{
  "openapi": "3.1.0",
  "info": {
    "title": "Modern Identity API",
    "version": "1.0",
    "description": "A modern identity lab complementing the OAuth playground with OIDC discovery, PKCE, device authorization, introspection and revocation."
  },
  "servers": [
    {
      "url": "https://funapi.dev/api/identity/v1"
    }
  ],
  "tags": [
    {
      "name": "discovery",
      "description": "provider metadata"
    },
    {
      "name": "tokens",
      "description": "PKCE and lifecycle"
    }
  ],
  "paths": {
    "/.well-known/openid-configuration": {
      "get": {
        "tags": [
          "discovery"
        ],
        "summary": "OIDC discovery document",
        "operationId": "id-discovery",
        "responses": {
          "200": {
            "description": "Provider metadata",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          }
        }
      }
    },
    "/jwks": {
      "get": {
        "tags": [
          "discovery"
        ],
        "summary": "Demo JSON Web Key Set",
        "operationId": "id-jwks",
        "responses": {
          "200": {
            "description": "JWKS",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          }
        }
      }
    },
    "/authorize": {
      "post": {
        "tags": [
          "tokens"
        ],
        "summary": "Issue an authorization code with real PKCE (S256)",
        "operationId": "id-authorize",
        "responses": {
          "200": {
            "description": "Code issued",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          },
          "400": {
            "description": "Invalid client, unsupported code_challenge_method, or missing codeChallenge",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "clientId": {
                    "type": "string"
                  },
                  "redirectUri": {
                    "type": "string"
                  },
                  "codeChallenge": {
                    "type": "string"
                  },
                  "codeChallengeMethod": {
                    "type": "string"
                  },
                  "scope": {
                    "type": "string"
                  }
                }
              },
              "example": {
                "clientId": "fun-client",
                "redirectUri": "https://example.com/callback",
                "codeChallenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
                "codeChallengeMethod": "S256",
                "scope": "openid profile"
              }
            }
          }
        }
      }
    },
    "/token": {
      "post": {
        "tags": [
          "tokens"
        ],
        "summary": "Exchange a PKCE code for scoped tokens — verifies BASE64URL(SHA256(codeVerifier)) against the stored codeChallenge",
        "operationId": "id-token",
        "responses": {
          "200": {
            "description": "Tokens issued",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          },
          "400": {
            "description": "invalid_grant",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "code": {
                    "type": "string"
                  },
                  "codeVerifier": {
                    "type": "string"
                  }
                }
              },
              "example": {
                "code": "code_from_authorize",
                "codeVerifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
              }
            }
          }
        }
      }
    },
    "/introspect": {
      "post": {
        "tags": [
          "tokens"
        ],
        "summary": "Introspect an access token",
        "operationId": "id-introspect",
        "responses": {
          "200": {
            "description": "Token state",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "token": {
                    "type": "string"
                  }
                }
              },
              "example": {
                "token": "oidc_xxx"
              }
            }
          }
        }
      }
    },
    "/revoke": {
      "post": {
        "tags": [
          "tokens"
        ],
        "summary": "Revoke an access token",
        "operationId": "id-revoke",
        "responses": {
          "204": {
            "description": "Revoked or already absent"
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "token": {
                    "type": "string"
                  }
                }
              },
              "example": {
                "token": "oidc_xxx"
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "Use qa-admin-token / qa-viewer-token, or a JWT from POST /auth/v1/login."
      },
      "apiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key",
        "description": "Cargo demo key: cargo-key-123."
      }
    },
    "schemas": {
      "Error": {
        "type": "object",
        "required": [
          "error",
          "message"
        ],
        "properties": {
          "error": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "requestId": {
            "type": "string"
          }
        },
        "additionalProperties": true
      }
    }
  }
}