{"openapi":"3.1.0","info":{"title":"MACROSTRATEGIES login","version":"1.0.0","description":"Email-code OpenID Connect provider for Cloudflare Access. Access is the relying party and enforces the session and policies.","license":{"name":"Proprietary"}},"servers":[{"url":"https://login.macrostrategies.ai"}],"paths":{"/":{"get":{"summary":"Redirects to https://macrostrategies.ai/","responses":{"302":{"description":"Redirect to the main site"}}}},"/stack":{"get":{"summary":"Stack","responses":{"200":{"description":"HTML page","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/compliance":{"get":{"summary":"Compliance","responses":{"200":{"description":"HTML page","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/api":{"get":{"summary":"API reference","responses":{"200":{"description":"HTML page","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/sandbox":{"get":{"summary":"Sandbox (demo data, sends nothing)","responses":{"200":{"description":"HTML page","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/healthz":{"get":{"summary":"Health","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}}}},"503":{"description":"Configuration missing","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/openapi.json":{"get":{"summary":"This document","responses":{"200":{"description":"OpenAPI document","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/.well-known/openid-configuration":{"get":{"summary":"OIDC discovery","responses":{"200":{"description":"Discovery document","content":{"application/json":{"schema":{"type":"object"}}}},"503":{"description":"Unavailable","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/jwks.json":{"get":{"summary":"Public signing keys","responses":{"200":{"description":"JWK set","content":{"application/json":{"schema":{"type":"object"}}}},"503":{"description":"Unavailable","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/authorize":{"get":{"summary":"Start sign-in (OIDC authorization endpoint)","parameters":[{"name":"client_id","in":"query","required":true,"schema":{"type":"string"}},{"name":"redirect_uri","in":"query","required":true,"schema":{"type":"string"}},{"name":"response_type","in":"query","required":true,"schema":{"type":"string"}},{"name":"scope","in":"query","required":true,"schema":{"type":"string"}},{"name":"state","in":"query","required":true,"schema":{"type":"string"}},{"name":"nonce","in":"query","required":false,"schema":{"type":"string"}},{"name":"code_challenge","in":"query","required":false,"schema":{"type":"string"}},{"name":"code_challenge_method","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Email page","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"Redirect","headers":{"Location":{"schema":{"type":"string","format":"uri"}}}},"400":{"description":"Unknown client or redirect URI","content":{"text/html":{"schema":{"type":"string"}}}},"429":{"description":"Rate limited","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"Fails closed when configuration is missing","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/authorize/email":{"post":{"summary":"Send a code to an email address, if it has access","requestBody":{"required":true,"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"txn":{"type":"string","description":"Sign-in transaction id from the page. Must match the cookie."},"email":{"type":"string","format":"email"}},"required":["txn","email"]}}}},"responses":{"200":{"description":"Code page (same page whether or not the address has access)","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"Invalid email or expired sign-in","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"Origin mismatch","content":{"text/html":{"schema":{"type":"string"}}}},"429":{"description":"Rate limited","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"Send failed; nothing sent","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/authorize/resend":{"post":{"summary":"Send a new code to the same address","requestBody":{"required":true,"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"txn":{"type":"string","description":"Sign-in transaction id from the page. Must match the cookie."}},"required":["txn"]}}}},"responses":{"200":{"description":"Code page","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"Expired","content":{"text/html":{"schema":{"type":"string"}}}},"429":{"description":"Rate limited","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/authorize/restart":{"post":{"summary":"Go back to the email step","requestBody":{"required":true,"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"txn":{"type":"string","description":"Sign-in transaction id from the page. Must match the cookie."}},"required":["txn"]}}}},"responses":{"200":{"description":"Email page","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"Expired","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/authorize/verify":{"post":{"summary":"Check a code and return to Access","requestBody":{"required":true,"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"txn":{"type":"string","description":"Sign-in transaction id from the page. Must match the cookie."},"code":{"type":"string","pattern":"^[0-9]{6}$"}},"required":["txn","code"]}}}},"responses":{"302":{"description":"Redirect","headers":{"Location":{"schema":{"type":"string","format":"uri"}}}},"400":{"description":"Wrong, expired, or used code","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"Origin mismatch","content":{"text/html":{"schema":{"type":"string"}}}},"429":{"description":"Rate limited","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/token":{"post":{"summary":"Redeem an authorization code (OIDC token endpoint)","security":[{"clientBasic":[]},{}],"requestBody":{"required":true,"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"grant_type":{"type":"string","enum":["authorization_code"]},"code":{"type":"string"},"redirect_uri":{"type":"string","format":"uri"},"code_verifier":{"type":"string"},"client_id":{"type":"string"},"client_secret":{"type":"string"}},"required":["grant_type","code","redirect_uri"]}}}},"responses":{"200":{"description":"Tokens","content":{"application/json":{"schema":{"type":"object","properties":{"access_token":{"type":"string"},"token_type":{"type":"string"},"expires_in":{"type":"integer"},"id_token":{"type":"string"},"scope":{"type":"string"}}}}}},"400":{"description":"invalid_request, invalid_grant, or unsupported_grant_type","content":{"application/json":{"schema":{"type":"object"}}}},"401":{"description":"invalid_client","content":{"application/json":{"schema":{"type":"object"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"server_error; fails closed","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/sandbox/api/code":{"post":{"summary":"Sandbox: issue a demo code for an @example.com address. Sends nothing.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email"}},"required":["email"]}}}},"responses":{"200":{"description":"Demo code","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Not an @example.com address","content":{"application/json":{"schema":{"type":"object"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/sandbox/api/verify":{"post":{"summary":"Sandbox: check a demo code. Issues no token.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string"},"code":{"type":"string"}},"required":["email","code"]}}}},"responses":{"200":{"description":"Result","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Wrong or expired code","content":{"application/json":{"schema":{"type":"object"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"type":"object"}}}}}}}},"components":{"securitySchemes":{"clientBasic":{"type":"http","scheme":"basic"}}}}