openapi: 3.0.0
info:
  version: 1.0.0
  title: 'Private CIAM Cloud - Parent User Invitation API Definition'
  description: |-
    This is the RESTful API for parent organization user invitation for child organizations in CIAM Cloud. This API 
    allows administrators to invite users, manage the invitations and invitees are allowed to accept the invitation.
  contact:
    name: WSO2
    url: 'https://wso2.com/ciam-suite/private-ciam-cloud/b2b-ciam'
    email: iam-dev@wso2.org
  license:
    name: Apache 2.0
    url: 'http://www.apache.org/licenses/LICENSE-2.0.html'
servers:
  - url: 'https://localhost:9443/o/{organization-domain}/api/server/v1'
    variables:
      organization-domain:
        default: 10084a8d-113f-4211-a0d5-efe36b082211
paths:
  /guests/invite:
    post:
      tags:
        - Parent Organization User Invitation
      summary: Invite a parent organization user to a child organization
      description: |
        Initiates an invitation to a user in the parent organization to onboard to the child organization.
        This will be initiated from the child organization.
        
        <b>Scope required:</b> <br/> 
        - internal_guest_mgt_invite_add
      operationId: invitationTriggerPost
      requestBody:
        $ref: '#/components/requestBodies/InvitationRequestPayload'
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvitationSuccessResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /guests/invitation/introspect:
    post:
      tags:
        - Parent Organization User Invitation
      summary: introspect an invitation's confirmation code
      description: |
        This API can be used to introspect the confirmation code. This will be 
        invoked from the application with the access token of the user which
        was logged into the application and switched to the organization where 
        the user resides in.

        <b>Scope required:</b> <br/> 
        - none
      operationId: invitationIntrospectPost
      requestBody:
        $ref: '#/components/requestBodies/IntrospectRequestPayload'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntrospectSuccessResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /guests/invitation/accept:
    post:
      tags:
        - Parent Organization User Invitation
      summary: Accepts an invitation from a user in the parent organization
      description: |
        After user clicks on the link provided, the redirected application should invoke this API.
        This API is a public API and this should be invoked with the confirmation code which is 
        appended to the notification.
        
        <b>Scope required:</b> <br/> 
        - none
      operationId: invitationAcceptPost
      requestBody:
        $ref: '#/components/requestBodies/AcceptanceRequestPayload'
      responses:
        '200':
          description: Successful Response
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /guests/invitations:
    get:
      tags:
        - Invitation Management
      summary: List down the user invitations
      description: |
        List down the invitations triggered from the current organization. This should be invoked
        from an access token issued from an administrator of that organization.
        
        <b>Scope required:</b> <br/> 
        - internal_guest_mgt_invite_list
      operationId: invitationListGet
      parameters:
        - $ref: '#/components/parameters/FilterQueryParam'
        - $ref: '#/components/parameters/LimitQueryParam'
        - $ref: '#/components/parameters/OffsetQueryParam'
        - $ref: '#/components/parameters/sortOrderQueryParam'
        - $ref: '#/components/parameters/sortByQueryParam'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvitationsListResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /guests/invitations/{invitationId}:
    delete:
      tags:
        - Invitation Management
      summary: Delete an invitation
      description: |
        Based on the requirements the invitations which are initiated by the same organization
        can be deleted. This should be invoked from an access token issued from an administrator of that organization.
        
        <b>Scope required:</b> <br/> 
        - internal_guest_mgt_invite_delete
      operationId: invitationDelete
      parameters:
        - name: invitationId
          in: path
          description: ID of the invitation to delete
          required: true
          schema:
            type: string
            example: 2d88a90a-3060-46f0-b863-fc481fef8137
      responses:
        '204':
          description: Successful Response and if the resource not found
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  requestBodies:
    InvitationRequestPayload:
      description: Details that need to initiate an invitation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/InvitationRequestBody'
      required: true
    IntrospectRequestPayload:
      description: Details that need to introspect an invitation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/IntrospectRequestBody'
      required: true
    AcceptanceRequestPayload:
      description: Details that need to confirm an invitation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AcceptanceRequestBody'
      required: true
  parameters:
    FilterQueryParam:
      in: query
      name: filter
      required: false
      description: Filtering the invitation based on the status. Status can be PENDING or EXPIRED.
      schema:
        type: string
      example: status eq PENDING
    LimitQueryParam:
      in: query
      name: limit
      required: false
      description: |
        Maximum number of records to return
        _This parameter is not supported yet._
      schema:
        type: integer
      example: 10
    OffsetQueryParam:
      in: query
      name: offset
      required: false
      description: |
        Starting index of the pagination
        _This parameter is not supported yet._
      schema:
        type: integer
      example: 0
    sortOrderQueryParam:
      in: query
      name: sortOrder
      required: false
      description: |
        Sort order of the returned records. Either ASC or DESC
        _This parameter is not supported yet._
      schema:
        type: string
        enum:
          - ASC
          - DESC
    sortByQueryParam:
      in: query
      name: sortBy
      required: false
      description: |
        Sort by a specific field
        _This parameter is not supported yet._
      schema:
        type: string
        example: createdTime
  schemas:
    InvitationRequestBody:
      type: object
      required:
        - username
      properties:
        username:
          type: string
          description: Username of the user who will be invited to the organization. This can be an
            email or an alphanumeric username.
          example: alex@gmail.com/alex
        userDomain:
          type: string
          description: User store domain of the user. If not provided, PRIMARY will be used.
          example: PRIMARY
        roleAssignments:
          type: array
          description: Role assignments which the user will be assigned to.
          items:
            $ref: '#/components/schemas/RoleAssignmentRequestBody'
    InvitationSuccessResponse:
      type: object
      required:
        - username
        - email
        - roleAssignments
      properties:
        username:
          type: string
          description: Username of the user who will be invited to the organization. This can be an
            email or an alphanumeric username.
          example: alex@gmail.com/alex
        email:
          type: string
          description: Email of the user who will be invited to the organization.
          example: alex@gmail.com
        roleAssignments:
          type: array
          description: Role assignments which the user will be assigned to.
          items:
            $ref: '#/components/schemas/RoleAssignmentResponse'
    IntrospectRequestBody:
      type: object
      required:
        - confirmationCode
      properties:
        confirmationCode:
          type: string
          example: 2663329b-c8c5-4c71-9500-9ea8c4e77d94
    IntrospectSuccessResponse:
      type: object
      required:
        - confirmationCode
        - username
        - userOrganization
        - initiatedOrganization
        - status
      properties:
        confirmationCode:
          type: string
          description: Confirmation code of the invitation which needs to be introspected.
          example: 2663329b-c8c5-4c71-9500-9ea8c4e77d94
        username:
          type: string
          description: Username of the user who will be invited to the organization. This can be an
            email or an alphanumeric username.
          example: alex@gmail.com/alex
        userOrganization:
          type: string
          description: Organization which the user is residing.
          example: 8763329b-c8c5-4c71-9500-9ea8c4e77345
        initiatedOrganization:
          type: string
          description: Organization which the invitation is initiated.
          example: 1239329b-c8c5-4c71-9500-9ea8c4e70987
        status:
          type: string
          description: Status of the invitation.
          example: PENDING/EXPIRED
    AcceptanceRequestBody:
      type: object
      required:
        - confirmationCode
      properties:
        confirmationCode:
          type: string
          example: 2663329b-c8c5-4c71-9500-9ea8c4e77d94
    InvitationsListResponse:
      type: object
      properties:
        invitations:
          type: array
          items:
            $ref: '#/components/schemas/InvitationResponse'
    InvitationResponse:
      type: object
      required:
        - id
        - username
        - email
        - status
      properties:
        id:
          type: string
          example: f7594498-5b52-4201-abd5-d7cf72565c73
        username:
          type: string
          example: alex@gmail.com/alex
        email:
          type: string
          example: alex@gmail.com
        roleAssignments:
          type: array
          items:
            $ref: '#/components/schemas/RoleAssignmentResponse'
        status:
          type: string
          example: PENDING/EXPIRED
        expiredAt:
          type: string
          example: 2021-08-10T10:15:30.00Z
    RoleAssignmentResponse:
      type: object
      required:
        - applicationId
        - roles
      properties:
        applicationId:
          type: string
          example: f7594498-5b52-4201-abd5-d7cf72565c73
        applicationName:
          type: string
          example: b2b_business_sample_application
        roles:
          type: array
          items:
            type: string
            example: editor, manager
    RoleAssignmentRequestBody:
      type: object
      required:
        - applicationId
        - roles
      properties:
        applicationId:
          type: string
          example: f7594498-5b52-4201-abd5-d7cf72565c73
        roles:
          type: array
          items:
            type: string
            example: editor, manager
    Error:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
          example: OUI-00000
          description: An error code.
        message:
          type: string
          example: Some Error Message
          description: An error message.
        description:
          type: string
          example: Some Error Description
          description: An error description.
        traceId:
          type: string
          example: e0fbcfeb-3617-43c4-8dd0-7b7d38e13047
          description: An error trace identifier.
  #--------------------------------------------------------
  # Descriptions of error responses.
  #--------------------------------------------------------
  responses:
    NotFound:
      description: Resource is not found.
      content:
        'application/json':
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Authentication information is missing or invalid.
    Forbidden:
      description: Access forbidden.
    ServerError:
      description: Internal server error.
      content:
        'application/json':
          schema:
            $ref: '#/components/schemas/Error'