openapi-flow.yaml

openapi: 3.0.3
info:
  title: Flow API
  description: Flow API
  version: 1.2.0
servers:
  - url: "https://{tenant_id}.hanko.io"
    variables:
      tenant_id:
        default: ""
        description: "The (UU)ID of a tenant. Replace the default value with your tenant ID."
paths:
  /registration:
    post:
      tags:
        - flow
      description: Initialize or advance a registration flow.
      summary: Registration
      parameters:
        - $ref: "#/components/parameters/ActionParam"
        - $ref: "#/components/parameters/LanguageParam"
      requestBody:
        $ref: "#/components/requestBodies/RegistrationRequestBody"
      responses:
        200:
          $ref: "#/components/responses/RegistrationFlowResponse"
        400:
          $ref: "#/components/responses/RegistrationFlowResponseBadRequestError"
        401:
          $ref: "#/components/responses/FlowResponseUnauthorizedError"
        403:
          $ref: "#/components/responses/FlowResponseForbiddenError"
        410:
          $ref: "#/components/responses/FlowResponseGoneError"
        429:
          $ref: "#/components/responses/FlowResponseTooManyRequestsError"
        500:
          $ref: "#/components/responses/FlowResponseInternalServerError"
  /login:
    post:
      tags:
        - flow
      description: Initialize or advance a login flow.
      summary: Login
      parameters:
        - $ref: "#/components/parameters/ActionParam"
        - $ref: "#/components/parameters/LanguageParam"
      requestBody:
        $ref: "#/components/requestBodies/LoginRequestBody"
      responses:
        200:
          $ref: "#/components/responses/LoginFlowResponse"
        400:
          $ref: "#/components/responses/LoginFlowResponseBadRequestError"
        401:
          $ref: "#/components/responses/FlowResponseUnauthorizedError"
        403:
          $ref: "#/components/responses/FlowResponseForbiddenError"
        410:
          $ref: "#/components/responses/FlowResponseGoneError"
        429:
          $ref: "#/components/responses/FlowResponseTooManyRequestsError"
        500:
          $ref: "#/components/responses/FlowResponseInternalServerError"
  /profile:
    post:
      tags:
        - flow
      description: Initialize or advance a profile flow.
      summary: Profile
      security:
        - CookieAuth: []
        - BearerTokenAuth: []
      parameters:
        - $ref: "#/components/parameters/ActionParam"
        - $ref: "#/components/parameters/LanguageParam"
      requestBody:
        $ref: "#/components/requestBodies/ProfileRequestBody"
      responses:
        200:
          $ref: "#/components/responses/ProfileFlowResponse"
        400:
          $ref: "#/components/responses/ProfileFlowResponseBadRequestError"
        401:
          $ref: "#/components/responses/FlowResponseUnauthorizedError"
        403:
          $ref: "#/components/responses/FlowResponseForbiddenError"
        404:
          $ref: "#/components/responses/FlowResponseNotFoundError"
        410:
          $ref: "#/components/responses/FlowResponseGoneError"
        429:
          $ref: "#/components/responses/FlowResponseTooManyRequestsError"
        500:
          $ref: "#/components/responses/FlowResponseInternalServerError"
  /token_exchange:
    post:
      tags:
        - flow
      description: |
        Initialize or advance a token exchange flow. 
        
        This flow is only available if SAML is enabled.
      summary: Token exchange
      parameters:
        - $ref: "#/components/parameters/ActionParam"
        - $ref: "#/components/parameters/LanguageParam"
      requestBody:
        $ref: "#/components/requestBodies/TokenExchangeRequestBody"
      responses:
        200:
          $ref: "#/components/responses/TokenExchangeFlowResponse"
        400:
          $ref: "#/components/responses/LoginFlowResponseBadRequestError"
        401:
          $ref: "#/components/responses/FlowResponseUnauthorizedError"
        403:
          $ref: "#/components/responses/FlowResponseForbiddenError"
        429:
          $ref: "#/components/responses/FlowResponseTooManyRequestsError"
        500:
          $ref: "#/components/responses/FlowResponseInternalServerError"
components:
  securitySchemes:
    CookieAuth:
      type: apiKey
      in: cookie
      name: hanko
    BearerTokenAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
  parameters:
    ActionParam:
      in: query
      name: action
      description: |
        String of the format `{action_name}@{flow_id}`. Indicates the action to perform on the flow with the 
        given `flow_id`. Omitting the query parameter initializes a new flow.
        
        _Note for playground usage_: You can derive the value for this query parameter from the `action`'s `href` 
        property in a flow state response, e.g. for an `href` value of 
        `/login?action=register_client_capabilities%4015655672-41ca-48cc-afb1-90be77075764` the (non-URL-encoded) value
        would be `register_client_capabilities@15655672-41ca-48cc-afb1-90be77075764`.
      schema:
        type: string
        example: register_client_capabilities@15655672-41ca-48cc-afb1-90be77075764
    LanguageParam:
      in: header
      name: X-Language
      schema:
        type: string
        enum:
          - bn
          - de
          - en
          - fr
          - it
          - nl
          - pt-BR
          - zh
      description: |
        Used to internationalize outgoing emails (e.g. for email verification, recovery, etc.). 

        If email delivery by Hanko is enabled the values for supported languages are: 
          - "bn" (Bengali/Bangla)
          - "de" (German) 
          - "en" (English) 
          - "fr" (French) 
          - "it" (Italian) 
          - "nl" (Dutch)
          - "pt-BR" (Brazilian Portuguese), 
          - "zh" (Chinese)
        
        If email delivery by Hanko is disabled and a webhook has been configured for the `email.send` event, the
        JWT payload of the `token` contained in the response to the webhook endpoint contains a `language` claim that
        reflects the value originally passed as the header value.
  schemas:
    Action:
      description: Action
      type: object
      properties:
        action:
          description: The name of the action.
          type: string
        href:
          description: The action target as a URL relative to the API tenant base URL.
          type: string
        description:
          description: The description for the action.
          type: string
        inputs:
          description: |
            The inputs for the action. 
            
            An input indicates that when making a request to perform an action, the `input_data` value of the 
            request body must contain a key with the given `name` value of the respective input. The corresponding 
            value for that key is specified by the remaining properties of the input.
          type: object
    ActionAccountDelete:
      description: |
        Delete an account.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "account_delete"
    ActionBack:
      description: Go back to the previous state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "back"
    ActionConnectThirdPartyOAuthProvider:
      description: Connect a third-party OAuth provider.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "connect_thirdparty_oauth_provider"
            inputs:
              $ref: "#/components/schemas/InputsConnectThirdPartyOAuthProvider"
    ActionContinueToLoginOTP:
      description: Continue to the `login_otp` state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_to_login_otp"
    ActionContinueToLoginSecurityKey:
      description: Continue to the `login_security_key` state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_to_login_security_key"
    ActionContinueToOTPSecretCreation:
      description: Continue to the `mfa_otp_secret_creation` state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_to_otp_secret_creation"
    ActionContinueToPasscodeConfirmation:
      description: Continue to the `passcode_confirmation` state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_to_passcode_confirmation"
    ActionContinueToPasscodeConfirmationRecovery:
      description: Continue to the `passcode_confirmation` state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_to_passcode_confirmation_recovery"
    ActionContinueToPasskeyRegistration:
      description: Continue to the `onboarding_create_passkey` state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_to_passkey_registration"
    ActionContinueToPasswordRegistration:
      description: Continue to the `password_creation` state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_to_password_registration"
    ActionContinueToPasswordLogin:
      description: Continue to the `login_password` state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_to_password_login"
    ActionContinueToSecurityKeyCreation:
      description: Continue to the `mfa_security_key_creation` state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_to_security_key_creation"
    ActionContinueWithLoginIdentifier:
      description: Provide a login identifier (email or username).
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "continue_with_login_identifier"
            inputs:
              $ref: "#/components/schemas/InputsContinueWithLoginIdentifier"
    ActionDisconnectThirdPartyOAuthProvider:
      description: Disconnect a third-party OAuth provider.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "disconnect_thirdparty_oauth_provider"
            inputs:
              $ref: "#/components/schemas/InputsDisconnectThirdPartyOAuthProvider"
    ActionEmailAddressSet:
      description: Set an email address.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "email_address_set"
            inputs:
              $ref: "#/components/schemas/InputsEmailAddressSet"
    ActionEmailCreate:
      description: Add an email.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "email_create"
            inputs:
              $ref: "#/components/schemas/InputsEmailCreate"
    ActionEmailDelete:
      description: Delete an email.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "email_delete"
            inputs:
              $ref: "#/components/schemas/InputsEmailDelete"
    ActionEmailSetPrimary:
      description: Set an email as the primary email.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "email_set_primary"
            inputs:
              $ref: "#/components/schemas/InputsEmailSetPrimary"
    ActionEmailVerify:
      description: Verify an email.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "email_verify"
            inputs:
              $ref: "#/components/schemas/InputsEmailVerify"
    ActionExchangeToken:
      description: Exchange a one time token after a third party authentication for a session token.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "exchange_token"
            inputs:
              $ref: "#/components/schemas/InputsExchangeToken"
    ActionRegisterClientCapabilities:
      description: Provide information about whether the client is capable of using passkeys (a.k.a. the Webauthn API).
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "register_client_capabilities"
            inputs:
              $ref: "#/components/schemas/InputsRegisterClientCapabilities"
    ActionRegisterLoginIdentifier:
      description: Register an email or username.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "register_login_identifier"
            inputs:
              $ref: "#/components/schemas/InputsRegisterLoginIdentifier"
    ActionRegisterPassword:
      description: Register a password.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "register_password"
            inputs:
              $ref: "#/components/schemas/InputsRegisterPassword"
    ActionResendPasscode:
      description: Resend a passcode.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "resend_passcode"
    ActionOTPCodeVerify:
      description: Verify an OTP code to set up (T)OTP MFA.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "otp_code_verify"
            inputs:
              $ref: "#/components/schemas/InputsOTPCodeVerify"
    ActionOTPCodeValidate:
      description: Validate an OTP code for use as a second factor.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "otp_code_validate"
            inputs:
              $ref: "#/components/schemas/InputsOTPCodeVerify"
    ActionPasswordCreate:
      description: Create a password.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "password_create"
            inputs:
              $ref: "#/components/schemas/InputsPasswordCreate"
    ActionOTPSecretDelete:
      description: Delete an OTP secret.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "otp_secret_delete"
    ActionPasswordDelete:
      description: Delete a password.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "password_delete"
    ActionPasswordUpdate:
      description: Update a password.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "password_update"
            inputs:
              $ref: "#/components/schemas/InputsPasswordUpdate"
    ActionPasswordLogin:
      description: Authenticate with a password.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "password_login"
            inputs:
              $ref: "#/components/schemas/InputsPasswordLogin"
    ActionPasswordRecovery:
      description: Set up a new password as part of a recovery process.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "password_recovery"
            inputs:
              $ref: "#/components/schemas/InputsPasswordRecovery"
    ActionPatchMetadata:
      description: Patches the (unsafe) metadata of a user.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "patch_metadata"
            inputs:
              $ref: "#/components/schemas/InputsPatchMetadata"
    ActionRememberMe:
      description: |
        This action determines whether a session cookie or a persistent cookie is issued on flow success. 
        
        - If the `remember_me` input is set to `true`, the flow response on flow success contains a `Set-Cookie` header
        with a persistent cookie and an `X-Session-Retention` header with a `persistent` value.
        - If the `remember_me` input is set to `false`, the flow response on flow success contains a `Set-Cookie` header
        with a session cookie and an `X-Session-Retention` header with a `session` value.
        
        The action is only present if the tenant's cookie retention type is set to 'prompt'.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "remember_me"
            inputs:
              $ref: "#/components/schemas/InputsRememberMe"
    ActionThirdPartyOauth:
      description: |
        Initialize a third party sign-up/sign-in by specifying the `provider` (it must be enabled and configured at the 
        tenant) to use and the  URL to redirect to (`redirect_to`) after successful authentication with the provider. 

        A `redirect_url` to the selected provider is placed in the `payload` of the next state (`thirdparty`).
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "thirdparty_oauth"
            inputs:
              $ref: "#/components/schemas/InputsThirdPartyOauth"
    ActionUsernameDelete:
      description: Delete a username.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "username_create"
    ActionUsernameSet:
      description: Set a username.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "username_set"
            inputs:
              $ref: "#/components/schemas/InputsUsernameSet"
    ActionSecurityKeyCreate:
      description: Create a security key.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "security_key_create"
    ActionSecurityKeyDelete:
      description: Delete a security key.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "security_key_delete"
            inputs:
              $ref: "#/components/schemas/InputsSecurityKeyDelete"
    ActionSessionDelete:
      description: Revoke a session.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "session_delete"
            inputs:
              $ref: "#/components/schemas/InputsSessionDelete"
    ActionSkip:
      description: Skip to the next state.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "skip"
    ActionTrustDevice:
      description: |
        Execution of this action indicates that a user considers the device or browser used as trusted. As a 
        result, MFA (if it is enabled and the user has registered an MFA credential) is skipped for subsequent logins. 
        Trust persists until it explicitly expires and its expiry is not
        extended on subsequent logins. Users must provide MFA again after expiry.
        
        Generates a random device token that is returned to the client in a `Set-Cookie` header on flow success.
        The action is only present in the flow response if this Cookie is not set, i.e. if no trust has been granted 
        or if the cookie has expired.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "trust_device"
    ActionVerifyPasscode:
      description: Verify a passcode.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "verify_passcode"
            inputs:
              $ref: "#/components/schemas/InputsVerifyPasscode"
    ActionWebauthnCredentialCreate:
      description: Generate passkey creation options for registering a passkey.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "webauthn_credential_create"
    ActionWebauthnCredentialDelete:
      description: Delete a passkey.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "webauthn_credential_delete"
            inputs:
              $ref: "#/components/schemas/InputsWebauthnCredentialDelete"
    ActionWebauthnCredentialRename:
      description: Rename a passkey.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "webauthn_credential_rename"
            inputs:
              $ref: "#/components/schemas/InputsWebauthnCredentialRename"
    ActionWebauthnGenerateCreationOptions:
      description: Generate passkey creation options for registering a passkey.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "webauthn_generate_creation_options"
    ActionWebauthnGenerateRequestOptions:
      description: Generate passkey request options for authenticating with a passkey.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "webauthn_generate_request_options"
    ActionWebauthnVerifyAssertionResponse:
      description: Verify an assertion response to complete a passkey authentication.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "webauthn_verify_assertion_response"
            inputs:
              $ref: "#/components/schemas/InputsWebauthnVerifyAssertionResponse"
    ActionWebauthnVerifyAttestationResponse:
      description: Verify an attestation response to complete a passkey registration.
      allOf:
        - $ref: "#/components/schemas/Action"
        - type: object
          properties:
            action:
              enum:
                - "webauthn_verify_assertion_response"
            inputs:
              $ref: "#/components/schemas/InputsWebauthnVerifyAttestationResponse"
    Actions:
      description: List of actions that can be performed in the current flow state in order to advance the flow to the next state.
      type: object
      additionalProperties:
        $ref: "#/components/schemas/Action"
    ActionsDeviceTrust:
      type: object
      properties:
        trust_device:
          $ref: "#/components/schemas/ActionTrustDevice"
        skip:
          $ref: "#/components/schemas/ActionSkip"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsCredentialOnboardingChooser:
      type: object
      properties:
        continue_to_passkey_registration:
          $ref: "#/components/schemas/ActionContinueToPasskeyRegistration"
        continue_to_password_registration:
          $ref: "#/components/schemas/ActionContinueToPasswordRegistration"
        skip:
          $ref: "#/components/schemas/ActionSkip"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsLoginInit:
      type: object
      properties:
        continue_with_login_identifier:
          $ref: "#/components/schemas/ActionContinueWithLoginIdentifier"
        webauthn_generate_request_options:
          $ref: "#/components/schemas/ActionWebauthnGenerateRequestOptions"
        webauthn_verify_assertion_response:
          $ref: "#/components/schemas/ActionWebauthnVerifyAssertionResponse"
        thirdparty_oauth:
          $ref: "#/components/schemas/ActionThirdPartyOauth"
        remember_me:
          $ref: "#/components/schemas/ActionRememberMe"
    ActionsLoginMethodChooser:
      type: object
      properties:
        continue_to_password_login:
          $ref: "#/components/schemas/ActionContinueToPasswordLogin"
        continue_to_passcode_confirmation:
          $ref: "#/components/schemas/ActionContinueToPasscodeConfirmation"
    ActionsLoginPasskey:
      type: object
      properties:
        webauthn_verify_assertion_response:
          $ref: "#/components/schemas/ActionWebauthnVerifyAssertionResponse"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsLoginPassword:
      type: object
      properties:
        password_login:
          $ref: "#/components/schemas/ActionPasswordLogin"
        continue_to_passcode_confirmation_recovery:
          $ref: "#/components/schemas/ActionContinueToPasscodeConfirmationRecovery"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsLoginOTP:
      type: object
      properties:
        otp_code_validate:
          $ref: "#/components/schemas/ActionOTPCodeValidate"
        continue_to_login_security_key:
          $ref: "#/components/schemas/ActionContinueToLoginSecurityKey"
    ActionsLoginSecurityKey:
      type: object
      properties:
        webauthn_generate_request_options:
          $ref: "#/components/schemas/ActionWebauthnGenerateRequestOptions"
        continue_to_login_otp:
          $ref: "#/components/schemas/ActionContinueToLoginOTP"
    ActionsLoginPasswordRecovery:
      type: object
      properties:
        password_recovery:
          $ref: "#/components/schemas/ActionPasswordRecovery"
    ActionsMFAMethodChooser:
      type: object
      properties:
        back:
          $ref: "#/components/schemas/ActionBack"
        continue_to_otp_secret_creation:
          $ref: "#/components/schemas/ActionContinueToOTPSecretCreation"
        continue_to_security_key_creation:
          $ref: "#/components/schemas/ActionContinueToSecurityKeyCreation"
        skip:
          $ref: "#/components/schemas/ActionSkip"
    ActionsMFAOTPSecretCreation:
      type: object
      properties:
        otp_code_verify:
          $ref: "#/components/schemas/ActionOTPCodeVerify"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsMFASecurityKeyCreation:
      type: object
      properties:
        webauthn_generate_creation_options:
          $ref: "#/components/schemas/ActionWebauthnGenerateCreationOptions"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsOnboardingCreatePasskey:
      type: object
      properties:
        webauthn_generate_creation_options:
          $ref: "#/components/schemas/ActionWebauthnGenerateCreationOptions"
        skip:
          $ref: "#/components/schemas/ActionSkip"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsOnboardingEmail:
      type: object
      properties:
        email_address_set:
          $ref: "#/components/schemas/ActionEmailAddressSet"
        skip:
          $ref: "#/components/schemas/ActionSkip"
    ActionsOnboardingUsername:
      type: object
      properties:
        username_set:
          type: object
          properties:
            action:
              enum:
                - "username_set"
            inputs:
              $ref: "#/components/schemas/InputsUsernameSet"
        skip:
          $ref: "#/components/schemas/ActionSkip"
    ActionsOnboardingVerifyPasskeyAttestation:
      type: object
      properties:
        webauthn_verify_attestation_response:
          type: object
          properties:
            action:
              enum:
                - "webauthn_verify_attestation_response"
            inputs:
              $ref: "#/components/schemas/InputsWebauthnVerifyAttestationResponse"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsPasscodeConfirmation:
      type: object
      properties:
        verify_passcode:
          $ref: "#/components/schemas/ActionVerifyPasscode"
        resend_passcode:
          $ref: "#/components/schemas/ActionResendPasscode"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsPasswordCreation:
      type: object
      properties:
        register_password:
          $ref: "#/components/schemas/ActionRegisterPassword"
        skip:
          $ref: "#/components/schemas/ActionSkip"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsPreflight:
      type: object
      properties:
        register_client_capabilities:
          $ref: "#/components/schemas/ActionRegisterClientCapabilities"
    ActionsProfileInit:
      type: object
      properties:
        account_delete:
          $ref: "#/components/schemas/ActionAccountDelete"
        connect_thirdparty_oauth_provider:
          $ref: "#/components/schemas/ActionConnectThirdPartyOAuthProvider"
        continue_to_otp_secret_creation:
          $ref: "#/components/schemas/ActionContinueToOTPSecretCreation"
        disconnect_thirdparty_oauth_provider:
          $ref: "#/components/schemas/ActionDisconnectThirdPartyOAuthProvider"
        email_create:
          $ref: "#/components/schemas/ActionEmailCreate"
        email_delete:
          $ref: "#/components/schemas/ActionEmailDelete"
        email_set_primary:
          $ref: "#/components/schemas/ActionEmailSetPrimary"
        email_verify:
          $ref: "#/components/schemas/ActionEmailVerify"
        otp_secret_delete:
          $ref: "#/components/schemas/ActionOTPSecretDelete"
        password_create:
          $ref: "#/components/schemas/ActionPasswordCreate"
        password_update:
          $ref: "#/components/schemas/ActionPasswordUpdate"
        password_delete:
          $ref: "#/components/schemas/ActionPasswordDelete"
        patch_metadata:
          $ref: "#/components/schemas/ActionPatchMetadata"
        security_key_create:
          $ref: "#/components/schemas/ActionSecurityKeyCreate"
        security_key_delete:
          $ref: "#/components/schemas/ActionSecurityKeyDelete"
        session_delete:
          $ref: "#/components/schemas/ActionSessionDelete"
        username_set:
          $ref: "#/components/schemas/ActionUsernameSet"
        username_delete:
          $ref: "#/components/schemas/ActionUsernameDelete"
        webauthn_credential_rename:
          $ref: "#/components/schemas/ActionWebauthnCredentialRename"
        webauthn_credential_create:
          $ref: "#/components/schemas/ActionWebauthnCredentialCreate"
        webauthn_credential_delete:
          $ref: "#/components/schemas/ActionWebauthnCredentialDelete"
    ActionsRegistrationInit:
      type: object
      properties:
        register_login_identifier:
          $ref: "#/components/schemas/ActionRegisterLoginIdentifier"
        thirdparty_oauth:
          $ref: "#/components/schemas/ActionThirdPartyOauth"
        remember_me:
          $ref: "#/components/schemas/ActionRememberMe"
    ActionsThirdParty:
      type: object
      properties:
        exchange_token:
          $ref: "#/components/schemas/ActionExchangeToken"
        back:
          $ref: "#/components/schemas/ActionBack"
    ActionsWebauthnVerifyAttestationResponse:
      description: ActionsWebauthnVerifyAttestationResponse
      type: object
      properties:
        webauthn_verify_attestation_response:
          $ref: "#/components/schemas/ActionWebauthnVerifyAttestationResponse"
        back:
          $ref: "#/components/schemas/ActionBack"
    AnyValue:
      description: Can be any value - string, number, boolean, array or object.
    Claims:
      description: Contains the claims of a user as they appear in the payload of session JWTs.
      type: object
      properties:
        amr:
          description: Authentication Method References, JSON array of strings that are identifiers for authentication methods used in the authentication.
          type: array
          items:
            type: string
            enum:
              - pwd
              - passkey
              - otp
              - ext:<provider>
              - totp
              - security_key
            description: |
              - `pwd` => password
              - `passkey` => passkey
              - `otp` => email passcode
              - `ext:<provider>` => thirdparty provider, where <provider> is the internal provider ID, e.g. `ext:microsoft`
              - `totp` => 2FA authenticator app
              - `security_key` => 2FA security key
        subject:
          type: string
          format: uuid4
        issued_at:
          type: string
          format: date-time
        audience:
          type: array
          items:
            type: string
        issuer:
          type: string
        email:
          type: object
          properties:
            address:
              type: string
            is_verified:
              type: boolean
            is_primary:
              type: boolean
      additionalProperties:
        description: "Any additional claims defined through templates for customizing the session JWT"
    CSRFToken:
      description: |
        Not required on flow initialization, i.e. on requests without an `action`
        query parameter.

        Required on all other requests performing an action, i.e. on requests that use an `action` 
        query parameter. Should be the `csrf_token` value from the most recent flow state response.
      type: string
      example: qvcZt29spXYO77Y9IaxxN4MzLnmbjozl
    Error:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        cause:
          type: string
    Input:
      type: object
      properties:
        name:
          type: string
        type:
          type: string
        required:
          type: boolean
        min_length:
          type: integer
        max_length:
          type: integer
        hidden:
          type: boolean
        value:
          type: string
        allowed_values:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
              value:
                $ref: "#/components/schemas/AnyValue"
    InputAssertionResponse:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "assertion_response"
            type:
              enum:
                - "json"
    InputCode:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "code"
            type:
              enum:
                - "string"
            min_length:
              default: 6
            max_length:
              default: 6
            required:
              default: true
            hidden:
              default: false
    InputEmail:
      title: Email
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              type: string
              enum:
                - "email"
            type:
              type: string
              enum:
                - "email"
            max_length:
              default: 120
            required:
              default: true
            hidden:
              default: false
    InputEmailId:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              type: string
              enum:
                - "email_id"
            type:
              type: string
              enum:
                - "string"
            required:
              default: true
            hidden:
              default: true
    InputIdentifier:
      title: Identifier
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "identifier"
            type:
              enum:
                - "string"
            max_length:
              type: integer
              default: 255
            required:
              default: true
            hidden:
              default: false
    InputNewPassword:
      allOf:
        - $ref: "#/components/schemas/InputPassword"
        - type: object
          properties:
            name:
              type: string
              enum:
                - "new_password"
    InputOTPCode:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "otp_code"
            type:
              enum:
                - "string"
            required:
              default: true
            hidden:
              default: false
    InputPassword:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "password"
            type:
              enum:
                - "password"
            min_length:
              default: 8
            required:
              default: true
            hidden:
              default: false
    InputPasskeyId:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "passkey_id"
            type:
              enum:
                - "string"
            required:
              default: true
            hidden:
              default: false
    InputPasskeyName:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "passkey_name"
            type:
              enum:
                - "string"
            required:
              default: true
            hidden:
              default: false
    InputPatchMetadata:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "patch_metadata"
            type:
              enum:
                - "json"
            required:
              default: true
            hidden:
              default: false
    InputProvider:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "provider"
            type:
              enum:
                - "string"
            value:
              type: string
            required:
              default: true
            hidden:
              default: true
            allowed_values:
              items:
                properties:
                  name:
                    description: A display name to use for the provider.
                  value:
                    $ref: "#/components/schemas/InputProviderAllowedValue"
    InputProviderAllowedValue:
      type: string
      enum:
        - apple
        - discord
        - facebook
        - github
        - google
        - linkedin
        - microsoft
    InputPublicKey:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "public-key"
            type:
              enum:
                - "json"
            required:
              default: true
            hidden:
              default: true
    InputRedirectTo:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "redirect_to"
            type:
              enum:
                - "string"
            required:
              default: true
            hidden:
              default: true
    InputCodeVerifier:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "code_verifier"
            type:
              enum:
                - "string"
            required:
              default: false
            hidden:
              default: true
    InputRememberMe:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "remember_me"
            type:
              enum:
                - "boolean"
            required:
              default: true
    InputSecurityKeyID:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "security_key_id"
            type:
              enum:
                - "string"
            required:
              default: true
            hidden:
              default: true
    InputSessionID:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "session_id"
            type:
              enum:
                - "string"
            required:
              default: true
            hidden:
              default: true
    InputToken:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "token"
            type:
              enum:
                - "string"
            required:
              default: true
            hidden:
              default: true
    InputUsername:
      title: Username
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              enum:
                - "username"
            type:
              enum:
                - "string"
            min_length:
              type: number
              enum:
                - 3
            max_length:
              type: number
              enum:
                - 40
            required:
              default: false
            hidden:
              default: false
    InputWebauthnAvailable:
      description: |
        Indicates whether the client the device is capable of creating and using passkeys/WebAuthn credentials.
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              type: string
              enum:
                - "webauthn_available"
            type:
              type: string
              enum:
                - "boolean"
    InputWebauthnConditionalMediationAvailable:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              type: string
              enum:
                - "webauthn_conditional_mediation_available"
            type:
              type: string
              enum:
                - "boolean"
    InputWebauthnPlatformAuthenticatorAvailable:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            name:
              type: string
              enum:
                - "webauthn_platform_authenticator_available"
            type:
              type: string
              enum:
                - "boolean"
    InputDataExchangeToken:
      title: ExchangeToken
      description: Input data for the `exchange_token` action.
      type: object
      properties:
        token:
          type: string
      required:
        - token
      additionalProperties: false
    InputDataEmailAddressSet:
      title: EmailAddressSet
      description: Input data for the `email_address_set` action.
      type: object
      properties:
        email:
          type: string
          format: email
      required:
        - email
      additionalProperties: false
    InputDataEmailCreate:
      title: EmailCreate
      description: Input data for the `email_create` action.
      type: object
      properties:
        email:
          type: string
          format: email
      required:
        - emai
      additionalProperties: false
    InputDataEmailDelete:
      title: EmailDelete
      description: Input data for the `email_delete` action.
      type: object
      properties:
        email_id:
          type: string
          format: email
      required:
        - email_id
      additionalProperties: false
    InputDataEmailSetPrimary:
      title: EmailSetPrimary
      description: Input data for the `email_set_primary` action.
      type: object
      properties:
        email_id:
          type: string
          format: email
      required:
        - email_id
      additionalProperties: false
    InputDataEmailVerify:
      title: EmailVerify
      description: Input data for the `email_verify` action.
      type: object
      properties:
        email_id:
          type: string
          format: email
      required:
        - email_id
      additionalProperties: false
    InputDataPasswordCreate:
      title: PasswordCreate
      description: Input data for the `password_create` action.
      type: object
      properties:
        password:
          type: string
          format: email
      required:
        - email_id
      additionalProperties: false
    InputDataPasswordUpdate:
      title: PasswordUpdate
      description: Input data for the `password_update` action.
      type: object
      properties:
        password:
          type: string
          format: email
      required:
        - email_id
      additionalProperties: false
    InputDataPatchMetadata:
      title: PatchMetadata
      description: Input data for the `patch_metadata` action.
      type: object
      properties:
        patch_metadata:
          type: object
          description: |
            Must be one of:
              - `null`: unsets the entire (unsafe) metadata 
              - an empty object `{}`: indicates an empty patch object, results in a noop
              - a non-empty object: the current (unsafe) metadata is merged with this patch
          additionalProperties: true
      required:
        - patch_metadata
      additionalProperties: false
    InputDataRegisterClientCapabilities:
      title: RegisterClientCapabilities
      description: Input data for the `register_client_capabilities` action.
      type: object
      properties:
        webauthn_available:
          type: boolean
          default: false
        webauthn_conditional_mediation_available:
          type: boolean
          default: false
        webauthn_platform_authenticator_available:
          type: boolean
          default: false
      required:
        - webauthn_available
      additionalProperties: false
    InputDataConnectThirdPartyOAuthProvider:
      title: ConnectThirdPartyOAuthProvider
      description: Input data for the `connect_thirdparty_oauth_provider` action.
      type: object
      properties:
        provider:
          type: string
          description: The third-party OAuth provider to connect.
        redirect_to:
          type: string
          description: URL to redirect to after authentication with the provider.
        code_verifier:
          type: string
          description: The code verifier for a PKCE OAuth flow.
      required:
        - provider
        - redirect_to
      additionalProperties: false
    InputDataDisconnectThirdPartyOAuthProvider:
      title: DisconnectThirdPartyOAuthProvider
      description: Input data for the `disconnect_thirdparty_oauth_provider` action.
      type: object
      properties:
        identity_id:
          type: string
          format: uuid4
          description: The ID of the third party identity to remove.
      required:
        - identity_id
      additionalProperties: false
    InputDataContinueWithLoginIdentifier:
      description: Input data for the `continue_with_login_identifier` action.
      oneOf:
        - type: object
          title: ContinueWithLoginIdentifier
          properties:
            identifier:
              description: Present only if emails and usernames are enabled.
              type: string
          required:
            - identifier
        - type: object
          title: ContinueWithLoginIdentifierEmail
          properties:
            email:
              type: string
              format: email
          required:
            - email
        - type: object
          title: ContinueWithLoginIdentifierUsername
          properties:
            username:
              type: string
          required:
            - username
      minProperties: 1
    InputDataOTPCodeValidate:
      allOf:
        - $ref: "#/components/schemas/InputDataOTPCodeVerify"
        - title: OTPCodeValidate
        - description: Input data for the `otp_code_validate` action.
    InputDataOTPCodeVerify:
      title: OTPCodeVerify
      description: Input data for the `otp_code_verify` action.
      type: object
      properties:
        otp_code:
          description: |
          type: string
          minLength: 6
          maxLength: 6
      required:
        - otp_code
      additionalProperties: false
    InputDataPasswordLogin:
      title: PasswordLogin
      description: Input data for the `password_login` action.
      type: object
      properties:
        password:
          type: string
      required:
        - password
      additionalProperties: false
    InputDataPasswordRecovery:
      title: PasswordRecovery
      description: Input data for the `password_recovery` action.
      type: object
      properties:
        new_password:
          type: string
      required:
        - new_password
      additionalProperties: false
    InputDataRegisterLoginIdentifier:
      title: RegisterLoginIdentifier
      description: Input data for the `register_login_identifier` action.
      type: object
      properties:
        email:
          type: string
          format: email
        username:
          type: string
      additionalProperties: false
      minProperties: 1
    InputDataRememberMe:
      description: Input data for the `remember_me` action.
      title: RememberMe
      type: object
      properties:
        remember_me:
          type: boolean
      required:
        - remember_me
      additionalProperties: false
    InputDataRegisterPassword:
      description: Input data for the `register_password` action.
      title: RegisterPassword
      type: object
      properties:
        new_password:
          type: string
      required:
        - new_password
      additionalProperties: false
    InputDataSecurityKeyDelete:
      title: SecurityKeyDelete
      description: Input data for the `security_key_delete` action.
      type: object
      properties:
        security_key_id:
          type: string
      required:
        - security_key_id
      additionalProperties: false
    InputDataSessionDelete:
      title: SessionDelete
      description: Input data for the `session_delete` action.
      type: object
      properties:
        session_id:
          description: |
            The ID of the session to revoke. 
            
            If server-side sessions are enabled, session IDs can be obtained from
            session tokens (JWTs) through their `session_id` claim.
          type: string
          format: uuid4
      required:
        - session_id
      additionalProperties: false
    InputDataThirdPartyOauth:
      title: ThirdPartyOauth
      description: Input data for the `thirdparty_oauth` action.
      type: object
      properties:
        provider:
          $ref: "#/components/schemas/InputProviderAllowedValue"
        redirect_to:
          type: string
          format: uri
        code_verifier:
          type: string
      required:
        - provider
        - redirect_to
      additionalProperties: false
    InputDataUsernameSet:
      title: UsernameSet
      description: Input data for the `username_set` action.
      type: object
      properties:
        username:
          type: string
      required:
        - provider
      additionalProperties: false
    InputDataWebauthnCredentialDelete:
      title: WebauthnCredentialDelete
      description: Input data for the `webauthn_credential_delete` action.
      type: object
      properties:
        passkey_id:
          type: string
      required:
        - passkey_id
      additionalProperties: false
    InputDataWebauthnCredentialRename:
      title: WebauthnCredentialRename
      description: Input data for the `webauthn_credential_rename` action.
      type: object
      properties:
        passkey_id:
          type: string
        passkey_name:
          type: string
      required:
        - passkey_id
        - passkey_name
      additionalProperties: false
    InputDataWebauthnVerifyAssertionResponse:
      title: WebauthnVerifyAssertionResponse
      description: Input data for the `webauthn_verify_assertion_response` action.
      type: object
      properties:
        assertion_response:
          description: |
            The [AuthenticatorAssertionResponse](https://developer.mozilla.org/en-US/docs/Web/API/AuthenticatorAssertionResponse)
            from the WebAuthn API.
          type: object
      required:
        - assertion_response
      additionalProperties: false
    InputDataWebauthnVerifyAttestationResponse:
      title: WebauthnVerifyAttestationResponse
      description: Input data for the `webauthn_verify_attestation_response` action.
      type: object
      properties:
        public_key:
          description: |
            The [AuthenticatorAttestationResponse](https://developer.mozilla.org/en-US/docs/Web/API/AuthenticatorAttestationResponse)
            from the WebAuthn API.
          type: object
      required:
        - public_key
      additionalProperties: false
    InputDataVerifyPasscode:
      title: VerifyPasscode
      description: Input data for the `verify_passcode` action.
      type: object
      properties:
        code:
          type: string
          minLength: 6
          maxLength: 6
      required:
        - code
      additionalProperties: false
    Inputs:
      description: Inputs
      type: object
      additionalProperties:
        $ref: "#/components/schemas/Input"
    InputsConnectThirdPartyOAuthProvider:
      $ref: "#/components/schemas/InputsThirdPartyOauth"
    InputsContinueWithLoginIdentifier:
      type: object
      properties:
        identifier:
          oneOf:
            - $ref: "#/components/schemas/InputIdentifier"
            - $ref: "#/components/schemas/InputEmail"
            - $ref: "#/components/schemas/InputUsername"
          discriminator:
            propertyName: name
    InputsDisconnectThirdPartyOAuthProvider:
      type: object
      properties:
        identity_id:
          type: string
          format: uuid4
          description: The ID of the third party identity to remove.
    InputsEmailAddressSet:
      type: object
      properties:
        email:
          $ref: "#/components/schemas/InputEmail"
    InputsEmailCreate:
      type: object
      properties:
        email:
          $ref: "#/components/schemas/InputEmail"
    InputsEmailDelete:
      type: object
      properties:
        email_id:
          $ref: "#/components/schemas/InputEmailId"
    InputsEmailSetPrimary:
      type: object
      properties:
        email_id:
          $ref: "#/components/schemas/InputEmailId"
    InputsEmailVerify:
      type: object
      properties:
        email_id:
          $ref: "#/components/schemas/InputEmailId"
    InputsExchangeToken:
      type: object
      properties:
        token:
          $ref: "#/components/schemas/InputToken"
    InputsOnboardingVerifyPasskeyAttestation:
      type: object
      properties:
        public_key:
          $ref: "#/components/schemas/InputWebauthnAvailable"
      required:
        - public_key
    InputsOTPCodeVerify:
      type: object
      properties:
        otp_code:
          $ref: "#/components/schemas/InputOTPCode"
      required:
        - otp_code
    InputsOTPCodeValidate:
      $ref: "#/components/schemas/InputsOTPCodeVerify"
    InputsPasswordCreate:
      type: object
      properties:
        password:
          $ref: "#/components/schemas/InputPassword"
    InputsPasswordLogin:
      type: object
      properties:
        password:
          $ref: "#/components/schemas/InputPassword"
      required:
        - password
    InputsPasswordRecovery:
      type: object
      properties:
        new_password:
          $ref: "#/components/schemas/InputNewPassword"
    InputsPasswordUpdate:
      type: object
      properties:
        password:
          $ref: "#/components/schemas/InputPassword"
    InputsPatchMetadata:
      type: object
      properties:
        patch_metadata:
          $ref: "#/components/schemas/InputPatchMetadata"
    InputsRegisterClientCapabilities:
      type: object
      properties:
        webauthn_available:
          $ref: "#/components/schemas/InputWebauthnAvailable"
        webauthn_conditional_mediation_available:
          $ref: "#/components/schemas/InputWebauthnConditionalMediationAvailable"
        webauthn_platform_authenticator_available:
          $ref: "#/components/schemas/InputWebauthnPlatformAuthenticatorAvailable"
      required:
        - webauthn_available
    InputsRegisterLoginIdentifier:
      type: object
      minProperties: 1
      properties:
        email:
          $ref: "#/components/schemas/InputEmail"
        username:
          $ref: "#/components/schemas/InputUsername"
    InputsRegisterPassword:
      type: object
      properties:
        new_password:
          $ref: "#/components/schemas/InputNewPassword"
    InputsRememberMe:
      type: object
      properties:
        remember_me:
          $ref: "#/components/schemas/InputRememberMe"
    InputsSecurityKeyDelete:
      type: object
      properties:
        security_key_id:
          $ref: "#/components/schemas/InputSecurityKeyID"
    InputsSessionDelete:
      type: object
      properties:
        session_id:
          $ref: "#/components/schemas/InputSessionID"
    InputsThirdPartyOauth:
      type: object
      properties:
        provider:
          $ref: "#/components/schemas/InputProvider"
        redirect_to:
          $ref: "#/components/schemas/InputRedirectTo"
        code_verifier:
          $ref: "#/components/schemas/InputCodeVerifier"
      required:
        - provider
        - redirect_to
    InputsUsernameSet:
      type: object
      properties:
        username:
          $ref: "#/components/schemas/InputUsername"
      required:
        - username
    InputsVerifyPasscode:
      type: object
      properties:
        code:
          $ref: "#/components/schemas/InputCode"
      required:
        - code
    InputsWebauthnCredentialDelete:
      type: object
      properties:
        passkey_id:
          $ref: "#/components/schemas/InputPasskeyId"
      required:
        - passkey_id
    InputsWebauthnCredentialRename:
      type: object
      properties:
        passkey_id:
          $ref: "#/components/schemas/InputPasskeyId"
        passkey_name:
          $ref: "#/components/schemas/InputPasskeyName"
      required:
        - passkey_id
        - passkey_name
    InputsWebauthnVerifyAssertionResponse:
      type: object
      properties:
        assertion_response:
          $ref: "#/components/schemas/InputAssertionResponse"
      required:
        - assertion_response
    InputsWebauthnVerifyAttestationResponse:
      type: object
      properties:
        public_key:
          $ref: "#/components/schemas/InputPublicKey"
      required:
        - public_key
    InputsUsernameAddressSet:
      type: object
      properties:
        email:
          $ref: "#/components/schemas/InputUsername"
    LastLogin:
      description: Contains data about the last login and MFA methods used by the user.
      type: object
      properties:
        login_method:
          description: The login method used.
          type: string
          enum:
            - password
            - passkey
            - passcode
            - third_party
        mfa_method:
          description: The MFA method used.
          type: string
          enum:
            - totp
            - security_key
        third_party_provider:
          description: Contains the name of the third party provider used if `login_method` is `third_party`.
          type: string
    Link:
      type: object
      properties:
        name:
          description: The name of the link.
          type: string
        href:
          description: The destination of the link.
          type: string
          format: uri
        category:
          description: The category of the link.
          type: string
        target:
          description: The target of the link.
          type: string
          enum:
            - _self
            - _blank
            - _parent
            - _top
    Payload:
      description: |
        Additional data that can be used by the client (e.g `user` data provided in the
        profile flow) or should/must be used as intermediary data in an out of band process to produce input data 
        for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the 
        Webauthn API to produce an assertion/attestation).
      type: object
      additionalProperties: true
    PayloadCreationOptions:
      type: object
      properties:
        creation_options:
          $ref: "#/components/schemas/CredentialCreationOptions"
      required:
        - creation_options
    PayloadProfileData:
      type: object
      properties:
        user:
          $ref: "#/components/schemas/ProfileDataUser"
    PayloadRequestOptions:
      type: object
      properties:
        request_options:
          $ref: "#/components/schemas/CredentialRequestOptions"
      required:
        - request_options
    PayloadResendAfter:
      description: Returned with a flow response when the request rate limit was exceeded.
      type: object
      properties:
        resend_after:
          description: |
            Indicates the amount of seconds required to pass in order to be able to send another request.
          type: integer
          example: 60
    PayloadThirdParty:
      type: object
      properties:
        redirect_url:
          type: string
          format: uri
      required:
        - redirect_url
    ProfileDataSessions:
      description: List of active sessions for this user.
      type: array
      items:
        type: object
        properties:
          created_at:
            description: Time of creation of the session.
            type: string
            format: date-time
          current:
            description: Indicates whether this session is the session currently used.
            type: boolean
          expires_at:
            description: Time of expiry of the session.
            type: string
            format: date-time
          id:
            description: The ID of the session.
            type: string
            format: uuid
          ip_address:
            oneOf:
              - description: IPv4 address the session was initialized from.
                type: string
                format: ipv4
              - description: IPv6 address the session was initialized from.
                type: string
                format: ipv6
          last_used:
            description: Time of last usage of this session.
            type: string
            format: date-time
          user_agent:
            description: |
              User agent string consisting of the native platform that the browser is running on (Windows, Mac, 
              Linux, Android, etc.) and a parenthesised name of the user agent.
            type: string
          user_agent_raw:
            description: |
              The complete user agent, i.e. the exact value of the `User-Agent` header the API received
              in the request(s) for establishing the session.
            type: string
    ProfileDataUser:
      description: Data pertaining to the user associated with the current session.
      type: object
      properties:
        user_id:
          type: string
          format: uuid
        passkeys:
          type: array
          items:
            $ref: "#/components/schemas/WebauthnCredential"
        security_keys:
          type: array
          items:
            $ref: "#/components/schemas/WebauthnCredential"
        emails:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                format: uuid
              address:
                type: string
                format: email
              is_primary:
                type: boolean
              is_verified:
                type: boolean
              identity:
                deprecated: true
                description: Deprecated. See `identities` instead.
                type: object
                properties:
                  id:
                    type: string
                    description: Contains the ID of the user at the provider.
                  provider:
                    type: string
                    description: |
                      Contains the display name of the provider, if available. Otherwise contains the provider ID.
              identities:
                deprecated: true
                description: Deprecated. See top-level `identities` instead.
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                      description: ID of the user at the provider
                    provider:
                      type: string
                      description: |
                        Contains the display name of the provider, if available. Otherwise contains the provider ID.
        identities:
          description: The user's third party connections/identities.
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                description: The ID of the user at the provider
              identity_id:
                type: string
                description: The identity's ID
                format: uuid4
              provider:
                type: string
                description: |
                  Contains the display name of the provider, if available. Otherwise contains the provider ID.
        metadata:
          type: object
          properties:
            public_metadata:
              type: object
              additionalProperties: {}
            unsafe_metadata:
              type: object
              additionalProperties: {}
        mfa_config:
          type: object
          properties:
            auth_app_set_up:
              type: boolean
              description: Indicates whether the user has set up an authenticator app for 2FA.
            totp_enabled:
              type: boolean
              description: |
                Indicates whether 2FA via authenticator app is enabled on this tenant. 
                
                To check whether a user has set up an authenticator app for 2FA, see [`payload.user.mfa_config.app_auth_set_up`](#response-one-of-1-payload-user-mfa-config-app-auth-set-up).
            security_keys_enabled:
              type: boolean
              description: |
                Indicates whether 2FA via security keys is enabled on this tenant.
                
                To check whether a user has enrolled security keys for 2FA, see [`payload.user.security_keys`](#response-one-of-1-payload-user-security-keys).
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
        name:
          type: string
        given_name:
          type: string
        family_name:
          type: string
        picture:
          type: string
          format: uri
    RequestInputData:
      description: |
        The actual properties of the `input_data` is determined by the `inputs` of the `action` to be performed.
        
        All requests that perform an `action` (i.e. requests other than flow initialization) must include 
        the `csrf_token` from the previous flow state response in the `input_data`.
      type: object
      additionalProperties: true
    StateBase:
      type: object
      properties:
        actions:
          description: |
            List of actions that can be performed in the current flow state in order to advance the flow to the next 
            state.
            
            Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration 
            some actions may or may not be present in the response.
          type: object
        name:
          description: The name of the flow state.
          type: string
        payload:
          description: |
            Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the
            profile flow) or should/must be used as intermediary data in an out of band process to produce input data 
            for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the 
            Webauthn API to produce an assertion/attestation).
          type: object
        status:
          description: The HTTP response status code for this flow response.
          type: integer
        csrf_token:
          description: Token to prevent Cross-Site Request Forgeries.
          type: string
          example: HvUwWSfPgz7VnwiS8VMDpnhZ1wNwTNiV
        links:
          type: array
          items:
            $ref: "#/components/schemas/Link"
          nullable: true
          example: []
    StateDeviceTrust:
      title: DeviceTrust
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - type: object
          properties:
            actions:
              $ref: "#/components/schemas/ActionsDeviceTrust"
            name:
              type: string
              enum:
                - "device_trust"
    StateLoginInit:
      title: LoginInit
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - type: object
          properties:
            actions:
              $ref: "#/components/schemas/ActionsLoginInit"
            name:
              type: string
              enum:
                - "login_init"
            payload:
              $ref: "#/components/schemas/PayloadRequestOptions"
            status:
              type: integer
              enum:
                - 200
    StateLoginMethodChooser:
      title: LoginMethodChooser
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsLoginMethodChooser"
            name:
              type: string
              enum:
                - "login_method_chooser"
            status:
              type: integer
              enum:
                - 200
    StateLoginOTP:
      title: LoginOTP
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsLoginOTP"
            name:
              type: string
              enum:
                - "login_otp"
            status:
              type: integer
              enum:
                - 200
    StateLoginPasskey:
      title: LoginPasskey
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsLoginPasskey"
            name:
              type: string
              enum:
                - "login_passkey"
            payload:
              $ref: "#/components/schemas/PayloadRequestOptions"
            status:
              type: integer
              enum:
                - 200
    StateLoginPassword:
      title: LoginPassword
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsLoginPassword"
            name:
              type: string
              enum:
                - "login_password"
            status:
              type: integer
              enum:
                - 200
    StateLoginPasswordRecovery:
      title: LoginPasswordRecovery
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsLoginPasswordRecovery"
            name:
              type: string
              enum:
                - "login_password_recovery"
            status:
              type: integer
              enum:
                - 200
    StateLoginSecurityKey:
      title: LoginSecurityKey
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsLoginSecurityKey"
            name:
              type: string
              enum:
                - "login_security_key"
            status:
              type: integer
              enum:
                - 200
    StateMFAMethodChooser:
      title: MFAMethodChooser
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsMFAMethodChooser"
            name:
              type: string
              enum:
                - "mfa_method_chooser"
            status:
              type: integer
              enum:
                - 200
    StateMFAOTPSecretCreation:
      title: MFAOTPSecretCreation
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsMFAOTPSecretCreation"
            name:
              type: string
              enum:
                - "mfa_otp_secret_creation"
            payload:
              type: object
              properties:
                otp_image_source:
                  description: |
                    Contains a QR code to scan with an authenticator app as a string in 
                    ["data" URL](https://datatracker.ietf.org/doc/html/rfc2397) format. Can be directly
                    used as the value for the `src` attribute in an HTML `img` element.
                  type: string
                otp_secret:
                  description: |
                    Shared secret that can be provided to authenticator apps if scanning
                    a QR code is not available.
                  type: string
            status:
              type: integer
              enum:
                - 200
    StateMFASecurityKeyCreation:
      title: MFASecurityKeyCreation
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsMFASecurityKeyCreation"
            name:
              type: string
              enum:
                - "mfa_security_key_creation"
            status:
              type: integer
              enum:
                - 200
    StatePreflight:
      title: Preflight
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsPreflight"
            name:
              type: string
              enum:
                - preflight
            status:
              type: integer
              enum:
                - 200
    StateRegistrationInit:
      description: Represents the initial state of a registration flow.
      title: RegistrationInit
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsRegistrationInit"
            name:
              type: string
              enum:
                - "registration_init"
            status:
              type: integer
              enum:
                - 200
    StatePasscodeConfirmation:
      title: PasscodeConfirmation
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsPasscodeConfirmation"
            name:
              type: string
              enum:
                - "passcode_confirmation"
            status:
              type: integer
              enum:
                - 200
    StatePasswordCreation:
      title: PasswordCreation
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsPasswordCreation"
            name:
              type: string
              enum:
                - "password_creation"
            status:
              type: integer
              enum:
                - 200
    StateProfileAccountDeleted:
      title: ProfileAccountDeleted
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              type: object
            name:
              type: string
              enum:
                - "account_deleted"
            status:
              type: integer
              enum:
                - 200
    StateProfileInit:
      title: ProfileInit
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsProfileInit"
            name:
              type: string
              enum:
                - "profile_init"
            payload:
              allOf:
                - $ref: "#/components/schemas/PayloadProfileData"
                - type: object
                  properties:
                    sessions:
                      $ref: "#/components/schemas/ProfileDataSessions"
            status:
              type: integer
              enum:
                - 200
    StateProfileWebauthnCredentialVerification:
      title: ProfileWebauthnCredentialVerification
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsWebauthnVerifyAttestationResponse"
            name:
              type: string
              enum:
                - "webauthn_credential_verification"
            payload:
              $ref: "#/components/schemas/PayloadCreationOptions"
            status:
              type: integer
              enum:
                - 200
    StateCredentialOnboardingChooser:
      title: CredentialOnboardingChooser
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsCredentialOnboardingChooser"
            name:
              type: string
              enum:
                - "credential_onboarding_chooser"
            payload:
              type: object
            status:
              type: integer
              enum:
                - 200
    StateOnboardingCreatePasskey:
      title: OnboardingCreatePasskey
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsOnboardingCreatePasskey"
            name:
              type: string
              enum:
                - "onboarding_create_passkey"
            payload:
              type: object
            status:
              type: integer
              enum:
                - 200
    StateOnboardingVerifyPasskeyAttestation:
      title: OnboardingVerifyPasskeyAttestation
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsOnboardingVerifyPasskeyAttestation"
            name:
              type: string
              enum:
                - "onboarding_verify_passkey_attestation"
            payload:
              $ref: "#/components/schemas/PayloadCreationOptions"
            status:
              type: integer
              enum:
                - 200
    StateOnboardingEmail:
      title: OnboardingEmail
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsOnboardingEmail"
            name:
              type: string
              enum:
                - "onboarding_email"
            payload:
              type: object
            status:
              type: integer
              enum:
                - 200
    StateOnboardingUsername:
      title: OnboardingUsername
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsOnboardingUsername"
            name:
              type: string
              enum:
                - "onboarding_username"
            payload:
              type: object
            status:
              type: integer
              enum:
                - 200
    StateSuccess:
      title: Success
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            name:
              type: string
              enum:
                - "success"
            payload:
              $ref: "#/components/schemas/PayloadProfileData"
            status:
              type: integer
              enum:
                - 200
    StateSuccessLogin:
      title: Success
      type: object
      allOf:
        - $ref: "#/components/schemas/StateSuccess"
        - type: object
          properties:
            payload:
              allOf:
                - $ref: "#/components/schemas/PayloadProfileData"
                - type: object
                  properties:
                    last_login:
                      $ref: "#/components/schemas/LastLogin"
                    claims:
                      $ref: "#/components/schemas/Claims"
    StateSuccessRegistration:
      title: Success
      type: object
      allOf:
        - $ref: "#/components/schemas/StateSuccess"
        - type: object
          properties:
            payload:
              allOf:
                - $ref: "#/components/schemas/PayloadProfileData"
                - type: object
                  properties:
                    claims:
                      $ref: "#/components/schemas/Claims"
    StateSuccessTokenExchange:
      title: Success
      type: object
      allOf:
        - $ref: "#/components/schemas/StateSuccess"
        - type: object
          properties:
            payload:
              allOf:
                - $ref: "#/components/schemas/PayloadProfileData"
                - type: object
                  properties:
                    claims:
                      $ref: "#/components/schemas/Claims"
    StateThirdParty:
      title: ThirdParty
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            actions:
              $ref: "#/components/schemas/ActionsThirdParty"
            name:
              type: string
              enum:
                - "thirdparty"
            payload:
              $ref: "#/components/schemas/PayloadThirdParty"
            status:
              type: integer
              enum:
                - 200
    StateError:
      title: Error
      type: object
      allOf:
        - $ref: "#/components/schemas/StateBase"
        - properties:
            name:
              type: string
              enum:
                - "error"
            payload:
              type: object
            status:
              type: integer
    CredentialCreationOptions:
      description: "Options for credential creation with the WebAuthn API"
      externalDocs:
        url: https://www.w3.org/TR/webauthn-2/#dictionary-makecredentialoptions
      type: object
      properties:
        publicKey:
          type: object
          properties:
            rp:
              type: object
              properties:
                name:
                  type: string
                  example: Hanko Authentication Service
                id:
                  type: string
                  example: localhost
            user:
              type: object
              properties:
                id:
                  type: string
                  example: pPQT9rwJRD7gVncsnCDNyN
                name:
                  type: string
                  example: user@example.com
                displayName:
                  type: string
                  example: user@example.com
            challenge:
              type: string
              format: base64url
              example: 7qmkJUXR0dOFnsW48evX3qKdCzlGjvvqAAvMDN+KTN0=
            pubKeyCredParams:
              type: array
              items:
                type: object
                properties:
                  type:
                    type: string
                    enum:
                      - public-key
                  alg:
                    type: number
              example:
                - type: public-key
                  alg: -7
            timeout:
              type: number
              format: int64
              example: 60000
            authenticatorSelection:
              type: object
              properties:
                authenticatorAttachment:
                  type: string
                  enum:
                    - platform
                    - cross-platform
                  example: platform
                requireResidentKey:
                  type: boolean
                  example: true
                residentKey:
                  type: string
                  enum:
                    - discouraged
                    - preferred
                    - required
                  example: preferred
                userVerification:
                  type: string
                  enum:
                    - discouraged
                    - preferred
                    - required
                  example: required
            attestation:
              type: string
              enum:
                - none
                - indirect
                - direct
                - enterprise
              example: none
    CredentialRequestOptions:
      description: "Options for assertion generation with the WebAuthn API"
      externalDocs:
        url: https://www.w3.org/TR/webauthn-2/#dictionary-assertion-options
      type: object
      properties:
        publicKey:
          type: object
          properties:
            challenge:
              type: string
              format: base64url
              example: qgOI+0KpGnl9NOqaT6dfsYvi96R87LgpErnvePeOgSU=
            timeout:
              type: number
              format: int64
              example: 60000
            rpId:
              type: string
              example: localhost
            allowCredentials:
              type: array
              items:
                type: object
                properties:
                  type:
                    type: string
                    enum:
                      - public-key
                    example: public-key
                  id:
                    type: string
                    format: base64url
                    example: Mepptysj5ZZrTlg0qiLbsZ068OtQMeGVAikVy2n1hvvG...
            userVerification:
              type: string
              enum:
                - required
                - preferred
                - discouraged
              example: required
    StatesLogin:
      oneOf:
        - $ref: "#/components/schemas/StatePreflight"
        - $ref: "#/components/schemas/StateLoginInit"
        - $ref: "#/components/schemas/StateLoginPasskey"
        - $ref: "#/components/schemas/StateLoginPassword"
        - $ref: "#/components/schemas/StateLoginPasswordRecovery"
        - $ref: "#/components/schemas/StateLoginMethodChooser"
        - $ref: "#/components/schemas/StateLoginOTP"
        - $ref: "#/components/schemas/StateLoginSecurityKey"
        - $ref: "#/components/schemas/StateMFAMethodChooser"
        - $ref: "#/components/schemas/StateMFAOTPSecretCreation"
        - $ref: "#/components/schemas/StateMFASecurityKeyCreation"
        - $ref: "#/components/schemas/StatePasscodeConfirmation"
        - $ref: "#/components/schemas/StatePasswordCreation"
        - $ref: "#/components/schemas/StateOnboardingEmail"
        - $ref: "#/components/schemas/StateOnboardingUsername"
        - $ref: "#/components/schemas/StateCredentialOnboardingChooser"
        - $ref: "#/components/schemas/StateOnboardingCreatePasskey"
        - $ref: "#/components/schemas/StateOnboardingVerifyPasskeyAttestation"
        - $ref: "#/components/schemas/StateDeviceTrust"
        - $ref: "#/components/schemas/StateThirdParty"
        - $ref: "#/components/schemas/StateSuccessLogin"
      discriminator:
        propertyName: name
        mapping:
          preflight: "#/components/schemas/StatePreflight"
          login_init: "#/components/schemas/StateLoginInit"
          login_method_chooser: "#/components/schemas/StateLoginMethodChooser"
          login_otp: "#/components/schemas/StateLoginOTP"
          login_passkey: "#/components/schemas/StateLoginPasskey"
          login_password: "#/components/schemas/StateLoginPassword"
          login_password_recovery: "#/components/schemas/StateLoginPasswordRecovery"
          login_security_key: "#/components/schemas/StateLoginSecurityKey"
          passcode_confirmation: "#/components/schemas/StatePasscodeConfirmation"
          password_creation: "#/components/schemas/StatePasswordCreation"
          mfa_method_chooser: "#/components/schemas/StateMFAMethodChooser"
          mfa_otp_secret_creation: "#/components/schemas/StateMFAOTPSecretCreation"
          mfa_security_key_creation: "#/components/schemas/StateMFASecurityKeyCreation"
          onboarding_email: "#/components/schemas/StateOnboardingEmail"
          onboarding_username: "#/components/schemas/StateOnboardingUsername"
          credential_onboarding_chooser: "#/components/schemas/StateCredentialOnboardingChooser"
          onboarding_create_passkey: "#/components/schemas/StateOnboardingCreatePasskey"
          onboarding_verify_passkey_attestation: "#/components/schemas/StateOnboardingVerifyPasskeyAttestation"
          device_trust: "#/components/schemas/StateDeviceTrust"
          thirdparty: "#/components/schemas/StateThirdParty"
          success: "#/components/schemas/StateSuccessLogin"
    StatesProfile:
      oneOf:
        - $ref: "#/components/schemas/StatePreflight"
        - $ref: "#/components/schemas/StateProfileInit"
        - $ref: "#/components/schemas/StateProfileAccountDeleted"
        - $ref: "#/components/schemas/StatePasscodeConfirmation"
        - $ref: "#/components/schemas/StateProfileWebauthnCredentialVerification"
        - $ref: "#/components/schemas/StateMFAOTPSecretCreation"
        - $ref: "#/components/schemas/StateThirdParty"
      discriminator:
        propertyName: name
        mapping:
          preflight: "#/components/schemas/StatePreflight"
          profile_init: "#/components/schemas/StateProfileInit"
          account_deleted: "#/components/schemas/StateProfileAccountDeleted"
          passcode_confirmation: "#/components/schemas/StatePasscodeConfirmation"
          webauthn_credential_verification: "#/components/schemas/StateProfileWebauthnCredentialVerification"
          mfa_otp_secret_creation: "#/components/schemas/StateMFAOTPSecretCreation"
          thirdparty: "#/components/schemas/StateThirdParty"
    StatesRegistration:
      oneOf:
        - $ref: "#/components/schemas/StatePreflight"
        - $ref: "#/components/schemas/StateRegistrationInit"
        - $ref: "#/components/schemas/StatePasscodeConfirmation"
        - $ref: "#/components/schemas/StatePasswordCreation"
        - $ref: "#/components/schemas/StateCredentialOnboardingChooser"
        - $ref: "#/components/schemas/StateMFAMethodChooser"
        - $ref: "#/components/schemas/StateMFAOTPSecretCreation"
        - $ref: "#/components/schemas/StateMFASecurityKeyCreation"
        - $ref: "#/components/schemas/StateOnboardingCreatePasskey"
        - $ref: "#/components/schemas/StateOnboardingVerifyPasskeyAttestation"
        - $ref: "#/components/schemas/StateThirdParty"
        - $ref: "#/components/schemas/StateSuccessRegistration"
      discriminator:
        propertyName: name
        mapping:
          preflight: "#/components/schemas/StatePreflight"
          registration_init: "#/components/schemas/StateRegistrationInit"
          passcode_confirmation: "#/components/schemas/StatePasscodeConfirmation"
          password_creation: "#/components/schemas/StatePasswordCreation"
          credential_onboarding_chooser: "#/components/schemas/StateCredentialOnboardingChooser"
          onboarding_create_passkey: "#/components/schemas/StateOnboardingCreatePasskey"
          onboarding_verify_passkey_attestation: "#/components/schemas/StateOnboardingVerifyPasskeyAttestation"
          mfa_method_chooser: "#/components/schemas/StateMFAMethodChooser"
          mfa_otp_secret_creation: "#/components/schemas/StateMFAOTPSecretCreation"
          mfa_security_key_creation: "#/components/schemas/StateMFASecurityKeyCreation"
          thirdparty: "#/components/schemas/StateThirdParty"
          success: "#/components/schemas/StateSuccessRegistration"
    StatesTokenExchange:
      oneOf:
        - $ref: "#/components/schemas/StatePasscodeConfirmation"
        - $ref: "#/components/schemas/StateOnboardingUsername"
        - $ref: "#/components/schemas/StateThirdParty"
        - $ref: "#/components/schemas/StateSuccessTokenExchange"
      discriminator:
        propertyName: name
        mapping:
          thirdparty: "#/components/schemas/StateThirdParty"
          passcode_confirmation: "#/components/schemas/StatePasscodeConfirmation"
          onboarding_username: "#/components/schemas/StateOnboardingUsername"
          success: "#/components/schemas/StateSuccessTokenExchange"
    WebauthnCredential:
      type: object
      properties:
        aaguid:
          type: string
          format: uuid
        attestation_type:
          type: string
          enum:
            - none
            - packed
            - tpm
            - android-key
            - android-safetynet
            - fido-u2f
            - apple
        backup_eligible:
          type: boolean
        backup_state:
          type: boolean
        created_at:
          type: string
          format: date-time
        id:
          type: string
          format: uuid
        last_used_at:
          type: string
          format: date-time
        mfa_only:
          type: boolean
        public-key:
          type: string
        transports:
          type: array
          items:
            type: string
            enum:
              - ble
              - internal
              - nfc
              - usb
    X-Auth-Token:
      type: string
      format: JWT
    X-Session-Lifetime:
      type: number
    X-Session-Retention:
      type: string
      enum:
        - session
        - persistent
    CookieSession:
      description: |
        Value `<JWT>` is a [JSON Web Token](https://www.rfc-editor.org/rfc/rfc7519.html)
        
        Only present on the `success` state of the flow.
      type: string
      example: hanko=<JWT>; Path=/; HttpOnly
    CookieDeviceToken:
      description: |
        Issued on a login flow's success if the `trust_device` action was executed during the flow. Used during 
        subsequent login flows to check if MFA (if it is enabled and the user has registered an MFA credential) 
        can be skipped.

        Only present on the `success` state of the flow.
      type: string
      example: |
        hanko-device-token=dl4yEFrW8XYU2GQ6IN3gJeqTiVhDKsfK_GYh-_HsAk4ZBdG1M6iA6QXQDJGSJNruS41_-bHTnlDjx8GyJ_WKA==,Path=/; HttpOnly, Secure
  responses:
    LoginFlowResponse:
      description: LoginFlowResponse
      headers:
        X-Auth-Token:
          description: |
            Used for cross-domain communication between client and Hanko API.
            
            Only present if configured on the tenant and on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/X-Auth-Token'
        X-Session-Lifetime:
          description: |
            Contains the seconds until the session expires.
            
            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/X-Session-Lifetime'
        X-Session-Retention:
          description: |
            Serves as a hint at what type of cookie (session or persistent) should be created.

            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/X-Session-Retention'
        Set-Cookie:
          schema:
            anyOf:
              - $ref: '#/components/schemas/CookieSession'
              - $ref: '#/components/schemas/CookieDeviceToken'
          examples:
            session:
              value: hanko=<JWT>; Path=/; HttpOnly
            device_token:
              value:  hanko-device-token=dl4yEFrW8XYU2GQ6IN3gJeqTiVhDKsfK_GYh-_HsAk4ZBdG1M6iA6QXQDJGSJNruS41_-bHTnlDjx8GyJ_WKA==,Path=/; HttpOnly, Secure
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/StatesLogin"
    LoginFlowResponseBadRequestError:
      description: LoginFlowResponseBadRequestError
      content:
        application/json:
          schema:
            allOf:
              - oneOf:
                  - $ref: "#/components/schemas/StateLoginInit"
                  - $ref: "#/components/schemas/StateLoginPasskey"
                  - $ref: "#/components/schemas/StateLoginPassword"
                  - $ref: "#/components/schemas/StatePasscodeConfirmation"
                  - $ref: "#/components/schemas/StatePasswordCreation"
                  - $ref: "#/components/schemas/StateOnboardingEmail"
                  - $ref: "#/components/schemas/StateOnboardingCreatePasskey"
                  - $ref: "#/components/schemas/StateOnboardingVerifyPasskeyAttestation"
                  - $ref: "#/components/schemas/StateOnboardingUsername"
                  - $ref: "#/components/schemas/StateThirdParty"
              - type: object
                properties:
                  status:
                    enum:
                      - 400
                  error:
                    $ref: "#/components/schemas/Error"
    ProfileFlowResponse:
      description: ProfileFlowResponse
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/StatesProfile"
    TokenExchangeFlowResponse:
      description: TokenExchangeFlowResponse
      headers:
        X-Auth-Token:
          description: |
            Enable via configuration option `session.enable_auth_token_header`
            for purposes of cross-domain communication between client and Hanko API.

            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/X-Auth-Token'
        X-Session-Lifetime:
          description: |
            Contains the seconds until the session expires.

            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/X-Session-Lifetime'
        X-Session-Retention:
          description: |
            Serves as a hint at what type of cookie (session or persistent) should be created.

            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/X-Session-Retention'
        Set-Cookie:
          description: |
            Value `<JWT>` is a [JSON Web Token](https://www.rfc-editor.org/rfc/rfc7519.html)

            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/CookieSession'
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/StatesTokenExchange"
    FlowResponseForbiddenError:
      description: FlowResponseForbiddenError
      content:
        application/json:
          schema:
            allOf:
              - $ref: "#/components/schemas/StateError"
              - type: object
                properties:
                  status:
                    enum:
                      - 403
                  error:
                    allOf:
                      - $ref: "#/components/schemas/Error"
                      - example:
                          code: operation_not_permitted_error
                          message: The flow is not permitted.
    FlowResponseGoneError:
      description: FlowResponseGoneError
      content:
        application/json:
          schema:
            allOf:
              - $ref: "#/components/schemas/StateError"
              - type: object
                properties:
                  status:
                    enum:
                      - 410
                  error:
                    allOf:
                      - $ref: "#/components/schemas/Error"
                      - example:
                          code: flow_expired_error
                          message: The flow has expired.
    FlowResponseInternalServerError:
      description: FlowResponseInternalServerError
      content:
        application/json:
          schema:
            allOf:
              - $ref: "#/components/schemas/StateError"
              - type: object
                properties:
                  status:
                    enum:
                      - 500
                  error:
                    allOf:
                      - $ref: "#/components/schemas/Error"
                      - example:
                          code: technical_error
                          message: Something went wrong.
    FlowResponseNotFoundError:
      description: FlowResponseNotFoundError
      content:
        application/json:
          schema:
            allOf:
              - $ref: "#/components/schemas/StateError"
              - type: object
                properties:
                  status:
                    enum:
                      - 404
                  error:
                    allOf:
                      - $ref: "#/components/schemas/Error"
                      - example:
                          code: not_found
                          message: The requested resource was not found.
    FlowResponseTooManyRequestsError:
      description: FlowResponseTooManyRequestsError
      content:
        application/json:
          schema:
            allOf:
              - $ref: "#/components/schemas/StateError"
              - type: object
                properties:
                  status:
                    enum:
                      - 429
                  payload:
                    $ref: "#/components/schemas/PayloadResendAfter"
                  error:
                    allOf:
                      - $ref: "#/components/schemas/Error"
                      - example:
                          code: rate_limit_exceeded
                          message: The rate limit has been exceeded.
    FlowResponseUnauthorizedError:
      description: FlowResponseUnauthorizedError
      content:
        application/json:
          schema:
            allOf:
              - $ref: "#/components/schemas/StateError"
              - type: object
                properties:
                  status:
                    enum:
                      - 401
                  error:
                    allOf:
                      - $ref: "#/components/schemas/Error"
                      - example:
                          code: passcode_max_attempts_reached
                          message: The passcode was entered wrong too many times.
    ProfileFlowResponseBadRequestError:
      description: ProfileFlowResponseBadRequestError
      content:
        application/json:
          schema:
            allOf:
              - oneOf:
                  - $ref: "#/components/schemas/StateProfileInit"
                  - $ref: "#/components/schemas/StatePasscodeConfirmation"
                  - $ref: "#/components/schemas/StateProfileWebauthnCredentialVerification"
              - type: object
                properties:
                  status:
                    enum:
                      - 400
                  error:
                    $ref: "#/components/schemas/Error"
    RegistrationFlowResponse:
      description: RegistrationFlowResponse
      headers:
        X-Auth-Token:
          description: |
            Enable via configuration option `session.enable_auth_token_header`
            for purposes of cross-domain communication between client and Hanko API.
            
            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/X-Auth-Token'
        X-Session-Lifetime:
          description: |
            Contains the seconds until the session expires.
            
            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/X-Session-Lifetime'
        X-Session-Retention:
          description: |
            Serves as a hint at what type of cookie (session or persistent) should be created.

            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/X-Session-Retention'
        Set-Cookie:
          description: |
            Value `<JWT>` is a [JSON Web Token](https://www.rfc-editor.org/rfc/rfc7519.html)
            
            Only present on the `success` state of the flow.
          schema:
            $ref: '#/components/schemas/CookieSession'
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/StatesRegistration"
    RegistrationFlowResponseBadRequestError:
      description: RegistrationFlowResponseBadRequestError
      content:
        application/json:
          schema:
            allOf:
              - oneOf:
                  - $ref: "#/components/schemas/StateRegistrationInit"
                  - $ref: "#/components/schemas/StatePasscodeConfirmation"
                  - $ref: "#/components/schemas/StatePasswordCreation"
                  - $ref: "#/components/schemas/StateOnboardingCreatePasskey"
                  - $ref: "#/components/schemas/StateOnboardingVerifyPasskeyAttestation"
                  - $ref: "#/components/schemas/StateThirdParty"
              - type: object
                properties:
                  error:
                    $ref: "#/components/schemas/Error"
  requestBodies:
    RegistrationRequestBody:
      description: RegistrationRequestBody
      content:
        application/json:
          schema:
            title: Registration request body
            type: object
            properties:
              input_data:
                oneOf:
                  - $ref: "#/components/schemas/InputDataRegisterClientCapabilities"
                  - $ref: "#/components/schemas/InputDataRegisterLoginIdentifier"
                  - $ref: "#/components/schemas/InputDataRememberMe"
                  - $ref: "#/components/schemas/InputDataRegisterPassword"
                  - $ref: "#/components/schemas/InputDataVerifyPasscode"
                  - $ref: "#/components/schemas/InputDataOTPCodeVerify"
                  - $ref: "#/components/schemas/InputDataThirdPartyOauth"
                  - $ref: "#/components/schemas/InputDataExchangeToken"
                  - $ref: "#/components/schemas/InputDataWebauthnVerifyAttestationResponse"
              csrf_token:
                $ref: "#/components/schemas/CSRFToken"
            additionalProperties: false
    LoginRequestBody:
      description: LoginRequestBody
      content:
        application/json:
          schema:
            title: Login request body
            type: object
            properties:
              input_data:
                oneOf:
                  - $ref: "#/components/schemas/InputDataRegisterClientCapabilities"
                  - $ref: "#/components/schemas/InputDataContinueWithLoginIdentifier"
                  - $ref: "#/components/schemas/InputDataRememberMe"
                  - $ref: "#/components/schemas/InputDataEmailAddressSet"
                  - $ref: "#/components/schemas/InputDataVerifyPasscode"
                  - $ref: "#/components/schemas/InputDataPasswordLogin"
                  - $ref: "#/components/schemas/InputDataRegisterPassword"
                  - $ref: "#/components/schemas/InputDataPasswordRecovery"
                  - $ref: "#/components/schemas/InputDataOTPCodeVerify"
                  - $ref: "#/components/schemas/InputDataOTPCodeValidate"
                  - $ref: "#/components/schemas/InputDataThirdPartyOauth"
                  - $ref: "#/components/schemas/InputDataExchangeToken"
                  - $ref: "#/components/schemas/InputDataWebauthnVerifyAttestationResponse"
                  - $ref: "#/components/schemas/InputDataWebauthnVerifyAssertionResponse"
              csrf_token:
                $ref: "#/components/schemas/CSRFToken"
            additionalProperties: false
    ProfileRequestBody:
      description: ProfileRequestBody
      content:
        application/json:
          schema:
            title: Profile request body
            type: object
            properties:
              input_data:
                oneOf:
                  - $ref: "#/components/schemas/InputDataRegisterClientCapabilities"
                  - $ref: "#/components/schemas/InputDataConnectThirdPartyOAuthProvider"
                  - $ref: "#/components/schemas/InputDataDisconnectThirdPartyOAuthProvider"
                  - $ref: "#/components/schemas/InputDataEmailCreate"
                  - $ref: "#/components/schemas/InputDataEmailDelete"
                  - $ref: "#/components/schemas/InputDataEmailSetPrimary"
                  - $ref: "#/components/schemas/InputDataEmailVerify"
                  - $ref: "#/components/schemas/InputDataExchangeToken"
                  - $ref: "#/components/schemas/InputDataPasswordCreate"
                  - $ref: "#/components/schemas/InputDataPasswordUpdate"
                  - $ref: "#/components/schemas/InputDataPatchMetadata"
                  - $ref: "#/components/schemas/InputDataOTPCodeVerify"
                  - $ref: "#/components/schemas/InputDataSecurityKeyDelete"
                  - $ref: "#/components/schemas/InputDataSessionDelete"
                  - $ref: "#/components/schemas/InputDataUsernameSet"
                  - $ref: "#/components/schemas/InputDataVerifyPasscode"
                  - $ref: "#/components/schemas/InputDataWebauthnCredentialRename"
                  - $ref: "#/components/schemas/InputDataWebauthnVerifyAttestationResponse"
              csrf_token:
                $ref: "#/components/schemas/CSRFToken"
            additionalProperties: false
    TokenExchangeRequestBody:
      description: TokenExchangeRequestBody
      content:
        application/json:
          schema:
            title: Token exchange request body
            type: object
            properties:
              input_data:
                oneOf:
                  - $ref: "#/components/schemas/InputDataExchangeToken"
                  - $ref: "#/components/schemas/InputDataVerifyPasscode"
                  - $ref: "#/components/schemas/InputDataUsernameSet"
              csrf_token:
                $ref: "#/components/schemas/CSRFToken"
            additionalProperties: false