openapi: 3.0.3
info:
  title: SIM Swap (CAMARA)
  description: |
    SIM Swap (CAMARA) enables you to verify that a SIM card has not recently been swapped.
  version: 0.4.0

servers:
  - url: https://api-sandbox.vf-dmp.engineering.vodafone.com
    description: "Sandbox"
  # - url: https://api.vf-dmp.engineering.vodafone.com
  #   description: "Production"
 
paths:

  /openIDConnectCIBA/v1/bc-authorize:
    post:
      # security:
      #   - BasicAuth: []
      tags:
        - Authentication Flow
      description: The SP makes a request to Vodafone’s Backchannel Authentication Endpoint to ask for end-user authorization. Vodafone validates the MSISDN is a Vodafone MSISDN and checks consent. If successful, it passes the request to the VF IDGW for processing. Once VF IDGW processing is successful, an “auth_req_id” is provided in the response to the SP.
      operationId: authenticationRequest
      parameters:
        - $ref: "#/components/parameters/authorization-basic"
        - $ref: "#/components/parameters/X-Correlator"
        - $ref: "#/components/parameters/vf-trace-transaction-id"
        - $ref: "#/components/parameters/vf_ext_bp_id"
        
      requestBody:
        description: |
          The SP makes a request to Vodafone’s Backchannel Authentication Endpoint to ask for end-user authorization. Vodafone validates the MSISDN is a Vodafone MSISDN and checks consent. If successful, it passes the request to the VF IDGW for processing. Once VF IDGW processing is successful, an “auth_req_id” is provided in the response to the SP.
        content :
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/AuthorizeReq"
        required: true
      responses:
        "200":
          description: | 
            **OK** If the authorization request is successfully completed (i.e. without error), an authorization id (auth_req_id) is returned by ID Gateway, in an HTTP 200 response in json payload with parameters.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AuthenticationResp"

        "400":
          $ref: "#/components/responses/AuthError400"
        "401":
          $ref: "#/components/responses/AuthError401"
        "403":
          $ref: "#/components/responses/AuthError403"
        "406":
          $ref: "#/components/responses/AuthError406"
        "415":
          $ref: "#/components/responses/AuthError415"
        "500":
          $ref: "#/components/responses/AuthError500"
        "502":
          $ref: "#/components/responses/AuthError502"
        "503":
          $ref: "#/components/responses/AuthError503"

        # '400' :
        #   description: |
        #       **Bad request**
        #   content:
        #     application/json:
        #       examples:
        #         login_hint missing:
        #           value: {
        #                   "error": "invalid_request",
        #                   "error_description": "The request is missing a mandatory parameter login_hint"
        #                   }
        #         scope missing:
        #           value: {
        #                   "error": "invalid_request",
        #                   "error_description": "The request is missing a mandatory parameter scope"
        #                   }
        #         same param multiple time:
        #           value: {
        #                   "error": "invalid_request",
        #                   "error_description": "Request contains same parameter multiple times"
        #                   }
        #         invalid vf-trace-transaction-id:
        #           value: {
        #                   "error": "invalid_request",
        #                   "error_description": "The request parameter vf-trace-transaction-id is invalid"
        #                   }
        #         invalid X-Correlator:
        #           value: {
        #                   "error": "invalid_request",
        #                   "error_description": "The request parameter X-Correlator is invalid"
        #                   }
        #         invalid MSISDN:
        #           value: {
        #                   "error": "invalid_request",
        #                   "error_description": "The request parameter login_hint is invalid"
        #                   }
        #         invalid scope:
        #           value: {
        #                   "error": "invalid_request",
        #                   "error_description": "The request parameter scope is invalid"
        #                   }

        # '401' : 
        #   description: |
        #       **Unauthorized**
        #   content:
        #     application/json:
        #       examples:
        #         invalid_client:
        #           value: {
        #             "error": "invalid_client",
        #             "error_description": "Client Authentication failed"
        #           }
        # '403' : 
        #   description: |
        #       **Forbidden**
        #   content:
        #     application/json:
        #       examples:
        #         login_hint Not whitelisted:
        #           value: {
        #             "error": "access_denied",
        #             "error_description": "The service is not whitelisted for the requested country"
        #           }
        #         invalid request IP:
        #           value: {
        #             "error": "access_denied",
        #             "error_description": "The access is denied"
        #           }

        # '406' :
        #   description: |
        #       **Not Acceptable**
        #   content:
        #     application/json:
        #       examples:
        #         Not Acceptable:
        #           value: {
        #             "error": "Not Acceptable",
        #             "error_description": "The Accept header is invalid ",
        #           }
                  

        # '415' :
        #   description: |
        #       **Unsupported Media Type**
        #   content:
        #     application/json:
        #       examples:
        #         Unsupported Media Type:
        #           value: {
        #             "error": "invalid_request",
        #             "error_description": "The value of the Content-Type header is invalid",
        #           }
                  
        # '500' : 
        #   description: |
        #       **Internal Server Error**
        #   content:
        #     application/json:
        #       examples:
        #         internal processing fail:
        #           value: {
        #             "error": "server_error",
        #             "error_description": "The authorization server encountered an unexpected condition that prevented it from fulfilling the request"
        #           }
        #         config param not extracted:
        #           value: {
        #             "error": "server_error",
        #             "error_description": "Internal configuration error"
        #           }

        # '502' :
        #   description: |
        #       **Bad Gateway**
        #   content:
        #     application/json:
        #       examples:
        #         Bad Gateway:
        #           value: {
        #             "error": "server_error",
        #             "error_description": "Error connecting to an upstream server"
        #           }
                  
        # '503' :
        #   description: |
        #       **Service Unavailable**
        #   content:
        #     application/json:
        #       examples:
        #         Service Unavailable:
        #           value: {
        #             "error": "temporarily unavailable",
        #             "error_description": "An upstream server is unavailable"
        #           }

  /openIDConnectCIBA/v1/token:
    post:
      # security:
      #   - BasicAuth: []
      tags:
        - Authentication Flow
      description: | 
        The request to the token endpoint must be sent using the HTTP POST method and have parameters populated in accordance with the rules
      operationId: tokenRequest
      parameters:
        - $ref: "#/components/parameters/authorization-basic"
        - $ref: "#/components/parameters/X-Correlator"
        - $ref: "#/components/parameters/vf-trace-transaction-id"
        - $ref: "#/components/parameters/vf_ext_bp_id"


      requestBody:
        description: |
          The request to the token endpoint must be sent using the HTTP POST method and have parameters populated in accordance with the rules.
        content :
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/TokenReq"
        required: true
      responses:
        "200":
          description: | 
            **OK** If the token request is successfully completed (i.e. without error), an acess_token is returned by Gateway, in an HTTP 200 response in json payload with parameters.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/TokenResp"
        "400":
          $ref: "#/components/responses/AuthError400"
        "401":
          $ref: "#/components/responses/AuthError401"
        "403":
          $ref: "#/components/responses/AuthError403"
        "406":
          $ref: "#/components/responses/AuthError406"
        "415":
          $ref: "#/components/responses/AuthError415"
        "500":
          $ref: "#/components/responses/AuthError500"
        "502":
          $ref: "#/components/responses/AuthError502"
        "503":
          $ref: "#/components/responses/AuthError503"
  /camara/sim-swap/v0/retrieve-date:
    post:
      # security:
      #   - BearerAuth: []
      tags:
        - Sim-Swap APIs
      description: Get timestamp of last MSISDN <-> IMSI pairing change for a mobile user account provided with MSIDN.
      operationId: retrieveSimSwapDate
      parameters:
        - $ref: "#/components/parameters/X-Correlator"
        - $ref: "#/components/parameters/authorization-bearer"
        - $ref: "#/components/parameters/vf-trace-transaction-id"
        - $ref: "#/components/parameters/vf_ext_bp_id"
      # requestBody:
      #   description: |
      #     Create a SIM swap date request for a MSISDN identifier.
      #   content :
      #     application/json:
      #       schema:
      #         $ref: "#/components/schemas/CreateSimSwapDate"
      #   required: true
      responses:
        "200":
          description: |
            **OK** Contains information about SIM swap change
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SimSwapInfo"
        "400":
          $ref: "#/components/responses/Generic400"
        "401":
          $ref: "#/components/responses/Generic401"
        "403":
          $ref: "#/components/responses/Generic403"
        "404":
          $ref: "#/components/responses/Generic404"
        "405":
          $ref: "#/components/responses/Generic405"
        "406":
          $ref: "#/components/responses/Generic406"
        "415":
          $ref: "#/components/responses/Generic415"
        "429":
          $ref: "#/components/responses/Generic429"
        "500":
          $ref: "#/components/responses/Generic500"
        "503":
          $ref: "#/components/responses/Generic503"
        "504":
          $ref: "#/components/responses/Generic504"
  /camara/sim-swap/v0/check:
    post:
      # security:
      #   - BearerAuth: []
      tags:
      - Sim-Swap APIs
      description: Check if SIM swap has been performed during a past period
      operationId: checkSimSwap
      parameters:
        - $ref: "#/components/parameters/X-Correlator"
        - $ref: "#/components/parameters/authorization-bearer"
        - $ref: "#/components/parameters/vf-trace-transaction-id"
        - $ref: "#/components/parameters/vf_ext_bp_id"
      requestBody:
        description: |
          Create a check SIM swap request for a MSISDN identifier.
        content :
          application/json:
            schema:
              $ref: "#/components/schemas/CreateCheckSimSwap"
        required: true
      responses:
        "200":
          description: |
            **OK** Returns whether a SIM swap has been performed during a past period
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CheckSimSwapInfo"
        "400":
          $ref: "#/components/responses/Generic400"
        "401":
          $ref: "#/components/responses/Generic401"
        "403":
          $ref: "#/components/responses/Generic403"
        "404":
          $ref: "#/components/responses/Generic404"
        "405":
          $ref: "#/components/responses/Generic405"
        "406":
          $ref: "#/components/responses/Generic406"
        "415":
          $ref: "#/components/responses/Generic415"
        "429":
          $ref: "#/components/responses/Generic429"
        "500":
          $ref: "#/components/responses/Generic500"
        "503":
          $ref: "#/components/responses/Generic503"
        "504":
          $ref: "#/components/responses/Generic504"


components:

  # securitySchemes:
  #   BasicAuth:
  #       type: http
  #       scheme: basic
  #   BearerAuth:
  #     type: http
  #     scheme: bearer
    
  
  parameters:

    authorization-basic:
      name: Authorization
      in: header
      required: true
      description: |
        “Basic “ + base_64_encode (client_id + “:” + client_secret)
      schema:
        type: string
        example: | 
          Basic d3lCOHF1R0RPWTdXTnUyVUV2eGF5Sk9aNVpTSU1KM1Y6V2ZHQUJqSUJpRDIySg==
          
    authorization-bearer:
      name: Authorization
      in: header
      required: true
      description: |
        “Bearer ” concatenated with the access token obtained from the token endpoint response.
      schema:
        type: string
        example: | 
          Bearer dUk4Bs0qgKQKujbGxQDvIdXkI6Bz
  
    X-Correlator:
      name: X-Correlator
      in: header
      required: false
      description: Correlation id for the different services ie 42da5b19-457a-4d30-a5c4-038c62dccbb0.
      schema:
        type: string
        # example: A111123e4567-e89b-12d3-a456-426614174000111
        
    vf-trace-transaction-id:
      name: vf-trace-transaction-id
      in: header
      required: false
      description: A unique identifier for each request (typically a GUID).  This is not defined as part of the standard, but it can be used by the Service Provider to set a value which could assist in troubleshooting.  Note - if this header is not set in the request, Vodafone generates this value upon receipt of the message and returns the value in the response as a header. ie 42da5b19-457a-4d30-a5c4-038c62dccbb0
      schema:
        type: string
        # example: A111123e4567-e89b-12d3-a456-426614174000111

    vf_ext_bp_id:
      name: vf_ext_bp_id
      in: header
      required: false
      description: The "VF_EXT_BP_ID" header holds the Client Origin Id. This is a means for identifying the originating customer. It can be used to define a specific pricing model. The value of Client Origin Id can be up to 12 characters in length, and it can contain a combination of A-Z, a-z, underscore and hyphen characters as permitted values. (No other special characters/white space is permitted). The value of the Client Origin ID will be assigned by Vodafone and communicated to the appropriate customer team.
      schema:
        type: string

  schemas:
  
    AuthorizeReq:
      type: object
      required:
        - login_hint
        - scope
      properties:
        login_hint: 
          type: string
          example : "tel:+447123456789"
          description: | 
           End-user for whom the authentication is being requested. This is MSISDN in the format    “tel:+{MSISDN}”, where +" prefix is optional. Examples: “tel:+447123456789” or “tel:34712345678”.
        scope: 
          type: string
          enum:
            - openid retrieve-sim-swap-date
            - openid check-sim-swap
          example: openid retrieve-sim-swap-date
          description: | 
            Authorization request MUST contain the scope value.
    AuthenticationResp:
      type: object
      properties:
        auth_req_id: 
          type: string
          format: UUID
          example: 39da5b19-457a-4d30-a5c4-047c62dcca3b
          description: |
            Unique Id of this authorization (to be used in the token request).
        expires_in: 
          type: number
          format: number
          example: 300
          description: | 
            The timeout available to make a request to the token endpoint. i.e. The request must be made before the “expires_in” time is reached.
        interval: 
          type: number
          format: number
          example: 0
          description: | 
            The time required to wait between receiving the authorization endpoint response and making the polling endpoint request (in seconds). This value can be ignored.
    
    TokenReq:
      type: object
      required:
        - auth_req_id
        - grant_type
      properties:
        auth_req_id: 
          type: string
          example : "39da5b19-457a-4d30-a5c4-047c62dcca3b"
          description: | 
           The auth_req_id received in the successful authorization endpoint response.
        grant_type: 
          type: string
          example: urn:openid:params:mc:grant-type:ciba
          description: | 
            For all token requests the value of the grant_type parameter MUST have the value: "urn:openid:params:mc:grant-type:ciba" (Note: must be url encoded)
    TokenResp:
      type: object
      properties:
        access_token: 
          type: string
          example: dUk4Bs0qgKQKujbGxQDvIdXkI6Bz
          description: |
            OAuth 2.0 access_token used to gain access to the end-user information. This token CANNOT can be reused
        token_type: 
          type: string
          example: Always "Bearer"
          description: | 
            The timeout available to make a request to the token endpoint. i.e. The request must be made before the “expires_in” time is reached.
        expires_in: 
          type: number
          format: number
          example: 3599
          description: | 
            Expiration time of the Access Token in seconds since the response was generated.
        id_token: 
          type: string
          example: "eyJraWQiOiJ0ZXN0IiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYeyJpc3MiOiJodHRwczovL2FwaXN0YWdpbmdyZWYuZGV2ZWxvcGVyLnZvZGFmb25lLmNvbSIsInN1YiI6ImRhNTNhOWRlLTljMmQtNGZkYy1hODY1LWE4OWZiZThmZGE2MyIsImF1ZCI6ImJSdlJKZVBHaGlMQndmelJSdEx3Z3REVFZ4UFdSQU1BIiwiZXhwIjoxNjA2OTE2Mzc2LCJpYXQiOjE2MDY5MTI3NzYsImF1dGhfdGltZSI6MTYwNjkxMjc1Niwibm9uY2UiOiI0NTI1OTUtOWRhMS00NDZiLWE0MmEtMWJkZmJmMTRhOGJjIiwiYXRfaGFzaCI6Ik9FRkZRVFpCTURCQ09FTkJRVVZFT0RnMU1qRTRSalJCUXpaQ1FUVXdRa1E0TWtRM1JFSTVSamsyT1RVMVJEbERPRE5GUkVFM05qa3hOVFl4UWpjM09BPT0iLCJhY3IiOiIwIiwiYW1yIjpbIk5PX0FVVEhOIl0sImF6cCI6IjU0NjEyNTk1LTlkYTAtNDQ2Yi1hNDJhLTFiZGZiZjE0YThhZiIsImhhc2hlZF9sb2dpbl9oaW50IjoiQUVBNkEwMEI4Q0FBRUQ4ODUyMThGNEFDNkJBNTBCRDgyRDdEQjlGOTY5NTVEOUM4M0VEQTc2OTE1NjFCNzc4In0.8Y4SArYeLdwyVUF7zjW9hyWTULiANn_MbvfXkxk62mKdPEeTI0HNOAG9tsItR1KVhHQdotAZOcoTNLRn66w4TMphQ1K2wfRcWTWKrTXtUA3Xuyx_bhZTkm7Zkz8k944JgpxejWgCjVUejlOiaQJZhu23UWufpd1An4x8UY7JU1LsKJj_OFMleESuM4xoJru0fPUkMMcNKB9D76sfBeSaZeMdqUARBhoWLyO_cb79sFfpu1Uf9V8SFB3NLRuktu0KANwqipwc_5c4LtxzP_rw3A_hWcaGpT67Qk1-tisW6ITCvrFKzZ5aqn8qWPEcte-XGoCXwd7pp0HKzgd1G8xw"
          description: | 
            This token is not used in CAMARA CIBA flows at this stage and can be ignored.
  
    SimSwapInfo:
      type: object
      properties:
        latestSimChange: 
          type: string
          format: date-time
          description: Timestamp of latest SIM swap performed
    CheckSimSwapInfo:
      type: object
      properties:
        swapped:
          type: boolean
          description: Indicates whether the SIM card has been swapped during the period within the provided age.
    PhoneNumber:
      type: string
      pattern: '^\+?[0-9]{5,15}$'
      example: '+346661113334'
      description: Subscriber number in E.164 format (starting with country code). Optionally prefixed with '+'.
    
    ErrorInfo:
      type: object
      required:
        - status
        - code
        - message
      properties:
        status:
          type: integer
          description: HTTP response status code
        code:
          type: string
          description: Code given to this error
        message:
          type: string
          description: Detailed error description
          
    AuthErrorInfo:
      type: object
      required:
        - status
        - code
        - message
      properties:
        error:
          type: integer
          description: HTTP response status code
        error_description:
          type: string
          description: Detailed error description
    CreateCheckSimSwap:
      type: object
      required:
        - phoneNumber
      properties:
        # phoneNumber:
        #   $ref: "#/components/schemas/PhoneNumber"
        maxAge:
          type: integer
          example: 240
          description: |
            Time period in hours to check mobile account for SIM Swap.Minimum value: 1 (hours) Maximum value: 2400 (hours) If not provided, default value used is 240 (hours).
          format: int32
          minimum: 1
          maximum: 2400
          default: 240
    CreateSimSwapDate:
      type: object
      required:
        - phoneNumber
      properties:
        phoneNumber:
          $ref: "#/components/schemas/PhoneNumber"





  responses:
    Generic400:
      description: |
        **Bad Request**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            invalid argument:
              value:
                status: 400
                code: INVALID_ARGUMENT
                message: Client specified an invalid argument, request body or query param
    Generic401:
      description: |
        **Unauthorized**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            invalid creds:
              value:
                status: 401
                code: UNAUTHENTICATED
                message: Request not authenticated due to missing, invalid, or expired credentials
    Generic403:
      description: |
        **Forbidden**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            permission denied:
              value:
                status: 403
                code: PERMISSION_DENIED
                message: Client does not have sufficient permissions to perform this action
    Generic404:
      description: |
        **Not Found**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:

              NOT_FOUND:
                value: {
                          "status": 404,
                          "code" : "NOT_FOUND",
                          "message": "The specified resource is not found."
                        }
              UNKNOWN_PHONE_NUMBER:
                value: {
                          "status": 404,
                          "code" : "SIM_SWAP.UNKNOWN_PHONE_NUMBER",
                          "message": "SIM Swap can't be checked because the phone number is unknown."
                        }
    Generic405:
      description: |
        **Method Not Allowed**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            METHOD_NOT_ALLOWED:
              value:
                status: 405
                code: METHOD_NOT_ALLOWED
                message: The requested method is not allowed/supported on
                      the target resource"
    Generic406:
      description: |
        **Not Acceptable**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            Not Acceptable:
              value:
                status: 406
                code: Not Acceptable
                message: The server cannot produce a response matching
                          the content requested by the client through Accept-* headers."
    Generic415:
      description: |
        **Unsupported Media Type**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            UNSUPPORTED_MEDIA_TYPE:
              value:
                status: 415
                code: UNSUPPORTED_MEDIA_TYPE
                message: The server refuses to accept the request because
                      the payload format is in an unsupported format
                      
    Generic429:
      description: |
        **Too Many Requests**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
              SpikeArrestViolation:
                value: {
                          "status": 429,
                          "code" : "TOO_MANY_REQUESTS",
                          "message": "Spike Arrest Violation."
                        }
              QuotaViolation:
                value: {
                          "status": 429,
                          "code" : "TOO_MANY_REQUESTS",
                          "message": "API/App/Country Quota limit reached."
                        }
                        
    Generic500:
      description: |
        **Internal Server Error**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            Internal_Server_Error:
              value:
                status: 500
                code: INTERNAL
                message: The server encountered an unexpected condition
                      that prevented it from fulfilling the request
    Generic502:
      description: |
        **Bad Gateway**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            Bad_Gateway:
              value:
                status: 502
                code: BAD_GATEWAY
                message: An upstream internal service cannot be reached

    Generic503:
      description: |
        **UNAVAILABLE**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            UNAVAILABLE:
              value:
                status: 503
                code: UNAVAILABLE
                message: Request timeout exceeded
    Generic504:
      description: |
        **Gateway Timeout**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorInfo'
          examples:
            TIMEOUT:
              value:
                status: 504
                code: TIMEOUT
                message: Request timeout exceeded. 
            
    AuthError400:
      description: | 
        **Bad Request**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthErrorInfo'
          examples:
            login_hint missing:
              value: {
                        "error": "invalid_request",
                        "error_description": "The request is missing a mandatory parameter login_hint"
                      }
            scope missing:
              value: {
                        "error": "invalid_request",
                        "error_description": "The request is missing a mandatory parameter scope"
                      }
            same param multiple time:
                  value: {
                           "error": "invalid_request",
                           "error_description": "Request contains same parameter multiple times"
                          }
            invalid vf-trace-transaction-id:
                  value: {
                           "error": "invalid_request",
                           "error_description": "The request parameter vf-trace-transaction-id is invalid"
                          }
            invalid X-Correlator:
                  value: {
                           "error": "invalid_request",
                           "error_description": "The request parameter X-Correlator is invalid"
                          }
            invalid MSISDN:
                  value: {
                           "error": "invalid_request",
                           "error_description": "The request parameter login_hint is invalid"
                          }
            invalid scope:
                  value: {
                           "error": "invalid_request",
                           "error_description": "The request parameter scope is invalid"
                          }
    AuthError401:
      description: |
        **Unauthorized**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthErrorInfo'
          examples:
            auth header invalid:
              value: {
                        "error": "invalid_client",
                        "error_description": "Client Authentication failed"
                      }
    AuthError403:
      description: | 
        **Forbidden**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthErrorInfo'
          examples:
            login_hint not whitelisted:
              value: {
                        "error": "access_denied",
                        "error_description": "The service is not whitelisted for the requested country"
                      }
            invalid request IP:
              value: {
                        "error": "access_denied",
                        "error_description": "The access is denied"
                      }

    AuthError406:
      description: |
        **Not Acceptable**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthErrorInfo'
          examples:
            Invalid Accept Header:
              value: {
                        "error": "server_error",
                        "error_description": "The Accept header is invalid"
                      }

    AuthError415:
      description: |
        **Unsupported Media Type**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthErrorInfo'
          examples:
            Invalid Content-Type :
              value: {
                        "error": "server_error",
                        "error_description": "The value of the Content-Type header is invalid"
                      }

    AuthError500:
      description: | 
        **Internal Server Error**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthErrorInfo'
          examples:
            Config Param Error:
              value: {
                        "error": "server_error",
                        "error_description": "Internal configuration error"
                      }
            Internal Processing Fail:
              value: {
                        "error": "server_error",
                        "error_description": "The authorization server encountered an unexpected condition that prevented it from fulfilling the request"
                      }

    AuthError502:
      description: | 
        **Bad Gateway**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthErrorInfo'
          examples:
            Bad Gateway:
              value: {
                        "error": "server_error",
                        "error_description": "Error connecting to an upstream server"
                      }
    AuthError503:
      description: | 
        **Service Unavailiable**
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthErrorInfo'
          examples:
            Service Unavailiable:
              value: {
                        "error": "temporarily unavailable",
                        "error_description": "An upstream server is unavailable"
                      }

