openapi: 3.0.1 info: title: Evolution Foundation - Auth Service - Access Tokens description: Authentication and user and account management version: v1.0.0 servers: - url: https://api.evoai.app description: Production server - url: http://localhost:3001 description: Development server variables: port: default: '3001' - url: '{customUrl}' description: Custom server variables: customUrl: default: https://your-instance.com description: Enter your server URL paths: /api/v1/access_tokens: get: summary: List access tokens (account-scoped) description: List access tokens for current account (uses account-id header) operationId: listAccountScopedAccessTokens security: - ApiAccessTokenAuth: [] parameters: - name: account-id in: header description: Account ID schema: type: string format: uuid - name: page in: query schema: type: integer - name: per_page in: query schema: type: integer responses: '200': description: Access tokens retrieved successfully content: application/json: schema: type: object properties: success: type: boolean example: true data: type: array items: $ref: '#/components/schemas/AccessToken' meta: type: object properties: timestamp: type: string format: date-time pagination: type: object properties: page: type: integer pageSize: type: integer total: type: integer totalPages: type: integer hasNextPage: type: boolean hasPreviousPage: type: boolean message: type: string '400': description: Bad Request (invalid data) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: account_id_required: summary: Account ID is required value: success: false error: code: VALIDATION_ERROR message: Account ID is required (provide account-id header or account_id in URL) meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens method: GET '401': description: Unauthorized (invalid or missing token) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalid_token: summary: Invalid or missing token value: success: false error: code: INVALID_TOKEN message: Invalid token meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens method: GET '403': description: Forbidden (insufficient permissions) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: forbidden: summary: Insufficient permissions value: success: false error: code: FORBIDDEN message: You are not authorized to perform this action details: action: access_tokens.read record: AccessToken meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens method: GET '500': description: Internal Server Error (erro interno do servidor) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal_error: summary: Internal server error value: success: false error: code: INTERNAL_ERROR message: An unexpected error occurred meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens method: GET post: summary: Create access token description: Create a new access token for current account (uses account-id header) operationId: createAccessToken security: - ApiAccessTokenAuth: [] parameters: - name: account-id in: header description: Account ID schema: type: string format: uuid responses: '201': description: Access token created successfully content: application/json: schema: type: object properties: success: type: boolean example: true data: type: object properties: access_token: $ref: '#/components/schemas/AccessToken' meta: type: object properties: timestamp: type: string format: date-time message: type: string '400': description: Bad Request (invalid data) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: account_id_required: summary: Account ID is required value: success: false error: code: VALIDATION_ERROR message: Account ID is required (provide account-id header or account_id in URL) meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens method: POST '401': description: Unauthorized (invalid or missing token) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalid_token: summary: Invalid or missing token value: success: false error: code: INVALID_TOKEN message: Invalid token meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens method: POST '403': description: Forbidden (insufficient permissions) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: forbidden: summary: Insufficient permissions value: success: false error: code: FORBIDDEN message: You are not authorized to perform this action details: action: access_tokens.create record: AccessToken meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens method: POST '422': description: Unprocessable Entity (validation error) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: validation_error: summary: Validation failed value: success: false error: code: VALIDATION_ERROR message: Validation failed details: - Name is required - Scopes is invalid meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens method: POST '500': description: Internal Server Error (erro interno do servidor) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal_error: summary: Internal server error value: success: false error: code: INTERNAL_ERROR message: An unexpected error occurred meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens method: POST requestBody: required: true content: application/json: schema: type: object properties: access_token: type: object properties: name: type: string scopes: type: string issued_id: type: string format: uuid required: - access_token /api/v1/access_tokens/{id}: parameters: - name: account_id in: path description: Account ID required: true schema: type: string format: uuid - name: id in: path description: Access Token ID required: true schema: type: string format: uuid get: summary: Get access token description: Get details of an access token operationId: getAccessToken security: - ApiAccessTokenAuth: [] responses: '200': description: Access token retrieved successfully content: application/json: schema: type: object properties: success: type: boolean example: true data: type: object properties: access_token: $ref: '#/components/schemas/AccessToken' meta: type: object properties: timestamp: type: string format: date-time message: type: string '400': description: Bad Request (invalid data) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: account_id_required: summary: Account ID is required value: success: false error: code: VALIDATION_ERROR message: Account ID is required (provide account-id header or account_id in URL) meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: GET '401': description: Unauthorized (invalid or missing token) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalid_token: summary: Invalid or missing token value: success: false error: code: INVALID_TOKEN message: Invalid token meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: GET '403': description: Forbidden (insufficient permissions) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: forbidden: summary: Insufficient permissions value: success: false error: code: FORBIDDEN message: You are not authorized to perform this action details: action: access_tokens.read record: AccessToken meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: GET '404': description: Not Found (access token not found) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: access_token_not_found: summary: Access token not found value: success: false error: code: RESOURCE_NOT_FOUND message: Access token not found meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: GET '500': description: Internal Server Error (erro interno do servidor) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal_error: summary: Internal server error value: success: false error: code: INTERNAL_ERROR message: An unexpected error occurred meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: GET patch: summary: Update access token description: Update an access token operationId: updateAccessToken security: - ApiAccessTokenAuth: [] responses: '200': description: Access token updated successfully content: application/json: schema: type: object properties: success: type: boolean example: true data: type: object properties: access_token: $ref: '#/components/schemas/AccessToken' meta: type: object properties: timestamp: type: string format: date-time message: type: string '400': description: Bad Request (invalid data) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: account_id_required: summary: Account ID is required value: success: false error: code: VALIDATION_ERROR message: Account ID is required (provide account-id header or account_id in URL) meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: PATCH '401': description: Unauthorized (invalid or missing token) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalid_token: summary: Invalid or missing token value: success: false error: code: INVALID_TOKEN message: Invalid token meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: PATCH '403': description: Forbidden (insufficient permissions) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: forbidden: summary: Insufficient permissions value: success: false error: code: FORBIDDEN message: You are not authorized to perform this action details: action: access_tokens.update record: AccessToken meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: PATCH '404': description: Not Found (access token not found) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: access_token_not_found: summary: Access token not found value: success: false error: code: RESOURCE_NOT_FOUND message: Access token not found meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: PATCH '422': description: Unprocessable Entity (validation error) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: validation_error: summary: Validation failed value: success: false error: code: VALIDATION_ERROR message: Validation failed details: - Name is required - Scopes is invalid meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: PATCH '500': description: Internal Server Error (erro interno do servidor) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal_error: summary: Internal server error value: success: false error: code: INTERNAL_ERROR message: An unexpected error occurred meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: PATCH requestBody: required: true content: application/json: schema: type: object properties: access_token: type: object properties: name: type: string scopes: type: string delete: summary: Delete access token description: Delete an access token operationId: deleteAccessToken security: - ApiAccessTokenAuth: [] responses: '200': description: Access token deleted successfully content: application/json: schema: type: object properties: success: type: boolean example: true data: type: object meta: type: object properties: timestamp: type: string format: date-time message: type: string example: success: true data: {} meta: timestamp: '2024-01-15T10:30:00Z' message: Access token deleted successfully '400': description: Bad Request (invalid data) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: account_id_required: summary: Account ID is required value: success: false error: code: VALIDATION_ERROR message: Account ID is required (provide account-id header or account_id in URL) meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: DELETE '401': description: Unauthorized (invalid or missing token) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalid_token: summary: Invalid or missing token value: success: false error: code: INVALID_TOKEN message: Invalid token meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: DELETE '403': description: Forbidden (insufficient permissions) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: forbidden: summary: Insufficient permissions value: success: false error: code: FORBIDDEN message: You are not authorized to perform this action details: action: access_tokens.delete record: AccessToken meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: DELETE '404': description: Not Found (access token not found) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: access_token_not_found: summary: Access token not found value: success: false error: code: RESOURCE_NOT_FOUND message: Access token not found meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: DELETE '500': description: Internal Server Error (erro interno do servidor) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal_error: summary: Internal server error value: success: false error: code: INTERNAL_ERROR message: An unexpected error occurred meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id} method: DELETE /api/v1/access_tokens/{id}/update_token: parameters: - name: account_id in: path description: Account ID required: true schema: type: string format: uuid - name: id in: path description: Access Token ID required: true schema: type: string format: uuid post: summary: Regenerate access token description: Regenerate the token value for an access token operationId: regenerateAccessToken security: - ApiAccessTokenAuth: [] responses: '200': description: Token regenerated successfully content: application/json: schema: type: object properties: success: type: boolean example: true data: type: object properties: access_token: $ref: '#/components/schemas/AccessToken' meta: type: object properties: timestamp: type: string format: date-time message: type: string '400': description: Bad Request (invalid data) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: account_id_required: summary: Account ID is required value: success: false error: code: VALIDATION_ERROR message: Account ID is required (provide account-id header or account_id in URL) meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id}/update_token method: POST '401': description: Unauthorized (invalid or missing token) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalid_token: summary: Invalid or missing token value: success: false error: code: INVALID_TOKEN message: Invalid token meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id}/update_token method: POST '403': description: Forbidden (insufficient permissions) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: forbidden: summary: Insufficient permissions value: success: false error: code: FORBIDDEN message: You are not authorized to perform this action details: action: access_tokens.update_token record: AccessToken meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id}/update_token method: POST '404': description: Not Found (access token not found) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: access_token_not_found: summary: Access token not found value: success: false error: code: RESOURCE_NOT_FOUND message: Access token not found meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id}/update_token method: POST '422': description: Unprocessable Entity (validation error) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: validation_error: summary: Validation failed value: success: false error: code: VALIDATION_ERROR message: Validation failed details: - Error details meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id}/update_token method: POST '500': description: Internal Server Error (erro interno do servidor) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal_error: summary: Internal server error value: success: false error: code: INTERNAL_ERROR message: An unexpected error occurred meta: timestamp: '2024-01-15T10:30:00Z' path: /api/v1/access_tokens/{id}/update_token method: POST components: schemas: AccessToken: type: object properties: id: type: string format: uuid name: type: string token: type: string scopes: type: string owner_type: type: string owner_id: type: string format: uuid owner_name: type: string issued_id: type: string format: uuid nullable: true issued_by: type: object nullable: true properties: id: type: string format: uuid email: type: string name: type: string created_at: type: string format: date-time updated_at: type: string format: date-time ErrorResponse: type: object required: - success - error - meta properties: success: type: boolean example: false error: type: object required: - code - message properties: code: type: string example: VALIDATION_ERROR message: type: string example: Validation failed details: type: object additionalProperties: true nullable: true meta: type: object required: - timestamp - path - method properties: timestamp: type: string format: date-time example: '2024-01-15T10:30:00Z' path: type: string example: /api/v1/super_admin/accounts/123 method: type: string example: POST securitySchemes: DeviseTokenAuth: type: apiKey in: header name: access-token description: Devise Token Auth - requires access-token, client, and uid headers BearerAuth: type: http scheme: bearer bearerFormat: JWT SuperAdminAuth: type: apiKey in: header name: api_access_token description: Super Admin authentication token ApiAccessTokenAuth: type: apiKey in: header name: api_access_token description: API access token authentication