AAPP/openapi.yaml at main · RunStack-AI/AAPP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
openapi: 3.0.3
info:
  title: Agent Account Provisioning Protocol (AAPP) - Reference API
  version: 1.0.0
  description: |
    Reference OpenAPI for the Agent Account Provisioning Protocol (AAPP).
    The API provides discovery, account provisioning, account linking, token issuance (PoP-bound tokens),
    attestations, and revocation endpoints for automated agent provisioning flows.
servers:
  - url: http://localhost:8080
paths:
  /.well-known/aapp:
    get:
      summary: AAPP discovery document
      responses:
        '200':
          description: metadata for AAPP endpoints and policies
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WellKnown'
  /aapp/provision:
    post:
      summary: Request provisioning of an account on behalf of a user
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProvisionRequest'
      responses:
        '201':
          description: Provision created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProvisionResponse'
        '400':
          description: Bad request
  /aapp/link:
    post:
      summary: Link an existing user oauth session to an agent token
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LinkRequest'
      responses:
        '200':
          description: Agent token issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProvisionResponse'
        '400':
          description: Bad request
  /aapp/revoke:
    post:
      summary: Revoke a provision or agent token
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevokeRequest'
      responses:
        '200':
          description: Revocation accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RevokeResponse'
  /aapp/provision/{provision_id}:
    get:
      summary: Get provision status / audit receipt
      parameters:
        - name: provision_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Provision record
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProvisionRecord'
components:
  schemas:
    WellKnown:
      type: object
      properties:
        version:
          type: string
        provision_endpoint:
          type: string
        link_endpoint:
          type: string
        token_endpoint:
          type: string
        attestations_endpoint:
          type: string
        supported_idp_claims:
          type: array
          items: { type: string }
        provisioning_policy:
          type: object
          additionalProperties: true
    ProvisionRequest:
      type: object
      required: [idp_assertion, agent_pubkey_jwk, requested_scopes, user_consent]
      properties:
        client_request_id:
          type: string
          description: Client-generated correlation id
        idp_assertion:
          type: string
          description: OIDC id_token or serialized VC asserting user's identity
        user_consent:
          type: object
          required: [consent_id, timestamp, text]
          properties:
            consent_id: { type: string }
            timestamp: { type: string, format: date-time }
            text: { type: string }
        agent_pubkey_jwk:
          type: object
          description: JSON Web Key (public)
        requested_scopes:
          type: array
          items: { type: string }
        provisioning_options:
          type: object
          properties:
            mode: { type: string, enum: ["alias-as-user","agent-owned"] }
            display_name: { type: string }
            preferred_username: { type: string }
    ProvisionResponse:
      type: object
      properties:
        provision_id: { type: string }
        account_id: { type: string }
        account_alias: { type: string }
        attestation_vc:
          type: object
          description: Signed TPS attestation (demo shape)
        agent_token:
          type: object
          properties:
            access_token: { type: string }
            token_type: { type: string }
            expires_in: { type: integer }
            cnf:
              type: object
    LinkRequest:
      type: object
      required: [oauth_access_token, agent_pubkey_jwk, requested_scopes]
      properties:
        oauth_access_token: { type: string }
        agent_pubkey_jwk: { type: object }
        requested_scopes:
          type: array
          items: { type: string }
    RevokeRequest:
      type: object
      required: [provision_id, reason]
      properties:
        provision_id: { type: string }
        reason: { type: string }
    RevokeResponse:
      type: object
      properties:
        provision_id: { type: string }
        revoked: { type: boolean }
        timestamp: { type: string, format: date-time }
    ProvisionRecord:
      allOf:
        - $ref: '#/components/schemas/ProvisionResponse'
        - type: object
          properties:
            status:
              type: string
              enum: [active, revoked, suspended]
            audit_receipt:
              type: object
              properties:
                receipt_id: { type: string }
                timestamp: { type: string, format: date-time }
                signed_by: { type: string }