{
  "openapi": "3.1.0",
  "info": {
    "title": "Credential Invitations API",
    "description": "Create and manage partner-delivered credential invitations.\n\nConfigure credential definitions, issuer settings, and webhook subscriptions in the DeepCredentials portal before using this API. Provision DeepAdmin service users through DeepCloud, not through the portal. Runtime invitation operations use only the B2B API. DeepCredentials returns the one-time invitation code to the caller and does not email it; your system owns delivery to the recipient.\n\nThese operations are wired to the intended `deepcredentials.issue` scope guard. Scope enforcement is currently disabled across B2B until DeepAdmin tokens carry the `deepcredentials.*` scope names. Authenticated B2B requests are also exempt from the shared anonymous-caller rate limit.",
    "version": "1.0.0",
    "x-metadata": {
      "title": "Credential Invitations API",
      "description": "Create and manage partner-delivered credential invitations"
    }
  },
  "servers": [
    {
      "url": "https://api.dev.deepcredentials.swiss",
      "description": "Development"
    },
    {
      "url": "https://api.int.deepcredentials.swiss",
      "description": "Integration"
    }
  ],
  "tags": [
    {
      "name": "Credential Invitations",
      "description": "Create and manage partner-delivered credential invitations."
    }
  ],
  "paths": {
    "/b2b/v1/credential-invitations": {
      "post": {
        "summary": "Create a credential invitation.",
        "description": "Creates a pending invitation in the organization and environment selected by the authenticated service user and required headers.\n\nThe response contains the only current plaintext code. DeepCredentials does not email the code or return a redemption URL in the B2B flow. Your system owns code delivery and the recipient experience. Exchange the recipient's email and code through `POST /api/v1/public/credential-invitations/redeem`; where and how your system exposes that flow is up to you.\n\nOnly one pending invitation may exist for the same organization, environment, credential definition, and normalized email address. `reference_id` is correlation metadata only; it does not make this operation idempotent or unique.",
        "operationId": "POST:b2b.CreateCredentialInvitation",
        "tags": [
          "Credential Invitations"
        ],
        "parameters": [
          {
            "$ref": "#/components/parameters/XOrgIdHeader"
          },
          {
            "$ref": "#/components/parameters/XEnvironmentHeader"
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateCredentialInvitationRequest"
              },
              "example": {
                "credential_definition_id": "db167a9d-8182-430c-bff0-f9baa6d48bb6",
                "email": "alice@example.com",
                "claims": {
                  "given_name": "Alice",
                  "employee_number": "E-1042"
                },
                "reference_id": "partner-invitation-1042",
                "invitation_ttl_seconds": 86400,
                "offer_validity_seconds": 600,
                "validity_seconds": 31536000
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Invitation created. The caller owns delivery of the returned code.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CredentialInvitationWithCode"
                },
                "example": {
                  "invitation_id": "305ac8b8-299a-4e63-a969-405840e67772",
                  "environment": "beta",
                  "credential_definition_id": "db167a9d-8182-430c-bff0-f9baa6d48bb6",
                  "credential_definition_name": "Employee Card",
                  "email": "alice@example.com",
                  "code_last4": "X7Q9",
                  "status": "pending",
                  "reference_id": "partner-invitation-1042",
                  "offer_validity_seconds": 600,
                  "expires_at": "2026-08-19T10:00:00Z",
                  "created_at": "2026-08-18T10:00:00Z",
                  "code": "7KMTD-5X7Q9"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/InvalidArgument"
          },
          "401": {
            "$ref": "#/components/responses/Unauthenticated"
          },
          "403": {
            "$ref": "#/components/responses/PermissionDenied"
          },
          "409": {
            "$ref": "#/components/responses/AlreadyExists"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      },
      "get": {
        "summary": "List credential invitations.",
        "description": "Returns a newest-first, paginated list scoped to the authenticated service user's organization and `X-Environment`.\n\nResults contain metadata only. They never contain the plaintext code, claims, `validity_seconds`, or a redemption URL. Exact filters support discovery after a create response is lost, but callers must reconcile the visible metadata with their own durable create-request record before rotating a code.",
        "operationId": "GET:b2b.ListCredentialInvitations",
        "tags": [
          "Credential Invitations"
        ],
        "parameters": [
          {
            "$ref": "#/components/parameters/XOrgIdHeader"
          },
          {
            "$ref": "#/components/parameters/XEnvironmentHeader"
          },
          {
            "name": "limit",
            "in": "query",
            "description": "Maximum results to return. Omitted or non-positive values use 50; values above 100 are capped at 100.",
            "schema": {
              "type": "integer",
              "format": "int64",
              "default": 50
            }
          },
          {
            "name": "offset",
            "in": "query",
            "description": "Results to skip. Omitted or negative values use 0.",
            "schema": {
              "type": "integer",
              "format": "int64",
              "default": 0
            }
          },
          {
            "name": "status",
            "in": "query",
            "description": "Filter by exact invitation status.",
            "schema": {
              "$ref": "#/components/schemas/CredentialInvitationStatus"
            }
          },
          {
            "name": "credential_definition_id",
            "in": "query",
            "description": "Filter by exact credential definition ID.",
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          },
          {
            "name": "email",
            "in": "query",
            "description": "Filter by exact normalized email address. Leading and trailing whitespace is removed and comparison is case-insensitive through lowercase normalization.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "reference_id",
            "in": "query",
            "description": "Filter by exact correlation identifier. This field is not unique.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Matching invitation metadata.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListCredentialInvitationsResponse"
                },
                "example": {
                  "invitations": [
                    {
                      "invitation_id": "305ac8b8-299a-4e63-a969-405840e67772",
                      "environment": "beta",
                      "credential_definition_id": "db167a9d-8182-430c-bff0-f9baa6d48bb6",
                      "credential_definition_name": "Employee Card",
                      "email": "alice@example.com",
                      "code_last4": "X7Q9",
                      "status": "pending",
                      "reference_id": "partner-invitation-1042",
                      "offer_validity_seconds": 600,
                      "expires_at": "2026-08-19T10:00:00Z",
                      "created_at": "2026-08-18T10:00:00Z"
                    },
                    {
                      "invitation_id": "72b53892-2592-4d3c-b213-4a5e30de01f8",
                      "environment": "beta",
                      "credential_definition_id": "db167a9d-8182-430c-bff0-f9baa6d48bb6",
                      "credential_definition_name": "Employee Card",
                      "email": "bob@example.com",
                      "code_last4": "Q8N4",
                      "status": "redeemed",
                      "redeemed_offer_id": "4638c446-a36d-4993-92f2-ea760fbad19e",
                      "expires_at": "2026-08-19T09:00:00Z",
                      "redeemed_at": "2026-08-18T09:05:00Z",
                      "created_at": "2026-08-18T09:00:00Z"
                    }
                  ],
                  "total": 2
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/InvalidArgument"
          },
          "401": {
            "$ref": "#/components/responses/Unauthenticated"
          },
          "403": {
            "$ref": "#/components/responses/PermissionDenied"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/b2b/v1/credential-invitations/{invitationId}": {
      "get": {
        "summary": "Get a credential invitation.",
        "description": "Returns code-free invitation metadata within the authenticated service user's organization and `X-Environment`.\n\nAn ID from another organization or environment returns `not_found`. The response never contains the plaintext code, claims, `validity_seconds`, or a redemption URL.",
        "operationId": "GET:b2b.GetCredentialInvitation",
        "tags": [
          "Credential Invitations"
        ],
        "parameters": [
          {
            "$ref": "#/components/parameters/XOrgIdHeader"
          },
          {
            "$ref": "#/components/parameters/XEnvironmentHeader"
          },
          {
            "$ref": "#/components/parameters/InvitationIdPath"
          }
        ],
        "responses": {
          "200": {
            "description": "Current invitation metadata.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CredentialInvitation"
                },
                "example": {
                  "invitation_id": "305ac8b8-299a-4e63-a969-405840e67772",
                  "environment": "beta",
                  "credential_definition_id": "db167a9d-8182-430c-bff0-f9baa6d48bb6",
                  "credential_definition_name": "Employee Card",
                  "email": "alice@example.com",
                  "code_last4": "X7Q9",
                  "status": "redeemed",
                  "reference_id": "partner-invitation-1042",
                  "offer_validity_seconds": 600,
                  "redeemed_offer_id": "4638c446-a36d-4993-92f2-ea760fbad19e",
                  "expires_at": "2026-08-19T10:00:00Z",
                  "redeemed_at": "2026-08-18T10:03:00Z",
                  "created_at": "2026-08-18T10:00:00Z"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/InvalidArgument"
          },
          "401": {
            "$ref": "#/components/responses/Unauthenticated"
          },
          "403": {
            "$ref": "#/components/responses/PermissionDenied"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/b2b/v1/credential-invitations/{invitationId}/rotate-code": {
      "post": {
        "summary": "Rotate a credential invitation code.",
        "description": "Replaces the code of a pending invitation, resets failed attempts, and sets a new expiry from the requested TTL.\n\nRotation is deliberately non-idempotent: every successful call invalidates the previous code and returns the only current plaintext code. DeepCredentials does not email the replacement. If a rotate response is lost, rotate again until your system receives a response, then deliver that returned code.",
        "operationId": "POST:b2b.RotateCredentialInvitationCode",
        "tags": [
          "Credential Invitations"
        ],
        "parameters": [
          {
            "$ref": "#/components/parameters/XOrgIdHeader"
          },
          {
            "$ref": "#/components/parameters/XEnvironmentHeader"
          },
          {
            "$ref": "#/components/parameters/InvitationIdPath"
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RotateCredentialInvitationCodeRequest"
              },
              "example": {
                "invitation_ttl_seconds": 86400
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Code rotated. The caller owns delivery of the replacement code.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CredentialInvitationWithCode"
                },
                "example": {
                  "invitation_id": "305ac8b8-299a-4e63-a969-405840e67772",
                  "environment": "beta",
                  "credential_definition_id": "db167a9d-8182-430c-bff0-f9baa6d48bb6",
                  "credential_definition_name": "Employee Card",
                  "email": "alice@example.com",
                  "code_last4": "8N4P",
                  "status": "pending",
                  "reference_id": "partner-invitation-1042",
                  "offer_validity_seconds": 600,
                  "expires_at": "2026-08-20T10:00:00Z",
                  "created_at": "2026-08-18T10:00:00Z",
                  "code": "9BR2K-Q8N4P"
                }
              }
            }
          },
          "400": {
            "description": "The request is invalid (`invalid_argument`), or the invitation is no longer pending (`failed_precondition`). A prior successful rotation does not block another rotation while the invitation remains pending.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "examples": {
                  "invalid_argument": {
                    "summary": "Invalid invitation TTL",
                    "value": {
                      "code": "invalid_argument",
                      "message": "invitation_ttl_seconds is required and must be positive"
                    }
                  },
                  "failed_precondition": {
                    "summary": "Invitation cannot be rotated",
                    "value": {
                      "code": "failed_precondition",
                      "message": "only pending invitations can be resent or rotated"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/Unauthenticated"
          },
          "403": {
            "$ref": "#/components/responses/PermissionDenied"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/b2b/v1/credential-invitations/{invitationId}/revoke": {
      "post": {
        "summary": "Revoke a credential invitation.",
        "description": "Revokes a pending invitation so it can no longer be redeemed.\n\nThe mutation is single-shot, not idempotent. Repeating it after the invitation leaves `pending` returns `failed_precondition`.",
        "operationId": "POST:b2b.RevokeCredentialInvitation",
        "tags": [
          "Credential Invitations"
        ],
        "parameters": [
          {
            "$ref": "#/components/parameters/XOrgIdHeader"
          },
          {
            "$ref": "#/components/parameters/XEnvironmentHeader"
          },
          {
            "$ref": "#/components/parameters/InvitationIdPath"
          }
        ],
        "responses": {
          "200": {
            "description": "Invitation revoked. This response does not contain a plaintext code.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CredentialInvitation"
                },
                "example": {
                  "invitation_id": "305ac8b8-299a-4e63-a969-405840e67772",
                  "environment": "beta",
                  "credential_definition_id": "db167a9d-8182-430c-bff0-f9baa6d48bb6",
                  "credential_definition_name": "Employee Card",
                  "email": "alice@example.com",
                  "code_last4": "X7Q9",
                  "status": "revoked",
                  "reference_id": "partner-invitation-1042",
                  "offer_validity_seconds": 600,
                  "expires_at": "2026-08-19T10:00:00Z",
                  "revoked_at": "2026-08-18T10:02:00Z",
                  "created_at": "2026-08-18T10:00:00Z"
                }
              }
            }
          },
          "400": {
            "description": "The request is invalid (`invalid_argument`), or the invitation is no longer pending (`failed_precondition`).",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "examples": {
                  "invalid_argument": {
                    "summary": "Malformed request",
                    "value": {
                      "code": "invalid_argument",
                      "message": "X-Environment header must be beta or production."
                    }
                  },
                  "failed_precondition": {
                    "summary": "Invitation cannot be revoked",
                    "value": {
                      "code": "failed_precondition",
                      "message": "only pending invitations can be revoked"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/Unauthenticated"
          },
          "403": {
            "$ref": "#/components/responses/PermissionDenied"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "BearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "DeepAdmin-issued Keycloak access token obtained via the OAuth 2.0\nResource Owner Password Credentials grant against the DeepCloud SSO\nrealm. See the Service Users guide for the exchange flow."
      }
    },
    "parameters": {
      "XOrgIdHeader": {
        "name": "X-Org-Id",
        "in": "header",
        "required": true,
        "schema": {
          "type": "string",
          "format": "uuid"
        },
        "description": "Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404."
      },
      "XEnvironmentHeader": {
        "name": "X-Environment",
        "in": "header",
        "required": true,
        "schema": {
          "type": "string",
          "enum": [
            "beta",
            "production"
          ]
        },
        "description": "Environment the call is scoped to. Invitation resources are isolated per environment."
      },
      "InvitationIdPath": {
        "name": "invitationId",
        "in": "path",
        "required": true,
        "schema": {
          "type": "string",
          "format": "uuid"
        },
        "description": "Credential invitation ID."
      }
    },
    "schemas": {
      "CreateCredentialInvitationRequest": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "credential_definition_id",
          "email",
          "claims",
          "invitation_ttl_seconds"
        ],
        "properties": {
          "credential_definition_id": {
            "type": "string",
            "format": "uuid",
            "description": "Credential definition to issue after redemption. Configure it in the portal before making runtime B2B calls."
          },
          "email": {
            "type": "string",
            "format": "email",
            "maxLength": 255,
            "description": "Recipient email used together with the code by the public redemption endpoint. It is trimmed and normalized to lowercase when stored. DeepCredentials does not email it in this B2B flow."
          },
          "claims": {
            "type": "object",
            "minProperties": 1,
            "description": "Claim values for the eventual credential. Keys and JSON value types must match the credential definition, all mandatory claims must be present, and the serialized payload must not exceed 6 MB. Invitation responses do not return these values; retain them in your own durable request record when lost-response recovery matters."
          },
          "reference_id": {
            "type": "string",
            "description": "Optional correlation identifier from your system; echoed on the resource."
          },
          "invitation_ttl_seconds": {
            "type": "integer",
            "format": "int64",
            "minimum": 1,
            "description": "Positive lifetime of the invitation code in seconds."
          },
          "offer_validity_seconds": {
            "type": "integer",
            "format": "int64",
            "minimum": 1,
            "description": "Optional positive lifetime, in seconds, of the credential offer created after redemption."
          },
          "validity_seconds": {
            "type": "integer",
            "format": "int64",
            "minimum": 60,
            "maximum": 315360000,
            "description": "Optional eventual credential lifetime in seconds. Omit to use the credential definition default. Allowed range is 60 seconds through 10 years. Invitation responses do not return this value; retain it in your own durable request record when lost-response recovery matters."
          }
        }
      },
      "RotateCredentialInvitationCodeRequest": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "invitation_ttl_seconds"
        ],
        "properties": {
          "invitation_ttl_seconds": {
            "type": "integer",
            "format": "int64",
            "minimum": 1,
            "description": "Positive lifetime, in seconds, applied from the successful rotation time."
          }
        }
      },
      "CredentialInvitationStatus": {
        "type": "string",
        "enum": [
          "pending",
          "redeemed",
          "expired",
          "revoked"
        ],
        "description": "Current invitation lifecycle state."
      },
      "CredentialInvitation": {
        "type": "object",
        "required": [
          "invitation_id",
          "environment",
          "credential_definition_id",
          "credential_definition_name",
          "email",
          "code_last4",
          "status",
          "expires_at",
          "created_at"
        ],
        "properties": {
          "invitation_id": {
            "type": "string",
            "format": "uuid",
            "description": "Credential invitation ID."
          },
          "environment": {
            "type": "string",
            "enum": [
              "beta",
              "production"
            ],
            "description": "Environment selected by `X-Environment` when the invitation was created."
          },
          "credential_definition_id": {
            "type": "string",
            "format": "uuid",
            "description": "Credential definition used for the eventual offer."
          },
          "credential_definition_name": {
            "type": "string",
            "description": "Credential definition name captured when the invitation was created."
          },
          "email": {
            "type": "string",
            "format": "email",
            "description": "Normalized recipient email required for public redemption."
          },
          "code_last4": {
            "type": "string",
            "minLength": 4,
            "maxLength": 4,
            "pattern": "^[0-9A-HJKMNP-TV-Z]{4}$",
            "description": "Last four normalized code characters for support and delivery confirmation. This is not a redeemable code."
          },
          "status": {
            "$ref": "#/components/schemas/CredentialInvitationStatus"
          },
          "reference_id": {
            "type": "string",
            "description": "Optional correlation identifier from your system; echoed on the resource."
          },
          "offer_validity_seconds": {
            "type": "integer",
            "format": "int64",
            "description": "Configured lifetime of the offer created after redemption, when supplied at creation."
          },
          "redeemed_offer_id": {
            "type": "string",
            "format": "uuid",
            "description": "Offer created by a successful redemption. Present only after redemption."
          },
          "expires_at": {
            "type": "string",
            "format": "date-time",
            "description": "Invitation-code expiry timestamp in RFC 3339 UTC."
          },
          "redeemed_at": {
            "type": "string",
            "format": "date-time",
            "description": "Successful redemption timestamp in RFC 3339 UTC."
          },
          "revoked_at": {
            "type": "string",
            "format": "date-time",
            "description": "Revocation timestamp in RFC 3339 UTC."
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "description": "Creation timestamp in RFC 3339 UTC."
          }
        }
      },
      "CredentialInvitationWithCode": {
        "allOf": [
          {
            "$ref": "#/components/schemas/CredentialInvitation"
          },
          {
            "type": "object",
            "required": [
              "code"
            ],
            "properties": {
              "code": {
                "type": "string",
                "minLength": 11,
                "maxLength": 11,
                "pattern": "^[0-9A-HJKMNP-TV-Z]{5}-[0-9A-HJKMNP-TV-Z]{5}$",
                "description": "One-time plaintext invitation code. Returned only by create and rotate; the caller owns secure delivery."
              }
            }
          }
        ]
      },
      "ListCredentialInvitationsResponse": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "invitations",
          "total"
        ],
        "properties": {
          "invitations": {
            "type": "array",
            "description": "Newest-first invitation metadata. Items never contain plaintext codes or credential claims.",
            "items": {
              "$ref": "#/components/schemas/CredentialInvitation"
            }
          },
          "total": {
            "type": "integer",
            "format": "int64",
            "minimum": 0,
            "description": "Total number of invitations matching the filters before pagination."
          }
        }
      },
      "Error": {
        "type": "object",
        "additionalProperties": true,
        "required": [
          "code",
          "message"
        ],
        "properties": {
          "code": {
            "type": "string",
            "description": "Machine-readable error code."
          },
          "message": {
            "type": "string",
            "description": "Human-readable error description."
          },
          "details": {
            "type": "object",
            "description": "Optional structured data with additional context."
          }
        }
      }
    },
    "responses": {
      "InvalidArgument": {
        "description": "Request validation failed (`invalid_argument`), including malformed required headers, identifiers, filters, email, claims, or lifetime values.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            },
            "example": {
              "code": "invalid_argument",
              "message": "invitation_ttl_seconds is required and must be positive"
            }
          }
        }
      },
      "Unauthenticated": {
        "description": "The Bearer token is missing, invalid, or expired (`unauthenticated`).",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            },
            "example": {
              "code": "unauthenticated",
              "message": "Missing or invalid Bearer token."
            }
          }
        }
      },
      "PermissionDenied": {
        "description": "The authenticated caller is not authorized for this operation (`permission_denied`). The `deepcredentials.issue` scope guard is wired but currently disabled as described above; this response may still come from another authorization gate.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            },
            "example": {
              "code": "permission_denied",
              "message": "Permission denied."
            }
          }
        }
      },
      "NotFound": {
        "description": "The invitation does not exist within the authenticated organization and environment (`not_found`).",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            },
            "example": {
              "code": "not_found",
              "message": "invitation not found"
            }
          }
        }
      },
      "AlreadyExists": {
        "description": "A pending invitation already exists for this recipient and credential definition in the selected environment (`already_exists`).",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            },
            "example": {
              "code": "already_exists",
              "message": "invitation already exists for this recipient"
            }
          }
        }
      },
      "InternalError": {
        "description": "Unexpected server failure (`internal`).",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            },
            "example": {
              "code": "internal",
              "message": "An unexpected error occurred."
            }
          }
        }
      }
    }
  },
  "security": [
    {
      "BearerAuth": []
    }
  ]
}