swagger: "2.0"
schemes:
  - https
host: api.nextauth.com
basePath: /
info:
  contact:
    x-twitter: nauthsec
  description: API for the nextAuth server
  title: nextAuth API
  version: "2.2"
  x-apisguru-categories:
    - security
  x-logo:
    url: https://twitter.com/nauthsec/profile_image?size=original
  x-origin:
    - format: swagger
      url: https://api.docs.nextauth.com/api/swagger.json
      version: "2.0"
  x-providerName: n-auth.com
produces:
  - application/json
securityDefinitions:
  api_key:
    description: API Key for a specific (virtual) server.
    in: header
    name: X-apikey
    type: apiKey
  role_id:
    description: ID of the role you want to impersonate (requires that the role associated with the API key passed in the header above has global 'root' or global 'setrid' permissions).
    in: header
    name: X-su
    type: apiKey
security:
  - api_key: []
  - api_key: []
    role_id: []
tags:
  - description: Basic calls that provide you with all the necessary HTML to include into your webpage for logging in (sessions), enrolling new users (registration) and logging out (sessions).
    name: HTML
  - description: Everything about session management and login.
    name: Sessions
  - description: Enrolling new users or coupling an exising account to a user.
    name: Registration
  - description: Everything about users.
    externalDocs:
      url: https://doc.nextauth.com/introduction/concepts.html#users
    name: Users
  - description: Everything about accounts (app instances).
    externalDocs:
      url: https://doc.nextauth.com/introduction/concepts.html#accounts
    name: Accounts
  - description: Everything about transactions.
    name: Transactions
  - description: Everything about your servers.
    externalDocs:
      url: https://doc.nextauth.com/introduction/concepts.html#servers
    name: Servers
  - description: "Everything for managing the access and authorisations to the servers themselves: permissions, roles and apikeys."
    name: Management
  - description: "Everything about global and privileged server attributes. Required permission: global 'servers'."
    name: Global
paths:
  /apikeys/:
    get:
      description: "Get all API keys generated by the current role. Required permission: global 'servers'."
      operationId: getApiKeys
      responses:
        "200":
          description: List of apikeys (with role and description)
          schema:
            $ref: "#/definitions/ApiKeys"
      summary: Get all API keys.
      tags:
        - Management
    post:
      description: "Create a new API key. Required permission: global 'servers'."
      operationId: createApiKey
      parameters:
        - description: Description for the new role
          in: query
          name: description
          required: true
          type: string
      responses:
        "200":
          description: Newly created apikey (with role and description)
          schema:
            $ref: "#/definitions/ApiKey"
      summary: Create a new API key.
      tags:
        - Management
  /attributes/:
    delete:
      description: "Delete all global attributes. Required permission: global 'servers'."
      operationId: deleteGlobalAttributes
      responses:
        "200":
          description: On successful delete
      summary: Delete all global attributes
      tags:
        - Global
    get:
      description: "Returns an array containing all global attributes. Required permission: global 'servers'."
      operationId: getGlobalAttributes
      produces:
        - text/plain
      responses:
        "200":
          description: Array of attributes
          schema:
            type: string
      summary: Get all global attributes
      tags:
        - Global
    post:
      description: "Set the global attributes. Prior attributes with keys that are not provided in the body of the request will be deleted. Required permission: global 'servers'."
      operationId: setGlobalAttributes
      parameters:
        - description: Array of attributes
          in: body
          name: attributes
          required: true
          schema:
            type: object
      responses:
        "200":
          description: OK
      summary: Set all global attributes
      tags:
        - Global
    put:
      description: "Update the specified global attributes. Prior attributes with keys that are not provided in the body of the request will not be deleted. Required permission: 'servers'."
      operationId: updateGlobalAttributes
      parameters:
        - description: Array of attributes
          in: body
          name: attributes
          required: true
          schema:
            type: object
      responses:
        "200":
          description: On successful update
      summary: Update specified global attributes
      tags:
        - Global
  "/attributes/{attributekey}":
    delete:
      description: "Delete global attribute with the specified key. Required: global 'servers'."
      operationId: deleteGlobalAttribute
      parameters:
        - description: Key of the attribute
          in: path
          name: attributekey
          required: true
          type: string
      responses:
        "200":
          description: On successful delete
      summary: Delete specific global attribute
      tags:
        - Global
  /servers/:
    get:
      consumes:
        - application/json
      description: "List all the servers you have the permissions for. Required permission: 'servers'."
      operationId: getServers
      parameters:
        - description: Limit the number of results
          in: query
          name: limit
          type: integer
        - description: Offset in the result list
          in: query
          name: marker
          type: integer
      produces:
        - application/json
      responses:
        "200":
          description: List of servers
          schema:
            $ref: "#/definitions/Servers"
      summary: List all your servers
      tags:
        - Servers
    post:
      consumes:
        - application/json
      description: "Create a new server. Required permission: global 'createserver'."
      operationId: createServer
      parameters:
        - description: Server data (note that serverid, serverpk and validtime are generated by the server)
          in: body
          name: createServerBody
          required: true
          schema:
            $ref: "#/definitions/Server"
      produces:
        - application/octet-stream
      responses:
        "200":
          description: Server config for newly created server
          schema:
            $ref: "#/definitions/Server"
      summary: Create a new server
      tags:
        - Servers
  "/servers/{serverid}/":
    get:
      description: "Returns the configuration of a specific server. Required permission: 'servers' or 'createserver'."
      operationId: getServer
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
      responses:
        "200":
          description: Server config
          schema:
            $ref: "#/definitions/Server"
        "404":
          description: Server not found
      summary: Configuration of a specific server
      tags:
        - Servers
    put:
      consumes:
        - application/json
      description: "Update the configuration of a specific server. Required permission: 'createserver'."
      operationId: updateServer
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Server data (note that serverid and serverpk cannot be changed)
          in: body
          name: server
          required: true
          schema:
            $ref: "#/definitions/Server"
      responses:
        "200":
          description: Server config
          schema:
            $ref: "#/definitions/Server"
        "404":
          description: Server not found
      summary: Update configuration of a specific server
      tags:
        - Servers
  "/servers/{serverid}/accounts/":
    get:
      description: Returns all account. Required permission 'accounts'.
      operationId: getAllAccounts
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Filter users based on an attribute. Takes the format *attributename=attributevalue*. You can filter for multiple values at once, e.g. *group=in:group1,group2*
          in: query
          name: filter
          type: string
        - description: Limit the number of results
          in: query
          name: limit
          type: integer
        - description: Offset in the result list
          in: query
          name: marker
          type: integer
        - description: Sort the results by column. You can also specify ascending (default if not specified) or descending, e.g., *column:asc* . You can also sort by multiple columns, e.g., *column1:desc,column2:asc*
          in: query
          name: sort
          type: string
      responses:
        "200":
          description: Array of accounts
          schema:
            $ref: "#/definitions/Accounts"
      summary: Get all accounts
      tags:
        - Accounts
  "/servers/{serverid}/accounts/{accountid}/":
    delete:
      description: "Delete an account. Required permission: 'accounts'."
      operationId: deleteAccount
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Account id
          in: path
          name: accountid
          required: true
          type: integer
      responses:
        "200":
          description: On successful delete
        "404":
          description: Account not found
      summary: Delete specific account
      tags:
        - Accounts
    get:
      description: "Returns the account. Required permission: 'sessions' or 'accounts'."
      operationId: getAccount
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Account id
          in: path
          name: accountid
          required: true
          type: integer
      responses:
        "200":
          description: Account
          schema:
            $ref: "#/definitions/Account"
        "404":
          description: Account not found
      summary: Get specific account
      tags:
        - Accounts
    put:
      description: |
        Update an account. The only available change is (un)blocking the account. Required permission: 'accounts'.
      operationId: updateAccount
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Account id
          in: path
          name: accountid
          required: true
          type: integer
        - description: True if the account is blocked
          in: query
          name: blocked
          required: true
          type: boolean
      responses:
        "200":
          description: Account after update
          schema:
            $ref: "#/definitions/Account"
        "404":
          description: Account not found
      summary: Update specific account
      tags:
        - Accounts
  "/servers/{serverid}/accounts/{accountid}/provokelogin":
    post:
      description: "Push a login to the nextAuth app for the user to confirm, based on the given account (app instance). Required permission: 'sessions' or 'accounts'."
      operationId: provokeLoginOnAccount
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Base64 encoded nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - description: Account id
          in: path
          name: accountid
          required: true
          type: integer
        - description: Session information to display to user
          in: body
          name: userContext
          required: false
          schema:
            $ref: "#/definitions/UserContext"
      responses:
        "200":
          description: OK
      summary: Push a login confirmation to the user's app
      tags:
        - Sessions
  "/servers/{serverid}/accounts/{accountid}/user":
    put:
      description: "Update the user of the given account. Required permission: 'accounts'."
      operationId: updateAccountUser
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Account id
          in: path
          name: accountid
          required: true
          type: integer
        - description: User name
          in: query
          name: userid
          required: true
          type: string
      responses:
        "200":
          description: Account after update
          schema:
            $ref: "#/definitions/Account"
        "403":
          description: Invalid user name
        "404":
          description: Account not found
      summary: Update user of the given account.
      tags:
        - Accounts
        - Registration
  "/servers/{serverid}/attributes/":
    delete:
      description: "Delete all attributes of a specific server. Required permission: 'servers'."
      operationId: deleteServerAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
      responses:
        "200":
          description: On successful delete
        "404":
          description: User not found
      summary: Delete all attributes of a specific server
      tags:
        - Servers
    get:
      description: "Returns an array containing all attributes corresponding to this server. Required permission: 'servers'."
      operationId: getServerAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
      produces:
        - text/plain
      responses:
        "200":
          description: Array of attributes
          schema:
            type: string
        "404":
          description: Server not found
      summary: Get all attributes of a specific server
      tags:
        - Servers
    post:
      description: "Set the attributes of a specific server. Prior attributes with keys that are not provided in the body of the request will be deleted. Required permission: 'servers'."
      operationId: setServerAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Array of attributes
          in: body
          name: attributes
          required: true
          schema:
            type: object
      responses:
        "200":
          description: OK
        "404":
          description: Server not found
      summary: Set all attributes of a specific server
      tags:
        - Servers
    put:
      description: "Update the specified attributes of a specific server. Prior attributes with keys that are not provided in the body of the request will not be deleted. Required permission: 'servers'."
      operationId: updateServerAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Array of attributes
          in: body
          name: attributes
          required: true
          schema:
            type: object
      responses:
        "200":
          description: On successful update
        "404":
          description: Server not found
      summary: Update specified attributes of a specific server
      tags:
        - Servers
  "/servers/{serverid}/attributes/{attributekey}":
    delete:
      description: "Delete attribute with the specified key of a specific server. Required permission: 'servers'."
      operationId: deleteServerAttribute
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Key of the attribute
          in: path
          name: attributekey
          required: true
          type: string
      responses:
        "200":
          description: On successful delete
        "404":
          description: Server not found
      summary: Delete specific attribute of a specific server
      tags:
        - Servers
  "/servers/{serverid}/permissions/":
    get:
      description: "Returns all permissions. Required permission: 'servers'."
      operationId: getAllPermissions
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
      produces:
        - application/json
      responses:
        "200":
          description: List of roles and permissions
          schema:
            $ref: "#/definitions/Permissions"
        "404":
          description: Server not found
      summary: Get all permissions for the specified server.
      tags:
        - Management
  "/servers/{serverid}/permissions/{roleid}":
    delete:
      description: "Revoke all permissions for the specified server and role. Required permission: 'root'."
      operationId: revokePermissions
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Base64 encoded role id
          in: path
          name: roleid
          required: true
          type: string
      responses:
        "200":
          description: ok
        "404":
          description: Server or role not found
      summary: Revoke all permissions for the specified server and role.
      tags:
        - Management
    get:
      description: "Returns all permissions. Required permission: 'servers'."
      operationId: getPermissions
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Base64 encoded role id
          in: path
          name: roleid
          required: true
          type: string
      produces:
        - application/json
      responses:
        "200":
          description: List of roles and permissions
          schema:
            $ref: "#/definitions/Permissions"
        "404":
          description: Server or role not found
      summary: Get all permissions for the specified server and role.
      tags:
        - Management
    post:
      consumes:
        - application/json
      description: "Set new permissions for the specified role on a server. This overwrites any existing permissions on this server for the specified role. Required permission: 'root'."
      operationId: grantPermissions
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Base64 encoded role id
          in: path
          name: roleid
          required: true
          type: string
        - description: Array of new permissions
          in: body
          name: permissions
          required: true
          schema:
            items:
              type: string
            type: array
      responses:
        "200":
          description: ok
        "404":
          description: Server or role not found
      summary: Set new permissions for the specified role on a server
      tags:
        - Management
  "/servers/{serverid}/privilegedattributes/":
    delete:
      description: "Delete all privileged attributes of a specific server. Required permission: global 'servers'."
      operationId: deleteServerPrivilegedAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
      responses:
        "200":
          description: On successful delete
        "404":
          description: User not found
      summary: Delete all privileged attributes of a specific server
      tags:
        - Global
    get:
      description: "Returns an array containing all privileged attributes corresponding to this server. Required permission: global 'servers'."
      operationId: getServerPrivilegedAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
      produces:
        - text/plain
      responses:
        "200":
          description: Array of attributes
          schema:
            type: string
        "404":
          description: Server not found
      summary: Get all privileged attributes of a specific server
      tags:
        - Global
    post:
      description: "Set the privileged attributes of a specific server. Prior attributes with keys that are not provided in the body of the request will be deleted. Required permission: global 'servers'."
      operationId: setServerPrivilegedAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Array of attributes
          in: body
          name: attributes
          required: true
          schema:
            type: object
      responses:
        "200":
          description: OK
        "404":
          description: Server not found
      summary: Set all privileged attributes of a specific server
      tags:
        - Global
    put:
      description: "Update the specified privileged attributes of a specific server. Prior privileged attributes with keys that are not provided in the body of the request will not be deleted. Required permission: global 'servers'."
      operationId: updateServerPrivilegedAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Array of attributes
          in: body
          name: attributes
          required: true
          schema:
            type: object
      responses:
        "200":
          description: On successful update
        "404":
          description: Server not found
      summary: Update privileged specified attributes of a specific server
      tags:
        - Global
  "/servers/{serverid}/privilegedattributes/{attributekey}":
    delete:
      description: "Delete privileged attribute with the specified key of a specific server. Required permission: global 'servers'."
      operationId: deleteServerPrivilegedAttribute
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Key of the attribute
          in: path
          name: attributekey
          required: true
          type: string
      responses:
        "200":
          description: On successful delete
        "404":
          description: Server not found
      summary: Delete specific privileged attribute of a specific server
      tags:
        - Global
  "/servers/{serverid}/sessions/":
    get:
      description: "Based on the browser/webserver session identifier, check if the user is logged in and return the associated username. This also returns additional information: the data for the login qr code and whether or not a loggin can be provoked directly from the server. Required permission: 'sessions'."
      operationId: getSession
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
      responses:
        "200":
          description: Current login status.
          schema:
            $ref: "#/definitions/LoginStatus"
      summary: Check if the user is logged in
      tags:
        - Sessions
        - HTML
  "/servers/{serverid}/sessions/html/enrol":
    get:
      description: |
        Generate HTML to enrol a new user. Required permission: 'sessions'.
      operationId: getHtmlEnrol
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - description: Name to forward to the nextAuth app for this account
          in: query
          name: name
          required: false
          type: string
        - description: User name to register this user under
          in: query
          name: userid
          required: false
          type: string
      produces:
        - text/html
      responses:
        "200":
          description: Generated HTML.
          schema:
            type: string
      summary: Generate HTML to enrol a new user
      tags:
        - HTML
  "/servers/{serverid}/sessions/html/footer":
    get:
      consumes:
        - application/json
      description: |
        HTML to add to footer of HTML page. Required permission: 'sessions'.
      operationId: getHtmlFooter
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - description: Additional sessions that should be monitored through the websocket.
          in: body
          name: HtmlFooterBody
          schema:
            $ref: "#/definitions/HtmlFooterBody"
      produces:
        - text/html
      responses:
        "200":
          description: Generated HTML.
          schema:
            type: string
      summary: Generic HTML to add to footer. Required for login/logout/enrol functionality.
      tags:
        - HTML
  "/servers/{serverid}/sessions/html/login":
    get:
      consumes:
        - application/json
      description: |
        Generate HTML for the login block. Required permission: 'sessions'.
      operationId: getHtmlLogin
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - description: Session information to display to user.
          in: body
          name: userContext
          required: false
          schema:
            $ref: "#/definitions/UserContext"
      produces:
        - text/html
      responses:
        "200":
          description: Generated HTML.
          schema:
            type: string
      summary: Generate HTML for the login block
      tags:
        - HTML
  "/servers/{serverid}/sessions/logout":
    post:
      description: "Force a logout on the given session. Required permission: 'sessions'."
      operationId: logout
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
      responses:
        "200":
          description: ok
      summary: Force a logout on the given session
      tags:
        - Sessions
        - HTML
  "/servers/{serverid}/sessions/provokelogin":
    post:
      consumes:
        - application/json
      description: |
        Push a login to the nextAuth app for the user to confirm, based on last account that successfully logged in for the given session. Required permission: 'sessions'.
      operationId: provokeLogin
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - description: Session information to display to user.
          in: body
          name: userContext
          required: false
          schema:
            $ref: "#/definitions/UserContext"
      responses:
        "200":
          description: OK
      summary: Push a login confirmation to the user's app
      tags:
        - Sessions
  "/servers/{serverid}/sessions/qr/enrol":
    get:
      description: "Returns the data for an enrol qr code. Required permission: 'sessions'."
      operationId: getQrEnrol
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - description: Name to forward to the nextAuth app for this account
          in: query
          name: name
          required: true
          type: string
        - description: User name to register this user under
          in: query
          name: userid
          required: false
          type: string
        - description: "'png' for a PNG image, not set for raw data in the qr code"
          in: query
          name: img
          required: false
          type: string
        - description: size in pixels of the qr code, defaults to 500
          in: query
          name: s
          required: false
          type: integer
      produces:
        - application/octet-stream
      responses:
        "200":
          description: Raw byte array containing the enrol qr code data (either raw or as a PNG image).
          schema:
            type: file
      summary: Generate data for an enrol qr code
      tags:
        - Registration
  "/servers/{serverid}/sessions/qr/login":
    get:
      consumes:
        - application/json
      description: "Returns the data for a login qr code. Required permission: 'sessions'."
      operationId: getQrLogin
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - description: '"png" for a PNG image, not set for raw data in the qr code'
          in: query
          name: img
          required: false
          type: string
        - description: size in pixels of the qr code, defaults to 500
          in: query
          name: s
          required: false
          type: integer
        - description: Session information to display to user.
          in: body
          name: userContext
          required: false
          schema:
            $ref: "#/definitions/UserContext"
      produces:
        - application/octet-stream
      responses:
        "200":
          description: Raw byte array containing the login qr code data (either raw or as a PNG image).
          schema:
            type: file
      summary: Generate data for a login qr code
      tags:
        - Sessions
  "/servers/{serverid}/sessions/registeruser":
    post:
      description: "Register a user for the currently logged in account. You can also directly pass a user name when generating an ENROL qr code. Required permission: 'users'."
      operationId: registerUser
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - description: Username to register
          in: query
          name: userid
          required: true
          type: string
      responses:
        "200":
          description: OK
      summary: Register a userid for the currently logged in account.
      tags:
        - Users
        - Registration
  "/servers/{serverid}/sessions/transactions":
    post:
      description: "Create a transaction for approval within the current session. Required permission: 'sessions'."
      operationId: createTransaction
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - in: body
          name: msg
          required: true
          schema:
            $ref: "#/definitions/Transaction"
      responses:
        "200":
          description: ok
          schema:
            $ref: "#/definitions/TransactionId"
        "403":
          description: no account associated with this session
      summary: Create a transaction to be approved within the current session.
      tags:
        - Transactions
  "/servers/{serverid}/transactions/{transactionid}":
    get:
      description: "Get transaction result for a given transaction id. Required permission: 'sessions'."
      operationId: getTransactionResult
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Base64 encoded transaction id
          in: path
          name: transactionid
          required: true
          type: string
      responses:
        "200":
          description: ok
          schema:
            $ref: "#/definitions/TransactionResult"
        "404":
          description: no transaction with given id found
      summary: Get transaction result for a given transaction.
      tags:
        - Transactions
  "/servers/{serverid}/users/":
    get:
      description: "Returns an array of arrays containing all accounts corresponding to all users. Required permission: 'users'."
      operationId: getUsers
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Filter users based on an attribute. Takes the format *attributename=attributevalue*. You can filter for multiple values at once, e.g. *group=in:group1,group2*
          in: query
          name: filter
          type: string
        - description: Search for a username LIKE %search%
          in: query
          name: search
          type: string
        - description: Limit the number of results
          in: query
          name: limit
          type: integer
        - description: Offset in the result list
          in: query
          name: marker
          type: integer
        - description: Sort the results by column. You can also specify ascending (default if not specified) or descending, e.g., *column:asc* . You can also sort by multiple columns, e.g., *column1:desc,column2:asc*
          in: query
          name: sort
          type: string
      responses:
        "200":
          description: Array of users
          schema:
            $ref: "#/definitions/Users"
      summary: Get all users
      tags:
        - Users
  "/servers/{serverid}/users/{userid}/":
    delete:
      description: "Delete a user. Required permission: 'users'."
      operationId: deleteUser
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
      responses:
        "200":
          description: On successful delete
        "404":
          description: User not found
      summary: Delete a specific user
      tags:
        - Users
  "/servers/{serverid}/users/{userid}/accounts":
    delete:
      description: "Delete all accounts corresponding to this user. The user itself is not deleted. Required permission: 'accounts' or 'users'."
      operationId: deleteUserAccounts
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
      responses:
        "200":
          description: On successful delete
      summary: Delete all accounts of a specific user
      tags:
        - Users
        - Accounts
    get:
      description: "Returns an array containing all accounts corresponding to this user. Required permission: 'sessions' or 'users'."
      operationId: getUser
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
        - description: Limit the number of results
          in: query
          name: limit
          type: integer
        - description: Offset in the result list
          in: query
          name: marker
          type: integer
        - description: Sort the results by column. You can also specify ascending (default if not specified) or descending, e.g., *column:asc* . You can also sort by multiple columns, e.g., *column1:desc,column2:asc*
          in: query
          name: sort
          type: string
      responses:
        "200":
          description: Array of accounts
          schema:
            $ref: "#/definitions/Accounts"
      summary: Get all accounts of a specific user
      tags:
        - Users
        - Accounts
  "/servers/{serverid}/users/{userid}/attributes/":
    delete:
      description: "Delete all attributes of a specific user. Required permission: 'users'."
      operationId: deleteUserAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
      responses:
        "200":
          description: On successful delete
        "404":
          description: User not found
      summary: Delete all attributes of a specific user
      tags:
        - Users
    get:
      description: "Returns an array containing all attributes corresponding to this user. Required permission: 'sessions' or 'users'."
      operationId: getUserAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
      produces:
        - text/plain
      responses:
        "200":
          description: Array of attributes
          schema:
            type: string
        "404":
          description: User not found
      summary: Get all attributes of a specific user
      tags:
        - Users
    post:
      description: "Set the attributes of a specific user. Prior attributes with keys that are not provided in the body of the request will be deleted. Creates the user if not exists. Required permission: 'users'."
      operationId: setUserAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
        - description: Array of attributes
          in: body
          name: attributes
          required: true
          schema:
            type: object
      responses:
        "200":
          description: OK
      summary: Set all attributes of a specific user
      tags:
        - Users
    put:
      description: "Update the specified attributes of a specific user. Prior attributes with keys that are not provided in the body of the request will not be deleted. Required permission: 'users'."
      operationId: updateUserAttributes
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
        - description: Array of attributes
          in: body
          name: attributes
          required: true
          schema:
            type: object
      responses:
        "200":
          description: On successful update
        "404":
          description: User not found
      summary: Update specified attributes of a specific user
      tags:
        - Users
  "/servers/{serverid}/users/{userid}/attributes/{attributekey}":
    delete:
      description: "Delete attribute with the specified key of a specific user. Required permission: 'users'."
      operationId: deleteUserAttribute
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
        - description: Key of the attribute
          in: path
          name: attributekey
          required: true
          type: string
      responses:
        "200":
          description: On successful delete
        "404":
          description: User not found
      summary: Delete specific attribute of a specific user
      tags:
        - Users
  "/servers/{serverid}/users/{userid}/provokelogin":
    post:
      consumes:
        - application/json
      description: "Push a login to the nextAuth app for the user to confirm, based on the given userid. Required permission: 'sessions' or 'users'."
      operationId: provokeLoginOnUser
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: Nonce to identify the browser/webserver session
          in: header
          name: X-nonce
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
        - description: Session information to display to user.
          in: body
          name: userContext
          required: false
          schema:
            $ref: "#/definitions/UserContext"
      responses:
        "200":
          description: OK
      summary: Push a login confirmation to the user's app
      tags:
        - Sessions
  "/servers/{serverid}/users/{userid}/role/":
    get:
      description: "Get role for a specific user. Required permission: 'users'."
      operationId: getUserRole
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
      responses:
        "200":
          description: User role (base 64 encoded)
          schema:
            $ref: "#/definitions/Role"
        "404":
          description: User not found, no role found for user
      summary: Get role for a specific user.
      tags:
        - Management
    post:
      description: "Get or create a role for a specific user. Required permission: 'users'."
      operationId: getOrCreateUserRole
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
        - description: User name
          in: path
          name: userid
          required: true
          type: string
      responses:
        "200":
          description: User role (base 64 encoded)
          schema:
            properties:
              role:
                type: string
            type: object
        "404":
          description: User not found
      summary: Get or create a role for a specific user.
      tags:
        - Management
  "/servers/{serverid}/vash":
    get:
      description: "Returns a PNG of the visual hash corresponding to this server. This visual hash is used during the registration process (optional), for the user to verify that (s)he is registering with the right server in the nextAuth app. For single-server nextAuth-enabled apps (white label or mobile SDK), the public key of the server is typically pinned within the app and hence this visual hash is not displayed to the user. Required permission: 'sessions' or 'servers'."
      operationId: getServerVash
      parameters:
        - description: Base64 encoded server id
          in: path
          name: serverid
          required: true
          type: string
      produces:
        - application/octet-stream
      responses:
        "200":
          description: Raw byte array containing the visual hash of this server as a PNG image.
          schema:
            type: file
        "404":
          description: Server not found
      summary: Visual hash of this server
      tags:
        - Registration
definitions:
  Account:
    properties:
      blocked:
        description: True if the account is blocked, false otherwise
        type: boolean
      clientVersion:
        description: Version nextAuth client in the app
        type: string
      created:
        description: Timestamp of creation
        format: int64
        type: integer
      description:
        description: Description of the account (e.g. device name)
        type: string
      id:
        description: Account id
        type: integer
      lastlogin:
        description: Timestamp of last login
        format: int64
        type: integer
      lastprovoke:
        description: Timestamp of last provoke (push message)
        format: int64
        type: integer
      userid:
        description: User name
        type: string
    required:
      - description
      - id
  Accounts:
    properties:
      accounts:
        description: Array of accounts
        items:
          $ref: "#/definitions/Account"
        type: array
      totalnumber:
        description: total number of accounts
        type: integer
    required:
      - accounts
  ApiKey:
    properties:
      apikey:
        description: API key
        type: string
      description:
        description: Description
        type: string
      role:
        description: Role id
        type: string
    type: object
  ApiKeys:
    properties:
      apikeys:
        description: Array of apikeys
        items:
          $ref: "#/definitions/ApiKey"
        type: array
    required:
      - apikeys
  HtmlFooterBody:
    properties:
      sessions:
        items:
          $ref: "#/definitions/ServerSession"
        type: array
    type: object
  LoginStatus:
    properties:
      accountid:
        description: Account id
        type: integer
      canprovoke:
        description: True if a login can be pushed from the server, false otherwise
        type: boolean
      hsid:
        description: Converted session id, used by the websockets
        type: string
      loggedin:
        description: True if the user is loggedin, false otherwise
        type: boolean
      loginqrdata:
        description: Base64 encoded data that is represented in the login qr code
        type: string
      pk:
        description: Base64 encoded public key of the nextAuth app. This uniquely identifies the account on the nextAuth app, regardless of the username
        type: string
      userid:
        description: User name
        type: string
  Permission:
    properties:
      acl:
        description: Comma-seperated list of permissions
        type: string
      role:
        description: Role id
        type: string
      server:
        description: Base64 encoded server id
        type: string
  Permissions:
    properties:
      permissions:
        description: Array of permissions
        items:
          $ref: "#/definitions/Permission"
        type: array
    required:
      - permissions
  Role:
    properties:
      role:
        description: Base64 encode role
        type: string
  Server:
    properties:
      accountCount:
        description: Number of accounts registered with this server
        type: integer
      appandroid:
        description: URL of the app in Google Play
        type: string
      appios:
        description: URL of the app in the App Store
        type: string
      appname:
        description: name of the app
        type: string
      appurl:
        description: URL (prefix) to launch the app
        type: string
      lastLogin:
        description: Last login on this server
        format: int64
        type: integer
      logo:
        description: Base 64 encoded logo
        type: string
      owner:
        description: Owner id
        type: integer
      pinTimeout:
        description: Time (minutes) since the last time the user entered his PIN, that the user is not requested a PIN at login. -1 means that the user is never asked for a PIN before logging in, 0 means that the user is asked every time he wants to login
        type: integer
      pinTransTimeout:
        description: Time (minutes) since the last time the user entered his PIN, that the user is not requested a PIN at transaction approval. -1 means that the user is never asked for a PIN before approving a transaction, 0 means that the user is asked every time he wants to approve a transaction
        type: integer
      pingTime:
        description: Time (seconds) that the nextAuth app has before it needs to reply to a ping request from the nextAuth server (continuous authentication)
        type: integer
      serverFlags:
        description: Server flags
        items:
          type: string
        type: array
      serverName:
        description: Server name
        type: string
      serverid:
        description: Base64 encoded id of the nextAuth server
        type: string
      serverpk:
        description: Base64 encoded public key of the nextAuth server
        type: string
      siteurl:
        description: URL of the main website
        type: string
      wsurl:
        description: Websocket URL
        type: string
    required:
      - logo
      - pinTimeout
      - pinTransTimeout
      - pingTime
      - serverFlags
      - serverName
      - serverid
      - serverpk
  ServerSession:
    properties:
      serverid:
        description: Server Id
        type: string
      sessionid:
        description: Base64 encoded nonce
        type: string
    required:
      - serverid
      - sessionid
  Servers:
    properties:
      servers:
        description: Array of servers
        items:
          $ref: "#/definitions/Server"
        type: array
      totalnumber:
        description: total number of users
        type: integer
    required:
      - servers
  SessionInfo:
    properties:
      info:
        description: Information to display to user
        type: object
      ip:
        description: IP address
        type: string
      logo:
        description: Base64 encoded logo
        format: byte
        type: string
      useragent:
        description: User agent of the browser
        type: string
  Transaction:
    properties:
      amount:
        type: string
      benificiary:
        type: string
      description:
        type: string
  TransactionId:
    properties:
      tid:
        description: Base64 encoded transaction id
        type: string
  TransactionResult:
    properties:
      tstatus:
        description: 0 = new, 1 = approved, 2 = declined
        type: string
  User:
    properties:
      lastlogin:
        description: (aggregated) last login over all accounts
        format: int64
        type: integer
      numberaccounts:
        description: (aggregated) number of accounts
        type: integer
      userid:
        description: User name
        type: string
    required:
      - userid
  UserContext:
    properties:
      announceinfo:
        $ref: "#/definitions/SessionInfo"
      sessioninfo:
        $ref: "#/definitions/SessionInfo"
  Users:
    properties:
      totalnumber:
        description: total number of users
        type: integer
      users:
        description: Array of users
        items:
          $ref: "#/definitions/User"
        type: array
    required:
      - users
