
        Visit https://github.com/ory/ladon#usage for more information on policy usage.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:policies:<id>"],
        "actions": ["get"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: Get an access control policy
      operationId: getPolicy
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the policy.
          name: id
          in: path
          required: true
      responses:
        '200':
          description: policy
          schema:
            $ref: '#/definitions/policy'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    put:
      description: |-
        Visit https://github.com/ory/ladon#usage for more information on policy usage.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:policies"],
        "actions": ["update"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: Update an access control policy
      operationId: updatePolicy
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the policy.
          name: id
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/policy'
      responses:
        '200':
          description: policy
          schema:
            $ref: '#/definitions/policy'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: |-
        Visit https://github.com/ory/ladon#usage for more information on policy usage.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:policies:<id>"],
        "actions": ["delete"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - policies
      summary: Delete an access control policy
      operationId: deletePolicy
      security:
        - oauth2:
            - hydra.policies
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the policy.
          name: id
          in: path
          required: true
      responses:
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /warden/allowed:
    post:
      description: |-
        Checks if an arbitrary subject is allowed to perform an action on a resource. This endpoint requires a subject,
        a resource name, an action name and a context.If the subject is not allowed to perform the action on the resource,
        this endpoint returns a 200 response with `{ "allowed": false} }`.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:warden:allowed"],
        "actions": ["decide"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
      summary: Check if a subject is allowed to do something
      operationId: wardenAllowed
      security:
        - oauth2:
            - hydra.warden
      parameters:
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/allowedRequest'
      responses:
        '200':
          $ref: '#/responses/wardenAllowedResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /warden/groups:
    get:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:warden:groups:<member>"],
        "actions": ["get"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Find group IDs by member
      operationId: findGroupsByMember
      security:
        - oauth2:
            - hydra.groups
      parameters:
        - type: integer
          format: int64
          x-go-name: Member
          description: The id of the member to look up.
          name: member
          in: query
      responses:
        '200':
          $ref: '#/responses/findGroupsByMemberResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    post:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:warden:groups"],
        "actions": ["create"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Create a group
      operationId: createGroup
      security:
        - oauth2:
            - hydra.groups
      responses:
        '201':
          $ref: '#/responses/groupResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  '/warden/groups/{id}':
    get:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:warden:groups:<id>"],
        "actions": ["create"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Get a group by id
      operationId: getGroup
      security:
        - oauth2:
            - hydra.groups
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the group to look up.
          name: id
          in: path
          required: true
      responses:
        '201':
          $ref: '#/responses/groupResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    post:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:warden:groups:<id>"],
        "actions": ["members.add"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Add members to a group
      operationId: addMembersToGroup
      security:
        - oauth2:
            - hydra.groups
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the group to modify.
          name: id
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/membersRequest'
      responses:
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
    delete:
      description: |-
        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:warden:groups:<id>"],
        "actions": ["members.remove"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
        - groups
      summary: Remove members from a group
      operationId: removeMembersFromGroup
      security:
        - oauth2:
            - hydra.groups
      parameters:
        - type: integer
          format: int64
          x-go-name: ID
          description: The id of the group to modify.
          name: id
          in: path
          required: true
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/membersRequest'
      responses:
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
  /warden/token/allowed:
    post:
      description: |-
        Checks if a token is valid and if the token owner is allowed to perform an action on a resource.
        This endpoint requires a token, a scope, a resource name, an action name and a context.

        If a token is expired/invalid, has not been granted the requested scope or the subject is not allowed to
        perform the action on the resource, this endpoint returns a 200 response with `{ "allowed": false} }`.

        Extra data set through the `at_ext` claim in the consent response will be included in the response.
        The `id_ext` claim will never be returned by this endpoint.

        The subject making the request needs to be assigned to a policy containing:

        ```
        {
        "resources": ["rn:hydra:warden:token:allowed"],
        "actions": ["decide"],
        "effect": "allow"
        }
        ```
      consumes:
        - application/json
      produces:
        - application/json
      schemes:
        - http
        - https
      tags:
        - warden
      summary: Check if the subject of a token is allowed to do something
      operationId: wardenTokenAllowed
      security:
        - oauth2:
            - hydra.warden
      parameters:
        - name: Body
          in: body
          schema:
            $ref: '#/definitions/wardenAccessRequest'
      responses:
        '200':
          $ref: '#/responses/wardenTokenAllowedResponse'
        '401':
          $ref: '#/responses/genericError'
        '403':
          $ref: '#/responses/genericError'
        '500':
          $ref: '#/responses/genericError'
definitions:
  Context:
    description: Context contains an access token's session data
    type: object
    properties:
      aud:
        description: Audience is who the token was issued for. This is an OAuth2 app usually.
        type: string
        x-go-name: Audience
      exp:
        description: ExpiresAt is the expiry timestamp.
        x-go-name: ExpiresAt
      ext:
        description: Extra represents arbitrary session data.
        type: object
        additionalProperties:
          type: object
        x-go-name: Extra
      iat:
        description: IssuedAt is the token creation time stamp.
        x-go-name: IssuedAt
      iss:
        description: 'Issuer is the id of the issuer, typically an hydra instance.'
        type: string
        x-go-name: Issuer
      scopes:
        description: GrantedScopes is a list of scopes that the subject authorized when asked for consent.
        type: array
        items:
          type: string
        x-go-name: GrantedScopes
      sub:
        description: |-
          Subject is the identity that authorized issuing the token, for example a user or an OAuth2 app.
          This is usually a uuid but you can choose a urn or some other id too.
        type: string
        x-go-name: Subject
    x-go-package: github.com/ory/hydra/firewall
  Firewall:
    type: object
    title: Firewall offers various validation strategies for access tokens.
    x-go-package: github.com/ory/hydra/firewall
  Headers:
    description: Headers is the jwt headers
    type: object
    properties:
      Extra:
        type: object
        additionalProperties:
          type: object
    x-go-package: github.com/ory/fosite/token/jwt
  IDTokenClaims:
    description: IDTokenClaims represent the claims used in open id connect requests
    type: object
    properties:
      AccessTokenHash:
        type: string
      Audience:
        type: string
      AuthTime: {}
      CodeHash:
        type: string
      ExpiresAt: {}
      Extra:
        type: object
        additionalProperties:
          type: object
      IssuedAt: {}
      Issuer:
        type: string
      Nonce:
        type: string
      Subject:
        type: string
    x-go-package: github.com/ory/fosite/token/jwt
  Manager:
    type: object
    x-go-package: github.com/ory/hydra/warden/group
  Session:
    type: object
    properties:
      Claims:
        $ref: '#/definitions/IDTokenClaims'
      ExpiresAt: {}
      Headers:
        $ref: '#/definitions/Headers'
      Subject:
        type: string
      Username:
        type: string
      extra:
        type: object
        additionalProperties:
          type: object
        x-go-name: Extra
    x-go-package: github.com/ory/hydra/oauth2
  allowedRequest:
    type: object
    title: AccessRequest is the warden's request object.
    properties:
      action:
        description: Action is the action that is requested on the resource.
        type: string
        x-go-name: Action
      context:
        description: Context is the request's environmental context.
        type: object
        additionalProperties:
          type: object
        x-go-name: Context
      resource:
        description: Resource is the resource that access is requested to.
        type: string
        x-go-name: Resource
      subject:
        description: Subejct is the subject that is requesting access.
        type: string
        x-go-name: Subject
    x-go-name: AccessRequest
    x-go-package: github.com/ory/hydra/firewall
  createRequest:
    type: object
    required:
      - alg
      - kid
    properties:
      alg:
        description: 'The algorithm to be used for creating the key. Supports "RS256", "ES521" and "HS256"'
        type: string
        x-go-name: Algorithm
      kid:
        description: The kid of the key to be created
        type: string
        x-go-name: KeyID
    x-go-package: github.com/ory/hydra/jwk
  group:
    description: Group represents a warden group
    type: object
    properties:
      id:
        description: ID is the groups id.
        type: string
        x-go-name: ID
      members:
        description: Members is who belongs to the group.
        type: array
        items:
          type: string
        x-go-name: Members
    x-go-name: Group
    x-go-package: github.com/ory/hydra/warden/group
  jwk:
    type: object
    properties:
      alg:
        description: |-
          The "alg" (algorithm) parameter identifies the algorithm intended for
          use with the key.  The values used should either be registered in the
          IANA "JSON Web Signature and Encryption Algorithms" registry
          established by [JWA] or be a value that contains a Collision-
          Resistant Name.
        type: string
        x-go-name: Alg
      crv:
        type: string
        x-go-name: Crv
      d:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: D
      dp:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: Dp
      dq:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: Dq
      e:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: E
      k:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: K
      kid:
        description: |-
          The "kid" (key ID) parameter is used to match a specific key.  This
          is used, for instance, to choose among a set of keys within a JWK Set
          during key rollover.  The structure of the "kid" value is
          unspecified.  When "kid" values are used within a JWK Set, different
          keys within the JWK Set SHOULD use distinct "kid" values.  (One
          example in which different keys might use the same "kid" value is if
          they have different "kty" (key type) values but are considered to be
          equivalent alternatives by the application using them.)  The "kid"
          value is a case-sensitive string.
        type: string
        x-go-name: Kid
      kty:
        description: |-
          The "kty" (key type) parameter identifies the cryptographic algorithm
          family used with the key, such as "RSA" or "EC". "kty" values should
          either be registered in the IANA "JSON Web Key Types" registry
          established by [JWA] or be a value that contains a Collision-
          Resistant Name.  The "kty" value is a case-sensitive string.
        type: string
        x-go-name: Kty
      'n':
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: 'N'
      p:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: P
      q:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: Q
      qi:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: Qi
      use:
        description: |-
          The "use" (public key use) parameter identifies the intended use of
          the public key. The "use" parameter is employed to indicate whether
          a public key is used for encrypting data or verifying the signature
          on data. Values are commonly "sig" (signature) or "enc" (encryption).
        type: string
        x-go-name: Use
      x:
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: X
      x5c:
        description: |-
          The "x5c" (X.509 certificate chain) parameter contains a chain of one
          or more PKIX certificates [RFC5280].  The certificate chain is
          represented as a JSON array of certificate value strings.  Each
          string in the array is a base64-encoded (Section 4 of [RFC4648] --
          not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value.
          The PKIX certificate containing the key value MUST be the first
          certificate.
        type: array
        items:
          type: string
        x-go-name: X5c
      'y':
        type: array
        items:
          type: integer
          format: uint8
        x-go-name: 'Y'
    x-go-name: swaggerJSONWebKey
    x-go-package: github.com/ory/hydra/jwk
  jwkSet:
    type: object
    properties:
      keys:
        description: |-
          The value of the "keys" parameter is an array of JWK values.  By
          default, the order of the JWK values within the array does not imply
          an order of preference among them, although applications of JWK Sets
          can choose to assign a meaning to the order for their purposes, if
          desired.
        type: array
        items:
          $ref: '#/definitions/jwk'
        x-go-name: Keys
    x-go-name: swaggerJSONWebKeySet
    x-go-package: github.com/ory/hydra/jwk
  membersRequest:
    type: object
    properties:
      members:
        type: array
        items:
          type: string
        x-go-name: Members
    x-go-package: github.com/ory/hydra/warden/group
  oauthClient:
    type: object
    title: Client represents an OAuth 2.0 Client.
    properties:
      client_name:
        description: |-
          Name is the human-readable string name of the client to be presented to the
          end-user during authorization.
        type: string
        x-go-name: Name
      client_secret:
        description: |-
          Secret is the client's secret. The secret will be included in the create request as cleartext, and then
          never again. The secret is stored using BCrypt so it is impossible to recover it. Tell your users
          that they need to write the secret down as it will not be made available again.
        type: string
        x-go-name: Secret
      client_uri:
        description: |-
          ClientURI is an URL string of a web page providing information about the client.
          If present, the server SHOULD display this URL to the end-user in
          a clickable fashion.
        type: string
        x-go-name: ClientURI
      contacts:
        description: |-
          Contacts is a array of strings representing ways to contact people responsible
          for this client, typically email addresses.
        type: array
        items:
          type: string
        x-go-name: Contacts
      grant_types:
        description: GrantTypes is an array of grant types the client is allowed to use.
        type: array
        pattern: client_credentials|authorize_code|implicit|refresh_token
        items:
          type: string
        x-go-name: GrantTypes
      id:
        description: ID is the id for this client.
        type: string
        x-go-name: ID
      logo_uri:
        description: LogoURI is an URL string that references a logo for the client.
        type: string
        x-go-name: LogoURI
      owner:
        description: Owner is a string identifying the owner of the OAuth 2.0 Client.
        type: string
        x-go-name: Owner
      policy_uri:
        description: |-
          PolicyURI is a URL string that points to a human-readable privacy policy document
          that describes how the deployment organization collects, uses,
          retains, and discloses personal data.
        type: string
        x-go-name: PolicyURI
      public:
        description: |-
          Public is a boolean that identifies this client as public, meaning that it
          does not have a secret. It will disable the client_credentials grant type for this client if set.
        type: boolean
        x-go-name: Public
      redirect_uris:
        description: 'RedirectURIs is an array of allowed redirect urls for the client, for example: http://mydomain/oauth/callback .'
        type: array
        items:
          type: string
        x-go-name: RedirectURIs
      response_types:
        description: |-
          ResponseTypes is an array of the OAuth 2.0 response type strings that the client can
          use at the authorization endpoint.
        type: array
        pattern: id_token|code|token
        items:
          type: string
        x-go-name: ResponseTypes
      scope:
        description: |-
          Scope is a string containing a space-separated list of scope values (as
          described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client
          can use when requesting access tokens.
        type: string
        pattern: '([a-zA-Z0-9\.]+\s)+'
        x-go-name: Scope
      tos_uri:
        description: |-
          TermsOfServiceURI is a URL string that points to a human-readable terms of service
          document for the client that describes a contractual relationship
          between the end-user and the client that the end-user accepts when
          authorizing the client.
        type: string
        x-go-name: TermsOfServiceURI
    x-go-name: Client
    x-go-package: github.com/ory/hydra/client
  policy:
    type: object
    properties:
      Conditions:
        description: Conditions under which the policy is active.
        type: object
        additionalProperties:
          type: object
          properties:
            options:
              type: object
              x-go-name: Options
            type:
              type: string
              x-go-name: Type
      actions:
        description: Actions impacted by the policy.
        type: array
        items:
          type: string
        x-go-name: Actions
      description:
        description: Description of the policy.
        type: string
        x-go-name: Description
      effect:
        description: Effect of the policy
        type: string
        x-go-name: Effect
      id:
        description: ID of the policy.
        type: string
        x-go-name: ID
      resources:
        description: Resources impacted by the policy.
        type: array
        items:
          type: string
        x-go-name: Resources
      subjects:
        description: Subjects impacted by the policy.
        type: array
        items:
          type: string
        x-go-name: Subjects
    x-go-name: swaggerPolicy
    x-go-package: github.com/ory/hydra/policy
  swaggerCreatePolicyParameters:
    type: object
    properties:
      Body:
        $ref: '#/definitions/policy'
    x-go-package: github.com/ory/hydra/policy
  swaggerGetPolicyParameters:
    type: object
    properties:
      id:
        description: |-
          The id of the policy.
          in: path
        type: integer
        format: int64
        x-go-name: ID
    x-go-package: github.com/ory/hydra/policy
  swaggerJwkCreateKey:
    type: object
    required:
      - set
    properties:
      Body:
        $ref: '#/definitions/createRequest'
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerJwkSetKeyQuery:
    type: object
    required:
      - kid
      - set
    properties:
      kid:
        description: |-
          The kid of the desired key
          in: path
        type: string
        x-go-name: KID
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerJwkSetQuery:
    type: object
    required:
      - set
    properties:
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerJwkUpdateKey:
    type: object
    required:
      - kid
      - set
    properties:
      Body:
        $ref: '#/definitions/jwkSet'
      kid:
        description: |-
          The kid of the desired key
          in: path
        type: string
        x-go-name: KID
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerJwkUpdateSet:
    type: object
    required:
      - set
    properties:
      Body:
        $ref: '#/definitions/jwkSet'
      set:
        description: |-
          The set
          in: path
        type: string
        x-go-name: Set
    x-go-package: github.com/ory/hydra/jwk
  swaggerListPolicyParameters:
    type: object
    properties:
      limit:
        description: |-
          The maximum amount of policies returned.
          in: query
        type: integer
        format: int64
        x-go-name: Limit
      offset:
        description: |-
          The offset from where to start looking.
          in: query
        type: integer
        format: int64
        x-go-name: Offset
    x-go-package: github.com/ory/hydra/policy
  swaggerListPolicyResponse:
    description: A policy
    type: object
    properties:
      Body:
        $ref: '#/definitions/policy'
    x-go-package: github.com/ory/hydra/policy
  swaggerUpdatePolicyParameters:
    type: object
    properties:
      Body:
        $ref: '#/definitions/policy'
      id:
        description: |-
          The id of the policy.
          in: path
        type: integer
        format: int64
        x-go-name: ID
    x-go-package: github.com/ory/hydra/policy
  tokenAllowedRequest:
    type: object
    properties:
      action:
        description: Action is the action that is requested on the resource.
        type: string
        x-go-name: Action
      context:
        description: Context is the request's environmental context.
        type: object
        additionalProperties:
          type: object
        x-go-name: Context
      resource:
        description: Resource is the resource that access is requested to.
        type: string
        x-go-name: Resource
    x-go-name: TokenAccessRequest
    x-go-package: github.com/ory/hydra/firewall
  wardenAccessRequest:
    type: object
    properties:
      action:
        description: Action is the action that is requested on the resource.
        type: string
        x-go-name: Action
      context:
        description: Context is the request's environmental context.
        type: object
        additionalProperties:
          type: object
        x-go-name: Context
      resource:
        description: Resource is the resource that access is requested to.
        type: string
        x-go-name: Resource
      scopes:
        type: array
        items:
          type: string
        x-go-name: Scopes
      token:
        type: string
        x-go-name: Token
    x-go-package: github.com/ory/hydra/warden
responses:
  clientsList:
    description: A list of clients.
    schema:
      type: array
      items:
        $ref: '#/definitions/oauthClient'
  findGroupsByMemberResponse:
    description: A list of groups the member is belonging to
    schema:
      type: array
      items:
        type: string
  genericError:
    description: The standard error format
    schema:
      type: object
      properties:
        code:
          type: integer
          format: int64
          x-go-name: Code
        details:
          type: array
          items:
            type: object
            additionalProperties:
              type: object
          x-go-name: Details
        message:
          type: string
          x-go-name: Message
        reason:
          type: string
          x-go-name: Reason
        request:
          type: string
          x-go-name: Request
        status:
          type: string
          x-go-name: Status
  groupResponse:
    description: A group
    schema:
      $ref: '#/definitions/group'
  introspectOAuthTokenResponse:
    description: The token introspection response
    schema:
      type: object
      properties:
        active:
          description: |-
            Boolean indicator of whether or not the presented token
            is currently active.  The specifics of a token's "active" state
            will vary depending on the implementation of the authorization
            server and the information it keeps about its tokens, but a "true"
            value return for the "active" property will generally indicate
            that a given token has been issued by this authorization server,
            has not been revoked by the resource owner, and is within its
            given time window of validity (e.g., after its issuance time and
            before its expiration time).
          type: boolean
          x-go-name: Active
        client_id:
          description: |-
            Client identifier for the OAuth 2.0 client that
            requested this token.
          type: string
          x-go-name: ClientID
        exp:
          description: |-
            Integer timestamp, measured in the number of seconds
            since January 1 1970 UTC, indicating when this token will expire
          type: integer
          format: int64
          x-go-name: ExpiresAt
        iat:
          description: |-
            Integer timestamp, measured in the number of seconds
            since January 1 1970 UTC, indicating when this token was
            originally issued
          type: integer
          format: int64
          x-go-name: IssuedAt
        scope:
          description: |-
            A JSON string containing a space-separated list of
            scopes associated with this token
          type: string
          x-go-name: Scope
        sess:
          $ref: '#/definitions/Session'
        sub:
          description: |-
            Subject of the token, as defined in JWT [RFC7519].
            Usually a machine-readable identifier of the resource owner who
            authorized this token.
          type: string
          x-go-name: Subject
        username:
          description: |-
            Human-readable identifier for the resource owner who
            authorized this token. Currently not supported by Hydra.
          type: string
          x-go-name: Username
  listPolicyResponse:
    description: A policy
    schema:
      $ref: '#/definitions/policy'
  oauthTokenResponse:
    description: The token response
    schema:
      type: object
      properties:
        access_token:
          description: The access token issued by the authorization server.
          type: string
          x-go-name: AccessToken
        expires_in:
          description: |-
            The lifetime in seconds of the access token.  For
            example, the value "3600" denotes that the access token will
            expire in one hour from the time the response was generated.
          type: integer
          format: int64
          x-go-name: ExpiresIn
        id_token:
          description: To retrieve a refresh token request the id_token scope.
          type: integer
          format: int64
          x-go-name: IDToken
        refresh_token:
          description: |-
            The refresh token, which can be used to obtain new
            access tokens. To retrieve it add the scope "offline" to your access token request.
          type: string
          x-go-name: RefreshToken
        scope:
          description: The scope of the access token
          type: integer
          format: int64
          x-go-name: Scope
        token_type:
          description: The type of the token issued
          type: string
          x-go-name: TokenType
  wardenAllowedResponse:
    description: The allowed response
    schema:
      type: object
      properties:
        allowed:
          description: Allowed is true if the request is allowed or false otherwise
          type: boolean
          x-go-name: Allowed
  wardenTokenAllowedResponse:
    description: The token allowed response
    schema:
      type: object
      properties:
        allowed:
          description: Allowed is true if the request is allowed or false otherwise
          type: boolean
          x-go-name: Allowed
        aud:
          description: Audience is who the token was issued for. This is an OAuth2 app usually.
          type: string
          x-go-name: Audience
        exp:
          description: ExpiresAt is the expiry timestamp.
          x-go-name: ExpiresAt
        ext:
          description: Extra represents arbitrary session data.
          type: object
          additionalProperties:
            type: object
          x-go-name: Extra
        iat:
          description: IssuedAt is the token creation time stamp.
          x-go-name: IssuedAt
        iss:
          description: 'Issuer is the id of the issuer, typically an hydra instance.'
          type: string
          x-go-name: Issuer
        scopes:
          description: GrantedScopes is a list of scopes that the subject authorized when asked for consent.
          type: array
          items:
            type: string
          x-go-name: GrantedScopes
        sub:
          description: |-
            Subject is the identity that authorized issuing the token, for example a user or an OAuth2 app.
            This is usually a uuid but you can choose a urn or some other id too.
          type: string
          x-go-name: Subject
securityDefinitions:
  oauth2:
    type: oauth2
    flow: accessCode
    authorizationUrl: /oauth2/auth
    tokenUrl: /oauth2/token
    scopes:
      hydra.clients: "A scope required to manage OAuth 2.0 Clients"
      hydra.policies: "A scope required to manage access control policies"
      hydra.groups: "A scope required to manage warden groups"
      hydra.warden: "A scope required to make access control inquiries"
      hydra.keys.get: "A scope required to fetch JSON Web Keys"
      hydra.keys.create: "A scope required to create JSON Web Keys"
      hydra.keys.delete: "A scope required to delete JSON Web Keys"
      hydra.keys.update: "A scope required to get JSON Web Keys"
      offline: "A scope required when requesting refresh tokens"
      
x-request-id: string