> ## Documentation Index
> Fetch the complete documentation index at: https://swapnice.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Get authorization server metadata

> Discover authorize, token, introspect, and revoke URLs. No authentication.

Discover authorize, token, introspect, and revoke URLs. No authentication.

Call this first to confirm you are talking to the Partner API.

```bash theme={null}
curl https://api.sandbox.swapnice.com/.well-known/oauth-authorization-server
```


## OpenAPI

````yaml openapi.yaml GET /.well-known/oauth-authorization-server
openapi: 3.0.3
info:
  title: Swapnice Partner API
  version: 0.1.0
  description: >
    Swapnice's partner API lets trusted partner applications connect customer
    accounts,

    collect explicit consent, ingest governed events and claims, and
    synchronously read

    consent-filtered profile intelligence with provenance.


    The API is designed for a Cloudflare Workers gateway backed by Durable
    Objects for

    short-lived sessions, per-customer ordering, consent coordination, and
    idempotency,

    plus D1 for longer-lived partner app configuration, consent archives, token
    metadata,

    customer records, and audit history.


    Public schemas use descriptive field names. Compact Firebase-era storage
    keys such as

    `c0`, `p0`, or `upiv` are internal implementation details and must not be
    exposed.
  contact:
    name: Swapnice API Support
    email: api@swapnice.com
  license:
    name: Proprietary
    url: https://swapnice.com/legal/api-terms
servers:
  - url: https://api.swapnice.com
    description: Production API
  - url: https://api.sandbox.swapnice.com
    description: Sandbox API
security:
  - OAuth2: []
tags:
  - name: OAuth
    description: OAuth 2.1 authorization, token, introspection, revocation, and discovery.
  - name: Apps
    description: Partner OAuth application configuration and webhook endpoints.
  - name: Connection Sessions
    description: Short-lived account-linking sessions coordinated by Durable Objects.
  - name: Consent
    description: Consent grants, receipts, effective consent state, and revocation.
  - name: Customers
    description: Partner-scoped customer records and metadata.
  - name: Ontologies
    description: Ontology contracts and filter-field metadata for entries and events.
  - name: Entries
    description: Ontology-backed collectible entries using readable external fields.
  - name: Events
    description: Non-blocking ordered event and claim ingestion.
  - name: Profiles
    description: Consent-aware synchronous reads for claims, intents, and profile facts.
  - name: Webhooks
    description: Partner webhook endpoint registration and delivery status.
paths:
  /.well-known/oauth-authorization-server:
    get:
      tags:
        - OAuth
      summary: Get OAuth authorization server metadata
      operationId: getOAuthAuthorizationServerMetadata
      responses:
        '200':
          description: OAuth authorization server metadata.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthAuthorizationServerMetadata'
        '400':
          $ref: '#/components/responses/BadRequest'
      security: []
components:
  schemas:
    OAuthAuthorizationServerMetadata:
      type: object
      required:
        - issuer
        - authorization_endpoint
        - token_endpoint
        - response_types_supported
        - grant_types_supported
        - code_challenge_methods_supported
      properties:
        issuer:
          type: string
          format: uri
        authorization_endpoint:
          type: string
          format: uri
        token_endpoint:
          type: string
          format: uri
        introspection_endpoint:
          type: string
          format: uri
        revocation_endpoint:
          type: string
          format: uri
        response_types_supported:
          type: array
          items:
            type: string
          example:
            - code
        grant_types_supported:
          type: array
          items:
            type: string
          example:
            - authorization_code
            - refresh_token
        code_challenge_methods_supported:
          type: array
          items:
            type: string
          example:
            - S256
        scopes_supported:
          type: array
          items:
            type: string
    ErrorResponse:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - request_id
          properties:
            code:
              type: string
              example: consent_denied
            message:
              type: string
            request_id:
              type: string
            details:
              type: array
              items:
                $ref: '#/components/schemas/ErrorDetail'
    ErrorDetail:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
        message:
          type: string
        field:
          type: string
  responses:
    BadRequest:
      description: Invalid request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    OAuth2:
      type: oauth2
      description: >-
        OAuth 2.1 authorization code with PKCE. Implicit and password flows are
        unsupported.
      flows:
        authorizationCode:
          authorizationUrl: https://api.swapnice.com/oauth/authorize
          tokenUrl: https://api.swapnice.com/oauth/token
          refreshUrl: https://api.swapnice.com/oauth/token
          scopes:
            offline_access: Issue rotating refresh tokens when allowed.
            apps:read: Read partner app configuration.
            apps:write: Manage partner app configuration.
            connections:read: Read connection sessions.
            connections:write: Create or cancel connection sessions.
            consent:read: Read consent receipts and effective consent.
            consent:write: Create and revoke consent.
            customers:read: Read partner customers.
            customers:write: Create or update partner customers.
            ontologies:read: Read ontologies and field maps.
            ontologies:write: Rebuild ontology filter metadata.
            entries:read: Read ontology-backed entries.
            entries:write: Create or update ontology-backed entries.
            events:read: Read event status.
            events:write: Ingest events and claims.
            profile:read: Read resolved profile facts.
            profiles:read: Read profile resources.
            claims:read: Read claims.
            intents:read: Read intents.
            webhooks:read: Read webhook endpoints.
            webhooks:write: Manage webhook endpoints.
            workflows:read: Read async workflow status.
            tokens:introspect: Introspect tokens.
            tokens:revoke: Revoke tokens.

````