openapi: 3.1.0
info:
  title: OwnID API
  version: 1.0.0
  description: OwnID Authentication API
servers:
  - url: 'https://{appId}.server.ownid.com'
    description: Production server
    variables:
      appId:
        default: TBD
        description: the application id
paths:
  /api/login:
    post:
      summary: User login
      operationId: login
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - $ref: '#/components/parameters/FlowTokenChallenge'
        - $ref: '#/components/parameters/NatureHintsHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
      responses:
        '201':
          description: Session created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        '403':
          description: Forbidden but may contain next operations recommendation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginForbiddenResponse'
        '404':
          description: User not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserNotFound'
        '423':
          description: User blocked
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserBlocked'
      tags:
        - login
  /api/challenges/defer/start:
    post:
      summary: Start Deferred Challenge
      operationId: startDeferredChallenge
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      description: Initiate a deferred challenge and return a URL for solving it.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeferredChallengeStart'
      responses:
        '201':
          description: Challenge initiated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeferredChallenge'
      tags:
        - challenges-defer-auth
  /api/challenges/defer/continue:
    post:
      summary: Set Challenge Status to Pending
      operationId: ContinueDeferChallenge
      parameters:
        - $ref: '#/components/parameters/FlowTokenChallenge'
      description: Update the status of the challenge to "pending".
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChallengeRequest'
      responses:
        '200':
          description: Challenge status updated to pending.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeStatusCheckResponse'
      tags:
        - challenges-defer-auth
  /api/challenges/defer/complete:
    post:
      summary: Complete Deferred Challenge
      operationId: completeDeferredChallenge
      description: >-
        Complete the challenge on a valid sub-domain using the provided
        challenge ID.
      security:
        - AccessTokenAuth: []
        - {}
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CompleteDeferChallengeRequest'
      responses:
        '202':
          description: Challenge completed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeStatusResponse'
        '403':
          description: Invalid sub-domain or authorization mismatch
      tags:
        - challenges-defer-auth
  /api/challenges/defer/status:
    post:
      summary: Check Challenge Status
      operationId: checkDeferredChallengeStatus
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenChallenge'
        - $ref: '#/components/parameters/FlowTokenVerifier'
      description: Check the current status of a challenge using the challenge ID.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChallengeRequest'
      responses:
        '200':
          description: Challenge status retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeStatusCheckResponse'
      tags:
        - challenges-defer-auth
  /api/challenges/defer/cancel:
    post:
      summary: Cancel Deferred Challenge
      operationId: cancelDeferredChallenge
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenChallenge'
      description: Invalidates (cancels) the provided deferred challenge for a given user.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChallengeRequest'
      responses:
        '204':
          description: Challenge cancelled successfully.
      tags:
        - challenges-defer-auth
  /api/passkeys/assertion/options:
    post:
      summary: Request options for asserting an existing credential
      operationId: assertionOptions
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssertionOptionsRequest'
      responses:
        '200':
          description: Started a passkey challenge
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AssertionOptionsResponse'
          links:
            AssertionResult:
              operationId: assertionResult
              description: Completing the assertion challenge
        '400':
          description: Invalid request
        '429':
          description: Too many attempts on loginId or IP
      tags:
        - passkeys
  /api/passkeys/assertion/result:
    post:
      summary: Send the result of a credential assertion
      operationId: assertionResult
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenChallenge'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssertionResultRequest'
      responses:
        '200':
          description: Assertion result processed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AssertionResultResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: Too many attempts
      tags:
        - passkeys
  /api/passkeys/assertion/cancel:
    post:
      summary: Cancel the assertion process
      operationId: assertionCancel
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasskeyCancelRequest'
      responses:
        '204':
          description: Assertion process canceled
        '400':
          description: Bad Request
      tags:
        - passkeys
  /api/passkeys/attestation/options:
    post:
      summary: Request options for creating a new credential
      operationId: attestationOptions
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AttestationOptionsRequest'
      responses:
        '200':
          description: Continue with passkey attestation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttestationOptionsResponse'
          links:
            AttestationResult:
              operationId: attestationResult
              description: Completing the attestation challenge
        '400':
          description: Invalid request
        '401':
          description: Unauthorized (invalid Authorization header)
        '429':
          description: Too many attempts on loginId or IP
      tags:
        - passkeys
  /api/passkeys/attestation/result:
    post:
      summary: Send the result of a new credential creation
      operationId: attestationResult
      parameters:
        - $ref: '#/components/parameters/FlowTokenChallenge'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AttestationResultRequest'
      responses:
        '200':
          description: Attestation result processed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttestationResultResponse'
        '401':
          description: Unauthorized
        '403':
          description: Invalid signed challenge
        '404':
          description: User not found
      tags:
        - passkeys
  /api/passkeys/attestation/cancel:
    post:
      summary: Cancel the attestation process
      operationId: attestationCancel
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasskeyCancelRequest'
      responses:
        '204':
          description: Attestation process canceled
        '400':
          description: Bad Request
      tags:
        - passkeys
  /api/passkeys/attestation/enroll:
    post:
      summary: Links a passkey to the user account
      operationId: attestationEnroll
      security:
        - AccessTokenAuth: []
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - $ref: '#/components/parameters/FlowTokenChallenge'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AttestationEnrollRequest'
      responses:
        '204':
          description: Enrollment processed successfully
        '403':
          description: Invalid authorization details
      tags:
        - passkeys
  /api/verifications/email/start:
    post:
      summary: Start email verification challenge
      operationId: startEmailVerification
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      description: Initializes an email verification challenge
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StartEmailVerificationRequest'
      responses:
        '201':
          description: Challenge started successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeResponse'
          links:
            CompleteEmailVerification:
              operationId: completeEmailVerification
              parameters:
                challengeId: $response.body#/challengeId
            CancelEmailVerification:
              operationId: cancelEmailVerification
              parameters:
                challengeId: $response.body#/challengeId
      tags:
        - verifications
  /api/verifications/email/complete:
    post:
      summary: Complete verification code
      operationId: completeEmailVerification
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - $ref: '#/components/parameters/FlowTokenChallenge'
      description: Complete the provided verification code for a given user.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CompleteChallengeRequest'
      responses:
        '200':
          description: Email LoginIdVerification passed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessOrProofTokensResponse'
      tags:
        - verifications
  /api/verifications/email/cancel:
    post:
      summary: Cancel verification code
      operationId: cancelEmailVerification
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      description: Invalidates (cancels) the provided verification code for a given user.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CancelChallengeOperationRequest'
      responses:
        '204':
          $ref: '#/components/responses/EmailVerificationCancelled'
      tags:
        - verifications
  /api/verifications/email/resend:
    post:
      summary: Resend verification code
      operationId: resendEmailVerification
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      description: Resends the verification code for a given user.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChallengeOperationRequest'
      responses:
        '204':
          description: LoginIdVerification code resent successfully
      tags:
        - verifications
  /api/verifications/email/enroll:
    post:
      summary: Enroll email address to an account
      operationId: enrollEmailAddress
      security:
        - AccessTokenAuth: []
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - $ref: '#/components/parameters/FlowTokenChallenge'
      description: Enrolls an email address to an account.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EnrollRequest'
      responses:
        '200':
          description: Email address enrolled successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnrollResponse'
      tags:
        - verifications
  /api/verifications/phone/start:
    post:
      summary: Start phone verification challenge
      operationId: startPhoneVerification
      security:
        - AccessTokenAuth: []
        - {}
      description: Initializes a phone verification challenge
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StartPhoneVerificationRequest'
      responses:
        '201':
          description: Challenge started successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeResponse'
          links:
            CompletePhoneVerification:
              operationId: completePhoneVerification
              parameters:
                challengeId: $response.body#/challengeId
            CancelPhoneVerification:
              operationId: cancelPhoneVerification
              parameters:
                challengeId: $response.body#/challengeId
      tags:
        - verifications
  /api/verifications/phone/complete:
    post:
      summary: Complete phone verification
      operationId: completePhoneVerification
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - $ref: '#/components/parameters/FlowTokenChallenge'
      description: Complete the provided verification code for a given user.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CompleteChallengeRequest'
      responses:
        '200':
          description: Phone LoginIdVerification passed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessOrProofTokensResponse'
      tags:
        - verifications
  /api/verifications/phone/cancel:
    post:
      summary: Cancel phone verification
      operationId: cancelPhoneVerification
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      description: Invalidates (cancels) the provided verification code for a given user.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CancelChallengeOperationRequest'
      responses:
        '204':
          $ref: '#/components/responses/PhoneVerificationCancelled'
      tags:
        - verifications
  /api/verifications/phone/resend:
    post:
      summary: Resend phone verification code
      operationId: resendPhoneVerification
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      description: Resends the verification code for a given user.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChallengeOperationRequest'
      responses:
        '204':
          description: LoginIdVerification code resent successfully
      tags:
        - verifications
  /api/verifications/phone/enroll:
    post:
      summary: Enroll phone number to an account
      operationId: enrollPhoneNumber
      security:
        - AccessTokenAuth: []
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - $ref: '#/components/parameters/FlowTokenChallenge'
      description: Enrolls a phone number to an account.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EnrollRequest'
      responses:
        '200':
          description: Phone number enrolled successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnrollResponse'
      tags:
        - verifications
  /api/event/journey:
    post:
      summary: Submit a journey event log
      description: >-
        Receives and processes event logs from clients, enforcing schema
        validation and event type restrictions.
      operationId: submitJourneyEventLog
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserJourneySummary'
      responses:
        '204':
          description: Event log accepted and processed
      tags:
        - events
  '/api/oidc/idp/start/{provider}':
    post:
      summary: Start OIDC challenge against an external IDP
      operationId: startOidcChallenge
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - name: provider
          in: path
          required: true
          description: The OIDC provider to use
          schema:
            $ref: '#/components/schemas/OidcProvider'
      description: Initializes an OIDC challenge
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StartOidcChallengeRequest'
      responses:
        '201':
          description: Challenge started successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OidcChallengeResponse'
      tags:
        - oidc
  /api/oidc/idp/complete:
    post:
      summary: Complete an OIDC challenge using an authorization code or an ID token
      operationId: completeOidcChallenge
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - $ref: '#/components/parameters/FlowTokenChallenge'
      description: Complete the OIDC challenge
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CompleteOidcChallengeRequest'
      responses:
        '200':
          description: OIDC challenge completed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenWithUserInfoResponse'
      tags:
        - oidc
  /api/oidc/idp/cancel:
    post:
      summary: Cancel challenge
      operationId: cancelOidcVerification
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
      description: Invalidates (cancels) the provided verification code for a given user.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CancelOidcChallengeRequest'
      responses:
        '204':
          $ref: '#/components/responses/OidcCancelled'
      tags:
        - oidc
  /api/challenges/agent/start:
    post:
      summary: Start Agent Challenge
      operationId: startAgentChallenge
      parameters:
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - $ref: '#/components/parameters/NatureHintsHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AgentChallengeStart'
      responses:
        '201':
          description: Challenge initiated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AgentChallengeResponse'
      tags:
        - agent
  /api/challenges/agent/continue:
    post:
      summary: Set Challenge Status to Pending
      operationId: continueAgentChallenge
      parameters:
        - $ref: '#/components/parameters/FlowTokenChallenge'
      description: Update the status of the challenge to "pending".
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AgentChallengeContinueRequest'
      responses:
        '200':
          description: Challenge status updated to pending.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AgentChallengeContinueResponse'
      tags:
        - agent
  /api/challenges/agent/complete:
    post:
      summary: Complete Agent Challenge
      operationId: completeAgentChallenge
      security:
        - AccessTokenAuth: []
        - {}
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AgentChallengeCompleteRequest'
      responses:
        '204':
          description: Challenge completed successfully.
      tags:
        - agent
  /api/challenges/agent/status:
    post:
      summary: Check Challenge Status
      operationId: checkAgentChallengeStatus
      parameters:
        - $ref: '#/components/parameters/FlowTokenChallenge'
        - $ref: '#/components/parameters/FlowTokenVerifier'
        - $ref: '#/components/parameters/NatureHintsHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AgentChallengeRequest'
      responses:
        '200':
          description: Challenge status retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AgentChallengeStatusResponse'
      tags:
        - agent
  /api/challenges/agent/cancel:
    post:
      summary: Cancel Agent Challenge
      operationId: cancelAgentChallenge
      security:
        - AccessTokenAuth: []
        - {}
      parameters:
        - $ref: '#/components/parameters/FlowTokenChallenge'
      description: Invalidates (cancels) the provided agent challenge for a given user.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AgentChallengeRequest'
      responses:
        '204':
          description: Challenge cancelled successfully.
      tags:
        - agent
components:
  schemas:
    AuthorizationTokenJti:
      type:
        - string
        - 'null'
      description: The JTI of the authorization token used to initiate the challenge.
    LoginIdType:
      type: string
      enum:
        - InternalUserId
        - UserName
        - Email
        - PhoneNumber
        - Fido2CredentialId
        - Anonymous
    LoginId:
      type: object
      properties:
        id:
          type: string
        type:
          $ref: '#/components/schemas/LoginIdType'
      required:
        - id
        - type
    LoginIdURN:
      type: string
      description: The URN of the login ID.
      contentSchema:
        type: array
        minItems: 3
        maxItems: 3
        prefixItems:
          - $ref: '#/components/schemas/LoginIdType'
          - const: ':'
          - type: string
            description: The ID of the login ID
    UnixTimestamp:
      type: integer
      format: int64
      description: 'A Unix timestamp, in seconds since 1970.'
    VerificationChallengeData:
      type: object
      description: The data of a verification challenge.
      properties:
        LoginId:
          $ref: '#/components/schemas/LoginId'
        OtpCode:
          type:
            - string
            - 'null'
          description: An optional code used for verification.
        MagicLinkCode:
          type:
            - string
            - 'null'
          description: An optional code used for verification.
        VerificationAttempts:
          type:
            - integer
            - 'null'
          description: The number of attempts made for verification.
        ResendAttempts:
          type:
            - integer
            - 'null'
          description: The number of times the verification code has been resent.
        LastResendTimeSec:
          $ref: '#/components/schemas/UnixTimestamp'
        AuthorizationTokenJti:
          $ref: '#/components/schemas/AuthorizationTokenJti'
        IsProofOnly:
          type: boolean
      required:
        - LoginId
        - LastResendTimeSec
        - IsProofOnly
    OidcProvider:
      type: string
      enum:
        - Google
        - Apple
    OidcChallengeData:
      type: object
      description: The data of an OIDC challenge.
      properties:
        Provider:
          $ref: '#/components/schemas/OidcProvider'
      required:
        - Provider
    DeferredChallengeData:
      type: object
      description: The data structure for a deferred challenge.
      properties:
        LoginId:
          $ref: '#/components/schemas/LoginId'
        CompletedAt:
          type: string
          format: date-time
          description: The timestamp when the challenge was completed.
        OriginDomain:
          type: string
          description: The domain or party initiating the challenge.
        Status:
          $ref: '#/components/schemas/ChallengeStatus'
        AuthorizationTokenJti:
          $ref: '#/components/schemas/AuthorizationTokenJti'
        AuthorizationDetailsList:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizationDetails'
          description: An array of authorization details related to the challenge.
        Context:
          $ref: '#/components/schemas/ChallengeContext'
      required:
        - LoginId
        - OriginDomain
        - Status
    AgentChallengeData:
      type: object
      description: The data structure for an agent challenge.
      properties:
        LoginId:
          $ref: '#/components/schemas/LoginId'
        CompletedAt:
          type: string
          format: date-time
          description: The timestamp when the challenge was completed.
        OriginDomain:
          type: string
          description: The domain or party initiating the challenge.
        Code:
          type: string
          description: The secret code to continue the challenge.
        Status:
          $ref: '#/components/schemas/ChallengeStatus'
        Provider:
          $ref: '#/components/schemas/AgentProvider'
        AuthorizationTokenJti:
          $ref: '#/components/schemas/AuthorizationTokenJti'
        AuthorizationDetailsList:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizationDetails'
          description: An array of authorization details related to the challenge.
        Authorized:
          type: boolean
          description: >-
            Indicates if the challenge was authorized or denied by the deferred
            to human.
      required:
        - LoginId
        - OriginDomain
        - Provider
        - Code
        - Status
        - AuthorizationTokenJti
        - AuthorizationDetailsList
    AttestationResultResponse:
      type: object
      format: OwnID.API.Contracts.Model.AttestationResultResponse
      required:
        - ownIdData
        - proofToken
      properties:
        ownIdData:
          description: ownidData object to replace the data in the vendor's db
        proofToken:
          type: string
          description: >-
            A signed JWT that can be verified as a proof of successful single
            operation
          contentEncoding: base64
          contentMediaType: application/jwt
    PasskeyAttestationChallenge:
      type: object
      properties:
        LoginId:
          $ref: '#/components/schemas/LoginId'
        RpId:
          type: string
          examples:
            - example.com
        Challenge:
          type: string
          examples:
            - random-challenge-string
        UserId:
          type: string
          format: uuid
          examples:
            - e4d909c290d0fb1ca068ffaddf22cbd0
        AuthorizationTokenJti:
          $ref: '#/components/schemas/AuthorizationTokenJti'
      required:
        - RpId
        - Challenge
        - UserId
        - LoginId
    PasskeyAssertionChallenge:
      type: object
      properties:
        LoginId:
          $ref: '#/components/schemas/LoginId'
        Challenge:
          type: string
          examples:
            - random-challenge-string
        RpId:
          type: string
          examples:
            - example.com
        AuthorizationTokenJti:
          $ref: '#/components/schemas/AuthorizationTokenJti'
      required:
        - LoginId
        - Challenge
        - RpId
    ChallengeStatus:
      type: string
      description: The status of the challenge.
      enum:
        - initiated
        - pending
        - completed
    DeviceDelegation:
      type: string
      description: >-
        Specifies the type of device delegation method. this goes to
        getSessionByLoginIdEndpoint,search IsDeferred on CreateSession function
      enum:
        - qr
    AccessTokenResponse:
      type: object
      properties:
        accessToken:
          type: string
          description: >-
            A signed JWT that can be verified as a proof of successful
            operations
          contentEncoding: base64
          contentMediaType: application/jwt
          contentSchema:
            $ref: '#/components/schemas/OperationsTokenJwt'
      required:
        - accessToken
    ProofTokenResponse:
      type: object
      properties:
        proofToken:
          type: string
          description: >-
            A signed JWT that can be verified as a proof of successful single
            operation
          contentEncoding: base64
          contentMediaType: application/jwt
          contentSchema:
            $ref: '#/components/schemas/OperationsTokenJwt'
      required:
        - proofToken
    AccessOrProofTokensResponse:
      oneOf:
        - $ref: '#/components/schemas/AccessTokenResponse'
        - $ref: '#/components/schemas/ProofTokenResponse'
    OperationType:
      type: string
      enum:
        - LoginIdCollect
        - EmailVerification
        - EmailEnrollment
        - PhoneNumberVerification
        - PhoneNumberEnrollment
        - PasskeyCreation
        - PasskeyAuth
        - PasskeyEnrollment
        - SessionCreation
        - DeferredAuthentication
        - ExternalAuthentication
        - ProfileCollection
        - PasswordAuthentication
        - OidcAuthentication
        - AgentAuthorization
        - Registration
        - ProfileUpdate
    VerificationMethod:
      type: string
      enum:
        - MagicLink
        - Otp
    AuthorizationDetails:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/OperationType'
        method:
          $ref: '#/components/schemas/VerificationMethod'
        credentialId:
          type: string
        iat:
          type: integer
          format: date-time
          description: Issued at timestamp in UNIX format
        exp:
          type: integer
          format: date-time
          description: Expiration timestamp in UNIX format
        passkey:
          $ref: '#/components/schemas/PasskeyProof'
        device:
          $ref: '#/components/schemas/PasskeyDeviceInfo'
        deviceDelegation:
          $ref: '#/components/schemas/DeviceDelegation'
      required:
        - type
        - iat
        - exp
    PasskeyDeviceInfo:
      type: object
      properties:
        Os:
          $ref: '#/components/schemas/NameWithVersion'
        Browser:
          $ref: '#/components/schemas/NameWithVersion'
      required:
        - Os
        - Browser
    NameWithVersion:
      type: object
      properties:
        Name:
          type: string
        Version:
          type: string
    PasskeyProof:
      type: object
      properties:
        PublicKey:
          type: string
        RpId:
          type: string
        CredentialId:
          type: string
        Aaguid:
          type: string
          format: uuid
        SignCounter:
          type: integer
        Synced:
          type: boolean
      required:
        - PublicKey
        - RpId
        - CredentialId
        - Aaguid
        - SignCounter
        - Synced
    OperationsTokenJwt:
      type: array
      minItems: 2
      prefixItems:
        - const:
            typ: at+jwt
            alg: RS256
            kid:
              type: string
              description: App identifier
        - properties:
            jti:
              type: string
              description: Token unique id
            iss:
              type: string
              description: Token Issuer
            aud:
              type: string
              description: App identifier
            sub:
              type: string
              description: Account identifier in URN format
            iat:
              $ref: '#/components/schemas/UnixTimestamp'
            exp:
              $ref: '#/components/schemas/UnixTimestamp'
            authorization_details:
              $ref: '#/components/schemas/AuthorizationDetails'
          required:
            - jti
            - iss
            - aud
            - sub
            - iat
            - exp
            - authorization_details
    ScopeType:
      type: string
      enum:
        - data
        - channel
        - session
    EventType:
      type: string
      enum:
        - Auth
        - Session
        - Client
    AuthChallengeAction:
      type: string
      enum:
        - ChallengeStarted
        - ChallengeCompleted
        - ChallengeFailed
        - ChallengeCancelled
        - ChallengeResent
        - ContinueChallenge
        - ChallengeWrongAttempt
        - Enrolled
        - Revoked
    SessionAction:
      type: string
      description: Defines the possible actions for a session.
      enum:
        - created
      example: created
    FailureReason:
      type: string
      enum:
        - Timeout
        - LimitReached
        - NotFound
    WithUserPayload:
      type: object
      properties:
        User:
          $ref: '#/components/schemas/LoginId'
      required:
        - User
    WithFailureReason:
      type: object
      description: Contains user information and a failure reason.
      properties:
        user:
          $ref: '#/components/schemas/LoginId'
        reason:
          $ref: '#/components/schemas/FailureReason'
      required:
        - reason
      example:
        user:
          id: user123
          idType: email
        reason: timeout
    WithCredential:
      type: object
      description: Contains credential information.
      properties:
        credentialId:
          type: string
          description: The unique identifier for the credential.
      required:
        - credentialId
    CancelReason:
      type: string
      enum:
        - timeout
        - userClose
        - moveToOtherChallenge
        - systemError
        - unknown
    OperationScore:
      type: integer
      format: int
      description: Discrete score for an operation
    OperationTypeWithScore:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/OperationType'
        score:
          $ref: '#/components/schemas/OperationScore'
      required:
        - type
        - score
    ChallengesRecommendation:
      type: object
      properties:
        targetScore:
          $ref: '#/components/schemas/OperationScore'
        operations:
          type: array
          description: >-
            Sorted list of recommended operations that can be performed to reach
            the target score
          items:
            $ref: '#/components/schemas/OperationTypeWithScore'
      required:
        - targetScore
        - operations
    ChallengeContext:
      type: object
      properties:
        proofToken:
          type: string
          description: >-
            A signed JWT that can be verified as a proof of successful single
            operation
          contentEncoding: base64
          contentMediaType: application/jwt
          contentSchema:
            $ref: '#/components/schemas/OperationsTokenJwt'
      required:
        - proofToken
    NatureHints:
      type: object
      properties:
        passkeys:
          type:
            - boolean
            - 'null'
          description: Does the user device support passkeys
        platform:
          type: string
          description: The platform of the user's device
        hardwareConcurrency:
          type: integer
          description: >-
            The number of logical processors available to run threads on the
            user's device
        acceptLanguage:
          type: string
          description: Original value of the Accept-Language header
        languagesCount:
          type: integer
          description: The number of languages the device supports
        timezone:
          type: string
          description: The timezone of the user's device
      required:
        - passkeys
        - platform
        - hardwareConcurrency
        - acceptLanguage
        - languagesCount
        - timezone
    AgentProvider:
      type: string
      description: The AI agent provider.
      enum:
        - OpenAIOperator
        - ConvergenceProxy
    AuthMethod:
      type: string
      enum:
        - otp
        - passkey
        - magic-link
        - password
        - deferred
        - immediate
        - unknown
        - social-google
        - social-apple
    LoginRequest:
      type: object
      properties:
        loginId:
          $ref: '#/components/schemas/LoginId'
    LoginResponse:
      allOf:
        - $ref: '#/components/schemas/AccessTokenResponse'
        - type: object
          properties:
            sessionPayload:
              description: >-
                The session payload, could be of any type, depending on the app
                and integrations
          required:
            - sessionPayload
    LoginForbiddenResponse:
      type: object
      properties:
        reason:
          type: string
          description: The reason why the login is forbidden
        accountExists:
          type: boolean
          description: >-
            Hint if the account exists. Will be provided only for apps that
            enable this exposure.
        recommendation:
          $ref: '#/components/schemas/ChallengesRecommendation'
    UserNotFound:
      type: object
      properties:
        code:
          type: string
          default: UserNotFound
          description: User not found error code
        additionalDetails:
          type: string
          description: The reason why the user was not found
    UserBlocked:
      type: object
      properties:
        code:
          type: string
          default: UserBlocked
          description: User blocked error code
        additionalDetails:
          type: string
          description: The reason why the user is blocked
    DeferredChallengeStart:
      type: object
      properties:
        loginId:
          $ref: '#/components/schemas/LoginId'
    DeferredChallenge:
      type: object
      properties:
        challengeId:
          type: string
          description: ID of the initiated challenge
        challengeUrl:
          type: string
          description: URL to solve the challenge
        domain:
          type: string
          description: The domain where the challenge was initiated
        timeout:
          type: integer
          format: int64
          description: Time in milliseconds until the challenge times out
      required:
        - challengeId
        - challengeUrl
        - domain
        - timeout
    ChallengeStatusResponse:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/ChallengeStatus'
        context:
          $ref: '#/components/schemas/ChallengeContext'
      required:
        - status
    ChallengeRequest:
      type: object
      properties:
        challengeId:
          type: string
          description: The ID of the defer challenge.
      required:
        - challengeId
    CompleteDeferChallengeRequest:
      type: object
      properties:
        challengeId:
          type: string
          description: The ID of the defer challenge.
        context:
          $ref: '#/components/schemas/ChallengeContext'
      required:
        - challengeId
    ChallengeStatusCheckResponse:
      allOf:
        - $ref: '#/components/schemas/AccessTokenResponse'
        - $ref: '#/components/schemas/ChallengeStatusResponse'
    CredentialType:
      type: string
      description: 'The type of credential, always ''public-key'''
      enum:
        - public-key
    TransportType:
      type: string
      enum:
        - usb
        - nfc
        - ble
        - smart-card
        - hybrid
        - internal
    KeyAlgorithmType:
      type: integer
      description: The cryptographic algorithm to be used in COSE format
      enum:
        - -7
        - -257
    PublicKeyCredentialDescriptor:
      type: object
      required:
        - type
        - id
      properties:
        type:
          $ref: '#/components/schemas/CredentialType'
        id:
          type: string
          description: Base64url encoded credential ID
        transports:
          type: array
          items:
            $ref: '#/components/schemas/TransportType'
    UserVerification:
      type: string
      enum:
        - preferred
        - required
        - discouraged
    AuthenticatorAttachment:
      type: string
      enum:
        - platform
        - cross-platform
    ResidentKey:
      type: string
      enum:
        - required
        - preferred
        - discouraged
    AttestationConveyancePreference:
      type: string
      description: Attestation conveyance during credential generation
      enum:
        - none
        - direct
        - indirect
        - enterprise
    AssertionOptionsRequest:
      type: object
      properties:
        loginId:
          $ref: '#/components/schemas/LoginId'
    AssertionOptionsResponse:
      type: object
      required:
        - challenge
        - rpId
      properties:
        challenge:
          type: string
          description: The challenge that the authenticator needs to sign
        rpId:
          type: string
          description: Relying Party identifier
        allowCredentials:
          type: array
          items:
            $ref: '#/components/schemas/PublicKeyCredentialDescriptor'
        userVerification:
          $ref: '#/components/schemas/UserVerification'
        timeout:
          type: integer
          description: >-
            Timeout for the operation in milliseconds, both for server challenge
            and client UI
          examples:
            - 60000
    AssertionResultRequest:
      type: object
      required:
        - id
        - type
        - response
        - authenticatorAttachment
      properties:
        id:
          type: string
          description: Base64url encoded credential ID
        type:
          $ref: '#/components/schemas/CredentialType'
        response:
          $ref: '#/components/schemas/AssertionAuthenticatorResponse'
        authenticatorAttachment:
          $ref: '#/components/schemas/AuthenticatorAttachment'
    AssertionAuthenticatorResponse:
      type: object
      required:
        - clientDataJSON
        - authenticatorData
        - signature
      properties:
        clientDataJSON:
          type: string
          maxLength: 1024
          description: Client data in JSON format
        authenticatorData:
          type: string
          maxLength: 1024
          description: Authenticator data used in the assertion signing process
        userHandle:
          type: string
          maxLength: 1024
          description: >-
            Base64url encoded identifier for a user account, specified by the
            Relying Party as user.id during registration
        signature:
          type: string
          maxLength: 1024
          description: 'Signature for the server challenge, returned from the authenticator'
    AttestationOptionsRequest:
      type: object
      properties:
        loginId:
          $ref: '#/components/schemas/LoginId'
    AttestationOptionsResponse:
      type: object
      required:
        - rp
        - user
        - challenge
        - pubKeyCredParams
      properties:
        rp:
          $ref: '#/components/schemas/RelayingParty'
        user:
          $ref: '#/components/schemas/Fido2User'
        challenge:
          type: string
          description: The challenge that the authenticator needs to sign
        pubKeyCredParams:
          type: array
          items:
            type: object
            required:
              - type
              - alg
            properties:
              type:
                $ref: '#/components/schemas/CredentialType'
              alg:
                $ref: '#/components/schemas/KeyAlgorithmType'
        attestation:
          $ref: '#/components/schemas/AttestationConveyancePreference'
        authenticatorSelection:
          type: object
          properties:
            authenticatorAttachment:
              $ref: '#/components/schemas/AuthenticatorAttachment'
            userVerification:
              $ref: '#/components/schemas/UserVerification'
            residentKey:
              $ref: '#/components/schemas/ResidentKey'
        timeout:
          type: integer
          description: >-
            Timeout for the operation in milliseconds, both for server challenge
            and client UI
          examples:
            - 60000
        excludeCredentials:
          type: array
          items:
            $ref: '#/components/schemas/PublicKeyCredentialDescriptor'
    AttestationEnrollRequest:
      type: object
      required:
        - proofToken
      properties:
        proofToken:
          type: string
          description: A signed JWT that contains an attested passkey
        proofTokenVerifier:
          type: string
          description: The verifier for the attestation token
    AssertionResultResponse:
      $ref: '#/components/schemas/AccessTokenResponse'
    RelayingParty:
      type: object
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: Relying Party identifier (passkey's domain)
        name:
          type: string
    Fido2User:
      type: object
      required:
        - id
        - name
        - displayName
      properties:
        id:
          type: string
          description: Base64url encoded user ID
        name:
          type: string
          description: User's name
        displayName:
          type: string
          description: User's display name
    AttestationResultRequest:
      type: object
      required:
        - id
        - type
        - response
      properties:
        id:
          type: string
          description: Base64url encoded credential ID
        type:
          $ref: '#/components/schemas/CredentialType'
        response:
          $ref: '#/components/schemas/AttestationAuthenticatorResponse'
        authenticatorAttachment:
          $ref: '#/components/schemas/AuthenticatorAttachment'
    AttestationAuthenticatorResponse:
      type: object
      required:
        - clientDataJSON
        - attestationObject
        - transports
      properties:
        clientDataJSON:
          type: string
          maxLength: 1024
          description: Client data in JSON format
        attestationObject:
          type: string
          maxLength: 2048
          description: Attestation object
        transports:
          type: array
          items:
            $ref: '#/components/schemas/TransportType'
    PasskeyCancelRequest:
      type: object
      required:
        - challenge
        - reason
      properties:
        challenge:
          type: string
          description: The challenge that the authenticator needs to sign
        reason:
          type: string
          description: The reason for canceling the operation
    ChallengeId:
      type: string
      description: Unique identifier for a verification challenge
      examples:
        - 123e4567-e89b-12d3-a456-426614174000
    Code:
      type: string
      examples:
        - '123456'
    ResendPolicy:
      type: object
      properties:
        allow:
          type: boolean
          description: Indicates whether resending is allowed.
        attempts:
          type: integer
          minimum: 0
          maximum: 10
          description: The maximum number of resends allowed.
        debounce:
          type: integer
          minimum: 1
          description: The delay in seconds before another resend can be made.
      required:
        - allow
        - attempts
        - debounce
    Timeout:
      type: integer
      format: int64
      description: >-
        A numerical hint, in milliseconds, which indicates the time the calling
        web app is willing to wait for the creation operation to complete. This
        hint may be overridden by the browser.
    ChallengeResponse:
      type: object
      required:
        - challengeId
        - methods
        - timeout
        - attempts
        - resendPolicy
      properties:
        challengeId:
          $ref: '#/components/schemas/ChallengeId'
        resendPolicy:
          $ref: '#/components/schemas/ResendPolicy'
        timeout:
          $ref: '#/components/schemas/Timeout'
        attempts:
          type: integer
          minimum: 1
          default: 5
        phone:
          type: string
        email:
          type: string
        methods:
          type: object
          allOf:
            - type: object
              properties:
                otp:
                  type: object
                  properties:
                    length:
                      type: integer
                      minimum: 4
                      default: 4
            - type: object
              properties:
                magicLink:
                  type: object
                  properties:
                    length:
                      type: integer
                      minimum: 4
    StartEmailVerificationRequest:
      type: object
      properties:
        email:
          type: string
          format: email
          examples:
            - user@ownid.com
        verificationMethods:
          type: array
          items:
            $ref: '#/components/schemas/VerificationMethod'
    StartPhoneVerificationRequest:
      type: object
      properties:
        phoneNumber:
          type: string
          format: phone
          examples:
            - '+1234567890'
        verificationMethods:
          type: array
          items:
            $ref: '#/components/schemas/VerificationMethod'
    CompleteChallengeRequest:
      type: object
      required:
        - challengeId
        - code
      properties:
        challengeId:
          $ref: '#/components/schemas/ChallengeId'
        code:
          $ref: '#/components/schemas/Code'
    ChallengeOperationRequest:
      type: object
      required:
        - challengeId
      properties:
        challengeId:
          $ref: '#/components/schemas/ChallengeId'
    CancelChallengeOperationRequest:
      type: object
      description: Request payload for canceling a challenge operation.
      required:
        - challengeId
      properties:
        challengeId:
          $ref: '#/components/schemas/ChallengeId'
        reason:
          $ref: '#/components/schemas/CancelReason'
    EnrollRequest:
      type: object
      required:
        - verificationToken
      properties:
        verificationToken:
          type: string
          description: A signed JWT that contains a verified phone number
        verificationTokenVerifier:
          type: string
          description: The token verifier
    EnrollResponse:
      $ref: '#/components/schemas/AccessTokenResponse'
    UserJourneySummary:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the journey
        reporter:
          $ref: '#/components/schemas/Reporter'
        eventInfo:
          $ref: '#/components/schemas/EventInfo'
        deviceInfo:
          $ref: '#/components/schemas/ClientDeviceInfo'
        userInfo:
          type: array
          items:
            $ref: '#/components/schemas/UserInfo'
      required:
        - id
        - reporter
        - eventInfo
        - deviceInfo
        - userInfo
    Reporter:
      type: object
      properties:
        service:
          type: string
          enum:
            - web-sdk
            - android-sdk
            - ios-sdk
        version:
          type: string
        origin:
          type: string
        referer:
          type: string
      required:
        - service
        - origin
        - referer
    EventInfo:
      type: object
      properties:
        type:
          type: string
          enum:
            - journey-summary
        flows:
          type: array
          items:
            $ref: '#/components/schemas/Flow'
      required:
        - type
        - flows
    Flow:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the flow
        name:
          type: string
        source:
          type: string
          enum:
            - widget-button
            - returning-user-prompt
            - recovery-prompt
            - enroll-prompt
            - elite
            - agent-authorizing
            - deferred
            - explicit
            - implicit
        status:
          type: string
          enum:
            - aborted
            - in-progress
            - completed
            - switched
            - failed
        startedAt:
          $ref: '#/components/schemas/Timestamp'
        completedAt:
          $ref: '#/components/schemas/Timestamp'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ClientError'
        switchedToFlow:
          type: string
        insights:
          $ref: '#/components/schemas/FlowInsights'
        steps:
          type: array
          items:
            $ref: '#/components/schemas/Step'
      required:
        - id
        - source
        - status
        - startedAt
        - steps
    ClientError:
      type: object
      properties:
        errorCode:
          type: string
        source:
          type: string
        message:
          type: string
      required:
        - errorCode
    FlowInsights:
      type: object
      properties:
        duration:
          $ref: '#/components/schemas/Duration'
        errorRate:
          type: number
          format: float
          description: Percentage of errors encountered in the flow
        retries:
          type: integer
        clicksCount:
          type: integer
        authMethod:
          type: string
          description: Authentication method used in the flow
        loggedIn:
          type: boolean
          description: Indicates if the user was logged in
        registered:
          type: boolean
          description: Indicates if the user was registered
    Step:
      type: object
      properties:
        operationType:
          $ref: '#/components/schemas/OperationType'
        name:
          type: string
        status:
          type: string
          enum:
            - aborted
            - in-progress
            - completed
            - failed
        startedAt:
          $ref: '#/components/schemas/Timestamp'
        completedAt:
          $ref: '#/components/schemas/Timestamp'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ClientError'
        insights:
          $ref: '#/components/schemas/StepInsights'
      required:
        - operationType
        - status
        - startedAt
    StepInsights:
      type: object
      properties:
        duration:
          $ref: '#/components/schemas/Duration'
        retries:
          type: integer
        clicksCount:
          type: integer
    ClientDeviceInfo:
      type: object
      properties:
        isPlatformAuthenticatorAvailable:
          type: boolean
        isWebView:
          type: boolean
      required:
        - isPlatformAuthenticatorAvailable
        - isWebView
    UserInfo:
      type: object
      properties:
        loginId:
          $ref: '#/components/schemas/LoginId'
        returningUser:
          type: boolean
      required:
        - loginId
    Duration:
      type: integer
      format: int64
      description: Duration in milliseconds
    Timestamp:
      type: string
      format: date-time
      description: UTC timestamp
    OidcChallengeResponse:
      type: object
      required:
        - challengeId
        - timeout
        - clientId
      properties:
        challengeId:
          type: string
          description: Unique identifier for a verification challenge
        timeout:
          type: integer
          format: int64
          description: >-
            A numerical hint, in milliseconds, which indicates the time the
            calling web app is willing to wait for the creation operation to
            complete. This hint may be overridden by the browser.
        clientId:
          type: string
          description: The client ID of the OIDC provider
        challengeUrl:
          type: string
          description: >-
            The URL to navigate to in order to face the challenge, will be
            provided if using web flow
    StartOidcChallengeRequest:
      type: object
      properties:
        loginIdHint:
          type: string
          description: A login ID hint for the OIDC provider
        oauthResponseType:
          type: string
          description: >-
            The response type that will be used to resolve the challenge.
            Currently only a subset of the types in the protocol are supported
          enum:
            - code
            - id_token
        redirectUri:
          type: string
          description: >-
            The redirect URI to be used in an OIDC web flow, defaults to the
            preconfigured app's redirect uri
      required:
        - oauthResponseType
    CompleteOidcChallengeRequest:
      oneOf:
        - type: object
          properties:
            challengeId:
              type: string
            code:
              type: string
              description: The authorization code returned by the OIDC provider
          required:
            - challengeId
            - code
        - type: object
          properties:
            challengeId:
              type: string
            idToken:
              type: string
              description: The ID token returned by the OIDC provider
          required:
            - idToken
            - challengeId
    CancelOidcChallengeRequest:
      type: object
      properties:
        challengeId:
          type: string
        reason:
          $ref: '#/components/schemas/CancelReason'
      required:
        - challengeId
    AccessTokenWithUserInfoResponse:
      allOf:
        - $ref: '#/components/schemas/AccessTokenResponse'
        - type: object
          properties:
            loginId:
              $ref: '#/components/schemas/LoginId'
            userInfo:
              type: object
              description: The user information
              additionalProperties:
                type: string
            provider:
              $ref: '#/components/schemas/OidcProvider'
          required:
            - userInfo
            - loginId
            - provider
    AgentChallengeStart:
      type: object
      properties:
        loginId:
          $ref: '#/components/schemas/LoginId'
      required:
        - loginId
    AgentChallengeResponse:
      type: object
      properties:
        challengeId:
          type: string
          description: ID of the initiated challenge
        timeout:
          type: integer
          format: int64
          description: Time in milliseconds until the challenge times out
      required:
        - challengeId
        - timeout
    AgentChallengeStatusResponse:
      type: object
      properties:
        accessToken:
          $ref: '#/components/schemas/AccessTokenResponse'
        status:
          $ref: '#/components/schemas/ChallengeStatus'
      required:
        - status
    AgentChallengeContinueRequest:
      type: object
      properties:
        challengeId:
          type: string
          description: The ID of the agent challenge.
        code:
          type: string
          description: The secret code to continue the challenge.
      required:
        - challengeId
        - code
    AgentChallengeContinueResponse:
      allOf:
        - $ref: '#/components/schemas/AccessTokenResponse'
        - type: object
          properties:
            loginId:
              $ref: '#/components/schemas/LoginId'
            provider:
              $ref: '#/components/schemas/AgentProvider'
          required:
            - loginId
            - provider
    AgentChallengeRequest:
      type: object
      properties:
        challengeId:
          type: string
          description: The ID of the agent challenge.
      required:
        - challengeId
    AgentChallengeCompleteRequest:
      type: object
      properties:
        challengeId:
          type: string
          description: The ID of the agent challenge.
        authorize:
          type: boolean
          description: The decision whether to authorize the access or deny it.
      required:
        - challengeId
        - authorize
  parameters:
    FlowTokenVerifier:
      in: header
      name: X-OwnID-Token-Verifier
      description: The plain secret used to verify a flow was initiated by same actor.
      schema:
        type: string
      required: false
    FlowTokenChallenge:
      in: header
      name: X-OwnID-Token-Challenge
      description: The encrypted challenge used to initiate a verifiable flow.
      schema:
        type: string
      required: false
    NatureHintsHeader:
      in: header
      name: X-OwnID-Nature
      description: Json encoded hints about the nature of the user.
      schema:
        type: string
        contentMediaType: application/json
        contentSchema:
          $ref: '#/components/schemas/NatureHints'
      required: false
  securitySchemes:
    AccessTokenAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
  responses:
    PhoneVerificationCancelled:
      description: Phone LoginIdVerification was cancelled successfully
    EmailVerificationCancelled:
      description: Email LoginIdVerification was cancelled successfully
    OidcCancelled:
      description: Challenge was cancelled successfully