{
  "openapi": "3.1.0",
  "info": {
    "title": "YeboID OAuth integration contract",
    "version": "2026-10-24",
    "description": "OAuth endpoints for agents and standard clients. Includes the public scope catalog and client registration preflight verified in production on 2026-10-24. No client-credentials or device-code grant. API authorization must check audience, type: access and actual scopes; generated wire clients alone do not provide authorization.",
    "license": {
      "name": "MIT",
      "identifier": "MIT"
    }
  },
  "servers": [
    {
      "url": "https://api.yeboid.com"
    }
  ],
  "paths": {
    "/.well-known/openid-configuration": {
      "get": {
        "operationId": "getDiscovery",
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "issuer": {
                      "type": "string",
                      "format": "uri"
                    },
                    "authorization_endpoint": {
                      "type": "string",
                      "format": "uri"
                    },
                    "token_endpoint": {
                      "type": "string",
                      "format": "uri"
                    },
                    "userinfo_endpoint": {
                      "type": "string",
                      "format": "uri"
                    },
                    "jwks_uri": {
                      "type": "string",
                      "format": "uri"
                    },
                    "scopes_supported": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "code_challenge_methods_supported": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    }
                  },
                  "required": [
                    "issuer",
                    "authorization_endpoint",
                    "token_endpoint"
                  ]
                }
              }
            }
          },
          "429": {
            "description": "Request rate limit exceeded; respect Retry-After."
          }
        },
        "summary": "Read OpenID Connect discovery"
      }
    },
    "/.well-known/jwks.json": {
      "get": {
        "operationId": "getJWKS",
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "keys": {
                      "type": "array",
                      "items": {
                        "type": "object"
                      }
                    }
                  },
                  "required": [
                    "keys"
                  ]
                }
              }
            }
          },
          "429": {
            "description": "Request rate limit exceeded; respect Retry-After."
          }
        },
        "summary": "Read public signing keys"
      }
    },
    "/oauth/token": {
      "post": {
        "operationId": "exchangeToken",
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "oneOf": [
                  {
                    "$ref": "#/components/schemas/AuthorizationCodeRequest"
                  },
                  {
                    "$ref": "#/components/schemas/RefreshTokenRequest"
                  },
                  {
                    "$ref": "#/components/schemas/BusinessExchangeRequest"
                  }
                ]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenResponse"
                }
              }
            }
          },
          "400": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "401": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "403": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "429": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "500": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "503": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          }
        },
        "summary": "Exchange a code, rotate a refresh token or select business context"
      }
    },
    "/oauth/userinfo": {
      "get": {
        "operationId": "getUserInfo",
        "security": [
          {
            "accessToken": []
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserInfo"
                }
              }
            }
          },
          "400": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "401": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "403": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "429": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "500": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "503": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          }
        },
        "summary": "Read the consenting user profile"
      }
    },
    "/oauth/introspect": {
      "post": {
        "operationId": "introspectToken",
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "client_id": {
                    "type": "string",
                    "minLength": 1
                  },
                  "client_secret": {
                    "type": "string",
                    "writeOnly": true,
                    "description": "Confidential servers only. Omit for public PKCE clients."
                  },
                  "token": {
                    "type": "string",
                    "writeOnly": true
                  },
                  "token_type_hint": {
                    "enum": [
                      "access_token",
                      "refresh_token"
                    ]
                  }
                },
                "required": [
                  "client_id",
                  "token"
                ]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Introspection"
                }
              }
            }
          },
          "400": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "401": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "403": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "429": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "500": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "503": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          }
        },
        "summary": "Read current token validity and granted scopes"
      }
    },
    "/oauth/revoke": {
      "post": {
        "operationId": "revokeToken",
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "client_id": {
                    "type": "string",
                    "minLength": 1
                  },
                  "client_secret": {
                    "type": "string",
                    "writeOnly": true,
                    "description": "Confidential servers only. Omit for public PKCE clients."
                  },
                  "token": {
                    "type": "string",
                    "writeOnly": true
                  },
                  "token_type_hint": {
                    "enum": [
                      "access_token",
                      "refresh_token"
                    ]
                  }
                },
                "required": [
                  "client_id",
                  "token"
                ]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Revocation accepted. Unknown/other-client tokens also return 200. Prefer revoking refresh tokens; offline access JWT validation lasts until expiry."
          },
          "400": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "401": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "403": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "429": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "500": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          },
          "503": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          }
        },
        "summary": "Revoke this app refresh token"
      }
    },
    "/oauth/authorize": {
      "get": {
        "operationId": "authorizeInBrowser",
        "servers": [
          {
            "url": "https://yeboid.com"
          }
        ],
        "description": "Navigate the system browser here; do not call as a JSON API. The hosted UI handles human sign-in and consent. Validate state and the exact callback before exchanging the code.",
        "parameters": [
          {
            "name": "response_type",
            "in": "query",
            "required": true,
            "schema": {
              "const": "code"
            }
          },
          {
            "name": "client_id",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "redirect_uri",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uri"
            }
          },
          {
            "name": "scope",
            "in": "query",
            "required": false,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "state",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "code_challenge",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "minLength": 43,
              "maxLength": 128
            }
          },
          {
            "name": "code_challenge_method",
            "in": "query",
            "required": true,
            "schema": {
              "const": "S256"
            }
          },
          {
            "name": "nonce",
            "in": "query",
            "required": false,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "prompt",
            "in": "query",
            "required": false,
            "schema": {
              "enum": [
                "none",
                "login",
                "consent"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Hosted login/consent HTML"
          },
          "302": {
            "description": "Redirect to exact registered callback with code/state or error/state"
          },
          "429": {
            "description": "Request rate limit exceeded; respect Retry-After."
          }
        },
        "summary": "Open hosted sign-in in the system browser"
      }
    },
    "/oauth/scopes": {
      "get": {
        "operationId": "getScopeCatalog",
        "responses": {
          "200": {
            "description": "Supported scopes, default scopes and presets",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "default_scopes",
                    "scopes",
                    "presets"
                  ],
                  "properties": {
                    "default_scopes": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "scopes": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "required": [
                          "scope",
                          "name",
                          "description",
                          "sensitive"
                        ],
                        "properties": {
                          "scope": {
                            "type": "string"
                          },
                          "name": {
                            "type": "string"
                          },
                          "description": {
                            "type": "string"
                          },
                          "sensitive": {
                            "type": "boolean"
                          }
                        }
                      }
                    },
                    "presets": {
                      "type": "object",
                      "additionalProperties": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "429": {
            "description": "Request rate limit exceeded; respect Retry-After."
          }
        },
        "summary": "Read supported scopes and presets"
      }
    },
    "/oauth/clients/{clientId}/configuration": {
      "get": {
        "operationId": "getClientConfiguration",
        "parameters": [
          {
            "name": "clientId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Public registration data; no secret or owner identity",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "client_id",
                    "name",
                    "redirect_uris",
                    "scopes",
                    "default_scopes",
                    "setup_url"
                  ],
                  "properties": {
                    "client_id": {
                      "type": "string"
                    },
                    "name": {
                      "type": "string"
                    },
                    "redirect_uris": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "scopes": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "default_scopes": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "setup_url": {
                      "type": "string",
                      "format": "uri"
                    },
                    "production_enabled": {
                      "type": "boolean"
                    }
                  }
                }
              }
            }
          },
          "404": {
            "description": "Unknown, disabled or deleted client. Treat this as a failed preflight."
          }
        },
        "summary": "Check a public app registration"
      }
    }
  },
  "components": {
    "securitySchemes": {
      "accessToken": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "Access token only; ID tokens and refresh tokens cannot authorize API calls."
      }
    },
    "schemas": {
      "AuthorizationCodeRequest": {
        "type": "object",
        "properties": {
          "client_id": {
            "type": "string",
            "minLength": 1
          },
          "client_secret": {
            "type": "string",
            "writeOnly": true,
            "description": "Confidential servers only. Omit for public PKCE clients."
          },
          "grant_type": {
            "const": "authorization_code"
          },
          "code": {
            "type": "string",
            "writeOnly": true
          },
          "redirect_uri": {
            "type": "string",
            "format": "uri"
          },
          "code_verifier": {
            "type": "string",
            "minLength": 43,
            "maxLength": 128,
            "writeOnly": true
          }
        },
        "required": [
          "grant_type",
          "client_id",
          "code",
          "redirect_uri",
          "code_verifier"
        ]
      },
      "RefreshTokenRequest": {
        "type": "object",
        "properties": {
          "client_id": {
            "type": "string",
            "minLength": 1
          },
          "client_secret": {
            "type": "string",
            "writeOnly": true,
            "description": "Confidential servers only. Omit for public PKCE clients."
          },
          "grant_type": {
            "const": "refresh_token"
          },
          "refresh_token": {
            "type": "string",
            "writeOnly": true
          },
          "scope": {
            "type": "string",
            "description": "Optional narrowing only; refresh cannot add consent."
          }
        },
        "required": [
          "grant_type",
          "client_id",
          "refresh_token"
        ]
      },
      "BusinessExchangeRequest": {
        "type": "object",
        "properties": {
          "client_id": {
            "type": "string",
            "minLength": 1
          },
          "client_secret": {
            "type": "string",
            "writeOnly": true,
            "description": "Confidential servers only. Omit for public PKCE clients."
          },
          "grant_type": {
            "const": "urn:ietf:params:oauth:grant-type:token-exchange"
          },
          "subject_token": {
            "type": "string",
            "writeOnly": true
          },
          "business_id": {
            "type": "string"
          },
          "scope": {
            "type": "string"
          }
        },
        "required": [
          "grant_type",
          "client_id",
          "subject_token",
          "business_id"
        ]
      },
      "TokenResponse": {
        "type": "object",
        "properties": {
          "access_token": {
            "type": "string",
            "x-sensitive": true
          },
          "refresh_token": {
            "type": "string",
            "x-sensitive": true
          },
          "id_token": {
            "type": "string",
            "description": "Not an API credential.",
            "x-sensitive": true
          },
          "token_type": {
            "const": "Bearer"
          },
          "expires_in": {
            "type": "integer",
            "minimum": 1
          },
          "scope": {
            "type": "string"
          },
          "issued_token_type": {
            "type": "string"
          }
        },
        "required": [
          "access_token",
          "token_type",
          "expires_in",
          "scope"
        ]
      },
      "Introspection": {
        "type": "object",
        "properties": {
          "active": {
            "type": "boolean"
          },
          "client_id": {
            "type": "string"
          },
          "sub": {
            "type": "string"
          },
          "token_type": {
            "type": "string",
            "description": "Bearer for access tokens; absent for refresh tokens. Reject refresh tokens on APIs."
          },
          "exp": {
            "type": "integer"
          },
          "iat": {
            "type": "integer"
          },
          "scope": {
            "type": "string",
            "description": "Space-separated actual grants."
          },
          "username": {
            "type": "string"
          },
          "business_id": {
            "type": "string"
          },
          "business_role": {
            "type": "string"
          }
        },
        "required": [
          "active"
        ]
      },
      "UserInfo": {
        "type": "object",
        "properties": {
          "sub": {
            "type": "string"
          },
          "preferred_username": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "picture": {
            "type": "string",
            "format": "uri"
          },
          "phone_number": {
            "type": "string"
          },
          "phone_number_verified": {
            "type": "boolean"
          },
          "email": {
            "type": "string"
          },
          "email_verified": {
            "type": "boolean"
          },
          "kyc_status": {
            "type": "string"
          },
          "country": {
            "type": "string"
          },
          "currency": {
            "type": "string"
          },
          "currency_symbol": {
            "type": "string"
          },
          "businesses": {
            "type": "array",
            "items": {
              "type": "object"
            }
          },
          "business": {
            "type": "object"
          }
        },
        "required": [
          "sub"
        ]
      },
      "OAuthError": {
        "type": "object",
        "properties": {
          "error": {
            "type": "string"
          },
          "error_description": {
            "type": "string"
          }
        },
        "required": [
          "error"
        ]
      }
    }
  },
  "security": []
}