---
swagger: "2.0"
info:
  title: Authorize & Token
  x-ibm-name: authorize-token
  version: 2.0.2
  description: Authorize is our implementation of the OAuth 2.0 framework. It lets
    you integrate the latest industry-standard secure authorization methods in your
    app.
  x-api-id: 1606b936-dd24-83e8-7013-fc77d3847278
  x-bmo-api-type: general-api
  x-bmo-api-provider-id: 3384
  x-bmoservicedomain-name: Issued Device Administration
  x-api-specification-compliant: false
  x-ibm-summary: ""
schemes:
- https
basePath: /open-banking/commercial-sb
produces:
- application/json
securityDefinitions:
  clientIdHeader:
    type: apiKey
    in: header
    name: X-IBM-Client-Id
x-ibm-configuration:
  cors:
    enabled: true
  type: rest
  phase: realized
  enforced: true
  testable: true
  categories:
  - techunit--obtps--sd--issueddeviceadministration--ent
  application-authentication:
    certificate: false
  servers:
  - url: https://sandbox-open-api.bmo.com/open-banking/commercial-sb
    type:
    - production
    - development
definitions:
  Payload:
    type: object
    properties:
      iss:
        type: string
      sub:
        type: string
      name:
        type: string
      aud:
        type: string
      scope:
        type: string
      exp:
        type: integer
      iat:
        type: integer
  Token:
    type: object
    additionalProperties: false
    required:
    - token_type
    - access_token
    - expires_in
    properties:
      token_type:
        enum:
        - bearer
      access_token:
        type: string
      expires_in:
        type: integer
      scope:
        type: string
      refresh_token:
        type: string
  introspect_response:
    type: object
    additionalProperties: false
    required:
    - active
    - client_id
    - client_name
    - username
    - sub
    - exp
    - expstr
    - iat
    - nbf
    - nbfstr
    - scope
    properties:
      active:
        type: boolean
      client_id:
        type: string
      client_name:
        type: string
      username:
        type: string
      sub:
        type: string
      exp:
        type: string
      expstr:
        type: string
      iat:
        type: string
      nbf:
        type: string
      nbfstr:
        type: string
      scope:
        type: string
      miscinfo:
        type: string
      consented_on:
        type: string
      consented_on_str:
        type: string
      grant_type:
        type: string
paths:
  /oauth20/authorize:
    get:
      operationId: Retrieve authorization code
      x-dataclassification-code: Highly Sensitive
      summary: Retrieve authorization code
      description: "Retrieve an authorization code to be used in exchange for an access
        token. \n"
      parameters:
      - name: client_id
        in: query
        description: Application client ID, can be provided in formData or using HTTP
          Basic Authentication
        type: string
        required: true
      - name: redirect_uri
        in: query
        description: required only if the redirect_uri parameter was included in the
          authorization request /oauth2/authorize; their values MUST be identical.
        required: true
        type: string
      - name: state
        in: query
        type: string
        description: The state value you create and will verify
        required: true
      - name: scope
        in: query
        description: the scope value you create and will verify
        required: true
        type: string
      - name: response_type
        in: query
        description: the response type
        required: true
        type: string
      responses:
        200:
          description: This operation returns no content
        400:
          description: This operation returns no content
  /oauth20/token:
    post:
      operationId: Request Access Tokens
      x-dataclassification-code: Public
      consumes:
      - application/x-www-form-urlencoded
      produces:
      - application/json
      summary: Request Access Tokens
      description: "Exchange the authorization code retrieved in the previous call
        \ for an access token and a refresh token. \n\n1. Authorization Code<br>Get
        an access token and refresh token by calling our /token endpoint and passing
        through the authorization code from the previous call. <br>The access token
        will only be valid for the scope for which the consent has been provided.
        It will have an expiration of 24 hours in the sandbox environment and 15 minutes
        in production. You can then call our APIs by passing this token in the Authorization
        header.<br>The refresh token can be used to get a new access token if the
        original one expires.\n\n2. Refresh Token<br>If your access token has expired
        and your refresh token is still valid, you can exchange your refresh token
        for a new access token and a new refresh token."
      parameters:
      - name: grant_type
        in: formData
        description: Type of grant
        type: string
        required: true
      - name: client_id
        in: formData
        description: Application client ID, can be provided in formData or using HTTP
          Basic Authentication
        required: false
        type: string
      - name: client_secret
        in: formData
        description: Application client secret, can be provided in formData or using
          HTTP Basic Authentication
        required: false
        type: string
      - name: code
        in: formData
        description: Authorization code provided by the /oauth2/authorize endpoint
        required: false
        type: string
      - name: redirect_uri
        in: formData
        description: required only if the redirect_uri parameter was included in the
          authorization request /oauth2/authorize; their values MUST be identical.
        required: false
        type: string
      - name: username
        in: formData
        type: string
        description: Resource owner username
        required: false
      - name: password
        in: formData
        type: string
        description: Resource owner password
        required: false
      - name: scope
        in: formData
        type: string
        description: Scope being requested
        required: false
      - name: refresh_token
        in: formData
        type: string
        description: The refresh token that the client wants to exchange for a new
          access token (refresh_token grant_type)
        required: false
      responses:
        200:
          description: json document containing token, etc.
          schema:
            $ref: '#/definitions/Token'
        400:
          description: json document that may contain additional details about the
            failure
host: sandbox-open-api.bmo.com
...
