openapi: 3.0.0
info:
  description: >
    This document specifies an **Password Expired User Identification API** for **WSO2 Identity server**.
  version: "v1"
  title: WSO2 Identity Server - Password Expired User Identification Rest API
  termsOfService: 'http://swagger.io/terms/'
  contact:
    name: WSO2
    url: 'http://wso2.com/products/identity-server/'
    email: architecture@wso2.org
  license:
    name: Apache 2.0
    url: 'http://www.apache.org/licenses/LICENSE-2.0.html'

servers:
  - url: 'https://{server-url}/t/{tenant-domain}/api/server/v1'
    variables:
      server-url:
        default: "localhost:9443"
      tenant-domain:
        default: "default"

paths:
  /password-expired-users:
    get:
      tags:
        - Get password expired users
      description: |
        Get password expired users list for a specified period.<br>
        
          <b>Scope(Permission) required:</b> `internal_password_expired_user_view`
      operationId: getPasswordExpiredUsers
      parameters:
        - in: query
          name: expiredAfter
          required: true
          schema:
            type: string
          description: The date after which passwords will expire.
          example: 2023-01-31
        - in: query
          name: excludeAfter
          schema:
            type: string
          description: The date after which should be excluded.
          example: 2023-01-01
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/ServerError'

components:
  schemas:
    Error:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
          example: 80001
        message:
          type: string
          example: Some error message
        description:
          type: string
          example: Some error description
    Unauthorized:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
          example: 401
        message:
          type: string
          example: Unauthorized
        description:
          type: string
          example: You are unauthorized to make this request
    PasswordExpiredUsersList:
      type: array
      items:
        $ref: '#/components/schemas/PasswordExpiredUser'
    PasswordExpiredUser:
      type: object
      properties:
        userId:
          type: string
        username:
          type: string
        userStoreDomain:
          type: string
      required:
        - username
      example:
        userId: 3c780e73-9ca6-4e49-811e-8e697df22a91
        username: JohnDoe
        userStoreDomain: DEFAULT

  responses:
    Unauthorized:
      description: Unauthorized
      content:
        'application/json':
          schema:
            $ref: '#/components/schemas/Unauthorized'
    Forbidden:
      description: Resource Forbidden
    ServerError:
      description: Internal Server Error
      content:
        'application/json':
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Invalid Input Request
      content:
        'application/json':
          schema:
            $ref: '#/components/schemas/Error'
    Success:
      description: Password expired users returned successfully
      content:
        'application/json':
          schema:
            $ref: '#/components/schemas/PasswordExpiredUsersList'
