openapi: 3.0.0
info:
  version: v2
  title: Event API
  description: >-
    API to access events generated by iWelcome.

    ***About the structure of the events***

    The events are designed to allow for easy querying to do data analysis and reporting.

    _event types and event categories_


    Several event types have been defined and each event_type is assigned to an event category.
    Both event types are listed below as 'schemas' having a 3-digit number, e.g. 507 OTP SMS sent. The event categories are listed as well, e.g. 5XX for Communication events.

    Note that a 'fake' event type 000 is defined in this specification that includes any data that may appear as event-data in any of the supported events.

    _event data_

    The design of the schemas for the events have as much 'common' event-attributes as possible. The schema for each event_type is a sub-set ('sub-schema' ) of the fake 000 event. The 000-event can be considered as the meta-schema for all events.

    The design of the event meta-schema aims at finding the right balance between the following (somewhat conflicting) principles:
      * grouping attributes reflecting the logical datamodel
      * 'flattening' the datamodel, such that event attributes follow the same structure. This allows for easy querying of events with the same values for those attributes.


paths:
  /event-api/v2/events:
    post:
      operationId: addFunctionalEvents
      summary: Add functional events
      description: >-
        Each added event is validated against the json-schema and MUST have the event_type-id
        no events can be posted that have:
        * event_type_id < 10000 (so an external application cannot post our native events)
        * event-category equal to one of our categories.
        * if a posted event has attributes that matches the default event metadata schema, they are validated against our validation-rules for such fields, see yAML.
        * Any event-attribute that is not in the json-schema is ignored; the event does not get rejected.
      security:
        - OAuth2: ['event:event:provider']
      parameters:
        - name: Authorization
          in: header
          description: >-
            Bearer <access_token>. The access_token should have the scope *event:event:provider*.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.iwelcome.v1+json:
            schema:
              $ref: '#/components/schemas/PostEventRequest'
      responses:
        '201':
          description: >-
            The event was published and can now be queried.
          content:
            application/vnd.iwelcome.v1+json:
              schema:
                $ref: '#/components/schemas/PostEventRequestResponse'
        '403':
          description: >-
            Permission denied, error code EVT000003.
          content:
            application/vnd.iwelcome.v1+json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: >-
            Failed to save the event, error code EVT000005.
          content:
            application/vnd.iwelcome.v1+json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    get:
      operationId: retrieveFunctionalEvents
      security:
        - OAuth2: []
      parameters:
        - name: user_id
          in: query
          description: >-
            The user id for which to query the events. When an authenticated user asks for his own events he needs to specify
            his own `user_id`.
            Only users having the `event:event:consumer` scope can access events for other users.
          required: false
          schema:
            type: string
        - name: filter
          in: query
          description: >-
            Filtering query that allows to filter on which events are returned. The following filter criteria are supported:
              * user-id EQ <user_id> <br/>
                Needed only when scope `event:event:consumer` is set)
              * event_category EQ <event_category> <br/>

            Multiple filter criteria can be used, using the AND / OR operators.
          required: false
          schema:
            type: string
        - name: page
          in: query
          description: Pagination parameter indicating which page must be returned,
          required: false
          schema:
            type: integer
            default: 1
            minimum: 1
        - name: size
          in: query
          description: Pagination parameter indicating the number of results per page that is returned.
          required: false
          schema:
            type: integer
            default: 20
            minimum: 1
            maximum: 100
        - name: Authorization
          in: header
          description: >-
            Bearer <access_token>. The access_token should have either scope:
                * `event:event:consumer`; when this scope is used any user's events can be returned (dependent on filtering)
          required: true
          schema:
            type: string
      summary: API to query an end-user's events
      description: API to query events, typically to display on a timeline in either a self-service application or user management application.
        The endpoint is protected
        * `event:event:consumer`; when this scope is used any user's events can be returned (dependent on filtering)
      responses:
        '200':
          $ref: '#/components/responses/MultipleEvents'
        '403':
          description: >-
            Permission denied, error code EVT000003.
          content:
            application/vnd.iwelcome.v1+json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
servers:
  - url: 'https://www.ongo.com/bikes/event/v2'
components:
  responses:
    MultipleEvents:
      description: The events for the user
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/PaginatedEventV2Response"
          example:
            event_type_id: "000"
            event_type_details:
              category: "fake events"
              name: "fake event"
            timestamp: "2018-11-14T14:55:22Z"
            device:
              user_agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"
              os: "Mac OS X 10_14_2"
              browser: "Chrome"
              browser_version: "71.0.3578.98"
            end_user:
              id: "98127d312d484a86a18e37b0ca404bb4"
              external_id: "ongo-customer-id-0123456789"
              segment: "ongo-bikes"
            authenticated_user:
              id: "5a377494075648679e37a02a86992e84"
              segment: "employees"
            location:
              ip: "172.18.0.1"
            client_application:
              client_id: "s6BhdRkqt3"
              client_name: "DUMS"
            iwelcome_as_a_client_application:
              client_id: "sfjsdfsfj"
              client_name: "Ongo IDaaS"
            authentication:
              requested_acr: "2FAPasswordProtectedTransportAndOtpPerSMS"
              acr: "2FAPreviousSessionAndOtpPerSMS"
              amr_list:
                - "Facebook"
                - "delegated"
                - "sms"
            identifier_value: "somebody@somewhere.com"
            application_session:
              scopes: [ "x", "y"]
              session_expiry: "2018-11-11T15:03:00Z"
            block:
              reason: "System generated reason"
              date_added: "2018-10-01T09:10:14Z"
              date_removed: "2018-10-21T17:58:53Z"
            message_details:
              date_sent: "2017-06-01Z"
              sent_to: "somebody@somewhere.com"
              sent_from: "Ongo-bikes<noreply@ong-bikes.com>"
              subject: "Reset the password for your account at ongo-bikes"
            email_template:
              template_name: "passwordResetEmail"
              description: "Email template to send an email containing a password reset link"
              subject: "Reset the password for your account at ${segment}"
              locale: "en_GB"
              segment: "ongo-bikes"
              brand: "ongo-bikes-2015-style"
            sms_template:
              body: "Your login-code is ${OTP}"
              locale: "en_GB"
              segment: "ongo-bikes"
              brand: "ongo-bikes-2015-style"
            phone_number: '+31612345678'
            profile_attribute:
              label: "phoneNumbers"
              external_label: "phone_number"
              value: "+31612345678"
              previous_value: "+31687654321"
            processing_purpose:
              id: "12345"
              description:
                locale: "en_GB"
                description: "to manage your account"
              attribute_name: "emails"
              data_controller: "Ongo Bikes Ltd."
            protocol: OAuth
            amr: "pwd"
            username: "Johnny1995"
            previous_state: "INACTIVE"
            new_state: "ACTIVE"
            count: 1
            group:
              id: "f480b020-61f5-478b-aa75-ec0c8b0dbba3"
              display_name: "Office365 users"
            sub_group:
              id: "c68b2d3f-ffc4-4751-874c-cc1ab224a87f"
              display_name: "Office365 administrators"
    EventV2Response:
      description: A single event
      content:
        application/json:
          schema:
            oneOf:
              - $ref: '#/components/schemas/LoginSuccessEventV2Response'
              - $ref: '#/components/schemas/LoginFailureEventV2Response'
              - $ref: '#/components/schemas/LogOffEventV2Response'
              - $ref: '#/components/schemas/SocialLoginEventV2Response'
              - $ref: '#/components/schemas/LoginWithAuthenticatingLinkEventV2Response'
              - $ref: '#/components/schemas/ClickOnIdentifyingLinkEventV2Response'
              - $ref: '#/components/schemas/UserNotFoundEventV2Response'
              - $ref: '#/components/schemas/PasswordValidationEventV2Response'
              - $ref: '#/components/schemas/SmsOtpValidationEventV2Response'
              - $ref: '#/components/schemas/DelegatedAuthenticationEventV2Response'
              - $ref: '#/components/schemas/TOTPValidationEventV2Response'
              - $ref: '#/components/schemas/LinkValidationEventV2Response'
              - $ref: '#/components/schemas/SmsOtpValidationFailedEventV2Response'
              - $ref: '#/components/schemas/PasswordValidationFailedEventV2Response'
              - $ref: '#/components/schemas/AccessGrantedEventV2Response'
              - $ref: '#/components/schemas/AccessDeniedEventV2Response'
              - $ref: '#/components/schemas/AccessTokenRenewedEventV2Response'
              - $ref: '#/components/schemas/AccessWithdrawnEventV2Response'
              - $ref: '#/components/schemas/TokenIntrospectionEventV2Response'
              - $ref: '#/components/schemas/CreateAccountEventV2Response'
              - $ref: '#/components/schemas/HardDeleteAccountEventV2Response'
              - $ref: '#/components/schemas/SoftDeleteAccountEventV2Response'
              - $ref: '#/components/schemas/AccountRestoredEventV2Response'
              - $ref: '#/components/schemas/BlockEventV2Response'
              - $ref: '#/components/schemas/UnblockEventV2Response'
              - $ref: '#/components/schemas/AddBlockEventV2Response'
              - $ref: '#/components/schemas/RemoveBlockEventV2Response'
              - $ref: '#/components/schemas/ActivationEventV2Response'
              - $ref: '#/components/schemas/AutomatedBlockEventV2Response'
              - $ref: '#/components/schemas/SetPasswordEventV2Response'
              - $ref: '#/components/schemas/SetUsernameEventV2Response'
              - $ref: '#/components/schemas/PasswordResetRequestEventV2Response'
              - $ref: '#/components/schemas/PasswordResetEventV2Response'
              - $ref: '#/components/schemas/SetPrimaryEmailEventV2Response'
              - $ref: '#/components/schemas/PasswordChangeEventV2Response'
              - $ref: '#/components/schemas/PasswordChangeFailedEventV2Response'
              - $ref: '#/components/schemas/RequestChangePrimaryEmailEventV2Response'
              - $ref: '#/components/schemas/ChangePrimaryEmailEventV2Response'
              - $ref: '#/components/schemas/SetPhoneNumberEventV2Response'
              - $ref: '#/components/schemas/RequestSetPrimaryPhoneNumberEventV2Response'
              - $ref: '#/components/schemas/ChangePrimaryPhoneNumberEventV2Response'
              - $ref: '#/components/schemas/SocialAccountLinkedEventV2Response'
              - $ref: '#/components/schemas/SocialAccountUnlinkedEventV2Response'
              - $ref: '#/components/schemas/IdentityLinkActivatedSuccessEventV2Response'
              - $ref: '#/components/schemas/IdentityLinkActivatedFailedEventV2Response'
              - $ref: '#/components/schemas/ValidationEmailSentEventV2Response'
              - $ref: '#/components/schemas/PasswordResetEmailSentEventV2Response'
              - $ref: '#/components/schemas/VerificationSmsCodeSentEventV2Response'
              - $ref: '#/components/schemas/OtpSmsCodeSentEventV2Response'
              - $ref: '#/components/schemas/PersonalDataSentEventV2Response'
              - $ref: '#/components/schemas/AccountAndPersonalDataDeletedEventV2Response'
              - $ref: '#/components/schemas/AttributeValueUpdatedEventV2Response'
              - $ref: '#/components/schemas/AttributeValueVerifiedEventV2Response'
              - $ref: '#/components/schemas/AttributeValueRetrievedEventV2Response'
              - $ref: '#/components/schemas/ExternalUserLookUpEventV2Response'
              - $ref: '#/components/schemas/DocumentConsentApprovedEventV2Response'
              - $ref: '#/components/schemas/DocumentConsentWithdrawnEventV2Response'
              - $ref: '#/components/schemas/ProcessingPurposeConsentApprovedEventV2Response'
              - $ref: '#/components/schemas/ProcessingPurposeConsentWithdrawnEventV2Response'
              - $ref: '#/components/schemas/UserDataViewedEventV2Response'
              - $ref: '#/components/schemas/AddUserToGroupEventV2Response'
              - $ref: '#/components/schemas/RemoveUserFromGroupEventV2Response'
              - $ref: '#/components/schemas/SubgroupAddedToGroupEventV2Response'
              - $ref: '#/components/schemas/SubgroupRemovedFromGroupEventV2Response'
              - $ref: '#/components/schemas/GroupCreatedEventV2Response'
              - $ref: '#/components/schemas/GroupDeletedEventV2Response'
            discriminator:
              propertyName: event_type_id
              mapping:
                '101': '#/components/schemas/LoginSuccessEventV2Response'
                '102': '#/components/schemas/LoginFailureEventV2Response'
                '103': '#/components/schemas/LogOffEventV2Response'
                '105': '#/components/schemas/SocialLoginEventV2Response'
                '106': '#/components/schemas/LoginWithAuthenticatingLinkEventV2Response'
                '107': '#/components/schemas/ClickOnIdentifyingLinkEventV2Response'
                '111': '#/components/schemas/UserNotFoundEventV2Response'
                '151': '#/components/schemas/PasswordValidationEventV2Response'
                '152': '#/components/schemas/SmsOtpValidationEventV2Response'
                '153': '#/components/schemas/DelegatedAuthenticationEventV2Response'
                '154': '#/components/schemas/TOTPValidationEventV2Response'
                '155': '#/components/schemas/LinkValidationEventV2Response'
                '157': '#/components/schemas/SmsOtpValidationFailedEventV2Response'
                '161': '#/components/schemas/PasswordValidationFailedEventV2Response'
                '201': '#/components/schemas/AccessGrantedEventV2Response'
                '202': '#/components/schemas/AccessDeniedEventV2Response'
                '203': '#/components/schemas/AccessTokenRenewedEventV2Response'
                '204': '#/components/schemas/AccessWithdrawnEventV2Response'
                '205': '#/components/schemas/TokenIntrospectionEventV2Response'
                '301': '#/components/schemas/CreateAccountEventV2Response'
                '302': '#/components/schemas/HardDeleteAccountEventV2Response'
                '303': '#/components/schemas/SoftDeleteAccountEventV2Response'
                '304': '#/components/schemas/AccountRestoredEventV2Response'
                '305': '#/components/schemas/BlockEventV2Response'
                '306': '#/components/schemas/UnblockEventV2Response'
                '307': '#/components/schemas/AddBlockEventV2Response'
                '308': '#/components/schemas/RemoveBlockEventV2Response'
                '311': '#/components/schemas/ActivationEventV2Response'
                '313': '#/components/schemas/AutomatedBlockEventV2Response'
                '401': '#/components/schemas/SetPasswordEventV2Response'
                '402': '#/components/schemas/SetUsernameEventV2Response'
                '403': '#/components/schemas/PasswordResetRequestEventV2Response'
                '404': '#/components/schemas/PasswordResetEventV2Response'
                '405': '#/components/schemas/SetPrimaryEmailEventV2Response'
                '406': '#/components/schemas/PasswordChangeEventV2Response'
                '407': '#/components/schemas/PasswordChangeFailedEventV2Response'
                '408': '#/components/schemas/RequestChangePrimaryEmailEventV2Response'
                '409': '#/components/schemas/ChangePrimaryEmailEventV2Response'
                '410': '#/components/schemas/SetPhoneNumberEventV2Response'
                '411': '#/components/schemas/RequestSetPrimaryPhoneNumberEventV2Response'
                '412': '#/components/schemas/ChangePrimaryPhoneNumberEventV2Response'
                '420': '#/components/schemas/SocialAccountLinkedEventV2Response'
                '421': '#/components/schemas/SocialAccountUnlinkedEventV2Response'
                '424': '#/components/schemas/IdentityLinkActivatedSuccessEventV2Response'
                '425': '#/components/schemas/IdentityLinkActivatedFailedEventV2Response'
                '501': '#/components/schemas/ValidationEmailSentEventV2Response'
                '503': '#/components/schemas/PasswordResetEmailSentEventV2Response'
                '506': '#/components/schemas/VerificationSmsCodeSentEventV2Response'
                '507': '#/components/schemas/OtpSmsCodeSentEventV2Response'
                '508': '#/components/schemas/PersonalDataSentEventV2Response'
                '509': '#/components/schemas/AccountAndPersonalDataDeletedEventV2Response'
                '601': '#/components/schemas/AttributeValueUpdatedEventV2Response'
                '602': '#/components/schemas/AttributeValueVerifiedEventV2Response'
                '605': '#/components/schemas/AttributeValueRetrievedEventV2Response'
                '650': '#/components/schemas/ExternalUserLookUpEventV2Response'
                '801': '#/components/schemas/DocumentConsentApprovedEventV2Response'
                '802': '#/components/schemas/DocumentConsentWithdrawnEventV2Response'
                '805': '#/components/schemas/ProcessingPurposeConsentApprovedEventV2Response'
                '806': '#/components/schemas/ProcessingPurposeConsentWithdrawnEventV2Response'
                '901': '#/components/schemas/UserDataViewedEventV2Response'
                '1001': '#/components/schemas/AddUserToGroupEventV2Response'
                '1002': '#/components/schemas/RemoveUserFromGroupEventV2Response'
                '1003': '#/components/schemas/SubgroupAddedToGroupEventV2Response'
                '1004': '#/components/schemas/SubgroupRemovedFromGroupEventV2Response'
                '1050': '#/components/schemas/GroupCreatedEventV2Response'
                '1051': '#/components/schemas/GroupDeletedEventV2Response'
  securitySchemes:
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: 'https://example.com/oauth/authorize'
          tokenUrl: 'https://example.com/oauth/token'
          scopes:
            'event:event:consumer': view events for other users
            'event:event:provider': post custom events
  schemas:
    PostEventRequestResponse:
      additionalProperties:
        type: object
      description: The event that has been added.
    PostEventRequest:
      additionalProperties:
        type: object
      description: The event to be added to elasticsearch.
    PaginatedEventV2Response:
      type: object
      description: The paginated response with the events.
      properties:
        page:
          type: integer
          description: The page number.
          example: 1
        size:
          type: integer
          description: The page size.
          example: 100
        count:
          type: integer
          description: The number of resources returned on the page.
          example: 50
        resources:
          type: array
          items:
            type: object
            additionalProperties:
              type: object
    EventV2Response:
      type: object
      required:
        - timestamp
        - event_type_id
        - event_type_details
      properties:
        version:
          type: string
          enum:
            - V2
        event_type_id:
          type: integer
          enum:
            - 101
            - 102
            - 103
            - 105
            - 106
            - 107
            - 111
            - 151
            - 152
            - 153
            - 154
            - 155
            - 157
            - 161
            - 201
            - 202
            - 203
            - 204
            - 205
            - 301
            - 302
            - 303
            - 304
            - 305
            - 306
            - 307
            - 308
            - 311
            - 313
            - 401
            - 402
            - 403
            - 404
            - 405
            - 406
            - 407
            - 408
            - 409
            - 410
            - 411
            - 412
            - 420
            - 421
            - 424
            - 425
            - 501
            - 503
            - 506
            - 507
            - 508
            - 509
            - 601
            - 602
            - 605
            - 650
            - 801
            - 802
            - 805
            - 806
            - 901
            - 1001
            - 1002
            - 1003
            - 1004
            - 1050
            - 1051
        event_type_details:
          type: object
          required:
            - name
            - category
          properties:
            category:
              $ref: '#/components/schemas/EventTypeCategoryResponse'
            name:
              type: string
              description: A short name or description for the event type.
        timestamp:
          type: string
          format: date-time
          description: The date and time on which the event occured.
    EventTypeCategoryResponse:
      description: Indicates the event category of an event.
      type: string
      enum:
        - AUTHENTICATION
        - AUTHORIZATION
        - CONSENT_MANAGEMENT
        - CREDENTIAL_VERIFICATION
        - ACCESS
        - IDENTITY_LIFECYCLE
        - CREDENTIAL_MANAGEMENT
        - COMMUNICATION
        - PROFILE_MANAGEMENT
        - PRIVACY
    IdentifierValueResponse:
      type: object
      properties:
        identifier_value:
          type: string
          description: The value of an identifier for an identity that was entered by a user or that was provided to iWelcome by an external IDP to identify the user, i.e. 'the linking pin'. The value may or may not be 'known' at iWelcome, so the look-up of the user may have succeeded or not. Possible values are email addresses, usernames, facebook-ids, etc.
          example: "somebody@somewhere.com"
        identifier_known:
          type: boolean
          description: The value of this attribute indicates if the identifier_value is already known; i.e if it's associated with a digital identity (a user) in iWelcome at the moment the event is generated.
    PhoneNumber:
      type: string
      description: A user's phonenumber.
      example: "+31612345678"
    Count:
      type: integer
      description: A multi-purpose event attribute that can be used in any event where something was counted. For example the number of results that were found during a user Look-Up.
      example:
        count: 1
    BlockReasonResponse:
      type: object
      required:
        - reason
      properties:
        reason:
          type: string
          example: "System generated reason"
        date_added:
          type: string
          format: date-time
          example: "2018-10-01T09:10:14Z"
        datetime_removed:
          type: string
          format: date-time
          example: "2018-10-21T17:58:53Z"

    UserResponse:
      type: object
      description: The end-user that is affected by the event
      required:
        - id
        - segment
      properties:
        id:
          type: string
          description: >-
            NEW. The id that was generated by iWelcome when the user was
            created.
          example: "98127d312d484a86a18e37b0ca404bb4"
        external_id:
          type: string
          description: >-
            The externalID that is set for the user through the SCIM
            interface.
          example: "ongo-customer-id-0123456789"
        segment:
          type: string
          description: The segment of the user.
          example: "ongo-bikes"
    LocationResponse:
      type: object
      required:
        - ip
      properties:
        ip:
          type: string
          description: The IP-address at which the user's device is located
          example: "172.18.0.1"
    ProcessingPurposeResponse:
      description: Processing purposes are defined and managed in the Privacy and Consent API. A simplified version of that definition is reflected in the events, leaving out details not relevant in the context of an event, such as 'state'. The naming of attributes of a processing purpose slightly deviate from those in the Privacy and Consent API to match iWelcome's naming conventions (that were not followed in the Privacy and Consent API).
        The description of a processing purpose is represented in the event using the user's locale at the time of giving the consent.
      properties:
        id:
          type: string
          description: identifier for an processing purpose
          example: "12345"
        description:
          $ref: '#/components/schemas/TranslationResponse'
        attribute_name:
          type: string
          description: >-
            The attribute for which this processing purpose is applied. The name
            of the attribute must be equal to the name of the attribute in the
            SCIM interface, but excluding the SCIM-schema extension.
          example: "emails"
        data_controller:
          type: string
          description: >-
            The name of the Data Controller. As per GDPR, the Data
            Controller is a legal person, public authority, agency or other
            body, which determines the purposes and means of the processing of
            personal data.
          example: "Ongo Bikes Ltd."

    TranslationResponse:
      type: object
      properties:
        locale:
          type: string
          description: The 'locale' that is used for the description.
          example: "en_GB"
        description:
          type: string
          description: >-
            A description of the processing purpose in the language as indicated
            by the locale. Data Controllers should ensure that the various
            'translations' for a single processing purpose have identifical
            meaning.
          example: "to manage your account"

    ProtocolResponse:
      type: object
      properties:
        protocol:
          type: string
          enum:
            - OAuth
            - OIDC
            - SAML
          example: "OAuth"
    AuthenticationResponse:
      type: object
      required:
        - amr_list
        - acr
      properties:
        requested_acr:
          $ref: '#/components/schemas/ACR'
        acr:
          $ref: '#/components/schemas/ACR'
        amr_list:
          type: array
          items:
            $ref: '#/components/schemas/AMR'

    ProfileAttributeValueResponse:
      type: object
      description: The value of an attribute in the user's profile.
      required:
        - label
        - value
      properties:
        label:
          type: string
          description: iWelcome's label for the attribute. Typically the attribute labels correspond with the names of the attributes in the core SCIM schema for the 'user' resource.
          example: "phoneNumbers"
        external_label:
          type: string
          description: Name of the attribute that is passed on to the client-application. iWelcome may have 'phoneNumbers' as label and may provide a phone number value under label 'phone_number'.
          example: "phone_number"
        value:
          type: string
          description: The value may be a complex attribute. For example, the 'name' attribute consists of several subattributes such as givenName and familyName.
        previous_value:
          type: string
    AttributeValueMetadataResponse:
      type: object
      properties:
        attribute_value_metadata:
          type: object
    ApplicationSessionResponse:
      type: object
      properties:
        scopes:
          type: array
          items:
            type: string
          example:
            - x
            - y
        session_expiry:
          type: string
          format: date-time
          example: "2018-11-11T15:03:00Z"

    EmailTemplateResponse:
      type: object
      properties:
        template_name:
          type: string
          example: "passwordResetEmail"
        description:
          type: string
          example: "Email template to send an email containing a password reset link"
        subject:
          type: string
          example: "Reset the password for your account at ${segment}"
        body:
          type: string
        locale:
          type: string
          example: "en_GB"
        segment:
          type: string
          example: "ongo-bikes"
        brand:
          type: string
          example: "ongo-bikes-2015-style"
    SMSTemplateResponse:
      type: object
      properties:
        #template_name:
        #type: string
        #description:
        #type: string
        body:
          type: string
          example: "Your login-code is ${OTP}"
        locale:
          type: string
          example: "en_GB"
        transmission_method:
          type: string
          example: "voice"
        segment:
          type: string
          example: "ongo-bikes"
        brand:
          type: string
          example: "ongo-bikes-2015-style"
    MessageDetailsResponse:
      type: object
      required:
        - date_sent
        - sent_to
        - sent_from
        - body
      properties:
        date_sent:
          type: string
          format: date-time
          example: "2017-06-01Z"
        sent_to:
          type: string
          example: "somebody@somewhere.com"
        sent_from:
          type: string
          example: "Ongo-bikes<noreply@ong-bikes.com>"
        subject:
          type: string
          description: The subject line of the message that was sent, including resolved 'parameters'.
          example: "Reset the password for your account at ongo-bikes"
        body:
          type: string
          description: The body of the actual message that was sent, including resolved 'parameters'. Typically html-formatted.
    ACR:
      type: string
      description: >
        Authentication Context Class Reference, as defined by
        OIDC-specifications and SAML specifications. Values as defined in RFC
        6711 and extended with values defined by iWelcome: XXX
      enum:
        - PasswordProtectedTransport
        - PreviousSession
        - 2FAPreviousSessionAndOtpPerSMS
        - 2FAPasswordProtectedTransportAndOtpPerSMS
      example: "PasswordProtectedTransport"
    AMR:
      description: >-
        Authentication Methods Reference; identifiers for authentication methods
        used in the authentication.
        External IDP's are considered as AMR's as well.
        When a user clicks on a link in an email, the email-domain (e.g. 'mymailprovider.com' or "mycompany.com') is the AMR value, since the user has to login to get access to his email box.
      type: string
      example: "pwd"
    DeviceResponse:
      type: object
      description: The end-user's device that was in use during the session that 'triggered' the event to happen.
      required:
        - userAgent
      properties:
        os:
          type: string
          description: The Operating System running on the client's device, which may imply the client's hardware as well.
          example: Mac OS X 10_13_6
        user_agent:
          type: string
          description: >-
            This is the header string that was provided by the client's user agent.
          example: >-
            Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6)
            AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100
            Safari/537.36
        browser:
          type: string
          description: The browser as retrieved from the user_agent string
          example: Chrome
        browser_version:
          type: string
          description: The version of the browser as retrieved from the user_agent
          example: "69.0.3497.100"
    DocumentResponse:
      type: object
      properties:
        name:
          description: Name of the document
          type: string
          example: "Terms of Service version 1.1"
        version:
          description: Version of the document
          type: string
          example: "v1.1"
        version_date:
          description: Date on which the documentversion became ACTIVE
          type: string
          format: date
          example: "2017-06-01Z"
    ClientApplicationResponse:
      type: object
      description: >
        The client application that invokes iWelcome API's. Client
        applications may be client-apps that are provided as part of
        iWelcome's service (such as Self-Service, ServiceDesk or DUMS) or
        they may be applications developed by the customer, such as a
        SCIM-client or an OAuth-client application.
      required:
        - client_id
      properties:
        client_id:
          description: As per OAuth RFC https://tools.ietf.org/html/rfc6749#section-2.2
          type: string
          example: "s6BhdRkqt3"
        client_name:
          type: string
          description: >
            Name for the client as per https://tools.ietf.org/html/rfc7591. Human-readable string name of the client to be presented to the end-user during authorization.  If omitted, the authorization
              server MAY display the raw "client_id" value to the end-user
              instead.  It is RECOMMENDED that clients always send this field.
              The value of this field MAY be internationalized, as described in Section 2.2.

            Possible values for iWelcome clients:
            Self-Service, ServiceDesk, DUMS
          example: "DUMS"
      example:
        client_id: "s6BhdRkqt3"
        client_name: "DUMS"
    APIDetailsResponse:
      type: object
      properties:
        endpoint_name:
          description: The logical name of the endpoint, independent of uri and branding
          type: string
        http_response_code:
          description: The response code that was returned on the api endpoint
          type: integer
        iWelcome_error_code:
          description: The error code that was generated by iWelcome.
          type: string
        iWelcome_error_description:
          description: Generic description that clarifies the iWelcome_error_code
          type: string
    iWelcomeAsAClientApplicationResponse:
      type: object
      description: >
        When iWelcome acts as a client towards other applications. For example, iWelcome may act as an Service Provider (or Relying Application) towards an external IDP such as facebook, ADFS or IDIN. When iWelcome is using an external Look-up service, iWelcome is also acting as a client.
        Within a single tenant, iWelcome may use multiple client_id's to interact with an external IDP.
        These attributes should not be restricted to just OAuth-based federation. In case of SAML federation client_name will contain XXXX To Do XXXX.
      properties:
        client_id:
          description: As per OAuth RFC https://tools.ietf.org/html/rfc6749#section-2.2
          type: string
          example: "sfjsdfsfj"
        client_name:
          type: string
          description: >
            Name for the client as per https://tools.ietf.org/html/rfc7591. Human-readable string name of the client to be presented to the end-user during authorization.  If omitted, the authorization
              server MAY display the raw "client_id" value to the end-user
              instead.  It is RECOMMENDED that clients always send this field.
              The value of this field MAY be internationalized, as described in Section 2.2.
          example: "Ongo IDaaS"
        service_name:
          type: string
          description: >
            Logical name for the service that is being invoked by iWelcome.
          example: "facebook"
      example:
        client_id: "sfjsdfsfj"
        client_name: "Ongo IDaaS"
        service_name: "facebook"
    IdentityStatus:
      description: Field that describes the state of a digital identity
      type: string
      enum:
        - INACTIVE
        - ACTIVE
        - BLOCKED
        - GRACE
        - WITHDRAWN
        - ARCHIVED
      example: "ACTIVE"
    IdentityStatusTransitionResponse:
      type: object
      properties:
        previous_state:
          $ref: '#/components/schemas/IdentityStatus'
        new_state:
          $ref: '#/components/schemas/IdentityStatus'
    GroupResponse:
      type: object
      properties:
        id:
          type: string
          description: Identifier for the group as generated by iWelcome
        display_name:
          type: string
          description: Displayable name for the group
    LoginSuccessEventV2Response:
      title: 101 Login with username and password
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            device:
              $ref: '#/components/schemas/DeviceResponse'
            user:
              $ref: '#/components/schemas/UserResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            authentication:
              $ref: '#/components/schemas/AuthenticationResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            session_id:
              type: string
    LoginFailureEventV2Response:
      title: 102 Failed login
      description: This event is generated when a user failed to authenticate himself correctly. The AMR attribute in this event indicates the failed authentication method.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          required:
            - amr
          properties:
            device:
              $ref: '#/components/schemas/DeviceResponse'
            user:
              $ref: '#/components/schemas/UserResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            authentication:
              $ref: '#/components/schemas/AuthenticationResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    LogOffEventV2Response:
      title: 103 Logoff
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            device:
              $ref: '#/components/schemas/DeviceResponse'
            user:
              $ref: '#/components/schemas/UserResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
    SocialLoginEventV2Response:
      title: 105 Social login
      description: |
        The amr will be one of:
          - facebook
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            device:
              $ref: '#/components/schemas/DeviceResponse'
            user:
              $ref: '#/components/schemas/UserResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            authentication:
              $ref: '#/components/schemas/AuthenticationResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
    LoginWithAuthenticatingLinkEventV2Response:
      title: 106 Login with authenticating link
      description: |
        The amr will be one of:
          - PreviousSession
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            device:
              $ref: '#/components/schemas/DeviceResponse'
            user:
              $ref: '#/components/schemas/UserResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            authentication:
              $ref: '#/components/schemas/AuthenticationResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
    ClickOnIdentifyingLinkEventV2Response:
      title: 107 Click on identifying link
      description: (Already implemented with old event schema)
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            device:
              $ref: '#/components/schemas/DeviceResponse'
            user:
              $ref: '#/components/schemas/UserResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            authentication:
              $ref: '#/components/schemas/AuthenticationResponse'
    UserNotFoundEventV2Response:
      title: 111 User not found
      description: >-
        Somebody tried to login with an unknown user; the email-address or username that was entered on the login-screen is not known within the segment.

         Limitations:
        The _implementation_ of this event doesn't yet contain the identifier that was entered. That information _is_ included here to document how it may be supported in future releases of iWelcome. The actual implemntation also does not contain the device-information like user_agent.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            device:
              $ref: '#/components/schemas/DeviceResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
    PasswordValidationEventV2Response:
      title: 151 Password OK
      description: >
        This event is generated whenever iWelcome verifies a user's password and the password was correct.
        This may happen during login but also when user changes his password
        through self-services and his current password is vlaidated before
        allowing him to set a new password. Passwords are validated against
        iWelcome's credential store.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    SmsOtpValidationEventV2Response:
      title: 152 SMS OTP OK
      description: >
        This event is generated whenever iWelcome verifies an OTP that was sent
        to a user's verified phone number.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    DelegatedAuthenticationEventV2Response:
      title: 153 Delegated authentication
      description: >
        This event is generated whenever iWelcome delegates authentication to an
        external IDP. iWelcome may apply additional authentication steps.
        Possible AMR's are restricted to the AMR's that represent a social IDP; such as Facebook, Microsoft, LinkedIn, Google.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            iWelcome_as_client_application:
              $ref: '#/components/schemas/iWelcomeAsAClientApplicationResponse'
            protocol:
              $ref: '#/components/schemas/ProtocolResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    TOTPValidationEventV2Response:
      title: 154 TOTP validation
      description: TOTP validation (already implemented with pervious schema)
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    LinkValidationEventV2Response:
      title: 155 Click on authenticating link
      description: >
        This event is generated whenever iWelcome delegates authentication to an
        external IDP and the IDP returns a logged-in user. iWelcome may apply additional authentication steps.
        Possible AMR's are restricted to domain names; i.e. the domain name of the email provider (e.g. 'mymailprovider.com' or "mycompany.com')
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    SmsOtpValidationFailedEventV2Response:
      title: 157 SMS OTP NOK
      description: >
        This event is generated whenever iWelcome verifies an OTP that was sent
        to a user's verified phonenumber and the OTP was not correct
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    PasswordValidationFailedEventV2Response:
      title: 161 Password NOK
      description: >
        This event is generated whenever iWelcome verifies a user's password and the password was not correct.
        This may happen during login but also when user changes his password
        through self-services and his current password is validated before
        allowing him to set a new password. Passwords are validated against iWelcome's credential store.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    AccessGrantedEventV2Response:
      title: 201 Access granted
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            application_session:
              $ref: '#/components/schemas/ApplicationSessionResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            protocol:
              $ref: '#/components/schemas/ProtocolResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            session_id:
              type: string
            access_flow:
              type: string
    AccessDeniedEventV2Response:
      title: 202 Access denied
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            protocol:
              $ref: '#/components/schemas/ProtocolResponse'
    AccessTokenRenewedEventV2Response:
      title: 203 Access token renewed
      description: An OAuth refresh token was used to obtain a new access token
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            application_session:
              $ref: '#/components/schemas/ApplicationSessionResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            protocol:
              $ref: '#/components/schemas/ProtocolResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            session_id:
              type: string
    AccessWithdrawnEventV2Response:
      title: 204 Access withdrawn
      description: User did single Log-off , so the access to an application is withdrawn.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            protocol:
              $ref: '#/components/schemas/ProtocolResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            session_id:
              type: string
            access_flow:
              type: string
    TokenIntrospectionEventV2Response:
      title: 205 Token introspection
      description: An OAuth-token (access token or refresh token) was inspected for validity and other characteristics.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            protocol:
              $ref: '#/components/schemas/ProtocolResponse'
    CreateAccountEventV2Response:
      title: 301 Account created
      description: A new 'digital identity' (or account) was created within iWelcome.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
    HardDeleteAccountEventV2Response:
      title: 302 Account deleted
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
    SoftDeleteAccountEventV2Response:
      title: 303 Soft delete (grace)
      description: The user is soft deleted, a state transition has occured from any state to GRACE state.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
    AccountRestoredEventV2Response:
      title: 304 Account restored
      description: A soft deleted account is restored from GRACE to its previous state.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
    BlockEventV2Response:
      title: 305 Account blocked
      description: The state of the user changed to BLOCKED
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
            block_reason:
              $ref: '#/components/schemas/BlockReasonResponse'
    UnblockEventV2Response:
      title: 306 Account unblocked
      description: The state of the user changed from BLOCKED to ACTIVE after last block was removed. The block information that is included in the evnt is the (last) block that was removed.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
            block_reason:
              $ref: '#/components/schemas/BlockReasonResponse'
    AddBlockEventV2Response:
      title: 307 Block added, already blocked
      description: >
        An additional block was added to an account that was already BLOCKE.
        CHECK, This may actually be generated for any block that is added; 1st one or 2nd one.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
            block_reason:
              $ref: '#/components/schemas/BlockReasonResponse'
    RemoveBlockEventV2Response:
      title: 308 Block removed, still blocked
      description: >
        A block is removed, but there are still blocks left on the account, so the account's status remains BLOCKED. The block infrmation that's included in the evnt is the block that was removed.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
            block_reason:
              $ref: '#/components/schemas/BlockReasonResponse'
    ActivationEventV2Response:
      title: 311 Account activated
      description: Account was activated.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
    AutomatedBlockEventV2Response:
      title: 313 Account blocked after failed logins
      description: >
        The state of the user changed to BLOCKED after the user did too many subsequent failed login attempts.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            block_reason:
              $ref: '#/components/schemas/BlockReasonResponse'
            identity_status_transition:
              $ref: '#/components/schemas/IdentityStatusTransitionResponse'
    SetPasswordEventV2Response:
      title: 401 Set password
      description: >
        A (initial) password was set for the user for example during registration; the user did not execute a password reset nor did he have to enter his current password.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            authentication:
              type: object
              properties:
                acr:
                  $ref: '#/components/schemas/ACR'
    SetUsernameEventV2Response:
      title: 402 Set username
      description: A username was set for the user for example during registration or via self-service
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
    PasswordResetRequestEventV2Response:
      title: 403 Password reset was requested
      description: >
        Execution of a password reset was requested for the indicated email address, username.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
    PasswordResetEventV2Response:
      title: 404 Password reset
      description: The user reset his (forgotten) password.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            authentication:
              type: object
              properties:
                acr:
                  $ref: '#/components/schemas/ACR'
    SetPrimaryEmailEventV2Response:
      title: 405 Primary email address was set.
      description: >
        A user's primary email was set. Typically after the user confirmed the e-mail address by clicking on a link that was sent to the associated e-mail box.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            authentication:
              type: object
              properties:
                acr:
                  $ref: '#/components/schemas/ACR'
    PasswordChangeEventV2Response:
      title: 406 Change password
      description: The user changed his password.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    PasswordChangeFailedEventV2Response:
      title: 407 Failed password change
      description: An attempt to change the user's password failed.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            api_details:
              $ref: '#/components/schemas/APIDetailsResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    RequestChangePrimaryEmailEventV2Response:
      title: 408 Primary Email requested
      description: A new primary email address is requested.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            authentication:
              type: object
              properties:
                acr:
                  $ref: '#/components/schemas/ACR'
    ChangePrimaryEmailEventV2Response:
      title: 409 Primary email address was changed.
      description: >
        A user's primary email was changed. Typically after the user confirmed the e-mail address by clicking on a link that was sent to the associated e-mail box.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            authentication:
              type: object
              properties:
                acr:
                  $ref: '#/components/schemas/ACR'
    SetPhoneNumberEventV2Response:
      title: 410 Set primary phone
      description: >
        A primary phonenumber was set for the user for example during registration or via provisioning.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            phone_number:
              $ref: '#/components/schemas/PhoneNumber'
    RequestSetPrimaryPhoneNumberEventV2Response:
      title: 411 Primary phonenumber is requested
      description: >
        A phonenumber was requested to become primary for a certain user.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            phone_number:
              $ref: '#/components/schemas/PhoneNumber'
    ChangePrimaryPhoneNumberEventV2Response:
      title: 412 Primary phone is changed
      description: An active user's primnary phonenumber is changed.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            phone_number:
              $ref: '#/components/schemas/PhoneNumber'
    SocialAccountLinkedEventV2Response:
      title: 420 Social account linked
      description: >
        This event is generated whenever a social account is successfully linked to an account within iWelcome. The type of social account is indicated in the amr attribute, e.g. 'Facebook' or 'LinkedIn'.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    SocialAccountUnlinkedEventV2Response:
      title: 421 Social account unlinked
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    IdentityLinkActivatedSuccessEventV2Response:
      title: 424 Identity link activated
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    IdentityLinkActivatedFailedEventV2Response:
      title: 425 Identity link activated failed
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            identifier_value:
              $ref: '#/components/schemas/IdentifierValueResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            amr:
              $ref: '#/components/schemas/AMR'
    ValidationEmailSentEventV2Response:
      title: 501 Email address verification
      description: This event indicates when an email is sent to validate a (new) e-mail address to an ACTIVE account.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            email_template:
              $ref: '#/components/schemas/EmailTemplateResponse'
            message_details:
              $ref: '#/components/schemas/MessageDetailsResponse'
    PasswordResetEmailSentEventV2Response:
      title: 503 Password reset email sent
      description: This event indicates a password reset email was sent. The trigger (i.e. It may have been triggered by the user itself on the login-page, from a User Management application or via an API.) is not explicely reflected in the event, although different templates may be applied.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            email_template:
              $ref: '#/components/schemas/EmailTemplateResponse'
            message_details:
              $ref: '#/components/schemas/MessageDetailsResponse'
    VerificationSmsCodeSentEventV2Response:
      title: 506 Phone verification SMS sent
      description: This event indicates a code has been sent per SMS text message to verify a user's phonenumber.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            sms_template:
              $ref: '#/components/schemas/SMSTemplateResponse'
            message_details:
              $ref: '#/components/schemas/MessageDetailsResponse'
    OtpSmsCodeSentEventV2Response:
      title: 507 OTP SMS sent
      description: This event indicates a login code has been sent per SMS text message to the user's verified phonenumber.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            sms_template:
              $ref: '#/components/schemas/SMSTemplateResponse'
            message_details:
              $ref: '#/components/schemas/MessageDetailsResponse'
    PersonalDataSentEventV2Response:
      title: 508 Personal data sent
      description: This event indicates (a link to ) a copy of the user's personal data has been sent to the user's email address.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            email_template:
              $ref: '#/components/schemas/EmailTemplateResponse'
            message_details:
              $ref: '#/components/schemas/MessageDetailsResponse'
    AccountAndPersonalDataDeletedEventV2Response:
      title: 509 Account and personal data has been deleted
      description: This event indicates the user's account and personal data has been deleted from iWelcome.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            email_template:
              $ref: '#/components/schemas/EmailTemplateResponse'
            message_details:
              $ref: '#/components/schemas/MessageDetailsResponse'
    AttributeValueUpdatedEventV2Response:
      title: 601 Attribute value was updated
      description: The attribute's value was updated.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            profile_attribute_value:
              $ref: '#/components/schemas/ProfileAttributeValueResponse'
            attribute_value_metadata:
              $ref: '#/components/schemas/AttributeValueMetadataResponse'
    AttributeValueVerifiedEventV2Response:
      title: 602 Attribute value was verified
      description: The attribute's value has been verified. This event gets generated when an email address or a phonenumber was verified by sending a link or code.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            attribute_value_metadata:
              $ref: '#/components/schemas/AttributeValueMetadataResponse'
    AttributeValueRetrievedEventV2Response:
      title: 605 Attribute value was retrieved
      description: ToDo - To be defined exactly. The event is already implemented.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            profile_attribute_value:
              $ref: '#/components/schemas/ProfileAttributeValueResponse'
    ExternalUserLookUpEventV2Response:
      title: 650 The user was looked-up in an external identity store
      description: iWelcome may look-up a user in an external user/identity based on a part of the user's profile that is available within iWelcome. Note that this event does not contain personal information that was part of the request or the response (privacy by design).
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            iWelcome_as_client_application:
              $ref: '#/components/schemas/iWelcomeAsAClientApplicationResponse'
            count:
              $ref: '#/components/schemas/Count'
    DocumentConsentApprovedEventV2Response:
      title: 801 Document consented
      description: The end-user gave his consent to a document, such as Privacy Policy or Terms of Service.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            document:
              $ref: '#/components/schemas/DocumentResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
    DocumentConsentWithdrawnEventV2Response:
      title: 801 Document consent withdrawn
      description: The end-user revoked his consent to a document, such as Privacy Policy or Terms of Service.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            document:
              $ref: '#/components/schemas/DocumentResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
    ProcessingPurposeConsentApprovedEventV2Response:
      title: 805 Processing purpose consented
      description: The user gave consent on a processing purpose. (Since a processing purpose is always related to some personal information that is stored as an attribute in the user's profile, this event is also known as an 'attribute consent').
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            processing_purpose:
              $ref: '#/components/schemas/ProcessingPurposeResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
    ProcessingPurposeConsentWithdrawnEventV2Response:
      title: 806 Processing purpose consent withdrawn
      description: The user withdrew his consent on a processing purpose.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            device:
              $ref: '#/components/schemas/DeviceResponse'
            location:
              $ref: '#/components/schemas/LocationResponse'
            processing_purpose:
              $ref: '#/components/schemas/ProcessingPurposeResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
    UserDataViewedEventV2Response:
      title: 901 User data viewed
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
    AddUserToGroupEventV2Response:
      title: 1001 User added to group
      description: A user was added to the group.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            parent_group:
              $ref: '#/components/schemas/GroupResponse'
    RemoveUserFromGroupEventV2Response:
      title: 1002 User removed from group
      description: A user was removed from the group.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            user:
              $ref: '#/components/schemas/UserResponse'
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            parent_group:
              $ref: '#/components/schemas/GroupResponse'
    SubgroupAddedToGroupEventV2Response:
      title: 1003 Subgroup added to a group
      description: An existing group was added as a subgroup to another group.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            child_group:
              $ref: '#/components/schemas/GroupResponse'
            parent_group:
              $ref: '#/components/schemas/GroupResponse'
    SubgroupRemovedFromGroupEventV2Response:
      title: 1004 Subgroup removed from group
      description: A subgroup was removed from the parent group. The subgroup still exists.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            child_group:
              $ref: '#/components/schemas/GroupResponse'
            parent_group:
              $ref: '#/components/schemas/GroupResponse'
    GroupCreatedEventV2Response:
      title: 1050 Group created
      description: A group has been created.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            parent_group:
              $ref: '#/components/schemas/GroupResponse'
    GroupDeletedEventV2Response:
      title: 1051 Group deleted
      description: Group has been deleted.
      allOf:
        - $ref: '#/components/schemas/EventV2Response'
        - type: object
          properties:
            authenticated_user:
              $ref: '#/components/schemas/UserResponse'
            client_application:
              $ref: '#/components/schemas/ClientApplicationResponse'
            parent_group:
              $ref: '#/components/schemas/GroupResponse'
    ErrorResponse:
      type: object
      properties:
        code:
          type: string
          enum:
            - EVT000001
            - EVT000002
            - EVT000003
            - EVT000004
            - EVT000005
          description: >-
            Error code:
              * EVT000001: Invalid input
              * EVT000002: Authorization failure
              * EVT000003: Permission denied
              * EVT000004: User not found
              * EVT000005: Internal server error
        description:
          type: string
          description: detail error message