openapi: 3.0.0
info:
  description: >
    This document specifies an **Application Management RESTful API** for **WSO2
    Identity Server**.
  version: "v1"
  title: WSO2 Identity Server - Application Management Rest API
  termsOfService: 'http://swagger.io/terms/'
  contact:
    name: WSO2
    url: 'http://wso2.com/products/identity-server/'
    email: architecture@wso2.org
  license:
    name: Apache 2.0
    url: 'http://www.apache.org/licenses/LICENSE-2.0.html'

security:
  - OAuth2: []
  - BasicAuth: []
paths:
  /applications:
    get:
      tags:
        - Applications
      operationId: getAllApplications
      summary: |
        List applications
      description: |
        This API provides the capability to retrieve the list of applications.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      parameters:
        - $ref: '#/components/parameters/limitQueryParam'
        - $ref: '#/components/parameters/offsetQueryParam'
        - $ref: '#/components/parameters/filterQueryParam'
        - $ref: '#/components/parameters/sortOrderQueryParam'
        - $ref: '#/components/parameters/sortByQueryParam'
        - $ref: '#/components/parameters/attributesQueryParam'
        - $ref: '#/components/parameters/excludeSystemPortalsQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationListResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: Not Implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
        - Applications
      summary: |
        Add application
      operationId: createApplication
      description: >
        This API provides the capability to store the application information
        that is provided by users.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/create <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_create
      parameters:
        - in: query
          name: template
          required: false
          description: |
            Pre-defined template to use when creating the application.
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationModel'
        description: This represents the application to be created.
        required: true
      responses:
        '201':
          description: Successful response.
          headers:
            Location:
              description: This denotes the location of the newly-created application.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: Not Implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/import:
    post:
      tags:
        - Applications
      summary: |
        Create application from an exported XML file
      operationId: importApplication
      description: >
        This API provides the capability to store the application information,
        provided as a file.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/create <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_create
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/FileUpload'
        description: This represents the application to be created.
      responses:
        '201':
          description: Successfully created.
          headers:
            Location:
              description: Location of the newly created application.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Applications
      summary: |
        Update application from an exported XML file
      operationId: importApplicationForUpdate
      description: >
        This API provides the capability to update an application from information that has been exported as an XML file.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/FileUpload'
        description: This represents the application to be updated.
      responses:
        '200':
          description: Successfully Updated.
          headers:
            Location:
              description: Location of the updated application.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  '/applications/{applicationId}':
    get:
      tags:
        - Applications
      summary: |
        Retrieve application by ID
      operationId: getApplication
      description: >
        This API provides the capability to retrieve the application information
        by ID. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationResponseModel'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'

    patch:
      tags:
        - Applications
      summary: |
        Partially update application by ID
      operationId: patchApplication
      description: |
        This API provides the capability to partially update an application by ID.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationPatchModel'
        description: This represents the application details to be updated.
        required: true
      responses:
        '200':
          description: Successfully Updated
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - Applications
      summary: |
        Delete application by ID
      operationId: deleteApplication
      description: |
        This API provides the capability to delete an application by ID. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/delete <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_delete
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Successfully Deleted
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/export:
    get:
      tags:
        - Applications
      operationId: exportApplication
      summary: |
        Export application as an XML file
      description: |
        This API provides the capability to retrieve the application as an XML file.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - $ref: '#/components/parameters/exportSecretsQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/octet-stream:
              schema:
                example: 'Sample application configuration xml as a string'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/exportFile:
    get:
      tags:
        - Applications
      operationId: exportApplicationAsFile
      summary: |
        Export application in XML, YAML, or JSON file formats.
      description: |
        This API provides the capability to retrieve the application in XML, YAML, or JSON format.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - $ref: '#/components/parameters/exportSecretsQueryParam'
        - $ref: '#/components/parameters/fileTypeHeaderParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: string
              example: 'Sample application configuration in the requested format'
            application/yaml:
              schema:
                type: string
              example: 'Sample application configuration in the requested format'
            application/xml:
              schema:
                type: string
              example: 'Sample application configuration in the requested format'
            application/octet-stream:
              schema:
                type: string
              example: 'Sample application configuration in the requested format'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/owner:
    put:
      tags:
        - Applications
      operationId: changeApplicationOwner
      summary: |
        Change application owner
      description: |
        This API provides the capability to change the application owner.<br>
          <b>Permission required:</b> <br>
              * /permission/admin <br>
          <b>Scope required:</b> <br>
              * internal_organization_admin
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationOwner'
      responses:
        '200':
          description: Successfully Updated
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /applications/{applicationId}/authenticators:
    get:
      tags:
        - Authenticators
      summary: |
        Get configured authenticators
      operationId: getConfiguredAuthenticators
      description: |
        This API provides the capability to retrieve the configured authenticators.
        <b>Permission required:</b> <br>
            * /permission/admin/manage/identity/applicationmgt/view <br>
        <b>Scope required:</b> <br>
            * internal_application_mgt_view
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ConfiguredAuthenticatorsModal'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  /applications/{applicationId}/authorized-apis:
    get:
      tags:
        - Authorized APIs
      summary: |
        Get authorized APIs of the application.
      operationId: getAuthorizedAPIs
      description: |
        This API provides the capability to retrieve all the authorized APIs of the application.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuthorizedAPIResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
        - Authorized APIs
      summary: |
        Authorized an API to the application
      operationId: addAuthorizedAPI
      description: |
        This API provides the capability to authorized an API to the application.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizedAPICreationModel'
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'


  /applications/{applicationId}/authorized-apis/{apiId}:
    patch:
      tags:
        - Authorized APIs
      summary: |
        Update authorized API scopes
      operationId: patchAuthorizedAPI
      description: |
        This API provides the capability to update an authorized API of the application.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: apiId
          in: path
          description: ID of the API resource.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizedAPIPatchModel'
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

    delete:
      tags:
        - Authorized APIs
      summary: |
        Remove API authorization from the application
      operationId: deleteAuthorizedAPI
      description: |
        This API provides the capability to delete an authorized API of the application.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: apiId
          in: path
          description: ID of the API resource.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'


  /applications/resident:
    get:
      tags:
        - Resident Application
      summary: |
        Get Resident application
      operationId: getResidentApplication
      description: |
        This API provides the capability to retrieve the resident application information.
        <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResidentApplication'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Resident Application
      summary: |
        Update Resident Application
      operationId: updateResidentApplication
      description: >
        This API provides the capability to update the Resident Application Configuration. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: >-
                Location of the provisioning configuration of the resident
                application.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProvisioningConfiguration'
        description: >-
          This represents the provisioning configuration of the resident
          application.
        required: true
  '/applications/{applicationId}/inbound-protocols/':
    get:
      tags:
        - Inbound Protocols
      summary: |
        Retrieve inbound protocol configurations of the application
      operationId: getInboundAuthenticationConfigurations
      description: >
        This API provides the capability to retrieve authentication protocol
        configurations of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InboundProtocolsListResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  '/applications/{applicationId}/inbound-protocols/saml':
    get:
      tags:
        - Inbound Protocols - SAML
      summary: |
        Retrieve SAML2 authentication protocol parameters of application
      operationId: getInboundSAMLConfiguration
      description: >
        This API provides the capability to retrieve SAML2 authentication
        protocol parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SAML2ServiceProvider'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

    put:
      tags:
        - Inbound Protocols - SAML
      summary: |
        Update SAML2 authentication protocol parameters of application
      operationId: updateInboundSAMLConfiguration
      description: >
        This API provides the capability to store SAML2 authentication protocol
        parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update

        - There are three methods to create/update SAML2 authentication protocol configuration.
            1. Metadata File (by sending the Base64 encoded content of the metadata file.)
            2. Metadata URL
            3. Manual configuration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: Location of the newly created SAML Inbound configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAML2Configuration'
        description: This represents the SAML2 protocol attributes of the application.
        required: true
    delete:
      tags:
        - Inbound Protocols - SAML
      summary: |
        Delete SAML2 authentication protocol parameters of application
      operationId: deleteInboundSAMLConfiguration
      description: >
        This API provides the capability to delete SAML2 authentication protocol
        parameters of an application. <br>
          <b>Permissi on required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/delete <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_delete
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete successful
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'


  '/applications/{applicationId}/inbound-protocols/oidc':
    get:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Retrieve OIDC authentication protocol parameters of application
      description: >
        This API provides the capability to retrieve OIDC authentication
        protocol parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getInboundOAuthConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OpenIDConnectConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Update OIDC authentication protocol parameters of application
      description: >
        This API provides the capability to store OIDC authentication protocol
        parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      operationId: updateInboundOAuthConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Created
          headers:
            Location:
              description: This is the location of the newly created OIDC Authentication Configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OpenIDConnectConfiguration'
        description: >-
          This represents the OIDC authentication protocol parameters of an
          application.
        required: true
    delete:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Delete OIDC authentication protocol parameters of application
      description: >
        This API provides the capability to delete OIDC authentication protocol
        parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/delete <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_delete
      operationId: deleteInboundOAuthConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete Success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'


  '/applications/{applicationId}/inbound-protocols/oidc/regenerate-secret':
    post:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Regenerate the OAuth2/OIDC client secret of application
      description: |
        This API regenerates the OAuth2/OIDC client secret. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/create <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_create
      operationId: regenerateOAuthClientSecret
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OpenIDConnectConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/{applicationId}/inbound-protocols/oidc/revoke':
    post:
      tags:
        - Inbound Protocols - OAuth / OIDC
      summary: |
        Revoke the OAuth2/OIDC client of application
      description: |
        This API revokes the OAuth2/OIDC client secret. To re-activate the client, the client secret needs to be regenerated. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/create <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_create
      operationId: revokeOAuthClient
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Application Revoked
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/{applicationId}/inbound-protocols/passive-sts':
    get:
      tags:
        - Inbound Protocols - Passive STS
      summary: >
        Retrieve Passive STS authentication protocol parameters of application
      description: >
        This API provides the capability to retrieve Passive STS authentication
        protocol parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getPassiveStsConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PassiveStsConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

    put:
      tags:
        - Inbound Protocols - Passive STS
      summary: |
        Update Passive STS authentication protocol parameters of application
      description: >
        This API provides the capability to store passive STS authentication
        protocol parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      operationId: updatePassiveStsConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: >-
                Location of the newly created Passive STS Authentication
                Configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PassiveStsConfiguration'
        description: >-
          This represents the Passive STS authentication protocol parameters of
          an application.
        required: true
    delete:
      tags:
        - Inbound Protocols - Passive STS
      summary: |
        Delete Passive STS authentication protocol parameters of application
      description: >
        This API provides the capability to delete Passive STS authentication
        protocol parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/delete <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_delete
      operationId: deletePassiveStsConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete Success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/{applicationId}/inbound-protocols/ws-trust':
    get:
      tags:
        - Inbound Protocols - WS Trust
      summary: |
        Retrieve WS Trust authentication protocol parameters of application
      description: >
        This API provides the capability to retrieve Passive STS authentication
        protocol parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getWSTrustConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WSTrustConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

    put:
      tags:
        - Inbound Protocols - WS Trust
      summary: |
        Update WS Trust authentication protocol parameters of application
      description: >
        This API provides the capability to store WS Trust authentication
        protocol parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      operationId: updateWSTrustConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: >-
                Location of the newly created WS Trust Authentication
                Configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WSTrustConfiguration'
        description: >-
          This represents the Passive STS authentication protocol parameters of
          an application.
        required: true
    delete:
      tags:
        - Inbound Protocols - WS Trust
      summary: |
        Delete WS Trust authentication protocol parameters of application
      description: >
        This API provides the capability to delete WS Trust authentication
        protocol parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/delete <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_delete
      operationId: deleteWSTrustConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete Success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/{applicationId}/inbound-protocols/{inboundProtocolId}':
    get:
      tags:
        - Inbound Protocols - Custom
      summary: >
        Retrieve custom Inbound authentication protocol parameters of application.
      description: >
        This API provides the capability to retrieve custom inbound
        authentication protocol parameters of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getCustomInboundConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application
          required: true
          schema:
            type: string
        - name: inboundProtocolId
          in: path
          description: Inbound Authentication Protocol ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomInboundProtocolConfiguration'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - Inbound Protocols - Custom
      summary: |
        Update the custom inbound authentication protocol parameters of application
      description: >
        This API provides the capability to store custom inbound authentication protocol parameters of an application.
        <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/update <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_update
      operationId: updateCustomInboundConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: inboundProtocolId
          in: path
          description: Inbound Authentication Protocol ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful
        '201':
          description: Successful response.
          headers:
            Location:
              description: >-
                Location of the newly created Custom Inbound authentication
                protocol Configuration.
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomInboundProtocolConfiguration'
        description: >-
          This represents the Custom Inbound authentication protocol parameters
          of an application.
        required: true
    delete:
      tags:
        - Inbound Protocols - Custom
      summary: >
        Delete custom inbound authentication protocol parameters of application
      description: >
        This API provides the capability to delete custom inbound authentication protocol of an application. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/delete <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_delete
      operationId: deleteCustomInboundConfiguration
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: inboundProtocolId
          in: path
          description: Inbound Authentication Protocol ID
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Delete Success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/meta/inbound-protocols':
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve the list of inbound authentication protocols available
      description: >
        This API provides the capability to retrieve the list of inbound authentication protocols available.
        If the query parameter 'customOnly' is set to true, only custom inbound protocols will be listed.
        <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getInboundProtocols
      parameters:
        - $ref: '#/components/parameters/inboundProtocolsCustomOnly'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuthProtocolMetadata'
                example:
                  - name: "saml"
                    displayName: "SAML2 Web SSO Configuration"
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/meta/inbound-protocols/saml':
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve all the metadata related to the auth protocol SAML
      description: >
        This API provides the capability to retrieve all the metadata related to the auth protocol SAML. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getSAMLMetadata
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SAMLMetaData'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/meta/inbound-protocols/oidc':
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve all the metadata related to the authentication protocol OAuth / OIDC
      description: >
        This API provides the capability to retrieve all the metadata related to the authentication protocol OAuth / OIDC. <br>
           <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getOIDCMetadata
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OIDCMetaData'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/meta/inbound-protocols/ws-trust':
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve all the metadata related to the auth protocol WS Trust
      description: >
        This API provides the capability to retrieve all the metadata related to the auth protocol WS_Trust. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getWSTrustMetadata
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WSTrustMetaData'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/meta/inbound-protocols/{inboundProtocolId}':
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve all the metadata related to the custom auth protocol identified by the inboundProtocolId
      description: >
        This API provides the capability to retrieve all the metadata related to the custom auth protocol
        identified by the inboundProtocolId. The URL encoded inbound protocol name is used as inboundProtocolId.<br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getCustomProtocolMetadata
      parameters:
        - name: inboundProtocolId
          in: path
          description: Inbound Authentication Protocol ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomInboundProtocolMetaData'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  '/applications/meta/adaptive-auth-templates':
    get:
      tags:
        - Application Metadata
      summary: |
        Retrieve the sample adaptive authentication templates.
      description: >
        This API provides the capability to retrieve the sample adaptive authentication templates. <br>
          <b>Permission required:</b> <br>
              * /permission/admin/manage/identity/applicationmgt/view <br>
          <b>Scope required:</b> <br>
              * internal_application_mgt_view
      operationId: getAdaptiveAuthTemplates
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AdaptiveAuthTemplates'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  /applications/templates:
    get:
      tags:
        - Application Templates
      operationId: getAllApplicationTemplates
      summary: |
        List Application Templates
      description: |
        This API provides the capability to retrieve the list of templates available.
      parameters:
        - $ref: '#/components/parameters/limitWithoutDefaultQueryParam'
        - $ref: '#/components/parameters/offsetWithoutDefaultQueryParam'
        - $ref: '#/components/parameters/filterQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationTemplatesList'
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '404':
          description: "Not Found"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: "Not Implemented"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
        - Application Templates
      summary: |
        Add application template
      operationId: createApplicationTemplate
      description: >
        This API provides the capability to store the application template provided by users.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationTemplateModel'
        description: "This represents the application template to be created."
        required: true
      responses:
        '201':
          description: "Successful response."
          headers:
            Location:
              description: "Location of the newly created application template."
              schema:
                type: string
                example: "/t/wso2.com/api/server/v1/applications/templates/85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '409':
          description: "Conflict"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: "Not Implemented"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  /applications/templates/{template-id}:
    get:
      tags:
        - Application Templates
      summary: |
        Retrieve application template by ID
      operationId: getApplicationTemplate
      description: >
        This API provides the capability to retrieve the application template from the template id.
      parameters:
        - $ref: '#/components/parameters/templateIdPathParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationTemplateModel'
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '404':
          description: "Not Found"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'

    put:
      tags:
        - Application Templates
      summary: |
        Update the application template by the template ID.
      operationId: updateApplicationTemplate
      description: |
        This API provides the capability to update an application template by the template ID.
      parameters:
        - $ref: '#/components/parameters/templateIdPathParam'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationTemplateModel'
        description: "This represents the new application template."
        required: true
      responses:
        '200':
          description: "Successfully Updated"
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '404':
          description: "Not Found"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: "Conflict"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - Application Templates
      summary: |
        Delete application template by template ID.
      operationId: deleteApplicationTemplate
      description: |
        This API provides the capability to delete an application template by template ID.
      parameters:
        - $ref: '#/components/parameters/templateIdPathParam'
      responses:
        '204':
          description: "Successfully Deleted"
        '400':
          description: "Bad Request"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: "Unauthorized"
        '403':
          description: "Forbidden"
        '404':
          description: "Not Found"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
            application/xml:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: "Server Error"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  /applications/{applicationId}/share:
    post:
      summary: |
        Share the application from the root organization to the given organization.
      description: |
        This API provides the capability to share an application with organizations.
        <br><br>
        <b>Scope required:</b> 
        * internal_shared_application_create
      operationId: shareOrgApplication
      parameters:
        - name: applicationId
          in: path
          description: ID of the application which will be shared to organizations.
          required: true
          schema:
            type: string
            example: c75e27f9-98c7-4518-a968-c6cd59f0ac6b
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationSharePOSTRequest'
        required: true
      responses:
        '200':
          description: Ok
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Organization Application Sharing
    get:
      summary: |
        List of organizations that the application is shared to.
      description: |
        This API returns the list of organizations that the application is shared to.
        <br><br>
        <b>Scope required:</b> 
        * internal_shared_application_view
      operationId: shareOrgApplicationGet
      parameters:
        - name: applicationId
          in: path
          description: ID of the application which is shared to organizations.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SharedOrganizationsResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Organization Application Sharing
  /applications/{applicationId}/shared-apps:
    get:
      summary: |
        List of shared applications along with its organization.
      description: |
        This API returns the list of shared app ids along with the shared organization id.
        <br><br>
        <b>Scope required:</b> 
        * internal_shared_application_view
      operationId: sharedApplicationsGet
      parameters:
        - name: applicationId
          in: path
          description: ID of the application which is shared to organizations.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SharedApplicationsResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Organization Application Sharing
    delete:
      description: |
        This API provides the capability to stop sharing an application to all organizations the application is shared to.
        <br><br>
        <b>Scope required:</b> 
        * internal_shared_application_delete
      summary: |
        Stop sharing an application with all organizations.
      operationId: sharedApplicationsAllDelete
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Successfully deleted
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Organization Application Sharing
  /applications/{applicationId}/share/{shared-organization-id}:
    delete:
      description: |
        This API provides the capability to stop sharing an application to an organization by providing its ID.
        <br><br>
        <b>Scope required:</b> 
        * internal_shared_application_delete
      summary: |
        Stop sharing an application to a organization.
      operationId: shareOrgApplicationDelete
      parameters:
        - name: applicationId
          in: path
          description: ID of the application.
          required: true
          schema:
            type: string
        - name: shared-organization-id
          in: path
          description: ID of the organization to stop sharing.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Successfully deleted
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
        - Organization Application Sharing
  /applications/loginflow/generate:
    post:
      tags:
        - LoginFlow
      summary: Initiate login flow generation
      description: >
        This API provides the capability to initiate the generation of a login flow.
        <br>
        <b>Scope required:</b>
        * internal_application_mgt_update
      operationId: generateLoginFlow
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginFlowGenerateRequest'
      responses:
        '202':
          description: Accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginFlowGenerateResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  /applications/loginflow/status/{operation_id}:
    get:
      tags:
        - LoginFlow
      summary: Get the status of the login flow generation process
      description: >
        This API provides the capability to retrieve the status of the login flow generation process.
        <br>
        <b>Scope required:</b>
        * internal_application_mgt_update
      operationId: getLoginFlowGenerationStatus
      parameters:
        - name: operation_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginFlowStatusResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

  /applications/loginflow/result/{operation_id}:
    get:
      tags:
        - LoginFlow
      summary: Get the final login flow result
      description: >
        This API provides the capability to retrieve the final login flow result.
        <br>
        <b>Scope required:</b>
        * internal_application_mgt_update
      operationId: getLoginFlowGenerationResult
      parameters:
        - name: operation_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginFlowResultResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'

components:
  parameters:
    limitQueryParam:
      in: query
      name: limit
      required: false
      description: |
        Maximum number of records to return.
      schema:
        type: integer
        minimum: 1
        default: 30
    limitWithoutDefaultQueryParam:
      in: query
      name: limit
      required: false
      description: |
        Maximum number of records to return.
      schema:
        type: integer
    offsetQueryParam:
      in: query
      name: offset
      required: false
      description: |
        Number of records to skip for pagination.
      schema:
        type: integer
        default: 0
    offsetWithoutDefaultQueryParam:
      in: query
      name: offset
      required: false
      description: |
        Number of records to skip for pagination.
      schema:
        type: integer
    filterQueryParam:
      in: query
      name: filter
      required: false
      description: |
        Condition to filter the retrieval of records.
        Supports 'sw', 'co', 'ew', and 'eq' operations with 'and', 'or' logical operators.
        Please note that 'and' and 'or' operators in filters follow the general precedence of logical operators
        ex: A and B or C and D = (A and B) or (C and D)).
        Currently supports only filtering based on the 'name', the 'clientId', and the 'issuer' attributes.

        /applications?filter=name+eq+user_portal
        <br>
        /applications?filter=name+co+prod+or+clientId+co+123
      schema:
        type: string
    sortOrderQueryParam:
      in: query
      name: sortOrder
      required: false
      description: |
        Define the order in which the retrieved records should be sorted.
        _This parameter is not supported yet._
      schema:
        type: string
        enum:
          - ASC
          - DESC
    sortByQueryParam:
      in: query
      name: sortBy
      required: false
      description: |
        Attribute by which the retrieved records should be sorted.
        _This parameter is not supported yet._
      schema:
        type: string
    attributesQueryParam:
      in: query
      name: attributes
      required: false
      description: |
        Specifies the required parameters in the response.
        Currently supports for only 'advancedConfigurations', 'templateId', 'templateVersion', 'clientId', 'issuer', 'applicationEnabled' and 'associatedRoles.allowedAudience' attributes.

        /applications?attributes=advancedConfigurations,templateId,templateVersion,clientId,applicationEnabled,associatedRoles.allowedAudience
      schema:
        type: string
    excludeSystemPortalsQueryParam:
      in: query
      name: excludeSystemPortals
      required: false
      description: |
        Specifies whether to include or exclude system portals in the response. 
        Default will be treated as false if parameter is not preset in the request.

        /applications?excludeSystemPortals=true
      schema:
        type: boolean
    exportSecretsQueryParam:
      in: query
      name: exportSecrets
      required: false
      description: |
        Specifies whether to export secrets when exporting an application.
      schema:
        type: boolean
        default: false
    fileTypeHeaderParam:
      in: header
      name: Accept
      required: false
      description: |
        Content type of the file.
      schema:
        type: string
        default: application/xml
        enum:
          - application/json
          - application/xml
          - application/yaml
          - application/x-yaml
          - text/yaml
    inboundProtocolsCustomOnly:
      in: query
      name: customOnly
      required: false
      description: |
        Send only the custom inbound protocols.
      schema:
        type: boolean
        example: true
        default: false
    templateIdPathParam:
      in: path
      name: template-id
      required: true
      description: |
        Application template ID. This should be a valid locale.
      schema:
        type: string
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: 'https://localhost:9443/oauth2/authorize'
          tokenUrl: 'http://localhost:9763/oauth2/token'
          scopes: {}
  schemas:
    Link:
      type: object
      properties:
        href:
          type: string
          example: "applications?offset=10&limit=10"
        rel:
          type: string
          example: "next"

    ApplicationListResponse:
      type: object
      properties:
        totalResults:
          type: integer
          description: "Number of results that match the listing operation."
          example: 1
        startIndex:
          type: integer
          description: "Index of the first element of the page, which will be equal to offset + 1."
          example: 1
        count:
          type: integer
          description: "Number of elements in the returned page."
          example: 10
        applications:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationListItem'
        links:
          type: array
          items:
            $ref: '#/components/schemas/Link'

    ApplicationListItem:
      type: object
      properties:
        id:
          type: string
          example: "85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        name:
          type: string
          example: "user-portal"
        description:
          type: string
          example: Application representing user portal
        applicationVersion:
          type: string
          example: "v1.0.0"
        image:
          type: string
          example: 'https://example.com/logo/my-logo.png'
        accessUrl:
          type: string
          example: 'https://example.com/app/login'
        clientId:
          type: string
          example: 'SmrrDNXRYf1lMmDlnleeHTuXx_Ea'
        issuer:
          type: string
          example: 'http://idp.example.com/metadata.php'
        realm:
          type: string
          example: 'PassiveSTSSampleApp'
        access:
          type: string
          enum:
            - READ
            - WRITE
          default: READ
        self:
          type: string
          example: "/t/wso2.com/api/server/v1/applications/85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        advancedConfigurations:
          $ref: '#/components/schemas/AdvancedApplicationConfiguration'
        templateId:
          type: string
          example: "980b8tester24c64a8a09a0d80abf8c337bd2555"
        templateVersion:
          type: string
          example: "v1.0.0"
          description: Version of the template used to create the application.
        associatedRoles:
          type: object
          $ref: '#/components/schemas/AssociatedRolesConfig'
        applicationEnabled:
          type: boolean
          example: true
    ApplicationModel:
      type: object
      required:
        - name
      properties:
        id:
          type: string
          example: "394b8adcce24c64a8a09a0d80abf8c337bd253de"
          readOnly: true
        name:
          type: string
          example: pickup
        description:
          type: string
          example: This is the configuration for Pickup application.
        imageUrl:
          type: string
          example: 'https://example.com/logo/my-logo.png'
        accessUrl:
          type: string
          example: 'https://example.com/login'
        logoutReturnUrl:
          type: string
          example: 'https://example.com/app/logout'
        templateId:
          type: string
          example: "980b8tester24c64a8a09a0d80abf8c337bd2555"
        templateVersion:
          type: string
          example: "v1.0.0"
          description: Version of the template used to create the application.
        isManagementApp:
          default: false
          type: boolean
          example: false
          description: Decides whether the application used to access System APIs
        isB2BSelfServiceApp:
          default: false
          type: boolean
          example: false
          description: Decides whether the application used to for B2B self service
        applicationEnabled:
          default: true
          type: boolean
          example: true
          description: Decides whether the application is enabled.
        associatedRoles:
          $ref: '#/components/schemas/AssociatedRolesConfig'
        claimConfiguration:
          $ref: '#/components/schemas/ClaimConfiguration'
        inboundProtocolConfiguration:
          $ref: '#/components/schemas/InboundProtocols'
        authenticationSequence:
          $ref: '#/components/schemas/AuthenticationSequence'
        advancedConfigurations:
          $ref: '#/components/schemas/AdvancedApplicationConfiguration'
        provisioningConfigurations:
          $ref: '#/components/schemas/ProvisioningConfiguration'
    ApplicationResponseModel:
      type: object
      required:
        - name
      properties:
        id:
          type: string
          example: "394b8adcce24c64a8a09a0d80abf8c337bd253de"
          readOnly: true
        name:
          type: string
          example: pickup
        description:
          type: string
          example: This is the configuration for Pickup application.
        applicationVersion:
          type: string
          example: "v1.0.0"
        imageUrl:
          type: string
          example: 'https://example.com/logo/my-logo.png'
        accessUrl:
          type: string
          example: 'https://example.com/login'
        logoutReturnUrl:
          type: string
          example: 'https://example.com/app/logout'
        clientId:
          type: string
          example: 'SmrrDNXRYf1lMmDlnleeHTuXx_Ea'
        issuer:
          type: string
          example: 'http://idp.example.com/metadata.php'
        realm:
          type: string
          example: 'PassiveSTSSampleApp'
        templateId:
          type: string
          example: "adwefi2429asdfdf94444rraf44"
        templateVersion:
          type: string
          example: "v1.0.0"
          description: Version of the template used to create the application.
        isManagementApp:
          type: boolean
          example: false
          description: Decides whether the application used to access System APIs
        isB2BSelfServiceApp:
          type: boolean
          example: false
          description: Decides whether the application used to for B2B self service
        applicationEnabled:
          type: boolean
          example: true
          description: Decides whether the application is enabled.
        associatedRoles:
          $ref: '#/components/schemas/AssociatedRolesConfig'
        claimConfiguration:
          $ref: '#/components/schemas/ClaimConfiguration'
        inboundProtocols:
          $ref: '#/components/schemas/InboundProtocolsListResponse'
        authenticationSequence:
          $ref: '#/components/schemas/AuthenticationSequence'
        advancedConfigurations:
          $ref: '#/components/schemas/AdvancedApplicationConfiguration'
        provisioningConfigurations:
          $ref: '#/components/schemas/ProvisioningConfiguration'
        access:
          type: string
          enum:
            - READ
            - WRITE
          default: READ

    ApplicationPatchModel:
      type: object
      properties:
        name:
          type: string
          example: pickup
        description:
          type: string
          example: This is the configuration for Pickup application.
        applicationVersion:
          type: string
          example: "v1.0.0"
        imageUrl:
          type: string
          example: 'https://example.com/logo/my-logo.png'
        accessUrl:
          type: string
          example: 'https://example.com/login'
        logoutReturnUrl:
          type: string
          example: 'https://example.com/app/logout'
        templateId:
          type: string
          example: "adwefi2429asdfdf94444rraf44"
        templateVersion:
          type: string
          example: "v1.0.0"
          description: Version of the template used to create the application.
        applicationEnabled:
          type: boolean
          example: true
          description: Decides whether the application is enabled.
        associatedRoles:
          $ref: '#/components/schemas/AssociatedRolesConfig'
        claimConfiguration:
          $ref: '#/components/schemas/ClaimConfiguration'
        authenticationSequence:
          $ref: '#/components/schemas/AuthenticationSequence'
        advancedConfigurations:
          $ref: '#/components/schemas/AdvancedApplicationConfiguration'
        provisioningConfigurations:
          $ref: '#/components/schemas/ProvisioningConfiguration'

    ResidentApplication:
      type: object
      properties:
        provisioningConfigurations:
          $ref: '#/components/schemas/ProvisioningConfiguration'

    ProvisioningConfiguration:
      type: object
      properties:
        inboundProvisioning:
          $ref: '#/components/schemas/InboundSCIMProvisioningConfiguration'
        outboundProvisioningIdps:
          type: array
          items:
            $ref: '#/components/schemas/OutboundProvisioningConfiguration'
    InboundSCIMProvisioningConfiguration:
      type: object
      properties:
        proxyMode:
          type: boolean
          example: false
        provisioningUserstoreDomain:
          type: string
          example: PRIMARY
          description: >-
            This property becomes only applicable if the proxy-mode config is
            set to false

    OutboundProvisioningConfiguration:
      type: object
      properties:
        idp:
          type: string
          example: Google
        connector:
          type: string
          example: googleapps
        blocking:
          type: boolean
          example: false
        rules:
          type: boolean
          example: false
        jit:
          type: boolean
          example: false
      description: >-
        This property is disabled by default as of Identity Server version 7.0 onwards.
    ConfiguredAuthenticatorsModal:
      type: object
      properties:
        stepId:
          type: integer
          example: 1
        localAuthenticators:
          type: array
          items:
            $ref: '#/components/schemas/ConfiguredAuthenticator'
        federatedAuthenticators:
          type: array
          items:
            $ref: '#/components/schemas/ConfiguredAuthenticator'
    ConfiguredAuthenticator:
      type: object
      properties:
        name:
          type: string
          example: googleIdP
        type:
          type: string
          example: GoogleAuthenticator
    AdvancedApplicationConfiguration:
      type: object
      properties:
        saas:
          type: boolean
          example: false
          description: Decides whether the application is accessible across tenants.
        discoverableByEndUsers:
          type: boolean
          example: false
          description: Decides whether the application is visible for end users.
        certificate:
          $ref: '#/components/schemas/Certificate'
        skipLoginConsent:
          type: boolean
          example: false
          description: Decides whether user consent needs to be skipped during login flows.
        skipLogoutConsent:
          type: boolean
          example: false
          description: Decides whether user consent needs to be skipped during logout flows.
        useExternalConsentPage:
          type: boolean
          example: false
          description: Decides whether user needs to use external consent page.
        returnAuthenticatedIdpList:
          type: boolean
          example: false
          description: Decides whether the list of authenticated identity providers need to be returned in the authentication response.
        enableAuthorization:
          type: boolean
          description: Decides whether authorization policies needs to be engaged during authentication flows.
          example: true
        fragment:
          type: boolean
          description: Decides whether application is a fragment application.
          example: false
        enableAPIBasedAuthentication:
          type: boolean
          description: Decides whether API Based Authentication is enabled for this application.
          example: false
        attestationMetaData:
          type: object
          description: Decides the client attestation meta data for the application.
          properties:
            enableClientAttestation:
              type: boolean
              description: Decides whether client attestation enabled for this application.
              example: false
            androidPackageName:
              type: string
              description: Decides the android package name of the application.
              example: "com.wso2.mobile.sample"
            androidAttestationServiceCredentials:
              type: object
              description: Decides the credentials for the service account to access Google Play Integrity Service.
            appleAppId:
              type: string
              description: Decides the apple app id which denotes {apple-teamId}.{bundleId}.
              example: "APPLETEAMID.com.wso2.mobile.sample"
        trustedAppConfiguration:
          $ref: '#/components/schemas/TrustedAppConfiguration'
        additionalSpProperties:
          $ref: '#/components/schemas/AdditionalProperties'
    AdditionalProperties:
      type: array
      items:
        $ref: "#/components/schemas/AdditionalSpProperty"
    AdditionalSpProperty:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          example: "isInternalApp"
        value:
          type: string
          example: "true"
        displayName:
          type: string
          example: "Internal Application"
    TrustedAppConfiguration:
      type: object
      description: Decides the trusted app configurations for the application.
      properties:
        isFIDOTrustedApp:
          type: boolean
          description: Decides whether the application is a FIDO trusted app.
          example: false
        isConsentGranted:
          type: boolean
          description: Decides whether consent is granted for the trusted app.
          example: false
        androidPackageName:
          type: string
          description: Decides the android package name for the application.
          example: "com.wso2.mobile.sample"
        androidThumbprints:
          type: array
          items:
            type: string
            example:
              - "18:94:0A:DE:63:77:B6:84:43:1E:85:8F:03:CF:8A:14:87:9C:DE:DF:EA:7A:25:53:CD:53:5A:AF:C3:54:A5:56"
          description: Decides the android thumbprints for the application.
        appleAppId:
          type: string
          description: Decides the apple app id for the application.
          example: "APPLETEAMID.com.org.mobile.sample"
    Certificate:
      type: object
      properties:
        type:
          type: string
          description: >-
            Certificate type. This should be either JWKS or PEM.
        value:
          type: string
          description: >-
            Certificate value. If type is JWKS, value should be jwks URL. If
            type is PEM, value should be the certificate in PEM format.
    InboundProtocols:
      type: object
      properties:
        saml:
          $ref: '#/components/schemas/SAML2Configuration'
        oidc:
          $ref: '#/components/schemas/OpenIDConnectConfiguration'
        passiveSts:
          $ref: '#/components/schemas/PassiveStsConfiguration'
        wsTrust:
          $ref: '#/components/schemas/WSTrustConfiguration'
        custom:
          type: array
          items:
            $ref: '#/components/schemas/CustomInboundProtocolConfiguration'

    InboundProtocolsListResponse:
      type: array
      items:
        $ref: '#/components/schemas/InboundProtocolListItem'

    InboundProtocolListItem:
      type: object
      required:
        - type
        - name
        - self
      properties:
        type:
          type: string
          example: "samlsso"
        name:
          type: string
          example: "SAML2 Inbound"
        self:
          type: string
          example: "/t/carbon.super/api/server/v1/applications/29048810-1447-4ea0-a348-30d15ab65fa3/inbound-protocols/saml"

    ClaimConfiguration:
      type: object
      properties:
        dialect:
          type: string
          enum:
            - CUSTOM
            - LOCAL
          default: LOCAL
        claimMappings:
          type: array
          items:
            $ref: '#/components/schemas/ClaimMappings'
        requestedClaims:
          type: array
          items:
            $ref: '#/components/schemas/RequestedClaimConfiguration'
        subject:
          $ref: '#/components/schemas/SubjectConfig'
        role:
          $ref: '#/components/schemas/RoleConfig'
    SubjectConfig:
      type: object
      properties:
        claim:
          $ref: '#/components/schemas/Claim'
        includeUserDomain:
          type: boolean
          example: false
        includeTenantDomain:
          type: boolean
          example: false
        useMappedLocalSubject:
          type: boolean
          example: false
        mappedLocalSubjectMandatory:
          type: boolean
          example: false
    RoleConfig:
      type: object
      properties:
        mappings:
          type: array
          items:
            $ref: '#/components/schemas/RoleMapping'
        includeUserDomain:
          type: boolean
          example: true
        claim:
          $ref: '#/components/schemas/Claim'
    RoleMapping:
      type: object
      required:
        - localRole
        - applicationRole
      properties:
        localRole:
          type: string
          example: admin
        applicationRole:
          type: string
          example: Administrator
    AssociatedRolesConfig:
      type: object
      required:
        - allowedAudience
      properties:
        allowedAudience:
          type: string
          example: "ORGANIZATION"
          enum:
            - ORGANIZATION
            - APPLICATION
          default: ORGANIZATION
        roles:
          type: array
          items:
            $ref: '#/components/schemas/Role'
    Role:
      type: object
      required:
        - id
      properties:
        id:
          type: string
          example: "bf5abd05-3667-4a2a-a6c2-2fb9f4d26e47"
        name:
          type: string
          example: "RoleA"
    RequestedClaimConfiguration:
      type: object
      required:
        - claim
      description: >-
        User claims that need to be sent back to the application. If the
        claim mappings are local, use local claim URIs. If the custom claim
        mappings are configured, use the mapped application claim URI
      properties:
        claim:
          $ref: '#/components/schemas/Claim'
        mandatory:
          type: boolean
          example: false
    ClaimMappings:
      type: object
      required:
        - applicationClaim
        - localClaim
      properties:
        applicationClaim:
          type: string
          description: "Claim URI recieved by the application"
          example: firstname
        localClaim:
          $ref: '#/components/schemas/Claim'
    Claim:
      type: object
      required:
        - uri
      properties:
        id:
          type: string
          example: aHR0cDovL3dzbzIub3JnL2NsYWltcy91c2VybmFtZQ
          readOnly: true
        uri:
          type: string
          example: 'http://wso2.org/claims/username'
        displayName:
          type: string
          example: Username
          readOnly: true

    SAML2Configuration:
      type: object
      properties:
        metadataFile:
          type: string
          example: 'Base64 encoded metadata file content'
        metadataURL:
          type: string
          example: 'https://example.com/samlsso/meta'
        manualConfiguration:
          $ref: '#/components/schemas/SAML2ServiceProvider'

    SingleSignOnProfile:
      type: object
      properties:
        bindings:
          type: array
          items:
            type: string
            enum:
              - HTTP_POST
              - HTTP_REDIRECT
              - ARTIFACT

        enableSignatureValidationForArtifactBinding:
          type: boolean
          description: Enables Signature validation for SAML Artifact Binding. Applicable only if SAML Artifact binding is enabled through the bindings option.
          default: false

        attributeConsumingServiceIndex:
          type: string
          readOnly: true

        enableIdpInitiatedSingleSignOn:
          type: boolean
          default: false

        assertion:
          $ref: '#/components/schemas/SAMLAssertionConfiguration'

    SAMLAttributeProfile:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
        alwaysIncludeAttributesInResponse:
          type: boolean
          default: false

    SingleLogoutProfile:
      type: object
      properties:
        enabled:
          type: boolean
          default: true
        logoutRequestUrl:
          type: string
          description: Single logout request accepting endpoint
        logoutResponseUrl:
          type: string
          description: Single logout response accepting endpoint
        logoutMethod:
          type: string
          enum:
            - BACKCHANNEL
            - FRONTCHANNEL_HTTP_REDIRECT
            - FRONTCHANNEL_HTTP_POST
        idpInitiatedSingleLogout:
          $ref: '#/components/schemas/IdpInitiatedSingleLogout'

    IdpInitiatedSingleLogout:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
        returnToUrls:
          type: array
          items:
            type: string

    SAMLAssertionConfiguration:
      type: object
      properties:
        nameIdFormat:
          type: string
          default: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
          example: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'

        audiences:
          type: array
          description: Additional audience values to be added to the SAML Assertions
          example:
            - 'https://app.example.com/saml'
          items:
            type: string

        recipients:
          type: array
          description: Additional recipient values to be added to the SAML Assertions
          example:
            - 'https://app.example.com/saml'
          items:
            type: string

        digestAlgorithm:
          type: string
          default: "http://www.w3.org/2000/09/xmldsig#sha1"
          example: "http://www.w3.org/2000/09/xmldsig#sha1"
        encryption:
          $ref: '#/components/schemas/AssertionEncryptionConfiguration'

    AssertionEncryptionConfiguration:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
        assertionEncryptionAlgorithm:
          type: string
          default: "http://www.w3.org/2001/04/xmlenc#aes256-cbc"
        keyEncryptionAlgorithm:
          type: string
          default: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"

    SAMLRequestValidation:
      type: object
      properties:
        enableSignatureValidation:
          type: boolean
          default: true
        signatureValidationCertAlias:
          type: string

    SAMLResponseSigning:
      type: object
      properties:
        enabled:
          type: boolean
          default: true
        signingAlgorithm:
          type: string

    SAML2ServiceProvider:
      type: object
      required:
        - issuer
        - assertionConsumerUrls

      properties:
        issuer:
          type: string
        serviceProviderQualifier:
          type: string
        assertionConsumerUrls:
          type: array
          items:
            type: string
          minItems: 1
        defaultAssertionConsumerUrl:
          type: string
          description: "If not provided, the first assertion consumer URL on the assertionConsumerUrls will be picked as the default assertion consumer URL."
        idpEntityIdAlias:
          type: string
          description: "Default value is the IdP Entity ID value specified in Resident IdP."

        singleSignOnProfile:
          $ref: '#/components/schemas/SingleSignOnProfile'

        attributeProfile:
          $ref: '#/components/schemas/SAMLAttributeProfile'

        singleLogoutProfile:
          $ref: '#/components/schemas/SingleLogoutProfile'

        requestValidation:
          $ref: '#/components/schemas/SAMLRequestValidation'

        responseSigning:
          $ref: '#/components/schemas/SAMLResponseSigning'

        enableAssertionQueryProfile:
          type: boolean
          default: false

    OpenIDConnectConfiguration:
      type: object
      required:
        - grantTypes
      properties:
        clientId:
          type: string
        clientSecret:
          type: string
        state:
          type: string
          enum:
            - ACTIVE
            - REVOKED
          readOnly: true
          default: ACTIVE
        grantTypes:
          type: array
          example:
            - authorization_code
            - password
          items:
            type: string
          minItems: 1
        callbackURLs:
          type: array
          description: Authorized redirect URIs
          example:
            - 'regexp=(https://app.example.com/callback1|https://app.example.com/callback2)'
          items:
            type: string
        allowedOrigins:
          type: array
          description: Authorized JavaScript origins. CORS requests will be allowed to these origins.
          example:
            - 'https://app.example.com'
          items:
            type: string
        publicClient:
          type: boolean
          default: false
          description: >-
            Enabling this option will allow the client to authenticate without a
            client secret.
          example: false
        pkce:
          $ref: '#/components/schemas/OAuth2PKCEConfiguration'
        accessToken:
          $ref: '#/components/schemas/AccessTokenConfiguration'
        hybridFlow:
          $ref: '#/components/schemas/HybridFlowConfiguration'
        refreshToken:
          $ref: '#/components/schemas/RefreshTokenConfiguration'
        subjectToken:
          $ref: '#/components/schemas/SubjectTokenConfiguration'
        idToken:
          $ref: '#/components/schemas/IdTokenConfiguration'
        logout:
          $ref: '#/components/schemas/OIDCLogoutConfiguration'
        validateRequestObjectSignature:
          type: boolean
          default: false
          example: false
        scopeValidators:
          type: array
          example:
            - Role based scope validator
            - XACML Scope Validator
          items:
            type: string
        clientAuthentication:
          $ref: '#/components/schemas/ClientAuthenticationConfiguration'
        requestObject:
          $ref: '#/components/schemas/RequestObjectConfiguration'
        pushAuthorizationRequest:
          $ref: '#/components/schemas/PushAuthorizationRequestConfiguration'
        subject:
          $ref: '#/components/schemas/SubjectConfiguration'
        isFAPIApplication:
          type: boolean
          default: false
          description: Enabling this option will make the application FAPI conformant.
          example: false
    OAuth2PKCEConfiguration:
      type: object
      properties:
        mandatory:
          type: boolean
          example: false
        supportPlainTransformAlgorithm:
          type: boolean
          example: true
    HybridFlowConfiguration:
      type: object
      properties:
        enable:
          type: boolean
          description: "Indicates whether the hybrid flow is enabled."
          example: true
        responseType:
          type: string
          description: "Specifies the allowed response types for the hybrid flow, provided as a comma-separated string. 
          The supported combinations are: 'code token', 'code id_token token', and 'code id_token'."
          example: code id_token,code token
    AccessTokenConfiguration:
      type: object
      properties:
        type:
          type: string
          example: JWT
        userAccessTokenExpiryInSeconds:
          type: integer
          format: int64
          example: 3600
        applicationAccessTokenExpiryInSeconds:
          type: integer
          format: int64
          example: 3600
        bindingType:
          type: string
          description: "OAuth2 access token and refresh token can be bound to an external attribute during the token
          generation so that it can be optionally validated during the API invocation."
          default: "None"
          example: cookie
        revokeTokensWhenIDPSessionTerminated:
          type: boolean
          description: "If enabled, when the IDP session is terminated, all the access tokens bound to the session
          will get revoked."
        validateTokenBinding:
          type: boolean
          description: "If enabled, both access token and the token binding needs to be present for a successful API
          invocation."
        accessTokenAttributes:
          type: array
          items:
            type: string
    RefreshTokenConfiguration:
      type: object
      properties:
        expiryInSeconds:
          type: integer
          format: int64
          example: 86400
        renewRefreshToken:
          description: Decides whether the refresh token needs to be renewed during refresh grant flow.
          type: boolean
          example: true
    SubjectTokenConfiguration:
      type: object
      properties:
        enable:
          type: boolean
          description: "If enabled, subject token can be issued for token exchange grant type."
        applicationSubjectTokenExpiryInSeconds:
          type: integer
          example: 3600
    IdTokenConfiguration:
      type: object
      properties:
        expiryInSeconds:
          type: integer
          format: int64
          example: 3600
        audience:
          type: array
          example:
            - 'http://idp.xyz.com'
            - 'http://idp.abc.com'
          items:
            type: string
        idTokenSignedResponseAlg:
          type: string
          example: 'PS256'
        encryption:
          $ref: '#/components/schemas/IdTokenEncryptionConfiguration'
    IdTokenEncryptionConfiguration:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
          example: false
        algorithm:
          type: string
          example: RSA-OAEP
        method:
          type: string
          example: A128CBC+HS256
    ClientAuthenticationConfiguration:
      type: object
      properties:
        tokenEndpointAuthMethod:
          type: string
          example: 'client_secret_basic'
        tokenEndpointAllowReusePvtKeyJwt:
          type: boolean
          example: false
        tokenEndpointAuthSigningAlg:
          type: string
          example: 'PS256'
        tlsClientAuthSubjectDn:
          type: string
          example: 'CN=John Doe,OU=OrgUnit,O=Organization,L=Colombo,ST=Western,C=LK'
    RequestObjectConfiguration:
      type: object
      properties:
        requestObjectSigningAlg:
          type: string
          example: 'PS256'
        encryption:
          $ref: '#/components/schemas/RequestObjectEncryptionConfiguration'
    RequestObjectEncryptionConfiguration:
      type: object
      properties:
        algorithm:
          type: string
          example: RSA-OAEP
        method:
          type: string
          example: A128CBC+HS256
    PushAuthorizationRequestConfiguration:
      type: object
      properties:
        requirePushAuthorizationRequest:
          type: boolean
          example: false
    SubjectConfiguration:
      type: object
      properties:
        subjectType:
          type: string
          example: 'public'
        sectorIdentifierUri:
          type: string
          example: 'https://app.example.com'
    OIDCLogoutConfiguration:
      type: object
      properties:
        backChannelLogoutUrl:
          type: string
          example: 'https://app.example.com/backchannel/callback'
        frontChannelLogoutUrl:
          type: string
          example: 'https://app.example.com/frontchannel/callback'
    PassiveStsConfiguration:
      type: object
      required:
        - realm
        - replyTo
      properties:
        realm:
          type: string
        replyTo:
          type: string
        replyToLogout:
          type: string
    WSTrustConfiguration:
      type: object
      required:
        - audience
        - certificateAlias
      properties:
        audience:
          type: string
          description: Audience value of the trusted service
          example: https://wstrust.endpoint.com
        certificateAlias:
          type: string
          example: "wso2carbon"
    CustomInboundProtocolConfiguration:
      type: object
      required:
        - name
        - configName
      properties:
        name:
          type: string
          example: cas
        configName:
          type: string
          example: cas
        properties:
          type: array
          items:
            $ref: '#/components/schemas/PropertyModel'
    PropertyModel:
      type: object
      properties:
        key:
          type: string
          example: app-identifier
        value:
          type: string
          example: 'http://app.wso2.com/employeeApp'
        friendlyName:
          type: string
          example: Application Identifier
    AuthenticationSequence:
      type: object
      properties:
        type:
          type: string
          description: "
          - DEFAULT type indicates that the application will use the default authentication sequence specified at the tenant level. When the DEFAULT type is used, the information given in the other fields of the AuthenticationSequence will be ignored and overriden with values defined at the tenant level.

           - USER_DEFINED type indicates that the application will use a user-defined authentication sequence."
          enum:
            - DEFAULT
            - USER_DEFINED
          default: DEFAULT
        steps:
          type: array
          items:
            $ref: '#/components/schemas/AuthenticationStepModel'
        requestPathAuthenticators:
          type: array
          items:
            type: string
        script:
          type: string
        subjectStepId:
          type: integer
          default: 1
          example: 1
        attributeStepId:
          type: integer
          default: 1
          example: 1

    AuthenticationStepModel:
      type: object
      required:
        - id
        - options
      properties:
        id:
          type: integer
          minimum: 1
          example: 1
        options:
          type: array
          items:
            $ref: '#/components/schemas/Authenticator'
          minItems: 1
    Authenticator:
      type: object
      required:
        - idp
        - authenticator
      properties:
        idp:
          type: string
          example: LOCAL
        authenticator:
          type: string
          example: basic

    AuthProtocolMetadata:
      type: object
      properties:
        name:
          type: string
        displayName:
          type: string
    MetadataProperty:
      type: object
      properties:
        options:
          type: array
          items:
            type: string
          example:
            - 'Option 1'
            - 'Option 2'
        defaultValue:
          type: string
          example: 'Option 1'
    ClientAuthenticationMethodMetadata:
      type: object
      properties:
        options:
          type: array
          items:
            $ref: '#/components/schemas/ClientAuthenticationMethod'
    FapiMetadata:
      type: object
      properties:
        allowedSignatureAlgorithms:
          $ref: '#/components/schemas/MetadataProperty'
        allowedEncryptionAlgorithms:
          $ref: '#/components/schemas/MetadataProperty'
        tokenEndpointAuthMethod:
          $ref: '#/components/schemas/ClientAuthenticationMethodMetadata'
    ClientAuthenticationMethod:
      type: object
      properties:
        name:
          type: string
          example: private_key_jwt
        displayName:
          type: string
          example: Private Key JWT
    GrantTypeMetaData:
      type: object
      properties:
        options:
          type: array
          items:
            $ref: '#/components/schemas/GrantType'
    GrantType:
      type: object
      properties:
        name:
          type: string
          example: authorization_code
        displayName:
          type: string
          example: Code
    SAMLMetaData:
      type: object
      properties:
        defaultNameIdFormat:
          type: string
          example: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
        certificateAlias:
          $ref: '#/components/schemas/MetadataProperty'
        responseSigningAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        responseDigestAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        assertionEncryptionAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        keyEncryptionAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
    OIDCMetaData:
      type: object
      properties:
        allowedGrantTypes:
          $ref: '#/components/schemas/GrantTypeMetaData'
        defaultUserAccessTokenExpiryTime:
          type: string
          example: '3600'
        defaultApplicationAccessTokenExpiryTime:
          type: string
          example: '3600'
        defaultRefreshTokenExpiryTime:
          type: string
          example: '86400'
        defaultIdTokenExpiryTime:
          type: string
          example: '3600'
        idTokenEncryptionAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        idTokenEncryptionMethod:
          $ref: '#/components/schemas/MetadataProperty'
        scopeValidators:
          $ref: '#/components/schemas/MetadataProperty'
        accessTokenType:
          $ref: '#/components/schemas/MetadataProperty'
        accessTokenBindingType:
          $ref: '#/components/schemas/MetadataProperty'
        tokenEndpointAuthMethod:
          $ref: '#/components/schemas/ClientAuthenticationMethodMetadata'
        tokenEndpointAllowReusePvtKeyJwt:
          type: boolean
          default: false
        tokenEndpointSignatureAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        idTokenSignatureAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        requestObjectSignatureAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        requestObjectEncryptionAlgorithm:
          $ref: '#/components/schemas/MetadataProperty'
        requestObjectEncryptionMethod:
          $ref: '#/components/schemas/MetadataProperty'
        subjectType:
          $ref: '#/components/schemas/MetadataProperty'
        fapiMetadata:
          $ref: '#/components/schemas/FapiMetadata'
    WSTrustMetaData:
      type: object
      properties:
        certificateAlias:
          $ref: '#/components/schemas/MetadataProperty'
    CustomInboundProtocolMetaData:
      type: object
      properties:
        displayName:
          type: string
          example: 'My Custom Protocol'
        configName:
          type: string
          example: 'Custom Protocol'
        properties:
          type: array
          items:
            $ref: '#/components/schemas/CustomInboundProtocolProperty'
    CustomInboundProtocolProperty:
      type: object
      properties:
        name:
          type: string
          example: 'encryptionAlgorithm'
        displayName:
          type: string
          example: 'Encryption Algorithm'
        type:
          type: string
          enum:
            - STRING
            - BOOLEAN
            - INTEGER
          example: STRING
        required:
          type: boolean
          example: true
        availableValues:
          type: array
          items:
            type: string
            example:
              - 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p'
              - 'http://www.w3.org/2001/04/xmlenc#rsa-1_5'
        defaultValue:
          type: string
          example: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p'
        validationRegex:
          type: string
          example: '^[a-b][A-B]*'
        displayOrder:
          type: integer
          example: 1
        isConfidential:
          type: boolean
          default: false

    AdaptiveAuthTemplates:
      type: object
      properties:
        templatesJSON:
          type: string
          example: 'Adaptive Auth Templates JSON'

    FileUpload:
      type: object
      properties:
        file:
          type: string
          format: binary
          description: file to upload
    ApplicationTemplatesList:
      type: object
      properties:
        templates:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationTemplatesListItem'

    ApplicationTemplatesListItem:
      type: object
      properties:
        id:
          type: string
          example: "85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        name:
          type: string
          example: "OIDC Protocol Template"
        description:
          type: string
          example: "Template to be used for Single Page Applications"
        image:
          type: string
          example: "https://example.com/logo/my-logo.png"
        authenticationProtocol:
          type: string
          example: "oidc"
        types:
          type: array
          items:
            type: string
            example:
              - react
              - angular
        category:
          type: string
          enum: [DEFAULT, VENDOR]
          example: 'DEFAULT'
        displayOrder:
          type: integer
          example: 2
        templateGroup:
          type: string
          example: "web-application"
        self:
          type: string
          example: "/t/wso2.com/api/server/v1/applications/templates/85e3f4b8-0d22-4181-b1e3-1651f71b88bd"

    ApplicationTemplateModel:
      type: object
      properties:
        id:
          type: string
          readOnly: true
          example: "85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
        name:
          type: string
          example: "OIDC Protocol Template"
        description:
          type: string
          example: "Template to be used for Single Page Applications"
        image:
          type: string
          example: "https://example.com/logo/my-logo.png"
        authenticationProtocol:
          type: string
          example: "oidc"
        types:
          type: array
          items:
            type: string
          example:
            - react
            - angular
        category:
          type: string
          enum: [DEFAULT, VENDOR]
          example: 'DEFAULT'
        templateGroup:
          type: string
          example: "web-application"
        displayOrder:
          type: integer
          example: 2
        application:
          $ref: '#/components/schemas/ApplicationModel'
      required:
        - name
        - application
    ApplicationOwner:
      type: object
      properties:
        id:
          type: string
          example: "85e3f4b8-0d22-4181-b1e3-1651f71b88bd"
      required:
        - id

    AuthorizedAPIResponse:
      type: object
      properties:
        id:
          type: string
          example: 012df-232gf-545fg-dff23
        identifier:
          type: string
          example: https://greetings.io/v1/greet
        displayName:
          type: string
          example: Greetings API
        policyId:
          type: string
          example: RBAC
        type:
          type: string
          example: TENANT_ADMIN
        authorizedScopes:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizedScope'
        authorizedAuthorizationDetailsTypes:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizedAuthorizationDetailsTypes'

    AuthorizedScope:
      type: object
      properties:
        id:
          type: string
          example: 012df-232gf-545fg-dff23
        name:
          type: string
          example: bookings:read
        displayName:
          type: string
          example: Read Bookings

    AuthorizedAuthorizationDetailsTypes:
      type: object
      required:
        - type
        - name
      properties:
        id:
          type: string
          example: a9403470-dd11-46b4-8db9-aaa31f1d4423
          description: an unique id of the registered authorization details type
        type:
          type: string
          example: payment_initiation
          description: an unique type of the authorization details type
        name:
          type: string
          minLength: 3
          maxLength: 255
          description: display name of the authorization details type
          example: Payment Initiation

    AuthorizedAPICreationModel:
      type: object
      properties:
        id :
          type: string
          example: 012df-232gf-545fg-dff23
        policyIdentifier:
          type: string
          example: RBAC
        scopes:
          type: array
          items:
            type: string
            example: bookings:read
        authorizationDetailsTypes:
          type: array
          items:
            type: string
            example: payment_initiation

    AuthorizedAPIPatchModel:
      type: object
      properties:
        addedScopes:
          type: array
          items:
            type: string
            example: bookings:edit
        removedScopes:
          type: array
          items:
            type: string
            example: bookings:view
        addedAuthorizationDetailsTypes:
          type: array
          items:
            type: string
            example: payment_initiation
        removedAuthorizationDetailsTypes:
          type: array
          items:
            type: string
            example: account_information

    ApplicationSharePOSTRequest:
      type: object
      properties:
        shareWithAllChildren:
          type: boolean
          default: false
        sharedOrganizations:
          type: array
          items:
            type: string
    SharedOrganizationsResponse:
      type: object
      properties:
        organizations:
          type: array
          items:
            $ref: '#/components/schemas/BasicOrganizationResponse'
    SharedApplicationsResponse:
      type: object
      properties:
        sharedApplications:
          type: array
          items:
            $ref: '#/components/schemas/SharedApplicationResponse'
    SharedApplicationResponse:
      type: object
      properties:
        applicationId:
          type: string
          description: Shared application's id.
          example: 'ca322554-fe79-4c04-9c94-492855ef92a3'
        organizationId:
          type: string
          description: Shared application residing organization id.
          example: '682edf68-4835-4bb8-961f-0a16bc6cc866'
    BasicOrganizationResponse:
      type: object
      required:
        - id
        - name
        - status
        - ref
      properties:
        id:
          type: string
          example: 'b4526d91-a8bf-43d2-8b14-c548cf73065b'
        name:
          type: string
          example: 'ABC Builders'
        status:
          type: string
          enum: [ ACTIVE, DISABLED ]
          example: ACTIVE
        ref:
          type: string
          example: '/t/wso2.com/api/server/v1/organizations/b4526d91-a8bf-43d2-8b14-c548cf73065b'
    LoginFlowGenerateRequest:
      type: object
      properties:
        available_authenticators:
          type: object
          additionalProperties: true
          description: |
            Available authenticators of the organization.
            It's expected to provide the authenticator name, description, and the IDP.
        user_claims:
          type: array
          items:
            type: object
            additionalProperties: true
          description: |
            Metadata of the available user claims for the organization. 
            Provide the claim URI and a human-readable description of the claim.
        user_query:
          type: string
      example: {
        "available_authenticators": {
          "local": [
            {
              "description": "Login users with username and password credentials.",
              "idp": "LOCAL",
              "name": "BasicAuthenticator"
            },
            {
              "description": "Two-factor authentication using SMS one-time passcode.",
              "idp": "LOCAL",
              "name": "sms-otp-authenticator"
            }
          ],
          "social": [
            {
              "description": "Login users with existing Google accounts.",
              "idp": "Google",
              "name": "GoogleOIDCAuthenticator"
            }
          ]
        },
        "user_claims": [
          {
            "claimURI": "http://example.com/claims/email",
            "description": "Email address of the user."
          },
          {
            "claimURI": "http://example.com/claims/role",
            "description": "Role of the user in the application."
          }
        ],
        "user_query": "GoogleOIDCAuthenticator followed by SMS-OTP if user has admin role."
      }
    LoginFlowGenerateResponse:
      type: object
      properties:
        operation_id:
          type: string
    StatusEnum:
      type: string
      enum:
        - IN_PROGRESS
        - COMPLETED
        - FAILED
    LoginFlowStatusResponse:
      type: object
      properties:
        operation_id:
          type: string
        status:
          type: object
          description: A generic object representing the status
          example: {
            "retrieving_examples": true,
            "optimization_and_validation_complete": true,
            "login_flow_generation_complete": false,
            "optimizing_and_validating_user_query": true,
            "generating_authentication_sequence": true,
            "retrieval_of_examples_complete": true,
            "optimizing_and_validating_final_login_flow": false,
            "generation_of_authentication_sequence_complete": true
          }
    LoginFlowResultResponse:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/StatusEnum'
        data:
          type: object
          description: |
            The payload of the response, which varies based on the operation status.
            - For IN_PROGRESS status, an empty JSON object is returned.
            - For COMPLETED status, the authentication sequence is returned.
            - For FAILED status, an error message is returned.
    Error:
      type: object
      properties:
        code:
          type: string
          example: AAA-00000
        message:
          type: string
          example: Some error message.
        description:
          type: string
          example: Some error description.
        traceId:
          type: string
          example: e0fbcfeb-3617-43c4-8dd0-7b7d38e13047

servers:
  - url: 'https://{server-url}/t/{tenant-domain}/api/server/v1'
    variables:
      tenant-domain:
        default: "carbon.super"
      server-url:
        default: "localhost:9443"
