openapi: 3.0.0
x-origin:
  - url: https://flexera1000-ci.flexnetoperations.com/flexnet/v2/api-docs
    format: swagger
    version: '2.0'
    converter:
      url: https://github.com/mermade/oas-kit
      version: 7.0.8
info:
  description: FlexNet Operations Access Tokens API
  version: '2024.09'
  title: Introduction to the Access Token Controller REST API
security: []
tags:
  - name: Access Token Controller
    description: >
      A REST Controller for creating access tokens to be used as bearer

      authentication tokens for calling FlexNet Operations APIs (SOAP and
      REST). 

      This REST web service also supports reading, updating, searching,
      rotating, and deleting tokens. 


      FlexNet Operations uses different token types to manage different access
      levels and operations:

      - <b>NORMAL</b> tokens can be requested by any FlexNet Operations user to
      authenticate themselves at a FlexNet Operations API.</br>

      - <b>IMPERSONATED</b> tokens can be requested by a privileged user for use
      by other FlexNet Operations users.


      To create and manage IMPERSONATED tokens, users require the <b>Create
      Impersonated Token</b> permission and a <b>Manage Users</b>
      permission.      
paths:
  /uar/v1/token:
    post:
      tags:
        - Access Token Controller
      summary: Create an access token
      description: >
        Use this API to create an access token. 


        The response includes the token value. This is the only time the token
        value is displayed. 

        The value must be included as a Bearer token in the Authorization HTTP
        header for authorization requests.


        Typically, an access token has the following

        attributes: 

        - <b>Token name</b>—Must be unique and 5 - 25 characters long.

        - <b>Expiry string</b>—The token lifetime. Format: <b>*y *M *d *h
        *m</b>, where y=years, M=months, d=days, h=hours, m=minutes (case
        sensitive), and * representing any number.

        - <b>Token type</b>—Valid values: NORMAL | IMPERSONATED.

        - <b>Token description</b>—Mandatory for IMPERSONATED tokens.

        - <b>Username</b>—User name of the user on whose behalf the token is
        created. Mandatory for IMPERSONATED tokens.


        When a username is provided for the creation of a NORMAL token, that
        username is ignored when calling an API. 

        Instead, the user calling the API is authenticated. 
      operationId: createTokenUsingPOST_1
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessTokenCreateRequest'
        description: reqBody
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/AccessTokenAPIResponse_AccessTokenResponseWithTokenValue_
  /uar/v1/token/verification:
    post:
      tags:
        - Access Token Controller
      summary: Verify an access token
      description: >-
        Use this API to very if a token is valid. Pass the token value in the
        request body. The response shows if the token is valid, along with
        information about the token. <br/><br/> Only the token creator can
        verify IMPERSONATED tokens. If you do not have the <b>Create
        Impersonated Token</b> and relevant <b>Manage Users</b> permissions, the
        API returns obfuscated values.
      operationId: verifyTokenUsingPOST_1
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessTokenVerificationRequest'
        description: accessToken
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/AccessTokenAPIResponse_AccessTokenResponse_
  /uar/v1/token/{tokenName}:
    get:
      tags:
        - Access Token Controller
      summary: Get details of access token
      description: >-
        Use this API to fetch the details of an access token identified by its
        name.
      operationId: getTokenUsingGET_1
      parameters:
        - name: tokenName
          in: path
          description: >-
            The name of the token for which you want to retrieve details (case
            sensitive).
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/AccessTokenAPIResponse_AccessTokenResponse_
    put:
      tags:
        - Access Token Controller
      summary: Update an access token
      description: >
        Use this API to update some of the attributes of a specified access
        token. 

        Specify the name of the token that you want to update in the path (case
        sensitive).


        In the request body, specify the new values. You can update the
        following token attributes:<b></b>

        - <b>tokenName</b>—Must be 5 - 25 characters long.

        - <b>tokenDescription</b>—For IMPERSONATED tokens this field should
        state the impersonation reason.

        - <b>expiryStr</b>—Must not be in the past. Format:<b>*y *M *d *h
        *m</b>, where y=years, M=months, d=days, h=hours, 

        m=minutes (case sensitive), and * representing any number.


        Only the token creator or another privileged user can update an
        IMPERSONATED token. 

        You cannot edit an expired token or set the token expiry to a time in
        the past.
      operationId: updateTokenUsingPUT_1
      parameters:
        - name: tokenName
          in: path
          description: Name of the token to be updated (case sensitive).
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessTokenUpdateRequest'
        description: reqBody
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseEntity'
    delete:
      tags:
        - Access Token Controller
      summary: Delete an access token
      description: >-
        Use this API to delete an access token. Pass the name of the token to be
        deleted as a path parameter. The token name is case sensitive.<br/><br/>
        A deleted token can no longer be used to access the APIs.<br/><br/> Only
        the token creator can delete a token; this means that only users with
        the <b>Create Impersonated Token</b> and relevant <b>Manage Users</b>
        permission can delete IMPERSONATED tokens.
      operationId: deleteTokenUsingDELETE_1
      parameters:
        - name: tokenName
          in: path
          description: The name of the token to be deleted (case sensitive).
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseEntity'
  /uar/v1/token/{tokenName}/rotation:
    post:
      tags:
        - Access Token Controller
      summary: Rotate an access token
      description: >-
        Token rotation means that a token's value is changed, but no other
        properties. Pass the name of the token to be rotated as a path
        parameter. The token name is case sensitive.<br/><br/> The response
        contains the new token value. Make a note of the token value; this is
        the only time that the new value is displayed.<br/><br/> It is
        recommended to frequently rotate access tokens, but care should be
        exercised to not break any integrations you may have.
      operationId: rotateTokenUsingPOST_1
      parameters:
        - name: tokenName
          in: path
          description: The name of the access token to be rotated (case sensitive).
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/AccessTokenAPIResponse_AccessTokenResponseWithTokenValue_
  /uar/v1/tokens:
    get:
      tags:
        - Access Token Controller
      summary: List non-expired access tokens
      description: >-
        Use this API to get a list of all non-expired access tokens for a
        specified user.<br/> You must specify either the <b>username</b> or the
        <b>tokenCreator</b> parameter as search criteria.<br/> If you pass
        values for both parameters in the same request, the API returns a list
        of all non-expired tokens that match both parameters.<br/> If you do not
        have the <b>Create Impersonated Token</b> and relevant <b>Manage
        Users</b> permissions, the API returns obfuscated values.<br/><br/>
        <b>Tip:</b> If you want a more fine-grained search, use
        <b>/tokens/search</b>.
      operationId: getTokensForUserUsingGET_1
      parameters:
        - name: username
          in: query
          description: >-
            The email address of the user for whom tokens should be listed (case
            sensitive). This is the user for whom the token was created.
          required: false
          schema:
            type: string
        - name: tokenCreator
          in: query
          description: >-
            The email address of the token creator for whom tokens should be
            listed (case sensitive). This is the user who created tokens on
            another user's behalf.
          required: false
          schema:
            type: string
        - name: page
          in: query
          description: Retrieves a specific page. Must be a number (starting from 0).
          required: false
          schema:
            type: integer
            format: int32
        - name: pageSize
          in: query
          description: >-
            Specifies how many tokens per page should be returned. Must be a
            number.<br/> <b>Tip:</b> Use the <b>/tokens/count</b> API to
            determine the total number of records for a specified user.
          required: false
          schema:
            type: integer
            format: int32
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/AccessTokenAPIResponse_List_AccessTokenResponse_
  /uar/v1/tokens/count:
    get:
      tags:
        - Access Token Controller
      summary: Get count of non-expired access tokens
      description: >-
        Use this API to get a count of all non-expired access tokens for a
        specified user.<br/> You must specify either the <b>username</b> or the
        <b>tokenCreator</b> parameter as search criteria.<br/>

        <b>Tip:</b> Use this API to specify values for the pagination parameters
        of the <b>/tokens</b> API.
      operationId: getTokenCountUsingGET_1
      parameters:
        - name: username
          in: query
          description: >-
            The email address of the user for whom the token count should be
            returned (case sensitive). This is the user for whom the tokens were
            created.
          required: false
          schema:
            type: string
        - name: tokenCreator
          in: query
          description: >-
            The email address of the token creator for whom the token count
            should be returned (case sensitive). This is the user who created
            tokens on another user's behalf.
          required: false
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenAPIResponse_int_'
  /uar/v1/tokens/search:
    post:
      tags:
        - Access Token Controller
      summary: Search for non-expired access tokens
      description: >
        Get a list of all non-expired access tokens that match specified search
        criteria.<br/><br/>

        You must specify at least one of the following search criteria. If you
        pass multiple parameters as search criteria, 

        the API returns non-expired tokens that match all parameters.<br/>

        - <b>tokenName</b>—Search by token name. Use an asterisk (*) as
        placeholder for partial searches.<br/>

        - <b>tokenType</b>—Either NORMAL or IMPERSONATED. If not specified, all
        token types will be returned.<br/>

        - <b>username</b>—The email address of the user for whom the token was
        created.<br/>

        - <b>tokenCreator</b>—The email address of the user who created the
        token on another user's behalf. 

        For NORMAL tokens, <b>username</b> and <b>tokenCreator</b> must be the
        same. For IMPERSONATED

        tokens, the user firing this query must have the <b>Create Impersonated
        Token</b> permission and a <b>Manage Users</b> permission.<br/>

        - <b>expiresBefore</b>—Specify to filter for tokens that expire before a
        specified interval. 

        Can be used in conjunction with the <b>expiresLaterThan</b> parameter to
        filter for a given time range. 

        In that case, <b>expiresBefore</b> must be greater than
        <b>expiresLaterThan</b>.

        - <b>expiresLaterThan</b>—Specify to filter for tokens that expire after
        a specified interval.

        Can be used in conjunction with the <b>expiresBefore</b> parameter to
        filter for a given time range.

        In that case, <b>expiresLaterThan</b> must be less than
        <b>expiresBefore</b>.<br/>

        - <b>issuedBefore</b>—Specify to filter for tokens that were issued
        before a specified interval.<br/>


        If you do not have permission to view a given token, its details are
        returned as masked

        entries.<br/>


        The format for <b>expiresBefore</b>, <b>expiresLaterThan</b> and
        <b>issuedBefore</b> is <b>*y *M *d *h *m</b>, where 

        y=years, M=months, d=days, h=hours, m=minutes (case sensitive), and *
        representing any number.<br/>


        In addition to the search criteria above you must also specify the
        following parameters:<br/>

        - <b>page</b>—The number of the page to be returned (zero based).<br/>

        - <b>pageSize</b>—The number of records returned per page.<br/><br/>
      operationId: searchTokensUsingPOST_1
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchTokenRequest'
        description: searchToken
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/AccessTokenAPIResponse_PaginationSupportedResponse_List_AccessTokenResponse_
servers:
  - url: //{siteID}.flexnetoperations.com/flexnet
    description: Replace {siteID} with your FlexNet Operations instance.
components:
  requestBodies:
    _secure.token.reqobject.validate_:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/_secure.token.reqobject.validate_'
      description: request
      required: true
  securitySchemes:
    Bearer:
      type: apiKey
      name: Authorization
      in: header
    basicAuth:
      type: http
      scheme: basic
  schemas:
    _secure.token.reqobject.validate_:
      type: object
      properties:
        token:
          type: string
    AccessTokenCreateRequest:
      type: object
      required:
        - expiryStr
        - tokenName
        - tokenType
        - username
      properties:
        expiryStr:
          type: string
          description: >
            Lifetime of the token as specified when the token was created. <br>

            Format: <b>*y *M *d *h *m</b>, where y=years, M=months, d=days,
            h=hours, m=minutes (case sensitive), and * representing any number.
        tokenDescription:
          type: string
          description: >-
            Mandatory for IMPERSONATED tokens; optional for NORMAL tokens. For
            IMPERSONATED tokens, use this field to capture the impersonation
            reason.
        tokenName:
          type: string
          description: >
            Name of the token, must be 5 - 25 characters long.</br>

            The following characters are not supported:</br> * < > + $ ? . ^ | %
            ] \\\\\\\\ (four consecutive back slashes are not allowed) </br>

            HTML tags that may indicate an XSS attack will be rejected.
        tokenType:
          type: string
          description: >
            Specify the token type. </br> NORMAL tokens can be requested by any
            FlexNet Operations user.</br> IMPERSONATED tokens can be requested
            by a privileged user on behalf of another  FlexNet Operations user.
          enum:
            - NORMAL
            - IMPERSONATED
        username:
          type: string
          description: >
            The user for whom the token is created. Usually this is specified as
            an email address.  This field is mandatory for IMPERSONATED tokens.
    AccessTokenResponse:
      type: object
      required:
        - expiryStr
        - tokenName
        - tokenType
        - username
      properties:
        expiryStr:
          type: string
          description: >
            Lifetime of the token as specified when the token was created. <br>

            Format: <b>*y *M *d *h *m</b>, where y=years, M=months, d=days,
            h=hours, m=minutes (case sensitive), and * representing any number.
        tokenDescription:
          type: string
          description: >-
            Mandatory for IMPERSONATED tokens; optional for NORMAL tokens. For
            IMPERSONATED tokens, this field should capture the impersonation
            reason.
        tokenExpiryMillis:
          type: integer
          format: int64
          description: >-
            The date and time when the token expires in milliseconds since
            1970-01-01 00:00 (Epoch time).
        tokenIssueMillis:
          type: integer
          format: int64
          description: >-
            The date and time when the token was issued in milliseconds since
            1970-01-01 00:00 (Epoch time).
        tokenName:
          type: string
          description: The name of the token that was verified.
        tokenCreator:
          type: string
          description: >
            The email address of the user who created the token. 

            For NORMAL tokens, the email address for <b>tokenCreator</b> is the
            same as that for <b>username</b>.

            For IMPERSONATED tokens, the email addresses usually differ.
        tokenType:
          type: string
          description: The type of token that was verified.
          enum:
            - NORMAL
            - IMPERSONATED
        username:
          type: string
          description: >
            The user for whom the token was created. Usually this is specified
            as an email address.  For NORMAL tokens, the email address for
            <b>tokenCreator</b> is the same as that for <b>username</b>.
    AccessTokenResponseWithTokenValue:
      type: object
      required:
        - expiryStr
        - tokenName
        - tokenType
        - username
      properties:
        expiryStr:
          type: string
          description: >
            Lifetime of the token as specified when the token was created. <br>

            Format: <b>*y *M *d *h *m</b>, where y=years, M=months, d=days,
            h=hours, m=minutes (case sensitive), and * representing any number.
        tokenDescription:
          type: string
          description: >-
            Mandatory for IMPERSONATED tokens; optional for NORMAL tokens. For
            IMPERSONATED tokens, this field should capture the impersonation
            reason.
        tokenExpiryMillis:
          type: integer
          format: int64
          description: >-
            The date and time when the token expires in milliseconds since
            1970-01-01 00:00 (Epoch time).
        tokenIssueMillis:
          type: integer
          format: int64
          description: >-
            The date and time when the token was issued in milliseconds since
            1970-01-01 00:00 (Epoch time).
        tokenName:
          type: string
          description: The name of the token that was created.
        tokenCreator:
          type: string
          description: >
            The email address of the user who created the token. 

            For NORMAL tokens, the email address for <b>tokenCreator</b> is the
            same as that for <b>username</b>.

            For IMPERSONATED tokens, the email addresses usually differ.
        tokenType:
          type: string
          description: The type of the token that was created.
          enum:
            - NORMAL
            - IMPERSONATED
        tokenValue:
          type: string
          description: Actual token that is to be used for bearer authentication.
        username:
          type: string
          description: >-
            The user for whom the token is created. Usually this is an email
            address.
    AccessTokenUpdateRequest:
      type: object
      required:
        - expiryStr
        - tokenName
      properties:
        expiryStr:
          type: string
          description: >
            Lifetime of the token as specified when the token was created. <br>

            Format: <b>*y *M *d *h *m</b>, where y=years, M=months, d=days,
            h=hours, m=minutes (case sensitive), and * representing any number.
        tokenDescription:
          type: string
          description: >-
            Mandatory for IMPERSONATED tokens; optional for NORMAL tokens. For
            IMPERSONATED tokens, this field should capture the impersonation
            reason.
        tokenName:
          type: string
          description: The name of the token.
    AccessTokenVerificationRequest:
      type: object
      required:
        - accessToken
      properties:
        accessToken:
          type: string
          description: The value of the access token that should be verified.
    ResponseEntity:
      type: object
      properties:
        body:
          type: object
        statusCode:
          type: string
          enum:
            - '100'
            - '101'
            - '102'
            - '103'
            - '200'
            - '201'
            - '202'
            - '203'
            - '204'
            - '205'
            - '206'
            - '207'
            - '208'
            - '226'
            - '300'
            - '301'
            - '302'
            - '303'
            - '304'
            - '305'
            - '307'
            - '308'
            - '400'
            - '401'
            - '402'
            - '403'
            - '404'
            - '405'
            - '406'
            - '407'
            - '408'
            - '409'
            - '410'
            - '411'
            - '412'
            - '413'
            - '414'
            - '415'
            - '416'
            - '417'
            - '418'
            - '419'
            - '420'
            - '421'
            - '422'
            - '423'
            - '424'
            - '426'
            - '428'
            - '429'
            - '431'
            - '451'
            - '500'
            - '501'
            - '502'
            - '503'
            - '504'
            - '505'
            - '506'
            - '507'
            - '508'
            - '509'
            - '510'
            - '511'
        statusCodeValue:
          type: integer
          format: int32
    SearchTokenRequest:
      type: object
      required:
        - page
        - pageSize
      properties:
        tokenCreator:
          type: string
          description: >-
            The email address of the user who created tokens on another user's
            behalf (case sensitive).
        expiresBefore:
          type: string
          description: >-
            Gets tokens that expire before a specified interval. If used in
            conjunction with <b>expiresLaterThan</b>, must be greater than
            <b>expiresLaterThan</b>. Use the format <b>5y 6M 4d 3h 5m</b>, where
            y=years, M=months, d=days, h=hours, m=minutes (case sensitive).
        expiresLaterThan:
          type: string
          description: >-
            Gets tokens that expire after a specified interval. If used in
            conjunction with <b>expiresBefore</b>, must be less than
            <b>expiresBefore</b>. Use the format <b>5y 6M 4d 3h 5m</b>, where
            y=years, M=months, d=days, h=hours, m=minutes (case sensitive).
        issuedBefore:
          type: string
          description: >-
            Gets tokens that were issued before a specified interval. Use the
            format <b>5y 6M 4d 3h 5m</b>, where y=years, M=months, d=days,
            h=hours, m=minutes (case sensitive).
        page:
          type: integer
          format: int32
          description: The number of the page to be returned (zero based).
        pageSize:
          type: integer
          format: int32
          description: The number of records returned per page.
        tokenName:
          type: string
          description: >-
            The name of the token. Use an asterisk (*) as placeholder for
            partial searches.
        tokenType:
          type: string
          description: Type of the token.
          enum:
            - NORMAL
            - IMPERSONATED
        username:
          type: string
          description: >-
            The email address of the user for whom the token was created (case
            sensitive).
    StatusInfoTypeDTO:
      type: object
      required:
        - reason
        - status
      properties:
        reason:
          type: string
          description: 'Gives reason for partial failure or failure. '
        status:
          type: string
          enum:
            - SUCCESS
            - FAILURE
            - PARTIAL_FAILURE
    AccessTokenAPIResponse_AccessTokenResponseWithTokenValue_:
      type: object
      properties:
        responseObject:
          $ref: '#/components/schemas/AccessTokenResponseWithTokenValue'
        statusMessage:
          type: string
          description: The status message related to this API request.
    AccessTokenAPIResponse_AccessTokenResponse_:
      type: object
      properties:
        responseObject:
          $ref: '#/components/schemas/AccessTokenResponse'
        statusMessage:
          type: string
          description: The status message related to this API request.
    AccessTokenAPIResponse_List_AccessTokenResponse_:
      type: object
      properties:
        responseObject:
          type: array
          description: The return value of this API request
          items:
            $ref: '#/components/schemas/AccessTokenResponse'
        statusMessage:
          type: string
          description: The status message related to this API request.
    AccessTokenAPIResponse_PaginationSupportedResponse_List_AccessTokenResponse_:
      type: object
      properties:
        responseObject:
          $ref: >-
            #/components/schemas/PaginationSupportedResponse_List_AccessTokenResponse_
        statusMessage:
          type: string
          description: The status message related to this API request.
    AccessTokenAPIResponse_int_:
      type: object
      properties:
        responseObject:
          type: integer
          format: int32
          description: The return value of this API request
        statusMessage:
          type: string
          description: The status message related to this API request.
    PaginationSupportedResponse_List_AccessTokenResponse_:
      type: object
      properties:
        pageNumber:
          type: integer
          format: int32
        pageSize:
          type: integer
          format: int32
        response:
          type: array
          items:
            $ref: '#/components/schemas/AccessTokenResponse'
        totalResults:
          type: integer
          format: int64
