# Reflexis Auth — external auth (T-API) login.
# Base path is the kernel webapp on the host (not under /MYWORK/service).
openapi: 3.0.3
info:
  title: TM Next-Gen — Auth
  description: |
    OpenAPI for Reflexis **Auth** HTTP endpoints, including T-API external authentication.

    **Authentication:** T-API login expects the `X-reflexis-auth-token-X` header (T-API / integration token).  

    **Note:** Do not commit or share real token values. Use the **Authorize** dialog or environment-specific secrets in Try it out.
  version: 1.0.0
  contact:
    name: API Support
    email: noreply@zebra.com

servers:
  - url: https://fs3.reflexisinc.com/
    description: Example host (replace with your environment)
  - url: http://localhost:3001/
    description: Local CORS proxy — npm run cors-proxy; full target URL is rewritten by the proxy

tags:
  - name: KernelAuth
    description: Kernel authentication and external auth handlers

security:
  - ReflexisAuthToken: []

paths:
  /kernel/auth/extauthhandler/TAPILogin.json:
    post:
      tags:
        - KernelAuth
      summary: T-API login (external auth handler)
      description: |
        Authenticates or establishes context for T-API using `domainId` and `userId`.  
        Requires `X-reflexis-auth-token-X` and `Content-Type: application/json`.
      operationId: tapiLogin
      parameters:
        - name: X-reflexis-auth-token-X
          in: header
          required: true
          schema:
            type: string
          description: T-API / integration authentication token issued for your integration.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TapiLoginRequest'
            examples:
              sample:
                summary: Domain and user
                value:
                  domainId: RFLXUS
                  userId: SYSADMIN
      responses:
        '200':
          description: Success — response shape is defined by the Kernel implementation (typically JSON).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonObject'
        '400':
          description: Bad request (invalid body or parameters).
        '401':
          description: Unauthorized (missing or invalid `X-reflexis-auth-token-X` or session).
        '500':
          description: Server error.

components:
  securitySchemes:
    ReflexisAuthToken:
      type: apiKey
      in: header
      name: X-reflexis-auth-token-X
      description: T-API / integration authentication token issued for your integration.

  schemas:
    JsonObject:
      type: object
      additionalProperties: true
      description: JSON object (structure varies by endpoint).
    TapiLoginRequest:
      type: object
      required:
        - domainId
        - userId
      properties:
        domainId:
          type: string
          description: Target domain identifier.
          example: RFLXUS
        userId:
          type: string
          description: User id to authenticate in the given domain.
          example: SYSADMIN
      example:
        domainId: RFLXUS
        userId: SYSADMIN