openapi: "3.0.0"
info:
  title: Nuts Crypto Service API spec
  description: API specification for crypto services available within nuts node
  version: 1.0.0
  license:
    name: GPLv3
servers:
  - url: http://localhost:1323
paths:
  /internal/crypto/v1/sign_jwt:
    post:
      summary: "sign a JWT payload with the private key of the given kid"
      description: |
        Sign a JWT payload with the private key of the given kid

        error returns:
        * 400 - incorrect input
      operationId: signJwt
      tags:
        - crypto
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignJwtRequest'
      responses:
        '200':
          description: "OK response, body holds JWT"
          content:
            text/plain:
              schema:
                type: string
                example: "aa==.bb==.cc=="
        default:
          $ref: '../common/error_response.yaml'
  /internal/crypto/v1/sign_jws:
    post:
      summary: "sign a payload and headers with the private key of the given kid into a JWS object"
      description: |
        Sign a payload and headers with the private key of the given kid into a JWS object

        error returns:
        * 400 - incorrect input
      operationId: signJws
      tags:
        - crypto
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignJwsRequest'
      responses:
        '200':
          description: "OK response, body holds JWS"
          content:
            text/plain:
              schema:
                type: string
                example: "aa==.bb==.cc=="
        default:
          $ref: '../common/error_response.yaml'

components:
  schemas:
    SignJwtRequest:
      required:
        - claims
        - kid
      properties:
        kid:
          type: string
        claims:
          type: object
    SignJwsRequest:
      required:
        - headers
        - payload
        - kid
      properties:
        kid:
          type: string
          description: "Reference to the key ID used for signing the JWS."
        headers:
          type: object
          description: "The map of protected headers"
        payload:
          type: string
          format: byte
          description: "The payload to be signed as bytes. The bytes must be encoded with base64 encoding."
        detached:
          type: boolean
          default: false
          description: "In detached mode the payload is signed but NOT included in the returned JWS object. 
          Instead, the space between the first and second dot is empty, like this: \"<header>..<signature>\".
          Defaults to false."
  securitySchemes:
    jwtBearerAuth:
      type: http
      scheme: bearer

security:
  - {}
  - jwtBearerAuth: []
