openapi: 3.0.1
info:
  title: Client Secret Management Service
  description: 'SLB Authorization: Client Secret Management Service'
  version: 1.0.0.0
  x-product-id: SAuth-Client-Secret-Management-Service
security:
  - appkey: []
    bearer: []
tags:
  - name: Client-Secret
    description: Manage SLB Authenticator client secrets.
paths:
  /v1/clients/{clientID}/secrets:
    post:
      tags:
        - Client-Secret
      summary: Generate Client secret.
      description: Create a new secret for an SLB Authenticator Client.
      operationId: CreateClientSecret
      parameters:
        - name: clientID
          in: path
          required: true
          schema:
            type: string
      requestBody:
        description: details to create a client secret.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSecretPayload'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateSecretResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '422':
          description: UnprocessableEntity
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
    get:
      tags:
        - Client-Secret
      summary: Get Client secrets.
      description: Return list of secrets of an SLB Authenticator Client.
      operationId: ListClientSecrets
      parameters:
        - name: clientID
          schema:
            type: string
          in: path
          required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secrets'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
    put:
      tags:
        - Client-Secret
      summary: Rotate secret for a client
      description: >-
        Create a new secret and revoke the given secret of an SLB Authenticator
        Client.
      operationId: RotateClientSecret
      parameters:
        - name: clientID
          schema:
            type: string
          in: path
          required: true
      requestBody:
        description: details to rotate a client secret.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RotateSecretPayload'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RotateSecretResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
  /v1/clients/{clientID}/secrets/{secretID}:
    delete:
      tags:
        - Client-Secret
      summary: Revoke Client secret.
      description: Revoke secret of SLB Authenticator Client.
      operationId: RevokeClientSecret
      parameters:
        - name: clientID
          schema:
            type: string
          in: path
          required: true
        - name: secretID
          schema:
            type: string
          in: path
          required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleResponse'
components:
  schemas:
    SimpleResponse:
      properties:
        id:
          type: string
        message:
          type: string
      type: object
    CreateSecretPayload:
      type: object
      properties:
        secretName:
          type: string
          description: >-
            Represents the name of the secret. Helps user to identify secret of
            a client.
    CreateSecretResponse:
      required:
        - secretId
        - secretValue
      type: object
      properties:
        secretName:
          type: string
        secretId:
          type: string
          description: unique identifier for a client secret.
        secretValue:
          type: string
          description: value of secret that can be used for CCG.
    Secret:
      type: object
      required:
        - secretId
      properties:
        secretId:
          type: string
          description: unique identifier for a client secret.
        secretName:
          type: string
          description: name of the secret. helps user to identify secret of their client.
    Secrets:
      properties:
        secrets:
          type: array
          items:
            $ref: '#/components/schemas/Secret'
    RotateSecretPayload:
      type: object
      required:
        - existingSecretId
      properties:
        secretName:
          type: string
          description: name of the new secret to be created.
        existingSecretId:
          type: string
          description: secretId of the client that needs to revoked.
    RotateSecretResponse:
      type: object
      required:
        - secretId
        - secretValue
        - revokedSecretId
      properties:
        secretName:
          type: string
        secretId:
          type: string
          description: id of the new secret
        secretValue:
          type: string
        revokedSecretId:
          type: string
          description: secretId of the revoked secret
        revokedSecretName:
          type: string
          description: name of the revoked secret
  securitySchemes:
    appkey:
      type: apiKey
      description: AppKey/ConsumerKey from your App on Developer Portal
      name: appkey
      in: header
    bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: User Token from SLB Authenticator Service
x-google-endpoints:
  - name: auth-client
servers:
  - url: https://api.delfi.slb.com/auth/client
    description: US
  - url: https://eu-api.delfi.slb.com/auth/client
    description: EU
