openapi: 3.0.3
info:
  title: 'Fibre Gateway : Authentication'
  version: '1.0'
  description: >
    # Introduction


    The Fibre Cafe is a scalable, unified platform to support L2C provisioning,
    in-life modification/cease and

    T2R trouble resolution between communication providers (CP) and network
    operators or aggregators.


    The Fibre Cafe is secured using the standard OAuth 2.0 authorization
    protocol - all requests must include a valid

    access token. Tenant access tokens provide access to the Tenant API and
    supplier access tokens provide access to

    the Supplier Updates API. IP address whitelisting is also enabled so all
    callers must provide the static public IP

    address for any inbound traffic.


    Access tokens can be retrieved from this endpoint - they are intended to be
    re-used and not created per request. 

    The tokens will expire in 60 minutes by default - at which point a new token
    can be requested.

    __


    © 2022-2026 Strategic Imperatives
servers:
  - url: https://prod.fibregateway.com/v1
paths:
  /auth/tenant/access-token:
    post:
      summary: Tenant authentication - retrieve access token.
      description: >
        This endpoint is called to retrieve an access token which must be
        provided in the header

        on subsequent tenant calls to the gateway.


        Either Authorization header or client id/secret must be provided.
      operationId: getTenantAccessToken
      security:
        - {}
      parameters:
        - name: Authorization
          description: >-
            The Authorization header is Basic Base64-encoded app client
            credentials - client_id:client_secret
          in: header
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - grant_type
              properties:
                grant_type:
                  description: >-
                    Grant type - only client_credentials is supported at the
                    moment
                  type: string
                  example: client_credentials
                scope:
                  description: >-
                    Limit to space-delimited list of scopes registered with the
                    app client (optional)
                  type: string
                  example: com.fibregateway.<ENV_NAME>/tenant.all.all
                client_id:
                  description: >-
                    The ID of the app client - required if not using
                    Authorization header
                  type: string
                client_secret:
                  description: >-
                    The client secret for the app client - required if not using
                    Authorization header
                  type: string
      responses:
        '200':
          description: Successfully generated access token
          content:
            application/json:
              schema:
                description: Represents authentication response including access token.
                type: object
                properties:
                  access_token:
                    description: Access token to use in requests
                    type: string
                    example: eyJraWQiOiI3WEl6amJaakZjYlpWK...
                  expires_in:
                    description: Token expiry in seconds (TTL)
                    type: string
                    example: 3600
                  token_type:
                    description: Token type
                    type: string
                    example: Bearer
        '400':
          description: Bad request - authentication failed
          content:
            application/json:
              schema:
                description: Supplied request was malformed or missing mandatory parameters
                type: object
                properties:
                  error:
                    description: >
                      Reason for failure:

                      - invalid_request - request is missing a required
                      parameter or is otherwise malformed

                      - invalid_client - client authentication failed - no such
                      client id and/or secret

                      - invalid_grant - access issue or access has been revoked

                      - unauthorized_client - client is not authorized 

                      - unsupported_grant_type - an unrecognised grant type was
                      specified
                    type: string
                    example: >-
                      invalid_request|invalid_client|invalid_grant|unauthorized_client|unsupported_grant_type
        '503':
          description: Fibre Gateway is temporarily unavailable
  /auth/supplier/access-token:
    post:
      summary: Supplier KCI authentication - retrieve access token.
      description: >
        This endpoint is called to retrieve an access token which must be
        provided in the header

        on subsequent supplier KCI calls to the gateway.


        Either Authorization header or client id/secret must be provided.
      operationId: getSupplierAccessToken
      security:
        - {}
      parameters:
        - name: Authorization
          description: >-
            The Authorization header is Basic Base64-encoded app client
            credentials - client_id:client_secret
          in: header
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - grant_type
              properties:
                grant_type:
                  description: >-
                    Grant type - only client_credentials is supported at the
                    moment
                  type: string
                  example: client_credentials
                scope:
                  description: >-
                    Limit to space-delimited list of scopes registered with the
                    app client (optional)
                  type: string
                  example: com.fibregateway.<ENV_NAME>/tenant.all.all
                client_id:
                  description: >-
                    The ID of the app client - required if not using
                    Authorization header
                  type: string
                client_secret:
                  description: >-
                    The client secret for the app client - required if not using
                    Authorization header
                  type: string
      responses:
        '200':
          description: Successfully generated access token
          content:
            application/json:
              schema:
                description: Represents authentication response including access token.
                type: object
                properties:
                  access_token:
                    description: Access token to use in requests
                    type: string
                    example: eyJraWQiOiI3WEl6amJaakZjYlpWK...
                  expires_in:
                    description: Token expiry in seconds (TTL)
                    type: string
                    example: 3600
                  token_type:
                    description: Token type
                    type: string
                    example: Bearer
        '400':
          description: Bad request - authentication failed
          content:
            application/json:
              schema:
                description: Supplied request was malformed or missing mandatory parameters
                type: object
                properties:
                  error:
                    description: >
                      Reason for failure:

                      - invalid_request - request is missing a required
                      parameter or is otherwise malformed

                      - invalid_client - client authentication failed - no such
                      client id and/or secret

                      - invalid_grant - access issue or access has been revoked

                      - unauthorized_client - client is not authorized 

                      - unsupported_grant_type - an unrecognised grant type was
                      specified
                    type: string
                    example: >-
                      invalid_request|invalid_client|invalid_grant|unauthorized_client|unsupported_grant_type
        '503':
          description: Fibre Gateway is temporarily unavailable
components: {}
