api_spec.yaml

openapi: 3.0.0
info:
  description: |
    This is the API exposed by the SuperTokens Core. To be consumed by your backend only.

    `appid-<appId>` and `<tenantId>` in all the APIs are optional. Their default values are `appid-public` and `public` respectively.

    Those that do not have `<tenantId>` in the path will enforce that the API is called from `public` tenant only.

  version: 5.1.1
  title: Core Driver Interface
  contact:
    email: team@supertokens.io
tags:
  - name: EmailPassword Recipe
  - name: ThirdParty Recipe
  - name: Passwordless Recipe
  - name: EmailVerification Recipe
  - name: User Metadata Recipe
  - name: User Roles Recipe
  - name: UserIdMapping Recipe
  - name: Session Recipe
  - name: Multitenancy Recipe
  - name: Core
  - name: Dashboard Recipe
  - name: Totp Recipe
  - name: Account Linking Recipe

paths:
  /appid-<appId>/recipe/accountlinking/user/primary/check:
    get:
      tags:
        - Account Linking Recipe
      operationId: canCreatePrimaryUser
      description: |
        Check if primary user can be created for given user id
      parameters:
        - $ref: '#/components/parameters/accountLinkingRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: recipeUserId
          schema:
            type: string
            example: fa7a0841-b533-4478-9253-0fde890c576
          required: true
      responses:
        '200':
          description: Indicates success with the status and canCreatePrimaryUser properties
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      wasAlreadyAPrimaryUser:
                        type: boolean
                        example: true
                  - type: object
                    properties:
                      status:
                        type: string
                        enum:
                          [
                            'ACCOUNT_INFO_ALREADY_ASSOCIATED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR',
                          ]
                      primaryUserId:
                        type: string
                        example: fa7a0841-b533-4478-9253-0fde890c576
                      description:
                        type: string
                  - type: object
                    properties:
                      status:
                        type: string
                        enum:
                          [
                            'RECIPE_USER_ID_ALREADY_LINKED_WITH_PRIMARY_USER_ID_ERROR',
                          ]
                      primaryUserId:
                        type: string
                        example: fa7a0841-b533-4478-9253-0fde890c576
                      description:
                        type: string
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/accountlinking/user/link/check:
    get:
      tags:
        - Account Linking Recipe
      operationId: canLinkAccounts
      description: |
        Check if accounts can be linked for given primary and recipe user id
      parameters:
        - $ref: '#/components/parameters/accountLinkingRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: primaryUserId
          schema:
            type: string
            example: fa7a0841-b533-4478-9253-0fde890c576
          required: true
        - in: query
          name: recipeUserId
          schema:
            type: string
            example: fa7a0841-b533-4478-9253-0fde890c576
          required: true
      responses:
        '200':
          description: Indicates success with the status prop
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      accountsAlreadyLinked:
                        type: boolean
                        example: true
                  - type: object
                    properties:
                      status:
                        type: string
                        enum:
                          [
                            'ACCOUNT_INFO_ALREADY_ASSOCIATED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR',
                          ]
                      primaryUserId:
                        type: string
                        example: fa7a0841-b533-4478-9253-0fde890c576
                      description:
                        type: string
                  - type: object
                    properties:
                      status:
                        type: string
                        enum:
                          [
                            'RECIPE_USER_ID_ALREADY_LINKED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR',
                          ]
                      primaryUserId:
                        type: string
                        example: fa7a0841-b533-4478-9253-0fde890c576
                      description:
                        type: string
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['INPUT_USER_IS_NOT_A_PRIMARY_USER']
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/accountlinking/user/primary:
    post:
      tags:
        - Account Linking Recipe
      operationId: createPrimaryUser
      description: |
        Create a primary user for given user id
      parameters:
        - $ref: '#/components/parameters/accountLinkingRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                recipeUserId:
                  type: string
                  example: fa7a0841-b533-4478-9253-0fde890c576
              required:
                - recipeUserId
      responses:
        '200':
          description: Indicates success with the status and primaryUserId properties
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      wasAlreadyAPrimaryUser:
                        type: boolean
                        example: true
                      user:
                        $ref: '#/components/schemas/authRecipeUser'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum:
                          [
                            'ACCOUNT_INFO_ALREADY_ASSOCIATED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR',
                          ]
                      primaryUserId:
                        type: string
                        example: fa7a0841-b533-4478-9253-0fde890c576
                      description:
                        type: string
                  - type: object
                    properties:
                      status:
                        type: string
                        enum:
                          [
                            'RECIPE_USER_ID_ALREADY_LINKED_WITH_PRIMARY_USER_ID_ERROR',
                          ]
                      primaryUserId:
                        type: string
                        example: fa7a0841-b533-4478-9253-0fde890c576
                      description:
                        type: string
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/accountlinking/user/link:
    post:
      tags:
        - Account Linking Recipe
      operationId: linkAccounts
      description: |
        Link accounts for given primary and recipe user id
      parameters:
        - $ref: '#/components/parameters/accountLinkingRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                primaryUserId:
                  type: string
                  example: fa7a0841-b533-4478-9253-0fde890c576
                recipeUserId:
                  type: string
                  example: fa7a0841-b533-4478-9253-0fde890c576
              required:
                - primaryUserId
                - recipeUserId
      responses:
        '200':
          description: Indicates success with the status and accountsAlreadyLinked properties
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      accountsAlreadyLinked:
                        type: boolean
                        example: true
                      user:
                        $ref: '#/components/schemas/authRecipeUser'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum:
                          [
                            'ACCOUNT_INFO_ALREADY_ASSOCIATED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR',
                          ]
                      primaryUserId:
                        type: string
                        example: fa7a0841-b533-4478-9253-0fde890c576
                      description:
                        type: string
                  - type: object
                    properties:
                      status:
                        type: string
                        enum:
                          [
                            'RECIPE_USER_ID_ALREADY_LINKED_WITH_ANOTHER_PRIMARY_USER_ID_ERROR',
                          ]
                      primaryUserId:
                        type: string
                        example: fa7a0841-b533-4478-9253-0fde890c576
                      user:
                        $ref: '#/components/schemas/authRecipeUser'
                      description:
                        type: string
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['INPUT_USER_IS_NOT_A_PRIMARY_USER']
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/accountlinking/user/unlink:
    post:
      tags:
        - Account Linking Recipe
      operationId: unlinkAccounts
      description: |
        Unlink accounts for given recipe user id
      parameters:
        - $ref: '#/components/parameters/accountLinkingRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                recipeUserId:
                  type: string
                  example: fa7a0841-b533-4478-9253-0fde890c576
              required:
                - recipeUserId
      responses:
        '200':
          description: Indicates success with the status and accountsUnlinked properties
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      wasRecipeUserDeleted:
                        type: boolean
                        example: true
                      wasLinked:
                        type: boolean
                        example: true
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/totp/device:
    post:
      tags:
         - Totp Recipe
      operationId: createTotpDevice
      description: |
        Add a TOTP device for a user and enable TOTP if not already enabled.
      parameters:
        - $ref: '#/components/parameters/totpRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                deviceName:
                  type: string
                  example: "My Authy App"
                skew:
                  type: number
                  example: 0
                period:
                  type: number
                  example: 30
              required:
                - userId
                - skew
                - period

      responses:
        '200':
          description: Indicates success with the status and secret properties
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      secret:
                        type: string
                        example: "JBSWY3DPEHPK3PXP"
                      deviceName:
                        type: string
                        example: d1

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['DEVICE_ALREADY_EXISTS_ERROR']


        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'
    put:
      tags:
         - Totp Recipe
      operationId: updateTotpDeviceName
      description: |
        Update the name of a TOTP device for a user.
      parameters:
        - $ref: '#/components/parameters/totpRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                existingDeviceName:
                  type: string
                  example: "My Authy App"
                newDeviceName:
                  type: string
                  example: "A better name for my TOTP device"
              required:
                - userId
                - existingDeviceName
                - newDeviceName

      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["UNKNOWN_DEVICE_ERROR"]
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["DEVICE_ALREADY_EXISTS_ERROR"]

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/totp/device/list:
    get:
      tags:
          - Totp Recipe
      operationId: getTotpDevices
      description: |
        Retrieve a list of TOTP devices for a user.
      parameters:
        - $ref: '#/components/parameters/totpRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: userId
          schema:
            type: string
          required: true

      responses:
        '200':
          description: Retrives all TOTP devices
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      devices:
                        type: array
                        items:
                          type: object
                          properties:
                            name:
                              type: string
                            period:
                              type: number
                            skew:
                              type: number
                            verified:
                              type: boolean
                    required:
                      - status

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'
  /recipe/totp/device/import:
    post:
      tags:
         - Totp Recipe
      operationId: importTotpDevice
      description: |
        Add a TOTP device for a user and enable TOTP if not already enabled.
      parameters:
        - $ref: '#/components/parameters/totpRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                deviceName:
                  type: string
                  example: "My Authy App"
                skew:
                  type: number
                  example: 0
                period:
                  type: number
                  example: 30
                secretKey:
                  type: string
                  example: "BSWY3DPEMOWNFUWJLDIWNDNDPONBIUFG"
              required:
                - userId
                - skew
                - period
                - secretKey
      responses:
        '200':
          description: Indicates success with the status and secret properties
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      deviceName:
                        type: string
                        example: d1

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['DEVICE_ALREADY_EXISTS_ERROR']


        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/totp/device/remove:
    post:
      tags:
         - Totp Recipe
      operationId: removeTotpDevice
      description: |
        Remove a TOTP device for a user. If all devices are removed, TOTP is disabled for the user.
      parameters:
        - $ref: '#/components/parameters/totpRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                deviceName:
                  type: string
                  example: "My Authy App"
              required:
                - userId
                - deviceName

      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      didDeviceExist:
                        type: boolean
                        example: true

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/totp/verify:
    post:
      tags:
         - Totp Recipe
      operationId: verifyTotpCode
      description: |
        Check if a TOTP code is valid against any of the TOTP devices for a user.
      parameters:
        - $ref: '#/components/parameters/totpRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                totp:
                  type: string
                  example: "123456"
                allowUnverifiedDevices:
                  type: boolean
                  example: false
              required:
                - userId
                - totp
                - allowUnverifiedDevices

      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['INVALID_TOTP_ERROR']
                      currentNumberOfFailedAttempts:
                        type: number
                        example: 2
                      maxNumberOfFailedAttempts:
                        type: number
                        example: 5

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['UNKNOWN_USER_ID_ERROR']

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['LIMIT_REACHED_ERROR']
                      retryAfterMs:
                        type: number
                        example: 90000
                      currentNumberOfFailedAttempts:
                        type: number
                        example: 2
                      maxNumberOfFailedAttempts:
                        type: number
                        example: 5


        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/totp/device/verify:
    post:
      tags:
         - Totp Recipe
      operationId: verifyTotpDevice
      description: |
        Mark a TOTP device as verified if the given TOTP code is valid for that device.
      parameters:
        - $ref: '#/components/parameters/totpRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                deviceName:
                  type: string
                  example: "My Authy App"
                totp:
                  type: string
                  example: "123456"
              required:
                - userId
                - deviceName
                - totp

      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      wasAlreadyVerified:
                        type: boolean
                        example: false

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['UNKNOWN_DEVICE_ERROR']

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['INVALID_TOTP_ERROR']
                      currentNumberOfFailedAttempts:
                        type: number
                        example: 2
                      maxNumberOfFailedAttempts:
                        type: number
                        example: 5

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['LIMIT_REACHED_ERROR']
                      retryAfterMs:
                        type: number
                        example: 90000
                      currentNumberOfFailedAttempts:
                        type: number
                        example: 2
                      maxNumberOfFailedAttempts:
                        type: number
                        example: 5


        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/userid/map:
    post:
      tags:
         - UserIdMapping Recipe
      operationId: userIdMappingCreateMapping
      description: |
        Create a mapping between a SuperTokens userId and an external userId.
      parameters:
        - $ref: '#/components/parameters/userIdMappingRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                superTokensUserId:
                  $ref: '#/components/schemas/userId'
                externalUserId:
                  type: string
                  example: "externalId"
                externalUserIdInfo:
                  type: string
                  example: "Info about external userId"
                force:
                  type: boolean
              required:
                - superTokensUserId
                - externalUserId

      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['UNKNOWN_SUPERTOKENS_USER_ID_ERROR']

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['USER_ID_MAPPING_ALREADY_EXISTS_ERROR']
                      doesSuperTokensUserIdExist:
                        type: boolean
                      doesExternalUserIdExist:
                        type: boolean


        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'
    get:
      tags:
          - UserIdMapping Recipe
      operationId: userIdMappingGetMapping
      description: |
        Retrieve a UserIdMapping
      parameters:
        - $ref: '#/components/parameters/userIdMappingRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: userId
          schema:
            type: string
          required: true
        - in: query
          name: userIdType
          schema:
            type: string
            enum: ["SUPERTOKENS", "EXTERNAL", "ANY"]

      responses:
        '200':
          description: Retrives a userId mapping
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      superTokensUserId:
                        $ref: '#/components/schemas/userId'
                      externalUserId:
                        type: string
                        example: "externalId"
                      externalUserIdInfo:
                        type: string
                        example: "Info about external userId"
                    required:
                      - status
                      - superTokensUserId
                      - externalUserId
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["UNKNOWN_MAPPING_ERROR"]

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/userid/map/remove:
    post:
      tags:
         - UserIdMapping Recipe
      operationId: userIdMappingRemoveMapping
      description: |
        Delete a mapping between a SuperTokens userId and an external userId.
      parameters:
        - $ref: '#/components/parameters/userIdMappingRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                userIdType:
                  type: string
                  enum: ["SUPERTOKENS", "EXTERNAL", "ANY"]
                force:
                  type: boolean

              required:
                - userId

      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  didMappingExist:
                    type: boolean

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/userid/external-user-id-info:
    put:
      tags:
         - UserIdMapping Recipe
      operationId: userIdMappingUpateExternalUserIdInfo
      description: |
        Update or delete externalUserIdInfo
      parameters:
        - $ref: '#/components/parameters/userIdMappingRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                userIdType:
                  type: string
                  enum: ["SUPERTOKENS", "EXTERNAL", "ANY"]
                externalUserIdInfo:
                  type: string
                  example: "new external userId info"
                  nullable: true
              required:
                - userId
                - externalUserIdInfo

      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["UNKNOWN_MAPPING_ERROR"]

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/signinup/code/check:
    post:
      tags:
        - Passwordless Recipe
      operationId: passwordlessCheckCode
      description: |
        Tries to check if the passed userInputCode+deviceId combo or the linkCode is valid
      parameters:
        - $ref: '#/components/parameters/passwordlessRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - type: object
                  properties:
                    preAuthSessionId:
                      $ref: '#/components/schemas/preAuthSessionId'
                    linkCode:
                      $ref: '#/components/schemas/linkCode'
                  required:
                    - preAuthSessionId
                    - linkCode
                - type: object
                  properties:
                    preAuthSessionId:
                      $ref: '#/components/schemas/preAuthSessionId'
                    deviceId:
                      $ref: '#/components/schemas/deviceId'
                    userInputCode:
                      $ref: '#/components/schemas/userInputCode'
                  required:
                    - preAuthSessionId
                    - deviceId
                    - userInputCode
      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      consumedDevice:
                        type: object
                        required:
                          - preAuthSessionId
                          - failedCodeInputAttemptCount
                        properties:
                          preAuthSessionId:
                            $ref: '#/components/schemas/preAuthSessionId'
                          failedCodeInputAttemptCount:
                            type: number
                            example: 2
                          email:
                            $ref: '#/components/schemas/email'
                          phoneNumber:
                            $ref: '#/components/schemas/phoneNumber'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['INCORRECT_USER_INPUT_CODE_ERROR', 'EXPIRED_USER_INPUT_CODE_ERROR']
                      failedCodeInputAttemptCount:
                        type: number
                        example: 2
                      maximumCodeInputAttempts:
                        type: number
                        example: 5

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['RESTART_FLOW_ERROR']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/signinup/code/consume:
    post:
      tags:
        - Passwordless Recipe
      operationId: passwordlessTryUseCode
      description: |
        Tries to consume the passed userInputCode+deviceId combo or the linkCode to sign the user in
      parameters:
        - $ref: '#/components/parameters/passwordlessRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - type: object
                  properties:
                    preAuthSessionId:
                      $ref: '#/components/schemas/preAuthSessionId'
                    linkCode:
                      $ref: '#/components/schemas/linkCode'
                  required:
                    - preAuthSessionId
                    - linkCode
                - type: object
                  properties:
                    preAuthSessionId:
                      $ref: '#/components/schemas/preAuthSessionId'
                    deviceId:
                      $ref: '#/components/schemas/deviceId'
                    userInputCode:
                      $ref: '#/components/schemas/userInputCode'
                  required:
                    - preAuthSessionId
                    - deviceId
                    - userInputCode
      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      createdNewUser:
                        type: boolean
                        example: true
                      user:
                        $ref: '#/components/schemas/authRecipeUser'
                      recipeUserId:
                        $ref: '#/components/schemas/userId'
                      consumedDevice:
                        type: object
                        required:
                          - preAuthSessionId
                          - failedCodeInputAttemptCount
                        properties:
                          preAuthSessionId:
                            $ref: '#/components/schemas/preAuthSessionId'
                          failedCodeInputAttemptCount:
                            type: number
                            example: 2
                          email:
                            $ref: '#/components/schemas/email'
                          phoneNumber:
                            $ref: '#/components/schemas/phoneNumber'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['INCORRECT_USER_INPUT_CODE_ERROR', 'EXPIRED_USER_INPUT_CODE_ERROR']
                      failedCodeInputAttemptCount:
                        type: number
                        example: 2
                      maximumCodeInputAttempts:
                        type: number
                        example: 5

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['RESTART_FLOW_ERROR']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/signinup/code:
    post:
      tags:
        - Passwordless Recipe
      operationId: passwordlessStartSignIn
      description: |
        Starts a sign in process by requesting a linkCode and a deviceId + userInputCode combination the user can use to sign in.
        Passing the optional deviceId signifies a resend code flow.
      parameters:
        - $ref: '#/components/parameters/passwordlessRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - type: object
                  properties:
                    email:
                      $ref: '#/components/schemas/email'
                    userInputCode:
                      $ref: '#/components/schemas/userInputCode'
                  example:
                    email: "test@example.com"
                  required:
                    - email
                - type: object
                  properties:
                    phoneNumber:
                      $ref: '#/components/schemas/phoneNumber'
                    userInputCode:
                      $ref: '#/components/schemas/userInputCode'
                  required:
                    - phoneNumber
                - type: object
                  properties:
                    deviceId:
                      $ref: '#/components/schemas/deviceId'
                    userInputCode:
                      $ref: '#/components/schemas/userInputCode'
                  required:
                    - deviceId
      responses:
        '200':
          description: Starts the passwordless login process
          content:
            application/json:
                schema:
                  oneOf:
                    - type: object
                      properties:
                        status:
                          $ref: '#/components/schemas/statusOK'

                        preAuthSessionId:
                          $ref: '#/components/schemas/preAuthSessionId'

                        codeId:
                          $ref: '#/components/schemas/codeId'

                        deviceId:
                          $ref: '#/components/schemas/deviceId'

                        userInputCode:
                          $ref: '#/components/schemas/userInputCode'

                        linkCode:
                          $ref: '#/components/schemas/linkCode'

                        timeCreated:
                          $ref: '#/components/schemas/timeCreated'

                        codeLifetime:
                          $ref: '#/components/schemas/codeLifetime'
                    - type: object
                      properties:
                        status:
                          type: string
                          enum: ["RESTART_FLOW_ERROR", "USER_INPUT_CODE_ALREADY_USED_ERROR"]

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/signinup/code/remove:
    post:
      tags:
          - Passwordless Recipe
      operationId: passwordlessRevokeCode
      description: |
        Revokes a code by id
      parameters:
        - $ref: '#/components/parameters/passwordlessRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - type: object
                  properties:
                    codeId:
                      $ref: '#/components/schemas/codeId'
                  required:
                    - codeId
                - type: object
                  properties:
                    preAuthSessionId:
                      $ref: '#/components/schemas/preAuthSessionId'
                  required:
                    - preAuthSessionId
      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/signinup/codes:
    get:
      tags:
          - Passwordless Recipe
      operationId: passwordlessListCodes
      description: |
        Lists all active passwordless codes of the user
      parameters:
        - $ref: '#/components/parameters/passwordlessRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: email
          description: Use this parameter to get information about all devices associated with an email (without the other query params)
          schema:
            type: string
        - in: query
          name: phoneNumber
          description: Use this parameter to get information about all devices associated with a phoneNumber (without the other query params)
          schema:
            $ref: '#/components/schemas/phoneNumber'
        - in: query
          name: deviceId
          description: Use this parameter to get information about a single device (without the other query params)
          schema:
            $ref: '#/components/schemas/deviceId'
        - in: query
          name: preAuthSessionId
          description:  Use this parameter to get information about a single device (without the other query params)
          schema:
            $ref: '#/components/schemas/preAuthSessionId'
      responses:
        '200':
          description: List of all active passwordless codes of the user
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    devices:
                      type: array
                      items:
                        type: object
                        properties:
                          preAuthSessionId:
                            $ref: '#/components/schemas/preAuthSessionId'
                          failedCodeInputAttemptCount:
                            type: number
                            example: 2
                          email:
                            $ref: '#/components/schemas/email'
                          phoneNumber:
                            $ref: '#/components/schemas/phoneNumber'
                          codes:
                            type: array
                            items:
                              type: object
                              properties:
                                codeId:
                                  $ref: '#/components/schemas/codeId'
                                timeCreated:
                                  $ref: '#/components/schemas/timeCreated'
                                codeLifetime:
                                  $ref: '#/components/schemas/codeLifetime'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/signinup/codes/remove:
    post:
      tags:
          - Passwordless Recipe
      operationId: passwordlessRevokeAllCodesOfUser
      description: |
        Revokes all codes issued for the user
      parameters:
        - $ref: '#/components/parameters/passwordlessRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - type: object
                  properties:
                    email:
                      $ref: '#/components/schemas/email'
                  required:
                    - email
                - type: object
                  properties:
                    phoneNumber:
                      $ref: '#/components/schemas/phoneNumber'
                  required:
                    - phoneNumber
      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user⠀⠀:
    get:
      tags:
        - Passwordless Recipe
      operationId: passwordlessGetUser
      deprecated: true
      description: |
        Get a user's information.

        API is tenant specific if querying by email or phone number.
        If querying by userId, tenantId will be ignored.

        Note that there is an invisible character at the end of the path, this was to avoid a conflict with the OpenAPI spec.

      parameters:
        - $ref: '#/components/parameters/passwordlessRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/userId'
        - in: query
          name: email
          description: Use exactly one of phoneNumber, email or userId
          schema:
            $ref: '#/components/schemas/email'
        - in: query
          name: phoneNumber
          description: Use exactly one of phoneNumber, email or userId
          schema:
            $ref: '#/components/schemas/phoneNumber'
      responses:
        '200':
          description: Get a user's information.
          content:
            application/json:
                schema:
                  oneOf:
                    - type: object
                      properties:
                        status:
                          $ref: '#/components/schemas/statusOK'
                        user:
                          $ref: '#/components/schemas/authRecipeUser'
                    - type: object
                      properties:
                        status:
                          type: string
                          enum: ["UNKNOWN_USER_ID_ERROR", "UNKNOWN_EMAIL_ERROR", "UNKNOWN_PHONE_NUMBER_ERROR"]

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'
    put:
      tags:
        - Passwordless Recipe
      operationId: passwordlessPutUser
      description: |
        Update a user's information.
        If the email or phoneNumber is set to null the previous value will be deleted. If they are not set (i.e., undefined/missing from the request), they are left as-is.
      parameters:
        - $ref: '#/components/parameters/passwordlessRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                recipeUserId:
                  $ref: '#/components/schemas/userId'
                email:
                  allOf:
                    - $ref: '#/components/schemas/email'
                    - nullable: true
                phoneNumber:
                  allOf:
                    - $ref: '#/components/schemas/phoneNumber'
                    - nullable: true
              required:
                - userId

      responses:
        '200':
          description: update user's information
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    status:
                      type: string
                      enum: ['OK', 'UNKNOWN_USER_ID_ERROR', 'EMAIL_ALREADY_EXISTS_ERROR', 'PHONE_NUMBER_ALREADY_EXISTS_ERROR']
                - type: object
                  properties:
                    status:
                      type: string
                      enum: [ 'EMAIL_CHANGE_NOT_ALLOWED_ERROR', 'PHONE_NUMBER_CHANGE_NOT_ALLOWED_ERROR' ]
                    reason:
                      type: string

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/signin:
    post:
      tags:
        - EmailPassword Recipe
      operationId: emailPasswordSignin
      description: |
        Signin a user with email ID and password
      parameters:
        - $ref: '#/components/parameters/rid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  $ref: '#/components/schemas/email'
                password:
                  $ref: '#/components/schemas/password'
      responses:
        '200':
          description: signin response
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    user:
                      $ref: '#/components/schemas/authRecipeUser'
                    recipeUserId:
                      $ref: '#/components/schemas/userId'

                - $ref: '#/components/schemas/wrongCredentialsResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/signup:
    post:
      tags:
        - EmailPassword Recipe
      operationId: emailPasswordSignup
      description: |
        Signup a user with email ID and password
      parameters:
        - $ref: '#/components/parameters/rid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  $ref: '#/components/schemas/email'
                password:
                  $ref: '#/components/schemas/password'
      responses:
        '200':
          description: signup response
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    user:
                      $ref: '#/components/schemas/authRecipeUser'
                    recipeUserId:
                      $ref: '#/components/schemas/userId'
                - type: object
                  properties:
                    status:
                      type: string
                      enum: ['EMAIL_ALREADY_EXISTS_ERROR']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user:
    get:
      tags:
        - EmailPassword Recipe
      operationId: emailPasswordGetUser
      deprecated: true
      description: |
        Get a user's information

        API is tenant specific if querying by email.
        If querying by userId, tenantId will be ignored.

      parameters:
        - $ref: '#/components/parameters/rid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: email
          description: use either email or userId, not both
          schema:
            $ref: '#/components/schemas/email'
        - in: query
          name: userId
          description: use either email or userId, not both
          schema:
            $ref: '#/components/schemas/userId'

      responses:
        '200':
          description: get user's information
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      user:
                        $ref: '#/components/schemas/authRecipeUser'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['UNKNOWN_USER_ID_ERROR', 'UNKNOWN_EMAIL_ERROR']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'
    put:
      tags:
        - EmailPassword Recipe
      operationId: emailPasswordPutUser
      description: |
        Update a user's information
      parameters:
        - $ref: '#/components/parameters/rid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                recipeUserId:
                  $ref: '#/components/schemas/userId'
                email:
                  $ref: '#/components/schemas/email'
                password:
                  $ref: '#/components/schemas/password'

      responses:
        '200':
          description: update user's information
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    status:
                      type: string
                      enum: ['OK', 'UNKNOWN_USER_ID_ERROR', 'EMAIL_ALREADY_EXISTS_ERROR']
                - type: object
                  properties:
                    status:
                      type: string
                      enum: ['EMAIL_CHANGE_NOT_ALLOWED_ERROR']
                    reason:
                      type: string

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/password/reset/token:
    post:
      tags:
        - EmailPassword Recipe
      operationId: emailPasswordGetPasswordResetToken
      description: |
        Generate a new reset password token for this user
      parameters:
        - $ref: '#/components/parameters/rid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - userId
                - email
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                email:
                  $ref: '#/components/schemas/email'
      responses:
        '200':
          description: Generate a new reset password token for this user
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      token:
                        $ref: '#/components/schemas/token'
                  - $ref: '#/components/schemas/unknownUserIdResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/password/reset:
    post:
      tags:
        - EmailPassword Recipe
      operationId: emailPasswordGetPasswordReset
      deprecated: true
      description: |
        Reset a password using password reset token
      parameters:
        - $ref: '#/components/parameters/rid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                method:
                  type: string
                  enum:
                    - token
                token:
                  $ref: '#/components/schemas/token'
                newPassword:
                  type: string
                  example: newpassword123
      responses:
        '200':
          description: Reset a password using password reset token
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      userId:
                        $ref: '#/components/schemas/userId'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['RESET_PASSWORD_INVALID_TOKEN_ERROR']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/passwordhash/import:
    post:
      tags:
        - EmailPassword Recipe
      operationId: userImport
      description: |
        Import a user with email ID and password hash
      parameters:
        - $ref: '#/components/parameters/rid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  $ref: '#/components/schemas/email'
                passwordHash:
                  type: string
                  example: "passwordHash"
                hashingAlgorithm:
                  type: string
                  enum: ["argon2", "bcrypt", "firebase_scrypt"]


      responses:
        '200':
          description: import user response
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  user:
                    $ref: '#/components/schemas/authRecipeUser'
                  didUserAlreadyExist:
                    type: boolean

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/password/reset/token/consume:
    post:
      tags:
        - EmailPassword Recipe
      operationId: emailPasswordResetPasswordConsumeToken
      description: |
        Consume a password reset token
      parameters:
        - $ref: '#/components/parameters/rid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                token:
                  $ref: '#/components/schemas/token'
      responses:
        '200':
          description: Consume a password reset token
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      userId:
                        $ref: '#/components/schemas/userId'
                      email:
                        $ref: '#/components/schemas/email'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['RESET_PASSWORD_INVALID_TOKEN_ERROR']
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/signinup:
    post:
      tags:
        - ThirdParty Recipe
      operationId: thirdPartySigninup
      description: |
        Signin/up a user
      parameters:
        - $ref: '#/components/parameters/thirdPartyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                thirdPartyId:
                  $ref: '#/components/schemas/thirdPartyId'
                thirdPartyUserId:
                  $ref: '#/components/schemas/thirdPartyUserId'
                email:
                  $ref: '#/components/schemas/thirdPartyEmail'
      responses:
        '200':
          description: Signin/up a user
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    createdNewUser:
                      type: boolean
                      example: true
                    user:
                      $ref: '#/components/schemas/authRecipeUser'
                    recipeUserId:
                      $ref: '#/components/schemas/userId'
                - type: object
                  properties:
                    status:
                      type: string
                      enum: ['EMAIL_CHANGE_NOT_ALLOWED_ERROR']
                    reason:
                      type: string

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user⠀:
    get:
      tags:
        - ThirdParty Recipe
      operationId: thirdPartyGetUser
      deprecated: true
      description: |
        Get a user's information.

        API is tenant specific if querying by email.
        If querying by userId, tenantId will be ignored.

        Note that there is an invisible character at the end of the path, this was to avoid a conflict with the OpenAPI spec.

      parameters:
        - $ref: '#/components/parameters/thirdPartyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/userId'
        - in: query
          name: thirdPartyId
          description: Either use userId or thirdPartyId and thirdPartyUserId
          schema:
            $ref: '#/components/schemas/thirdPartyId'
        - in: query
          name: thirdPartyUserId
          description: Either use userId or thirdPartyId and thirdPartyUserId
          schema:
            $ref: '#/components/schemas/thirdPartyUserId'
      responses:
        '200':
          description: Get a user's information.
          content:
            application/json:
                schema:
                  oneOf:
                    - type: object
                      properties:
                        status:
                          $ref: '#/components/schemas/statusOK'
                        user:
                          $ref: '#/components/schemas/authRecipeUser'
                    - type: object
                      properties:
                        status:
                          type: string
                          enum: ["UNKNOWN_USER_ID_ERROR", "UNKNOWN_THIRD_PARTY_USER_ERROR"]

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/users/by-email:
    get:
      operationId: thirdPartyGetUsersByEmail
      deprecated: true
      tags:
        - ThirdParty Recipe
      description: |
        Get all users accounts associated with given email

      parameters:
        - $ref: '#/components/parameters/thirdPartyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: email
          required: true
          description: User's email
          schema:
            type: string
            example: john.doe@example.com


      responses:
        '200':
          description: Get all users associated with given email
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    users:
                      type: array
                      items:
                        $ref: '#/components/schemas/authRecipeUser'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/email/verify/token:
    post:
      tags:
        - EmailVerification Recipe
      operationId: emailVerificationVerifyToken
      description: |
        Generate a new email verification token for this user
      parameters:
        - $ref: '#/components/parameters/emailVerificationRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/emailVerificationVerifyTokenRequest'
      responses:
        '200':
          description: Generate a new email verification token for this user
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      token:
                        $ref: '#/components/schemas/token'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['EMAIL_ALREADY_VERIFIED_ERROR']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/email/verify/token/remove:
    post:
      tags:
        - EmailVerification Recipe
      operationId: emailVerificationVerifyTokenRemove
      description: |
        Remove all unused email verification tokens for this user
      parameters:
        - $ref: '#/components/parameters/emailVerificationRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/emailVerificationVerifyTokenRequest'
      responses:
        '200':
          description: OK response
          content:
            application/json:
                schema:
                  properties:
                    status:
                      type: string
                      enum: ['OK']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/email/verify:
    post:
      tags:
        - EmailVerification Recipe
      operationId: emailVerificationVerify
      description: |
        Verify an email
      parameters:
        - $ref: '#/components/parameters/emailVerificationRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                method:
                  type: string
                  enum:
                    - token
                token:
                  $ref: '#/components/schemas/token'

      responses:
        '200':
          description: Verify an email
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      userId:
                        $ref: '#/components/schemas/userId'
                      email:
                        $ref: '#/components/schemas/email'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['EMAIL_VERIFICATION_INVALID_TOKEN_ERROR']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/user/email/verify:
    get:
      tags:
        - EmailVerification Recipe
      operationId: emailVerificationVerifyGet
      description: |
        Check if an email is verified
      parameters:
        - $ref: '#/components/parameters/emailVerificationRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/userId'
        - $ref: '#/components/parameters/email'
      responses:
        '200':
          description: Verify an email
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    isVerified:
                      $ref: '#/components/schemas/isVerified'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/user/email/verify/remove:
    post:
      tags:
        - EmailVerification Recipe
      operationId: emailVerificationVerifyRemove
      description: |
        Unverify an email
      parameters:
        - $ref: '#/components/parameters/emailVerificationRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/emailVerificationVerifyTokenRequest'

      responses:
        '200':
          description: OK response
          content:
            application/json:
                schema:
                  properties:
                    status:
                      type: string
                      enum: ['OK']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/user/metadata:
    get:
      tags:
        - User Metadata Recipe
      operationId: userMetadataRead
      description: |
        Gets the stored metadata object of the user
      parameters:
        - $ref: '#/components/parameters/userMetadataRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/userIdRequired'
      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    metadata:
                      $ref: '#/components/schemas/userMetadata'
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

    put:
      tags:
        - User Metadata Recipe
      operationId: userMetadataUpdate
      description: |
        Updates the metadata object stored about the user by doing a shallow merge of the stored and the update JSONs
        and removing properties set to null on the root level of the update object. The merged object is then reserialized and stored.

        e.g.:
          - stored: `{ "preferences": { "theme":"dark" }, "notifications": { "email": true }, "todos": ["example"] }`

          - update: `{ "notifications": { "sms": true }, "todos": null }`

          - result: `{ "preferences": { "theme":"dark" }, "notifications": { "sms": true } }`

      parameters:
        - $ref: '#/components/parameters/userMetadataRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                metadataUpdate:
                  $ref: '#/components/schemas/userMetadataUpdate'
      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    metadata:
                      $ref: '#/components/schemas/userMetadata'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/user/metadata/remove:
    post:
      tags:
        - User Metadata Recipe
      operationId: userMetadataDelete
      description: |
        Removes the entire metadata JSON stored about the user.

      parameters:
        - $ref: '#/components/parameters/userMetadataRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'

      requestBody:
        content:
          application/json:
            schema:
              properties:
                userId:
                  $ref: '#/components/schemas/userId'

      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/role:
    put:
      tags:
        - User Roles Recipe
      operationId: addUserRole
      description: |
        Creates a User Role mapping

      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'

      requestBody:
        content:
          application/json:
            schema:
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                role:
                  $ref: '#/components/schemas/role'
              required: [userId, role]

      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      didUserAlreadyHaveRole:
                        type: boolean
                        example: true
                  - $ref: '#/components/schemas/unknownRoleResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/role/remove:
    post:
      tags:
        - User Roles Recipe
      operationId: removeUserRole
      description: |
        Removes a User Role mapping

      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'

      requestBody:
        content:
          application/json:
            schema:
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                role:
                  $ref: '#/components/schemas/role'
              required: [userId, role]

      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      didUserHaveRole:
                        type: boolean
                        example: true
                  - $ref: '#/components/schemas/unknownRoleResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/user/roles:
    get:
      tags:
        - User Roles Recipe
      operationId: getUserRoles
      description: |
        Retrive the roles associated with the user.
      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/userIdRequired'
      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  roles:
                    type: array
                    items:
                      $ref: '#/components/schemas/role'
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/role/users:
    get:
      tags:
        - User Roles Recipe
      operationId: getRoleUsers
      description: |
        Retrive the users associated with the role.
      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/roleRequired'
      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
              schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      users:
                        type: array
                        items:
                          $ref: '#/components/schemas/userId'
                  - $ref: '#/components/schemas/unknownRoleResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/role:
    put:
      tags:
        - User Roles Recipe
      operationId: putRole
      description: |
        Creates a role with permissions, can also be used to add permissions to a role

      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'

      requestBody:
        content:
          application/json:
            schema:
              properties:
                role:
                  $ref: '#/components/schemas/role'
                permissions:
                  type: array
                  items:
                    type: string
                    example: permission
              required: [role]

      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    createdNewRole:
                      type: boolean
                      example: true


        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/role/permissions:
    get:
      tags:
        - User Roles Recipe
      operationId: getRolePermissions
      description: |
        Retrive the permissions associated with a role
      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/roleRequired'
      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
              schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      permissions:
                        type: array
                        items:
                          type: string
                          example: permission
                  - $ref: '#/components/schemas/unknownRoleResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/role/permissions/remove:
    post:
      tags:
        - User Roles Recipe
      operationId: removeRolePermissions
      description: |
        Removes permissions mapped to a role, if no permissions are passed all permissions mapped to the role are removed

      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'

      requestBody:
        content:
          application/json:
            schema:
              properties:
                role:
                  $ref: '#/components/schemas/role'
                permissions:
                  type: array
                  items:
                    type: string
                    example: permission
              required: [role]

      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                  - $ref: '#/components/schemas/unknownRoleResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/permission/roles:
    get:
      tags:
        - User Roles Recipe
      operationId: getPermissionRoles
      description: |
        Retrive the roles associated with the permission
      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/permissionRequired'
      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  roles:
                    type: array
                    items:
                      type: string
                      example: admin

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/role/remove:
    post:
      tags:
        - User Roles Recipe
      operationId: removeRole
      description: |
        Deletes a role

      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'

      requestBody:
        content:
          application/json:
            schema:
              properties:
                role:
                  $ref: '#/components/schemas/role'
              required: [role]

      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    didRoleExist:
                      type: boolean
                      example: true

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/roles:
    get:
      tags:
        - User Roles Recipe
      operationId: getRoles
      description: |
        Retrive all created roles
      parameters:
        - $ref: '#/components/parameters/userRolesRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        '200':
          description: 'The operation was successful'
          content:
            application/json:
              schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    roles:
                      type: array
                      items:
                        type: string
                        example: admin

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/session:
    post:
      tags:
        - Session Recipe
      operationId: createNewSession
      description: |
        Create a new Session
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                userDataInJWT:
                  $ref: '#/components/schemas/userDataInJWT'
                userDataInDatabase:
                  $ref: '#/components/schemas/userDataInDatabase'
                enableAntiCsrf:
                  $ref: '#/components/schemas/enableAntiCsrf'
                useDynamicSigningKey:
                  type: boolean
                  description: Decides if the token should be signed with a dynamic or static key, defaults to true
                  example: false
      responses:
        '200':
          description: Create a new Session
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    session:
                      $ref: '#/components/schemas/session'
                    accessToken:
                      $ref: '#/components/schemas/cookieInfo'
                    refreshToken:
                      $ref: '#/components/schemas/cookieInfo'
                    antiCsrfToken:
                      $ref: '#/components/schemas/token'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/session:
    get:
      tags:
        - Session Recipe
      operationId: getSessionInfo
      description: |
        Get user and session information for a given session handle
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: sessionHandle
          schema:
            $ref: '#/components/schemas/handle'
      responses:
        '200':
          description: Get user and session information for a given session handle
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      userDataInDatabase:
                        $ref: '#/components/schemas/userDataInDatabase'
                      userDataInJWT:
                        $ref: '#/components/schemas/userDataInJWT'
                      userId:
                        $ref: '#/components/schemas/userId'
                      expiry:
                        $ref: '#/components/schemas/expiry'
                      timeCreated:
                        $ref: '#/components/schemas/timeCreated'
                      sessionHandle:
                        $ref: '#/components/schemas/handle'
                      tenantId:
                        $ref: '#/components/schemas/tenantId'
                  - $ref: '#/components/schemas/unauthorisedMessageResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/session/remove:
    post:
      tags:
        - Session Recipe
      operationId: deleteSession
      description: |
        Delete a sesion

        If revoking session by `userId`, the sessions are cleared across all tenants by default.

        Note: If `revokeAcrossAllTenants` is set to `true`, this API can only be called from `public` tenant.

      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - type: object
                  properties:
                    sessionHandles:
                      $ref: '#/components/schemas/sessionHandles'
                - type: object
                  required:
                  - userId
                  properties:
                    userId:
                      $ref: '#/components/schemas/userId'
                    revokeAcrossAllTenants:
                      type: boolean

      responses:
        '200':
          description: Delete a session
          content:
            application/json:
                schema:
                  type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    sessionHandlesRevoked:
                      $ref: '#/components/schemas/sessionHandles'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/session/verify:
    post:
      tags:
        - Session Recipe
      operationId: verifySession
      description: |
        Verify a Session
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                accessToken:
                  $ref: '#/components/schemas/token'
                enableAntiCsrf:
                  $ref: '#/components/schemas/enableAntiCsrf'
                doAntiCsrfCheck:
                  type: boolean
                  example: false
                checkDatabase:
                  type: boolean
                  description: Decides if we always check if the session exists in the DB or just do token validation, defaults to false.
                  example: false
                antiCsrfToken:
                  $ref: '#/components/schemas/token'
      responses:
        '200':
          description: Verify a session
          content:
            application/json:
                schema:
                  oneOf:
                    - type: object
                      properties:
                        status:
                          $ref: '#/components/schemas/statusOK'
                        session:
                          $ref: '#/components/schemas/session'
                        accessToken:
                          $ref: '#/components/schemas/cookieInfo'
                    - $ref: '#/components/schemas/unauthorisedMessageResponse'
                    - type: object
                      properties:
                        status:
                          $ref: '#/components/schemas/tryRefreshTokenResponse'
                        message:
                          $ref: '#/components/schemas/message'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/session/refresh:
    post:
      tags:
        - Session Recipe
      operationId: refreshSession
      description: |
        Refresh a Session
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                refreshToken:
                  $ref: '#/components/schemas/token'
                enableAntiCsrf:
                  $ref: '#/components/schemas/enableAntiCsrf'
                antiCsrfToken:
                  $ref: '#/components/schemas/token'
                useDynamicSigningKey:
                  type: boolean
              required: [refreshToken, enableAntiCsrf, useDynamicSigningKey]
      responses:
        '200':
          description: Refresh a session
          content:
            application/json:
                schema:
                  oneOf:
                    - type: object
                      properties:
                        status:
                          $ref: '#/components/schemas/statusOK'
                        session:
                          $ref: '#/components/schemas/session'
                        accessToken:
                          $ref: '#/components/schemas/cookieInfo'
                        refreshToken:
                          $ref: '#/components/schemas/cookieInfo'
                        antiCsrfToken:
                          $ref: '#/components/schemas/token'
                    - type: object
                      properties:
                        status:
                          $ref: '#/components/schemas/tokenTheftResponse'
                        session:
                          type: object
                          properties:
                            handle:
                              $ref: '#/components/schemas/handle'
                            userId:
                              $ref: '#/components/schemas/userId'
                    - $ref: '#/components/schemas/unauthorisedMessageResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/session/user:
    get:
      tags:
        - Session Recipe
      operationId: getUserSessionHandles
      description: |
        Get session handles for a user

        By default, the session handles are fetched across all tenants. Set `fetchAcrossAllTenants` to `false` to get sessionHandles for the user for a particular tenant.

        Note: If `fetchAcrossAllTenants` is set to `true`, this API can only be called from `public` tenant.
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/userId'
        - name: fetchAcrossAllTenants
          schema:
            type: string
            enum: ["true", "false"]
          required: false
          in: query
      responses:
        '200':
          description: Get user Session Handles
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  sessionHandles:
                    $ref: '#/components/schemas/sessionHandles'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/session/regenerate:
    post:
      tags:
        - Session Recipe
      operationId: regenerateSession
      description: |
        Regenerate a session
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                accessToken:
                  $ref: '#/components/schemas/token'
                userDataInJWT:
                  $ref: '#/components/schemas/userDataInJWT'
      responses:
        '200':
          description: Regenerate user session
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      session:
                        $ref: '#/components/schemas/session'
                      accessToken:
                        $ref: '#/components/schemas/cookieInfo'
                  - $ref: '#/components/schemas/unauthorisedMessageResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/session/data:
    get:
      deprecated: true
      tags:
        - Session Recipe
      operationId: getSessionData
      description: |
        Get session data
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: sessionHandle
          description: Users session handle
          schema:
            $ref: '#/components/schemas/handle'
      responses:
        '200':
          description: Get Session Data
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      userDataInDatabase:
                        $ref: '#/components/schemas/userDataInDatabase'
                  - $ref: '#/components/schemas/unauthorisedMessageResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

    put:
      tags:
        - Session Recipe
      operationId: putSessionData
      description: |
        Change session data
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                sessionHandle:
                  $ref: '#/components/schemas/handle'
                userDataInDatabase:
                  $ref: '#/components/schemas/userDataInDatabase'
      responses:
        '200':
          description: Change Session Data
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/statusOKResponse'
                  - $ref: '#/components/schemas/unauthorisedMessageResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/jwt:
    post:
      tags:
        - JWT Recipe
      operationId: createSignedJWT
      description: |
        Create a signed JWT
      parameters:
        - $ref: '#/components/parameters/jwtRID'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                payload:
                  $ref: '#/components/schemas/createJWTPayload'
                algorithm:
                  $ref: '#/components/schemas/createJWTAlgorithm'
                jwksDomain:
                  $ref: '#/components/schemas/jwksDomain'
                validity:
                  $ref: '#/components/schemas/jwtValidity'
                useStaticSigningKey:
                  type: boolean
                  description: Decides if the token should be signed with a dynamic or static key, defaults to true
                  example: true

      responses:
        '200':
          description: Create a signed JWT
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      jwt:
                        type: string
                        example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['UNSUPPORTED_ALGORITHM_ERROR']

        '400':
          $ref: '#/components/responses/400'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/jwt/jwks:
    get:
      deprecated: true
      tags:
        - JWT Recipe
      description: |
        Retrieve JWKs for JWT verification, containing both static and dynamic keys.
      parameters:
        - $ref: '#/components/parameters/jwtRID'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        '200':
          description: Retrieve JWKs for JWT verification, containing both static and dynamic keys.
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    enum: ["OK"]
                  keys:
                    type: array
                    items:
                      $ref: '#/components/schemas/jwk'

        '400':
          $ref: '#/components/responses/400'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/.well-known/jwks.json:
    get:
      tags:
        - Core
      description: |
        Retrieve JWKs for JWT verification, containing both static and dynamic keys.
      responses:
        '200':
          description: Retrieve JWKs for JWT verification, containing both static and dynamic keys.
          content:
            application/json:
              schema:
                type: object
                properties:
                  keys:
                    type: array
                    items:
                      $ref: '#/components/schemas/jwk'

        '400':
          $ref: '#/components/responses/400'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'


  /appid-<appId>/<tenantId>/recipe/jwt/data:
    get:
      deprecated: true
      tags:
        - Session Recipe
      operationId: getJWTData
      description: |
        Get JWT data for a session
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: sessionHandle
          description: Users session handle
          schema:
            $ref: '#/components/schemas/handle'
      responses:
        '200':
          description: Get JWT Data
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      userDataInJWT:
                        $ref: '#/components/schemas/userDataInJWT'
                  - $ref: '#/components/schemas/unauthorisedMessageResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

    put:
      tags:
        - Session Recipe
      operationId: putJWTData
      description: |
        Change JWT data for a session
      parameters:
        - $ref: '#/components/parameters/sessionRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                sessionHandle:
                  $ref: '#/components/schemas/handle'
                userDataInJWT:
                  $ref: '#/components/schemas/userDataInJWT'
      responses:
        '200':
          description: Change JWT Data for a session
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/statusOKResponse'
                  - $ref: '#/components/schemas/unauthorisedMessageResponse'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/dashboard/user:
    post:
      tags:
         - Dashboard Recipe
      operationId: createDashboardUser
      description: |
        Create a dashboard user
      parameters:
        - $ref: '#/components/parameters/dashboardRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  type: string
                  example: test@example.com
                password:
                  type: string
                  example: password@123
      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["OK"]
                      user:
                        type: object
                        properties:
                          userId:
                            type: string
                            example: "example-userid"
                          email:
                            type: string
                            example: "test@example.com"
                          timeCreated:
                            type: number
                            example: 1231321231
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["EMAIL_ALREADY_EXISTS_ERROR"]
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["PASSWORD_WEAK_ERROR"]
                      message:
                        type: string
                        example: "Your password must have at least 8 characters"
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["INVALID_EMAIL_ERROR"]

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          description: Indicates ayment required
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    enum: ["USER_LIMIT_REACHED_ERROR"]
                  message:
                    type: string
                    example: "You have reached the free limit for creating users, please purchase the dashboard feature to create new users"

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'
    put:
      tags:
         - Dashboard Recipe
      operationId: updateDashboardUser
      description: |
        Update a user's email or password
      parameters:
        - $ref: '#/components/parameters/dashboardRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - type: object
                  properties:
                    email:
                      type: string
                      example: test@example.com
                    newPassword:
                      type: string
                      example: password@123
                    newEmail:
                      type: string
                      example: test2@example.com
                - type: object
                  properties:
                    userId:
                      type: string
                      example: "ue21r-fw32r3-d121-d1"
                    newPassword:
                      type: string
                      example: "password@123"
                    newEmail:
                      type: string
                      example: test2@example.com
      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["OK"]
                      user:
                        type: object
                        properties:
                          userId:
                            type: string
                            example: "r23r-f235th54-g3413gf-r32dr2"
                          email:
                            type: string
                            example: "test@example.com"
                          timeCreated:
                            type: number
                            example: 391238234792
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["EMAIL_ALREADY_EXISTS_ERROR"]
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["PASSWORD_WEAK_ERROR"]
                      message:
                        type: string
                        example: "Your password must have at least 8 characters"
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["INVALID_EMAIL_ERROR"]
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["UNKNOWN_USER_ERROR"]


        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'
    delete:
      tags:
         - Dashboard Recipe
      operationId: deleteDashboardUser
      description: |
        Delete a dashboard user with their userId or email
      parameters:
        - $ref: '#/components/parameters/dashboardRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: email
          schema:
            type: string
            example: "test@example.com"
          required: false

        - in: query
          name: userId
          schema:
            type: string
            example: "ue1231-f32f290f2-f23r23f-323f2"
          required: false

      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  didUserExist:
                    type: boolean

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'


  /appid-<appId>/recipe/dashboard/users:
    get:
      tags:
        - Dashboard Recipe
      operationId: getAllDashboardUsers
      description: |
        Get a list of call the dashboard users
      parameters:
        - $ref: '#/components/parameters/dashboardRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        '200':
          description: get a list of dashboard users
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    enum: ["OK"]
                  users:
                    type: array
                    items:
                      type: object
                      properties:
                        email:
                          type: string
                          example: "test@example.com"
                        userId:
                          type: string
                          example: "uf2323-f223r233-f23-f23-f2f32"
                        timeCreated:
                          type: number
                          example: 16382348324
                        isSuspended:
                          type: boolean
                          example: false

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/dashboard/session/verify:
    post:
      tags:
         - Dashboard Recipe
      operationId: verifyDashboardUserSession
      description: |
        Verify a Dashboard user's sessionId
      parameters:
        - $ref: '#/components/parameters/dashboardRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                sessionId:
                  type: string
                  example: "rf32f-f32342f-32f-323r2f3-23"
      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["OK"]
                      email:
                        type: string
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["USER_SUSPENDED_ERROR"]
                      message:
                        type: string
                        example: "You have crossed the free dashboard user limit. Please purchase the dashboard feature or login with a valid user account"
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["INVAlID_SESSION_ERROR"]
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/dashboard/session:
    delete:
      tags:
         - Dashboard Recipe
      operationId: RevokeDashboardUsersSession
      description: |
        Revoke a Dashboard user's session
      parameters:
        - $ref: '#/components/parameters/dashboardRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: sessionId
          schema:
            type: string
            example: "ue1231-f32f290f2-f23r23f-323f2"

      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/dashboard/signin:
    post:
      tags:
         - Dashboard Recipe
      operationId: signInDashboardUser
      description: |
        Signin a Dashboard user
      parameters:
        - $ref: '#/components/parameters/dashboardRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  type: string
                  example: test@example.com
                password:
                  type: string
                  example: password@123
      responses:
        '200':
          description: Indicates success with the status property
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["OK"]
                      sessionId:
                        type: string
                        example:
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["USER_SUSPENDED_ERROR"]
                      message:
                        type: string
                        example: "You have crossed the free dashboard user limit. Please purchase the dashboard feature or login with a valid user account"
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ["INVAlID_CREDENTIALS_ERROR"]
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/dashboard/user/sessions:
    get:
      tags:
        - Dashboard Recipe
      operationId: getAllSessionsForDashboardUser
      description: |
        Get a list of the sessions for the dashboard user
      parameters:
        - $ref: '#/components/parameters/dashboardRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: userId
          schema:
            type: string
            example: "ue1231-f32f290f2-f23r23f-323f2"
          required: false
      responses:
        '200':
          description: get a list of sessions for dashboard user
          content:
            application/json:
              schema:
                type: object
                properties:
                  sessions:
                    type: array
                    items:
                      type: object
                      properties:
                        userId:
                          $ref: '#/components/schemas/userId'
                        sessionId:
                          type: string
                          example: "fni29f-f23f23-f2fq32qt-h35evf"
                        timeCreated:
                          type: number
                          example: 16382348324
                        expiry:
                          type: number
                          example: 16382348324

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/apiversion:
    get:
      tags:
        - Core
      operationId: getApiVersion
      description: |
        Get a list of compatible CDI versions
      parameters:
        - $ref: '#/components/parameters/api-key'
        - in: query
          name: websiteDomain
          schema:
            type: string
            example: https://example.com
          required: false
        - in: query
          name: apiDomain
          schema:
            type: string
            example: https://api.example.com
          required: false
      responses:
        '200':
          description: get api version
          content:
            application/json:
              schema:
                type: object
                properties:
                  versions:
                    type: array
                    items:
                      type: string
                      example: ['2.13']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /config:
    get:
      tags:
        - Core
      operationId: getConfig
      description: |
        Get path to the loaded config file
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: pid
          schema:
            type: string
            example: 21307

      responses:
        '200':
          description: get api version
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      path:
                        type: string
                        example: /usr/lib/supertokens/config.yaml
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['NOT_ALLOWED']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/:
    get:
      tags:
        - Core
      operationId: getHelloOnRootPath
      description: |
        Return a simple hello message
      responses:
        '200':
          $ref: '#/components/responses/hello'
        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/hello:
    get:
      tags:
        - Core
      operationId: getHello
      description: |
        Return a simple hello message
      responses:
        '200':
          $ref: '#/components/responses/hello'
        '500':
          $ref: '#/components/responses/500'
    put:
      tags:
        - Core
      operationId: putHello
      description: |
        Return a simple hello message
      responses:
        '200':
          $ref: '#/components/responses/hello'
        '500':
          $ref: '#/components/responses/500'

    post:
      tags:
        - Core
      operationId: postHello
      description: |
        Return a simple hello message
      responses:
        '200':
          $ref: '#/components/responses/hello'
        '500':
          $ref: '#/components/responses/500'

    delete:
      tags:
        - Core
      operationId: deleteHello
      description: |
        Return a simple hello message
      responses:
        '200':
          $ref: '#/components/responses/hello'
        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/telemetry:
    get:
      tags:
        - Core
      operationId: getTelemetry
      description: |
        Returns the telemetryID if it exists
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        '200':
          description:  Returns the telemetryID if it exists
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      exists:
                        type: boolean
                        enum: [true]
                      telemetryId:
                        type: string
                        example: 99c87c72-1807-22d-9b39-7a88f95re56c
                  - type: object
                    properties:
                      exists:
                        type: boolean
                        example: [false]

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/users/count:
    get:
      tags:
        - Core
      operationId: getUsersCount
      description: |
        Get number of users.

        API is tenant specific if `includeAllTenants` is false.
        Else, `tenantId` is ignored.

      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/includeRecipeIds'
        - name: includeAllTenants
          description: if set to true, will count users across all tenants in the app
          in: query
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Get number of users
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  count:
                    type: number
                    example: 1000000

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/users/count/active:
    get:
      tags:
        - Core
      operationId: getActiveUsersCount
      description: |
        Get number of active users.
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: since
          schema:
            type: number
            example: 1679875200000
          required: true
      responses:
        '200':
          description: Get number of active users
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  count:
                    type: number
                    example: 100000

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/users:
    get:
      tags:
        - Core
      operationId: getUsers
      description: |
        User Pagination
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/includeRecipeIds'
        - $ref: '#/components/parameters/paginationToken'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/timeJoinedOrder'
        - in: query
          name: email
          schema:
            type: string
            example: "test@example.com"
          required: false
        - in: query
          name: phone
          schema:
            type: number
            example: +911234567890
          required: false
        - in: query
          name: recipe
          schema:
            type: string
            example: "emailpassword"
          required: false
        - in: query
          name: provider
          schema:
            type: string
            example: "google"
          required: false
      responses:
        '200':
          description: User Pagination
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  users:
                    type: array
                    items:
                      type: object
                      properties:
                        user:
                          $ref: '#/components/schemas/authRecipeUser'
                      additionalProperties: false
                  nextPaginationToken:
                    $ref: '#/components/schemas/paginationToken'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/user/remove:
    post:
      tags:
        - Core
      operationId: deleteUser
      description: |
        Delete user
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - userId
              properties:
                userId:
                  $ref: '#/components/schemas/userId'
                removeAllLinkedAccounts:
                  type: boolean
                  example: true
      responses:
        '200':
          description:  Returns OK if the operation succeeded (even if the user didn't exist before the call)
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/user/search/tags:
    get:
      tags:
        - Core
      operationId: getSearchTags
      description: |
        Retrieve available tags for search
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'

      responses:
        '200':
          description: Returns available tags for search
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  tags:
                    type: array
                    items:
                      type: string
                      example: ['email', 'phone', 'provider']

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'


  /appid-<appId>/ee/featureflag:
    get:
      tags:
        - Core
      operationId: getFeatureFlag
      description: |
        Get a list of the enabled enterprise features
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        '200':
          description: The operation was successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  features:
                    type: array
                    items:
                      type: string
                    example: ["feature_1", "feature_2"]
                  usageStats:
                    type: object


        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/ee/license:
    put:
      tags:
        - Core
      operationId: setLicense
      description: |
        Set or sync license key
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                licenseKey:
                  type: string
                  example: "eyJhbGciOiJIUzI1NiIsIn..."
      responses:
        '200':
          description:  The operation was successful
          content:
            application/json:
              schema:
                 oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['MISSING_EE_FOLDER_ERROR']

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['INVALID_LICENSE_KEY_ERROR']

        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '500':
          $ref: '#/components/responses/500'

    delete:
      tags:
        - Core
      operationId: deleteLicense
      description: |
        Delete license key
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'

      responses:
        '200':
          description:  The operation was successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'

        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '500':
          $ref: '#/components/responses/500'

    get:
      tags:
        - Core
      operationId: getLicense
      description: |
        Retrieve license key
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'

      responses:
        '200':
          description:  The operation was successful
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      licenseKey:
                        type: string
                        example: "eyJhbGciOiJIUzI1NiIsIn..."

                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['NO_LICENSE_KEY_FOUND_ERROR']

        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/user/id:
    get:
      tags:
        - Core
      operationId: getUserId
      description: |
        Get user id from email or phone number
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - $ref: '#/components/parameters/userId'
      responses:
        '200':
          description: The operation was successful
          content:
            application/json:
              schema:
                oneOf:
                  - type: object
                    properties:
                      status:
                        $ref: '#/components/schemas/statusOK'
                      user:
                        $ref: '#/components/schemas/authRecipeUser'
                  - type: object
                    properties:
                      status:
                        type: string
                        enum: ['UNKNOWN_USER_ID_ERROR']
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/users/by-accountinfo:
    get:
      tags:
        - Core
      operationId: getUsersByAccountInfo
      description: |
        Get users by email, phoneNumber or thirdParty info
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
        - in: query
          name: email
          required: false
          schema:
            type: string
            example: 'test@example.com'
        - in: query
          name: phoneNumber
          required: false
          schema:
            type: string
            example: '+911234567890'
        - in: query
          name: thirdPartyId
          required: false
          schema:
            type: string
            example: 'google'
        - in: query
          name: thirdPartyUserId
          required: false
          schema:
            type: string
            example: '1234567890'
        - in: query
          name: doUnionOfAccountInfo
          required: true
          schema:
            type: boolean
            example: true
      responses:
        '200':
          description: The operation was successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  users:
                    type: array
                    items:
                      $ref: '#/components/schemas/authRecipeUser'
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/requests/stats:
    get:
      tags:
        - Core
      operationId: getRequestsStats
      description: |
        Get requests stats for last 24 hours

        `averageRequestsPerSecond` and `peakRequestsPerSecond` would countain `1440` values corresponding to `now - 1440 minutes` until `now - 1 minute`.

        A value of `-1` would mean that there is no data for that minute.
      parameters:
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        '200':
          description: The operation was successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  atMinute:
                    type: number
                    example: 16382348
                  averageRequestsPerSecond:
                    type: array
                    items:
                      type: number
                      example: 10.5
                  peakRequestsPerSecond:
                    type: array
                    items:
                      type: number
                      example: 20
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/connectionuridomain:
    put:
      tags:
        - Multitenancy Recipe

      description: |
        This API is deprecated. Please use the v2 version of this API. In the v2 version of the API, the login methods are no longer enabled using the `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs. Instead, they are enabled using factorIds (such as emailpassword, otp-email, etc) specified in the `firstFactors` and `requiredSecondaryFactors` inputs. Please refer [Multitenancy Docs](https://supertokens.com/docs/multitenancy/new-tenant) to know the list of factorIds available.

        Note: This deprecated API still accepts those `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs for backward compatibility.

        Create or update a connection uri domain.

        SuperTokens subscription license key is required, if not using the base connection uri domain.

        This request must originate from public app and public tenant on the base
        connection uri domain.

        If creating a new connection uri domain, only the login methods set to true will be enabled and rest will be disabled by default.

        `firstFactors` and `requiredSecondaryFactors` can be set to null to remove all entries in the core, or a non empty string array to be updated in the core. Setting of empty array is disallowed.

        Note: the create/update will fail if a login method is not enabled and a relavant factor is added to either `firstFactors` or `requiredSecondaryFactors`. For example, `emailPasswordEnabled` cannot be set to `false` if `emailpassword` is present in the `firstFactors` array.

        If updating an existing connection uri domain,
        1. core will keep the existing state of login methods and only update the ones that are specified in the request body.
        2. Core config will be merged into existing config. To delete a key in the config, use a null value

        Note: The core config must contain a unique connection to the storage layer, because sharing of database between 2 different connection uri domains is not allowed.

        Note: Updation of core config is not allowed for the default connectionUriDomain. In order to update config for the default connectionUriDomain, you must edit the config.yaml or the docker env directly.

      operationId: createOrUpdateConnectionURIDomainPUT
      deprecated: true
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - type: object
                required:
                  - connectionUriDomain
                properties:
                  connectionUriDomain:
                    type: string
                    example: core-1234.supertokens.io:3567
              - $ref: '#/components/schemas/tenantInput'
      responses:
        200:
          description: Create or Update connection uri domain result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - createdNew
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  createdNew:
                    type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/connectionuridomain/v2:
    put:
      tags:
        - Multitenancy Recipe

      description: |
        Create or update a connection uri domain.

        SuperTokens subscription license key is required, if not using the base connection uri domain.

        This request must originate from public app and public tenant on the base
        connection uri domain.

        The `firstFactors` can be set to following values:

        - `null`: When set to `null`, all the login methods will be available for the connection URI domain (public app, public tenant).
        - `[]` (empty array): No login methods will be enabled for the connection URI domain (public app, public tenant).
        - `['factor1', 'factor2', ...]` (non-empty array): The list of login methods to enable for the connection URI domain (public app, public tenant). For eg. if this is set to `['emailpassword', 'thirdparty']`, the users of the tenant will be able to login using emailpassword and third party providers.

        List of built-in first factors are as follows:

        - Email password auth: `emailpassword`
        - Social login / enterprise SSO auth: `thirdparty`
        - Passwordless:
          - With email OTP: `otp-email`
          - With SMS OTP: `otp-phone`
          - With email magic link: `link-email`
          - With SMS magic link: `link-phone`

        If first factors are not specified while creating a new connection uri domain, all the login methods will be enabled by default.

        The `requiredSecondaryFactors` can be set to following values:
        - `null`: When set to `null`, no secondary factors will be required for the users of the connection URI domain (public app, public tenant).
        - `['factor1', 'factor2', ...]` (non-empty array): The list of factors that the users of the connection URI domain (public app, public tenant) must complete post the first factor login. For eg. if this is set to `['otp-phone', 'totp']`, the users of the tenant will be required to complete either phone OTP or TOTP post the first factor login.

        List of built-in secondary factors are as follows:

        - Email password auth: `emailpassword`
        - Social login / enterprise SSO auth: `thirdparty`
        - Passwordless:
          - With email OTP: `otp-email`
          - With SMS OTP: `otp-phone`
          - With email magic link: `link-email`
          - With SMS magic link: `link-phone`
        - Time based OTP: `totp`

        If updating an existing connection uri domain,
        1. core will keep the existing state of login methods and only update the ones that are specified in the request body.
        2. Core config will be merged into existing config. To delete a key in the config, use a null value

        Note: The core config must contain a unique connection to the storage layer, because sharing of database between 2 different connection uri domains is not allowed.

        Note: Updation of core config is not allowed for the default connectionUriDomain. In order to update config for the default connectionUriDomain, you must edit the config.yaml or the docker env directly.

      operationId: createOrUpdateConnectionURIDomainV2PUT
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - type: object
                required:
                  - connectionUriDomain
                properties:
                  connectionUriDomain:
                    type: string
                    example: core-1234.supertokens.io:3567
              - $ref: '#/components/schemas/tenantInputV2'
      responses:
        200:
          description: Create or Update connection uri domain result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - createdNew
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  createdNew:
                    type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/connectionuridomain/remove:
    post:
      tags:
        - Multitenancy Recipe
      description: |
        Delete a connection uri domain.

        Deletion of base connection uri domain is not allowed.

        The request must originate from base connection uri domain and public app and tenant.

        Note: There should be no apps or tenants (other than the public app and public tenant) belonging to the connection uri domain to be able to delete it.

      operationId: deleteConnectionUriDomainPOST
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - connectionUriDomain
              properties:
                connectionUriDomain:
                  type: string
                  example: core-1234.supertokens.io:3567
      responses:
        200:
          description: Remove connection uri domain result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - didExist
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  didExist:
                    type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/connectionuridomain/list:
    get:
      tags:
        - Multitenancy Recipe
      description: |
        This API is deprecated. Please use the v2 version of this API. In the v2 version of the API, the login methods are no longer enabled using the `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs. Instead, they are enabled using factorIds (such as emailpassword, otp-email, etc) specified in the `firstFactors` and `requiredSecondaryFactors` inputs. Please refer [Multitenancy Docs](https://supertokens.com/docs/multitenancy/new-tenant) to know the list of factorIds available.

        Note: This deprecated API still returns `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` values for backward compatibility, and it's values are derived from the `firstFactors` and `requiredSecondaryFactors` configured for the tenant. The detailed computation of the values as per CDI version is described here: https://github.com/supertokens/supertokens-core/issues/979#issuecomment-2099971371

        Get a list of all connection uri domains.

        Request must originate from base connection uri domain and public app and tenant.

      operationId: connectionUriDomainListGET
      deprecated: true
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        200:
          description: List of connection uri domains

          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - connectionUriDomains
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  connectionUriDomains:
                    type: array
                    items:
                      type: object
                      properties:
                        connectionUriDomain:
                          type: string
                          example: core-1234.supertokens.io:3567
                        apps:
                          type: array
                          items:
                            type: object
                            properties:
                              appId:
                                type: string
                                example: app1
                              tenants:
                                type: array
                                items:
                                  $ref: '#/components/schemas/tenantConfig'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/connectionuridomain/list/v2:
    get:
      tags:
        - Multitenancy Recipe
      description: |
        Get a list of all connection uri domains.

        The value of `firstFactors` can be as follows:
        - `null`: When set to `null`, the SDK will use firstFactors defined in the SDK
        - `[]` (empty array): No first factors would be enabled for the tenant
        - non-empty array: The first factors that are enabled for the tenant

        Request must originate from base connection uri domain and public app and tenant.

      operationId: connectionUriDomainListV2GET
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        200:
          description: List of connection uri domains

          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - connectionUriDomains
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  connectionUriDomains:
                    type: array
                    items:
                      type: object
                      properties:
                        connectionUriDomain:
                          type: string
                          example: core-1234.supertokens.io:3567
                        apps:
                          type: array
                          items:
                            type: object
                            properties:
                              appId:
                                type: string
                                example: app1
                              tenants:
                                type: array
                                items:
                                  $ref: '#/components/schemas/tenantConfigV2'

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/app:
    put:
      tags:
        - Multitenancy Recipe

      description: |
        This API is deprecated. Please use the v2 version of this API. In the v2 version of the API, the login methods are no longer enabled using the `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs. Instead, they are enabled using factorIds (such as emailpassword, otp-email, etc) specified in the `firstFactors` and `requiredSecondaryFactors` inputs. Please refer [Multitenancy Docs](https://supertokens.com/docs/multitenancy/new-tenant) to know the list of factorIds available.

        Note: This deprecated API still accepts those `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs for backward compatibility.

        Create or update an app.

        SuperTokens subscription license key is required.

        If creating a new app, only the login methods set to true will be enabled and rest will be disabled by default.

        `firstFactors` and `requiredSecondaryFactors` can be set to null to remove all entries in the core, or a non empty string array to be updated in the core. Setting of empty array is disallowed.

        Note: the create/update will fail if a login method is not enabled and a relavant factor is added to either `firstFactors` or `requiredSecondaryFactors`. For example, `emailPasswordEnabled` cannot be set to `false` if `emailpassword` is present in the `firstFactors` array.

        If updating an existing app,
        1. core will keep the existing state of login methods and only update the ones that are specified in the request body.
        2. Core config will be merged into existing config. To delete a key in the config, use a null value

        Note: the newly created app will use the same connection uri domain from which
        this request originates and the request must originate from public app and public tenant.

        Note: Updation of core config is not allowed for the default connectionUriDomain, public app. In order to update config for the default connectionUriDomain and public app, you must edit the config.yaml or the docker env directly.

      operationId: createOrUpdateAppPUT
      deprecated: true
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - type: object
                required:
                  - appId
                properties:
                  appId:
                    type: string
                    example: app1
              - $ref: '#/components/schemas/tenantInput'
      responses:
        200:
          description: Create or Update app result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - createdNew
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  createdNew:
                    type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/app/v2:
    put:
      tags:
        - Multitenancy Recipe

      description: |
        Create or update an app.

        SuperTokens subscription license key is required.

        The `firstFactors` can be set to following values:

        - `null`: When set to `null`, all the login methods will be available for the app (public tenant).
        - `[]` (empty array): No login methods will be enabled for the app (public tenant).
        - `['factor1', 'factor2', ...]` (non-empty array): The list of login methods to enable for the app (public tenant). For eg. if this is set to `['emailpassword', 'thirdparty']`, the users of the tenant will be able to login using emailpassword and third party providers.

        List of built-in first factors are as follows:

        - Email password auth: `emailpassword`
        - Social login / enterprise SSO auth: `thirdparty`
        - Passwordless:
          - With email OTP: `otp-email`
          - With SMS OTP: `otp-phone`
          - With email magic link: `link-email`
          - With SMS magic link: `link-phone`

        If first factors are not specified while creating a new app, all the login methods will be enabled by default.

        The `requiredSecondaryFactors` can be set to following values:
        - `null`: When set to `null`, no secondary factors will be required for the users of the app (public tenant).
        - `['factor1', 'factor2', ...]` (non-empty array): The list of factors that the users of the app (public tenant) must complete post the first factor login. For eg. if this is set to `['otp-phone', 'totp']`, the users of the tenant will be required to complete either phone OTP or TOTP post the first factor login.

        List of built-in secondary factors are as follows:

        - Email password auth: `emailpassword`
        - Social login / enterprise SSO auth: `thirdparty`
        - Passwordless:
          - With email OTP: `otp-email`
          - With SMS OTP: `otp-phone`
          - With email magic link: `link-email`
          - With SMS magic link: `link-phone`
        - Time based OTP: `totp`

        If updating an existing app,
        1. core will keep the existing state of login methods and only update the ones that are specified in the request body.
        2. Core config will be merged into existing config. To delete a key in the config, use a null value

        Note: the newly created app will use the same connection uri domain from which
        this request originates and the request must originate from public app and public tenant.

        Note: Updation of core config is not allowed for the default connectionUriDomain, public app. In order to update config for the default connectionUriDomain and public app, you must edit the config.yaml or the docker env directly.

      operationId: createOrUpdateAppV2PUT
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - type: object
                required:
                  - appId
                properties:
                  appId:
                    type: string
                    example: app1
              - $ref: '#/components/schemas/tenantInputV2'
      responses:
        200:
          description: Create or Update app result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - createdNew
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  createdNew:
                    type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/app/remove:
    post:
      tags:
        - Multitenancy Recipe
      description: |
        Delete an app.

        Request must originate from public app and tenant.

        Note: No tenants (other than the public tenant) must belong to the app to be able to delete it.

      operationId: deleteAppPOST
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - appId
              properties:
                appId:
                  type: string
                  example: app1
      responses:
        200:
          description: Remove app result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - didExist
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  didExist:
                    type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/app/list:
    get:
      tags:
        - Multitenancy Recipe
      description: |
        This API is deprecated. Please use the v2 version of this API. In the v2 version of the API, the login methods are no longer enabled using the `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs. Instead, they are enabled using factorIds (such as emailpassword, otp-email, etc) specified in the `firstFactors` and `requiredSecondaryFactors` inputs. Please refer [Multitenancy Docs](https://supertokens.com/docs/multitenancy/new-tenant) to know the list of factorIds available.

        Note: This deprecated API still returns `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` values for backward compatibility, and it's values are derived from the `firstFactors` and `requiredSecondaryFactors` configured for the tenant. The detailed computation of the values as per CDI version is described here: https://github.com/supertokens/supertokens-core/issues/979#issuecomment-2099971371

        Get a list of all apps in a connection uri domain.

        Request must originate from public app and tenant.

      operationId: appListGET
      deprecated: true
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        200:
          description: List of apps

          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - apps
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  apps:
                    type: array
                    items:
                      type: object
                      properties:
                        appId:
                          type: string
                          example: app1
                        tenants:
                          type: array
                          items:
                            $ref: '#/components/schemas/tenantConfig'
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /recipe/multitenancy/app/list/v2:
    get:
      tags:
        - Multitenancy Recipe
      description: |
        Get a list of all apps in a connection uri domain.

        The value of `firstFactors` can be as follows:
        - `null`: When set to `null`, the SDK will use firstFactors defined in the SDK
        - `[]` (empty array): No first factors would be enabled for the tenant
        - non-empty array: The first factors that are enabled for the tenant

        Request must originate from public app and tenant.

      operationId: appListV2GET
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        200:
          description: List of apps

          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - apps
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  apps:
                    type: array
                    items:
                      type: object
                      properties:
                        appId:
                          type: string
                          example: app1
                        tenants:
                          type: array
                          items:
                            $ref: '#/components/schemas/tenantConfigV2'
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/multitenancy/tenant:
    put:
      tags:
        - Multitenancy Recipe
      description: |
        This API is deprecated. Please use the v2 version of this API. In the v2 version of the API, the login methods are no longer enabled using the `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs. Instead, they are enabled using factorIds (such as emailpassword, otp-email, etc) specified in the `firstFactors` and `requiredSecondaryFactors` inputs. Please refer [Multitenancy Docs](https://supertokens.com/docs/multitenancy/new-tenant) to know the list of factorIds available.

        Note: This deprecated API still accepts those `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs for backward compatibility.

        Creates or updates a tenant.

        SuperTokens subscription license key is required.

        If creating a new tenant, only the login methods set to true will be enabled and rest will be disabled by default.

        `firstFactors` and `requiredSecondaryFactors` can be set to null to remove all entries in the core, or a non empty string array to be updated in the core. Setting of empty array is disallowed.

        Note: the create/update will fail if a login method is not enabled and a relavant factor is added to either `firstFactors` or `requiredSecondaryFactors`. For example, `emailPasswordEnabled` cannot be set to `false` if `emailpassword` is present in the `firstFactors` array.

        If updating an existing tenant,
        1. core will keep the existing state of login methods and only update the ones that are specified in the request body.
        2. Core config will be merged into existing config. To delete a key in the config, use a null value

        The request must originate from public tenant, and the new tenant will use connectionUriDomain and app from which the request originates.

        Note: Updation of core config is not allowed for the default connectionUriDomain, public app and tenant. In order to update config for the default connectionUriDomain, public app and tenant, you must edit the config.yaml or the docker env directly.

      operationId: createOrUpdateTenantPUT
      deprecated: true
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - type: object
                required:
                  - tenantId
                properties:
                  tenantId:
                    $ref: '#/components/schemas/tenantId'
              - $ref: '#/components/schemas/tenantInput'
      responses:
        200:
          description: Create or Update tenant result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - createdNew
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  createdNew:
                    type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/multitenancy/tenant/v2:
    put:
      tags:
        - Multitenancy Recipe
      description: |
        Creates or updates a tenant.

        SuperTokens subscription license key is required.

        The `firstFactors` can be set to following values:

        - `null`: When set to `null`, all the login methods will be available for the tenant.
        - `[]` (empty array): No login methods will be enabled for the tenant.
        - `['factor1', 'factor2', ...]` (non-empty array): The list of login methods to enable for the tenant. For eg. if this is set to `['emailpassword', 'thirdparty']`, the users of the tenant will be able to login using emailpassword and third party providers.

        List of built-in first factors are as follows:

        - Email password auth: `emailpassword`
        - Social login / enterprise SSO auth: `thirdparty`
        - Passwordless:
          - With email OTP: `otp-email`
          - With SMS OTP: `otp-phone`
          - With email magic link: `link-email`
          - With SMS magic link: `link-phone`

        If first factors are not specified while creating a new tenant, all the login methods will be disabled by default.

        The `requiredSecondaryFactors` can be set to following values:
        - `null`: When set to `null`, no secondary factors will be required for the users of the tenant.
        - `['factor1', 'factor2', ...]` (non-empty array): The list of factors that the users of the tenant must complete post the first factor login. For eg. if this is set to `['otp-phone', 'totp']`, the users of the tenant will be required to complete either phone OTP or TOTP post the first factor login.

        List of built-in secondary factors are as follows:

        - Email password auth: `emailpassword`
        - Social login / enterprise SSO auth: `thirdparty`
        - Passwordless:
          - With email OTP: `otp-email`
          - With SMS OTP: `otp-phone`
          - With email magic link: `link-email`
          - With SMS magic link: `link-phone`
        - Time based OTP: `totp`

        If updating an existing tenant,
        1. core will keep the existing state of login methods and only update the ones that are specified in the request body.
        2. Core config will be merged into existing config. To delete a key in the config, use a null value

        The request must originate from public tenant, and the new tenant will use connectionUriDomain and app from which the request originates.

        Note: Updation of core config is not allowed for the default connectionUriDomain, public app and tenant. In order to update config for the default connectionUriDomain, public app and tenant, you must edit the config.yaml or the docker env directly.

      operationId: createOrUpdateTenantV2PUT
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              allOf:
              - type: object
                required:
                  - tenantId
                properties:
                  tenantId:
                    $ref: '#/components/schemas/tenantId'
              - $ref: '#/components/schemas/tenantInputV2'
      responses:
        200:
          description: Create or Update tenant result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - createdNew
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  createdNew:
                    type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/multitenancy/tenant:
    get:
      tags:
        - Multitenancy Recipe
      description: |
        This API is deprecated. Please use the v2 version of this API. In the v2 version of the API, the login methods are no longer enabled using the `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs. Instead, they are enabled using factorIds (such as emailpassword, otp-email, etc) specified in the `firstFactors` and `requiredSecondaryFactors` inputs. Please refer [Multitenancy Docs](https://supertokens.com/docs/multitenancy/new-tenant) to know the list of factorIds available.

        Note: This deprecated API still returns `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` values for backward compatibility, and it's values are derived from the `firstFactors` and `requiredSecondaryFactors` configured for the tenant. The detailed computation of the values as per CDI version is described here: https://github.com/supertokens/supertokens-core/issues/979#issuecomment-2099971371

        Get a tenant config of the tenant specified by the url prefix.

        SuperTokens subscription license key is required if querying any tenant other than the base tenant.

        Returns recipes with their enabled flag and recipe specific configs saved in core

      operationId: tenantConfigGet
      deprecated: true
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        200:
          description: Tenant config result
          content:
            application/json:
              schema:
                oneOf:
                - allOf:
                    - type: object
                      properties:
                        status:
                          $ref: '#/components/schemas/statusOK'
                    - $ref: '#/components/schemas/tenantConfig'
                - type: object
                  properties:
                    status:
                      type: string
                      enum: [TENANT_NOT_FOUND_ERROR]
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/multitenancy/tenant/v2:
    get:
      tags:
        - Multitenancy Recipe
      description: |
        Get a tenant config of the tenant specified by the url prefix.

        The value of `firstFactors` can be as follows:
        - `null`: When set to `null`, the SDK will use firstFactors defined in the SDK
        - `[]` (empty array): No first factors would be enabled for the tenant
        - non-empty array: The first factors that are enabled for the tenant

        SuperTokens subscription license key is required if querying any tenant other than the base tenant.

        Returns recipes with their enabled flag and recipe specific configs saved in core

      operationId: tenantConfigV2Get
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        200:
          description: Tenant config result
          content:
            application/json:
              schema:
                oneOf:
                - allOf:
                    - type: object
                      properties:
                        status:
                          $ref: '#/components/schemas/statusOK'
                    - $ref: '#/components/schemas/tenantConfigV2'
                - type: object
                  properties:
                    status:
                      type: string
                      enum: [TENANT_NOT_FOUND_ERROR]
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/dashboard/tenant/core-config:
    get:
      tags:
        - Dashboard Recipe
      description: |
        Get the core config of the tenant specified by the url prefix, along with the metadata of each of the fields.

      operationId: tenantCoreConfigForDashboardGET
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        '200':
          description: Tenant core config result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - config
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  config:
                    type: array
                    items:
                      type: object
                      properties:
                        key:
                          type: string
                          example: password_reset_token_lifetime
                        valueType:
                          type: string
                          enum: ["string", "number", "boolean"]
                          nullable: true
                          example: "number"
                        value:
                          nullable: true
                          oneOf:
                            - type: string
                            - type: number
                            - type: boolean
                          example: 3600000
                        description:
                          type: string
                          example: "Time in milliseconds for how long a password reset token / link is valid for. [Default: 3600000 (1 hour)]"
                        isDifferentAcrossTenants:
                          type: boolean
                        possibleValues:
                          nullable: true
                          type: array
                          items:
                            type: string
                        isNullable:
                          type: boolean
                          example: false
                        defaultValue:
                          nullable: true
                          oneOf:
                            - type: string
                            - type: number
                            - type: boolean
                          example: 3600000
                        isPluginProperty:
                          type: boolean
                          example: false
                        isPluginPropertyEditable:
                          type: boolean
                          example: false

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/multitenancy/tenant/remove:
    post:
      tags:
        - Multitenancy Recipe
      description: |
        Delete a tenant.

        Request must originate from public tenant.

      operationId: deleteTenantPOST
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - tenantId
              properties:
                tenantId:
                  $ref: '#/components/schemas/tenantId'
      responses:
        200:
          description: Remove tenant result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - didExist
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  didExist:
                    type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/multitenancy/tenant/list:
    get:
      tags:
        - Multitenancy Recipe
      description: |
        This API is deprecated. Please use the v2 version of this API. In the v2 version of the API, the login methods are no longer enabled using the `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` inputs. Instead, they are enabled using factorIds (such as emailpassword, otp-email, etc) specified in the `firstFactors` and `requiredSecondaryFactors` inputs. Please refer [Multitenancy Docs](https://supertokens.com/docs/multitenancy/new-tenant) to know the list of factorIds available.

        Note: This deprecated API still returns `emailPasswordEnabled`, `thirdPartyEnabled` and `passwordlessEnabled` values for backward compatibility, and it's values are derived from the `firstFactors` and `requiredSecondaryFactors` configured for the tenant. The detailed computation of the values as per CDI version is described here: https://github.com/supertokens/supertokens-core/issues/979#issuecomment-2099971371

        Get a list of all tenants in an app.

        Request must originate from public tenant.

      operationId: tenantListGET
      deprecated: true
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        200:
          description: List of tenants

          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - tenants
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  tenants:
                    type: array
                    items:
                      $ref: '#/components/schemas/tenantConfig'
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/recipe/multitenancy/tenant/list/v2:
    get:
      tags:
        - Multitenancy Recipe
      description: |
        Get a list of all tenants in an app.

        The value of `firstFactors` can be as follows:
        - `null`: When set to `null`, the SDK will use firstFactors defined in the SDK
        - `[]` (empty array): No first factors would be enabled for the tenant
        - non-empty array: The first factors that are enabled for the tenant

        Request must originate from public tenant.

      operationId: tenantListV2GET
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      responses:
        200:
          description: List of tenants

          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - tenants
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  tenants:
                    type: array
                    items:
                      $ref: '#/components/schemas/tenantConfigV2'
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/multitenancy/config/thirdparty:
    put:
      tags:
        - Multitenancy Recipe
      description: |
        Creates or updates ThirdParty Provider Config for a tenant.

        If `skipValidation` is set to true, the config will be saved without any validation.

        If the config already exists for the given `tenantId` and `thirdPartyId`, the config in the core will be completely replaced with the config provided in the request body.

        **Validations done by the core:**

        `thirdPartyId` and `name` are required

        Common to all providers:
          - `clients` list:
            - can be undefined or empty
            - if contains 1 element, clientType can be empty or undefined
            - if contains more than 1 element, clientType must be defined and unique
          - for each element in `clients`:
            - `clientId` must not be empty

        Built-in provider's specific validation is invoked if the `thirdPartyId` starts with the provider's id

        Apple (id: apple):
          - `clients`
            - if it contains elements, each of them are validated as follows:
              - `clientSecret` must be empty or undefined
              - `additionalConfig` should contain the following keys:
                - `keyId` must be a non empty string
                - `teamId` must be a non empty string
                - `privateKey` must be a non empty string

        Google Workspaces (id: google-workspaces):
          - `clients`
            - if it contains elements, each of them are validated as follows:
              - `additionalConfig` may contain the key `hd`
                - `hd` is optional
                - if specified, it must be either `"*"`, or a valid domain

        Boxy SAML (id: boxy-saml):
          - `clients`
            - `additionalConfig` in the each element must contain `boxyURL` and must be non-empty string

      operationId: createOrUpdateTenantConfigPUT
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - config
              properties:
                config:
                  $ref: '#/components/schemas/thirdPartyProviderConfig'
                skipValidation:
                  type: boolean
                  example: false

      responses:
        200:
          description: Create or Update result
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  required:
                    - status
                    - createdNew
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    createdNew:
                      type: boolean
                - type: object
                  required:
                  - status
                  - reason
                  properties:
                    status:
                      type: string
                      enum: ["CONFIG_VALIDATION_ERROR"]
                    reason:
                      type: string
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/multitenancy/config/thirdparty/remove:
    post:
      tags:
        - Multitenancy Recipe
      description: |
        Delete ThirdParty Provider config for a tenant.

      operationId: deleteTenantConfigPOST
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - thirdPartyId
              properties:
                thirdPartyId:
                  $ref: '#/components/schemas/thirdPartyId'

      responses:
        200:
          description: Remove thirdParty config result
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    didConfigExist:
                      type: boolean
        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/multitenancy/tenant/user:
    post:
      tags:
        - Multitenancy Recipe
      description: |
        Add user's association with the tenant.

        User will be added to the tenant based on the url prefix of the request.

        Note: To associate a user to a tenant, the tenant must be in the same database
        and user must already exist in the app

      operationId: addUserToTenant
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - recipeUserId
              properties:
                recipeUserId:
                  $ref: '#/components/schemas/userId'
      responses:
        200:
          description: Association result
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  required:
                    - status
                    - wasAlreadyAssociated
                  properties:
                    status:
                      $ref: '#/components/schemas/statusOK'
                    wasAlreadyAssociated:
                      type: boolean
                - type: object
                  required:
                  - status
                  properties:
                    status:
                      type: string
                      enum: ['UNKNOWN_USER_ID_ERROR', 'EMAIL_ALREADY_EXISTS_ERROR', 'PHONE_NUMBER_ALREADY_EXISTS_ERROR', 'THIRD_PARTY_USER_ALREADY_EXISTS_ERROR']
                - type: object
                  properties:
                    status:
                      type: string
                      enum: ['ASSOCIATION_NOT_ALLOWED_ERROR']
                    reason:
                      type: string

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'

  /appid-<appId>/<tenantId>/recipe/multitenancy/tenant/user/remove:
    post:
      tags:
        - Multitenancy Recipe
      description: |
        Remove user's association with the tenant

        User will be removed from the tenant based on the url prefix of the request.

      operationId: removeUserFromTenant
      parameters:
        - $ref: '#/components/parameters/multitenancyRid'
        - $ref: '#/components/parameters/api-key'
        - $ref: '#/components/parameters/cdi-version'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - recipeUserId
              properties:
                recipeUserId:
                  $ref: '#/components/schemas/userId'

      responses:
        200:
          description: Disassociation result
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - wasAssociated
                properties:
                  status:
                    $ref: '#/components/schemas/statusOK'
                  wasAssociated:
                    type: boolean

        '400':
          $ref: '#/components/responses/400'

        '401':
          $ref: '#/components/responses/401'

        '402':
          $ref: '#/components/responses/402'

        '404':
          $ref: '#/components/responses/404'

        '500':
          $ref: '#/components/responses/500'


components:
  parameters:
    rid:
      name: rid
      in: header
      example: emailpassword
      required: false
      schema:
        type: string
    api-key:
      name: Authorization
      in: header
      example: ajs30Nlbs0DjvsdFIne934n8NVee5n
      required: false
      schema:
        type: string

    thirdPartyRid:
      name: rid
      in: header
      example: thirdparty
      required: false
      schema:
        type: string

    passwordlessRid:
      name: rid
      in: header
      example: passwordless
      required: false
      schema:
        type: string

    emailVerificationRid:
      name: rid
      in: header
      example: emailverification
      required: false
      schema:
        type: string

    multitenancyRid:
      name: rid
      in: header
      example: multitenancy
      required: false
      schema:
        type: string

    userMetadataRid:
      name: rid
      in: header
      example: usermetadata
      required: false
      schema:
        type: string

    userRolesRid:
      name: rid
      in: header
      example: userroles
      required: false
      schema:
        type: string

    sessionRid:
      name: rid
      in: header
      example: session
      required: false
      schema:
        type: string

    jwtRID:
      name: rid
      in: header
      example: jwt
      required: false
      schema:
        type: string

    userIdMappingRid:
      name: rid
      in: header
      example: useridmapping
      required: false
      schema:
        type: string

    dashboardRid:
      name: rid
      in: header
      example: dashboard
      required: false
      schema:
        type: string

    totpRid:
      name: rid
      in: header
      example: totp
      required: false
      schema:
        type: string

    accountLinkingRid:
      name: rid
      in: header
      example: accountlinking
      required: false
      schema:
        type: string

    cdi-version:
      name: cdi-version
      in: header
      description: X.Y of the X.Y.Z CDI version.
      example: '5.1'
      schema:
        type: string


    paginationToken:
      name: paginationToken
      in: query
      example: ZmE3YTA4NDEtY...MjM5MTgwMzIyMzE=
      schema:
        type: string

    limit:
      name: limit
      in: query
      example: 1
      schema:
        type: number

    timeJoinedOrder:
      name: timeJoinedOrder
      in: query
      schema:
        type: string
        enum: ["ASC", "DESC"]


    email:
      name: email
      in: query
      required: false
      schema:
         type: string
         example: johndoe@gmail.com

    userId:
      name: userId
      in: query
      required: false
      schema:
         type: string
         example: fa7a0841-b533-4478-9253-0fde890c576

    userIdRequired:
      name: userId
      in: query
      required: true
      schema:
         type: string
         example: fa7a0841-b533-4478-9253-0fde890c576

    roleRequired:
      name: role
      in: query
      required: true
      schema:
         type: string
         example: admin

    permissionRequired:
      name: permission
      in: query
      required: true
      schema:
        type: string
        example: permission

    includeRecipeIds:
      name: includeRecipeIds
      in: query
      required: false
      description: The param should take an array of comma seperated strings
      schema:
        type: string
        example: val1,val2,val3..


  responses:
    500:
      description: error code 500
      content:
        text/plain:
          schema:
            $ref: "#/components/schemas/internalError"
    404:
      description: error code 404
      content:
        text/plain:
          schema:
            $ref: "#/components/schemas/notFound"
    405:
      description: error code 405
      content:
        text/plain:
          schema:
            $ref: "#/components/schemas/methodNotSupported"
    400:
      description: error code 400
      content:
        text/plain:
          schema:
            $ref: "#/components/schemas/invalidJSON"
    401:
      description: error code 401
      content:
        text/plain:
          schema:
            $ref: "#/components/schemas/requestUnauthorised"

    402:
      description: error code 402
      content:
        text/plain:
          schema:
            $ref: "#/components/schemas/licenseError"

    hello:
      description: return a simple hello message
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/helloResponse'

  schemas:
    authRecipeUser:
      type: object
      properties:
        id:
          $ref: '#/components/schemas/userId'
        isPrimaryUser:
          type: boolean
          example: true
        tenantIds:
          type: array
          items:
            $ref: '#/components/schemas/tenantId'
        timeJoined:
          $ref: '#/components/schemas/timeJoined'
        emails:
          type: array
          items:
            $ref: '#/components/schemas/email'
        phoneNumbers:
          type: array
          items:
            $ref: '#/components/schemas/phoneNumber'
        thirdParty:
          type: array
          items:
            type: object
            properties:
              id:
                $ref: '#/components/schemas/thirdPartyId'
              userId:
                $ref: '#/components/schemas/thirdPartyUserId'
        loginMethods:
          type: array
          items:
            type: object
            properties:
              tenantIds:
                type: array
                items:
                  $ref: '#/components/schemas/tenantId'
              recipeUserId:
                $ref: '#/components/schemas/userId'
              verified:
                type: boolean
                example: true
              timeJoined:
                $ref: '#/components/schemas/timeJoined'
              recipeId:
                $ref: '#/components/schemas/recipeId'
              email:
                $ref: '#/components/schemas/email'
              phoneNumber:
                $ref: '#/components/schemas/phoneNumber'
              thirdParty:
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/thirdPartyId'
                  userId:
                    $ref: '#/components/schemas/thirdPartyUserId'

    recipeId:
      type: string
      enum:
        - emailpassword
        - passwordless
        - thirdparty
    token:
      type: string
      example: ZTRiOTBjNz...jI5MTZlODkxw



    emailVerificationVerifyTokenRequest:
      type: object
      properties:
        userId:
          $ref: '#/components/schemas/userId'
        email:
          $ref: '#/components/schemas/email'



    thirdPartyId:
      type: string
      example: google

    thirdPartyUserId:
      type: string
      example: 106347997792363865062

    thirdPartyEmail:
      type: object
      properties:
        id:
          $ref: '#/components/schemas/email'
        isVerified:
          $ref: '#/components/schemas/isVerified'

    isVerified:
          type: boolean
          example: true

    email:
      type: string
      example: johndoe@gmail.com

    password:
      type: string
      example: password123

    userId:
      type: string
      example: fa7a0841-b533-4478-95533-0fde890c3483

    role:
      type: string
      example: admin

    timeJoined:
      type: number
      example: 1623918032231

    paginationToken:
      type: string
      example: ZmE3YTA4ND...OzE2MjM5MTgwMzIyMzE=

    phoneNumber:
      type: string
      example: '+14155552671'

    codeId:
      type: string
      description: Uniquely identifies a code
      example: QZ0Mx9zG9cfqNXmPI0I/67r9bpKghUBDQZeMMbayi+I=

    deviceId:
      type: string
      description: A random identifier that should be stored on the device that started the sign in process.
      example: TU/52WOcktSv99zqaAZuWJG9BSoS0aRLfCbep8rFEwk=

    preAuthSessionId:
      type: string
      description: A random identifier that can be used to identify the login attempt/device.
      example: kFmkPQEAJtACiT2w/K8fndEuNm+XozJXSZSlWEr+iGs=

    userInputCode:
      type: string
      description: This can be used to authenticate the user when paired with the deviceId
      example: 456123

    linkCode:
      type: string
      description: URL-safe string that can be used to authenticate the user, without the deviceId
      example: b10lbT_SnDC4flA6Fn7pE5TtG5k5NfigLef4QMBeGA8

    codeLifetime:
      type: number
      description: The maximum lifetime of the code in milliseconds
      example: 900000

    statusOK:
      type: string
      enum:
        - OK

    userMetadata:
      type: object
      description: should be a JSON object (not a JSON literal nor an array)
      example:
        {
          'preferences': { 'theme': 'dark' },
          'notifications': { 'email': true },
          'todos': ['example'],
        }

    userMetadataUpdate:
      type: object
      description: should be a JSON object (not a JSON literal nor an array)
      example: { 'notifications': { 'sms': true }, 'todos': null }

    userDataInJWT:
      type: object
      description: should be a JSON object (not a JSON literal nor an array)
      example: { 'test': 123 }

    userDataInDatabase:
      type: object
      description: should be a JSON object (not a JSON literal nor an array)
      example: { 'test': 123 }

    enableAntiCsrf:
      type: boolean
      example: false

    handle:
      type: string
      example: 68en6gd6-865b-4af6-ba00-96e5c153257d

    message:
      type: string
      example: Error Message

    session:
      type: object
      properties:
        handle:
          $ref: '#/components/schemas/handle'
        userId:
          $ref: '#/components/schemas/userId'
        userDataInJWT:
          $ref: '#/components/schemas/userDataInJWT'
        tenantId:
          $ref: '#/components/schemas/tenantId'
        recipeUserId:
          $ref: '#/components/schemas/userId'

    cookieInfo:
      type: object
      properties:
        token:
          $ref: '#/components/schemas/token'
        expiry:
          $ref: '#/components/schemas/expiry'
        createdTime:
          $ref: '#/components/schemas/timeCreated'

    expiry:
      type: number
      example: 1637262633029

    timeCreated:
      type: number
      example: 1637262633029


    sessionHandles:
      type: array
      items:
        $ref: '#/components/schemas/handle'

    createJWTPayload:
      type: object
      description: The payload of the JWT, should be a JSON object.
      example: {"custom-claim": ""}

    createJWTAlgorithm:
      type: string
      description: The algorithm to use when creating the JWT.
      enum: ["RS256"]

    jwksDomain:
      type: string
      description: This is used as the value for the issuer claim in the JWT payload.
      example: https://api.test.com/
    jwtValidity:
      type: number
      description: Duration in seconds, used to calculate JWT expiry
      example: 86400
    jwk:
      type: object
      description: A JWK that can be used to verify a JWT
      properties:
        alg:
          $ref: '#/components/schemas/createJWTAlgorithm'
        kty:
          type: string
          example: RSA
        use:
          type: string
          example: sig
        kid:
          type: string
          description: Unique identifier for the JWK
        x5c:
          type: array
          description: X.509 Certificate Chain
          items:
            type: string

    unauthorisedMessageResponse:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/unauthorisedResponse'
        message:
          $ref: '#/components/schemas/message'

    helloResponse:
      type: string
      enum: ['Hello']


    statusOKResponse:
      type: object
      properties:
        status:
          type: string
          enum: ['OK']


    wrongCredentialsResponse:
      type: object
      properties:
        status:
          type: string
          enum: ['WRONG_CREDENTIALS_ERROR']

    unknownUserIdResponse:
      type: object
      properties:
        status:
          type: string
          enum: ['UNKNOWN_USER_ID_ERROR']

    unknownRoleResponse:
      type: object
      properties:
        status:
          type: string
          enum: ['UNKNOWN_ROLE_ERROR']



    tokenTheftResponse:
        type: string
        enum: ['TOKEN_THEFT_DETECTED']

    unauthorisedResponse:
        type: string
        enum: ['UNAUTHORISED']

    tryRefreshTokenResponse:
        type: string
        enum: ['TRY_REFRESH_TOKEN']



    internalError:
      type: string
      enum:
        - Internal Error

    notFound:
      type: string
      enum:
        - Not Found

    methodNotSupported:
      type: string
      enum:
        - Method not supported

    invalidJSON:
      type: string

    requestUnauthorised:
      type: string
      enum:
        - Invalid API key

    licenseError:
      type: string
      enum:
        - License Error

    tenantId:
      type: string
      example: 'customer1'

    thirdPartyProviderConfig:
      type: object
      required:
        - thirdPartyId
      properties:
        thirdPartyId:
          type: string
        name:
          type: string
        clients:
          type: array
          items:
            type: object
            properties:
              clientType:
                type: string
              clientId:
                type: string
              clientSecret:
                type: string
              scope:
                type: array
                items:
                  type: string
              forcePKCE:
                type: boolean
              additionalConfig:
                type: object
        authorizationEndpoint:
          type: string
        authorizationEndpointQueryParams:
          type: object
        tokenEndpoint:
          type: string
        tokenEndpointBodyParams:
          type: object
        userInfoEndpoint:
          type: string
        userInfoEndpointQueryParams:
          type: object
        userInfoEndpointHeaders:
          type: object
        jwksURI:
          type: string
        oidcDiscoveryEndpoint:
          type: string
        requireEmail:
          type: boolean
          default: true
        userInfoMap:
          type: object
          properties:
            fromIdTokenPayload:
              type: object
              properties:
                userId:
                  type: string
                email:
                  type: string
                emailVerified:
                  type: string
            fromUserInfoAPI:
              type: object
              properties:
                userId:
                  type: string
                email:
                  type: string
                emailVerified:
                  type: string

    firstFactors:
      type: array
      items:
        type: string
        example: "emailpassword"
    requiredSecondaryFactors:
      type: array
      items:
        type: string
        example: otp-phone

    tenantInput:
      type: object
      properties:
        emailPasswordEnabled:
          type: boolean
        thirdPartyEnabled:
          type: boolean
        passwordlessEnabled:
          type: boolean
        firstFactors:
          $ref: '#/components/schemas/firstFactors'
        requiredSecondaryFactors:
          $ref: '#/components/schemas/requiredSecondaryFactors'
        coreConfig:
          type: object

    tenantInputV2:
      type: object
      properties:
        firstFactors:
          $ref: '#/components/schemas/firstFactors'
        requiredSecondaryFactors:
          $ref: '#/components/schemas/requiredSecondaryFactors'
        coreConfig:
          type: object

    tenantConfig:
      type: object
      required:
        - emailPassword
        - thirdParty
        - passwordless
        - coreConfig
        - tenantId
      properties:
        tenantId:
          $ref: '#/components/schemas/tenantId'
        emailPassword:
          type: object
          required:
            - enabled
          properties:
            enabled:
              type: boolean
        thirdParty:
          type: object
          required:
            - enabled
          properties:
            enabled:
              type: boolean
            providers:
              type: array
              items:
                $ref: '#/components/schemas/thirdPartyProviderConfig'
        passwordless:
          type: object
          required:
            - enabled
          properties:
            enabled:
              type: boolean
        firstFactors:
          $ref: '#/components/schemas/firstFactors'
        requiredSecondaryFactors:
          $ref: '#/components/schemas/requiredSecondaryFactors'
        coreConfig:
          type: object

    tenantConfigV2:
      type: object
      required:
        - thirdParty
        - coreConfig
        - tenantId
      properties:
        tenantId:
          $ref: '#/components/schemas/tenantId'
        thirdParty:
          type: object
          properties:
            providers:
              type: array
              items:
                $ref: '#/components/schemas/thirdPartyProviderConfig'
        firstFactors:
          $ref: '#/components/schemas/firstFactors'
        requiredSecondaryFactors:
          $ref: '#/components/schemas/requiredSecondaryFactors'
        coreConfig:
          type: object