openapi: 3.1.0
info:
  title: Challenges
  description: |-
    The Challenges API supports challenging banking users to verify their identity when performing other API operations.

    This API supports _challenges_ when the financial institution requires the user to prove their identity though a secondary challenge _factor_, such as entering a code sent to them via SMS (text message), email, voice call, or by answering security questions. User may have has one or more _channels_  associated with each factor, such as a multiple phone numbers or e-mail addresses. The financial institution may require a challenge before certain actions that warrant extra validation, such as making transfers to an external institution, updating the customer's mailing address, or ordering replacement debit cards.

    An API operation may return a 403 response with a `challengeRequired` problem type name to indicate a challenge is required for that operation. (The [problem response's](#schema-problemResponse) `type` is the URI [`https://static.api.apiture.com/errors/challengeRequired/v1.0.0/`](https://static.api.apiture.com/errors/challengeRequired/v1.0.0/). The actual version number `v1.0.0` may change, although the problem `type` URL always starts with `https://static.api.apiture.com/errors/challengeRequired/`.) For `challengeRequired`, the `attributes` in the [`apiProblem`](#schema-apiProblem) response lists the challenges that the client may choose from as described in the [`requiredIdentityChallenge`](#schema-requiredIdentityChallenge) schema. The user must complete one of the offered challenges.

    Each challenge contains a [`challengeFactor`](#schema-challengeFactor) which identifies how the user receives and completes the challenge. This object has a [`type`](#schema-challengeFactorType) which describes the factor used to complete the challenge and optional string `labels` which describe the channel(s) through which the user can complete the challenge. For `sms` and `voice` factors, the label is the last four digits of a phone number. For `email` challenges, the label is a masked email address. For `securityQuestions`, the `challengeFactor` includes a prompt for each of the user's security questions, and does not use the `labels`.

    The user selects their preferred channel from those available, and the client then starts that challenge flow via [the `startIdentityChallenge` operation](#op-startIdentityChallenge). In response to that operation, the service will send an _one-time passcode_ of several digits to the user via the corresponding channel for the `sms`, `email`, `voice`, `authenticatorToken` challenge factors. The start operation is required to activate the challenge, even if the service does not have to send information to the user, such as with `securityQuestions`.

    The user enters the challenge response, such as the _one-time passcode_ that was sent to them or the answers to their security questions, in the client. Then the client completes the challenge by [verifying the user's challenge response](#op-verifyIdentityChallenge).

    The system verifies the submitted challenge response(s) and, if valid, returns a token that the client must pass via the `Challenge` request header (in conjunction with the existing `Authorization` header) when it retries the operation.

    For example, if the user chose to complete the following `sms` challenge factor:
    `{ "type": "sms", "id": "15488eb31d2aef258d59", "labels": [ "3774" ] }`

      1. The client will [start that challenge](#op-startIdentityChallenge).
      1. The system sends the one-time passcode such as `987303` via SMS text message to their phone ending in 3774.
      1. The user enters that one-time passcode `987303` in the client application.
      1. The client application submits the one-time passcode response and the corresponding challenge `id`
         (`15488eb31d2aef258d59`) and `factor` (`sms`) and `responses` using the
         [`verifyIdentityChallenge`](#op-verifyIdentityChallenge) operation.

    The `verifyIdentityChallenge` response includes a `result`. A result of `failed` means the verification failed. A result of `locked` means the user has failed too many verification attempts and the system has locked them out. The response also include an `allows` object which indicate if the user can submit new response, restart the factor (i.e. resend the one-time passcode), or try the operation again to get a new challenge.

    A result of `verified` means the user's response matched the expected response. A response with a verified result also includes a `challengeToken` value. The client must send this in the `Challenge` request header in addition to the `Authorization` header when retrying the operation.

    For example, if the result from verifying the response contains `{ ... "result": "verified", "challengeToken": "91a2a7724d6e82f5cd73", ... }` and their existing bearer token is `eyJraWQi...VVb1pH9bcBbg`, then the client should send the request headers:

      * `Authentication: Bearer eyJraWQi...VVb1pH9bcBbg`
      * `Challenge: 91a2a7724d6e82f5cd73`

    when retrying the operation.
  version: 0.7.1
  contact:
    name: Apiture
    url: https://developer.apiture.com/help/support/
    email: api@apiture.com
  termsOfService: https://developer.apiture.com/docs/Apiture-API-License-Agreement.pdf
  license:
    name: Apiture API License
    url: https://developer.apiture.com/docs/Apiture-API-License-Agreement.pdf
x-apiture-namespace: bankingChallenges
servers:
  - url: /banking
tags:
  - name: Challenges
    description: Challenges
paths:
  /startedChallenges:
    post:
      summary: Start an identity challenge
      description: |
        Start the identity challenge flow for the user's chosen factor. For `sms`, `voice`, and `email` challenges, this causes the system to send a four to six digit code to the user via SMS, automated voice phone call, or email. The factor passed in the request is marked as _active_ and eligible to be verified. The user should complete the challenge by submitting their response(s) to the challenge via the [`verifyIdentityChallenge`](#op-verifyIdentityChallenge) operation.
      operationId: startIdentityChallenge
      x-apiture-api: bankingChallenges
      x-apiture-group: challenges
      tags:
        - Challenges
      security:
        - accessToken:
            - challenges/write
      requestBody:
        required: true
        description: The data necessary to initiate an identity challenge flow.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/identityChallenge'
          application/restful+json:
            schema:
              $ref: '#/components/schemas/identityChallenge'
      responses:
        '200':
          description: OK. The identity challenge flow was started successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/startedIdentityChallenge'
            application/restful+json:
              schema:
                $ref: '#/components/schemas/startedIdentityChallenge'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          description: |
            Unprocessable Entity.

            This error response may have one of the following `type` values:
            * [`https://static.api.apiture.com/errors/invalidChallengeId/v1.0.0`](https://static.api.apiture.com/errors/invalidChallengeId/v1.0.0)<br>
              The provided `challengeId` is invalid, expired, already claimed, or does not match the `factor` or context.
              Remediation: Provide the corresponding `operationId`, `factor` and `id` from the challenge.

            * [`https://static.api.apiture.com/errors/invalidChallengeFactor/v1.0.0`](https://static.api.apiture.com/errors/invalidChallengeFactor/v1.0.0)<br>
              The `factor` in the request does not match available factors.
              Remediation: Use a `factor` that corresponds to the `challengeId` from the corresponding challenge.

            * [`https://static.api.apiture.com/errors/invalidChallengeOperationId/v1.0.0`](https://static.api.apiture.com/errors/invalidChallengeOperationId/v1.0.0)<br>
              The `operationId` is invalid.
              Remediation: Use the `operationId` from the corresponding challenge.

            * [`https://static.api.apiture.com/errors/challengeBlocked/v1.0.0`](https://static.api.apiture.com/errors/challengeBlocked/v1.0.0)<br>
              The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
              Remediation: Have the user end their login session and login again.
          x-apiture-errors:
            - invalidChallengeId
            - invalidChallengeFactor
            - invalidChallengeOperationId
            - $ref: '#/components/x-apiture-errors/challengeBlocked'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/problemResponse'
            application/problem+json:
              schema:
                $ref: '#/components/schemas/problemResponse'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: startIdentityChallenge
  /verifiedChallenges:
    post:
      summary: Verify an identity challenge
      description: Verify an active identity challenge for a specific factor. This verifies that the submitted data matches the expected response(s) for the chosen challenge factor. The factor must be active; that is, it must be the most recent factor used to start the identity challenge.
      operationId: verifyIdentityChallenge
      x-apiture-api: bankingChallenges
      tags:
        - Challenges
      x-apiture-group: challenges
      security:
        - accessToken:
            - challenges/write
      requestBody:
        required: true
        description: The data necessary to initiate the challenge flow.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/identityChallengeResponse'
          application/restful+json:
            schema:
              $ref: '#/components/schemas/identityChallengeResponse'
      responses:
        '200':
          description: OK. The challenge verification completed successfully. The response indicates if the request matched or not.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/verifiedIdentityChallenge'
            application/restful+json:
              schema:
                $ref: '#/components/schemas/verifiedIdentityChallenge'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          description: |
            Unprocessable Entity. The request was well formed but contains invalid data.

            This error response may have one of the following `type` values:
            * [`https://static.api.apiture.com/errors/invalidChallengeFactorState/v1.0.0`](https://static.api.apiture.com/errors/invalidChallengeFactorState/v1.0.0)<br>
              The selected challenge factor is not active.
              Remediation: Start the challenge factor to set it as active before verifying a user response.
          x-apiture-errors:
            - invalidChallengeFactorState
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/problemResponse'
            application/problem+json:
              schema:
                $ref: '#/components/schemas/problemResponse'
        '422':
          description: |
            Unprocessable Entity. The request was well formed but contains invalid data.

            This error response may have one of the following `type` values:
            * [`https://static.api.apiture.com/errors/invalidChallengeId/v1.0.0`](https://static.api.apiture.com/errors/invalidChallengeId/v1.0.0)<br>
              The provided `challengeId` is invalid, expired, already claimed, or does not match the `factor` or context.
              Remediation: Provide the corresponding `operationId`, `factor` and `id` from the challenge.

            * [`https://static.api.apiture.com/errors/invalidChallengeFactor/v1.0.0`](https://static.api.apiture.com/errors/invalidChallengeFactor/v1.0.0)<br>
              The `factor` in the request does not match available factors.
              Remediation: Use a `factor` that corresponds to the `challengeId` from the corresponding challenge.

            * [`https://static.api.apiture.com/errors/invalidChallengeOperationId/v1.0.0`](https://static.api.apiture.com/errors/invalidChallengeOperationId/v1.0.0)<br>
              The `operationId` is invalid.
              Remediation: Use the `operationId` from the corresponding challenge.

            * [`https://static.api.apiture.com/errors/wrongNumberOfResponses/v1.0.0`](https://static.api.apiture.com/errors/wrongNumberOfResponses/v1.0.0)<br>
              The challenge verification sent the wrong number of response strings.
              Remediation: Send only one response for one-time passcode challenges, or send exactly one response for each security question.

            * [`https://static.api.apiture.com/errors/challengeBlocked/v1.0.0`](https://static.api.apiture.com/errors/challengeBlocked/v1.0.0)<br>
              The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
              Remediation: Have the user end their login session and login again.
          x-apiture-errors:
            - invalidChallengeId
            - invalidChallengeFactor
            - invalidChallengeOperationId
            - wrongNumberOfResponses
            - $ref: '#/components/x-apiture-errors/challengeBlocked'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/problemResponse'
            application/problem+json:
              schema:
                $ref: '#/components/schemas/problemResponse'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: verifyIdentityChallenge
components:
  securitySchemes:
    accessToken:
      type: openIdConnect
      description: OpenId Connect (OIDC) authentication/authorization. The client uses the `authorization_endpoint` and `token_endpoint` to obtain an access token to pass in the `Authorization` header. Those endpoints are available via the OIDC Configuration URL. The actual URL may vary with each financial institution. See details at [Secure Access](https://dx.apiture.com/docs/api/concepts/api-keys/).
      openIdConnectUrl: https://auth.apiture.com/oidc/.well-known/openid-configuration
      x-resolved-from: ../../common/openapi.yaml#/components/securitySchemes/accessToken
  parameters:
    challengeHeaderParam:
      name: Challenge
      description: This operation may require a completed challenge. If the first attempt calling this operation fails with a 403 `challengeRequired` error, the client should complete the challenge flow as described in the Challenges API, then retry the operation with this `Challenge` request header using the `challengeToken` returned at the end of that flow. If this is passed but the value is invalid, the operation fails with a 403 status code and the `invalidIdentityChallengeHeader` problem type.
      in: header
      schema:
        $ref: '#/components/schemas/challengeToken'
    requiredChallengeHeaderParam:
      name: Challenge
      description: This operation requires a completed challenge. The client should complete the challenge flow as described in the Challenges API, then complete this operation with this `Challenge` request header using the `challengeToken` returned at the end of that flow. If this is passed but the value is invalid, the operation fails with a 403 status code and the `invalidIdentityChallengeHeader` problem type.
      in: header
      required: true
      schema:
        $ref: '#/components/schemas/challengeToken'
  schemas:
    challenge:
      x-apiture-version: 1.3.0
      title: Challenge (v1.3.0)
      description: |
        The challenge that is initiated by a service and to be completed by a user.
      type: object
      x-apiture-fragment: true
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - type: object
          required:
            - challengeId
            - factor
          properties:
            challengeId:
              description: The ID of the selected challenge. This is the `challengeId` from the corresponding challenge in the 403 problem response.
              $ref: '#/components/schemas/resourceId'
            factor:
              description: The type of challenge.
              $ref: '#/components/schemas/challengeFactorType'
            factorId:
              description: |-
                The ID of the user-selected factor from the challenge.

                *Note*: The `factorId` will become `required` in a future update to this schema.
              $ref: '#/components/schemas/challengeFactorId'
      example:
        operationId: createTransfer
        challengeId: b8cae0901002bba4e2a7
        factor: sms
        factorId: mobile-1
    identityChallenge:
      x-apiture-version: 1.3.0
      title: Identity Challenge (v1.3.0)
      description: An identity challenge to verify the banking customer is who they claim.
      allOf:
        - $ref: '#/components/schemas/challenge'
        - type: object
          required:
            - operationId
          properties:
            operationId:
              description: The context in which the user must complete the challenge.
              $ref: '#/components/schemas/challengeOperationId'
    startedIdentityChallenge:
      x-apiture-version: 1.4.0
      title: Started Challenge (v1.4.0)
      description: The server response after starting an identity challenge.
      type: object
      allOf:
        - $ref: '#/components/schemas/identityChallenge'
        - type: object
          required:
            - expiresAt
            - minimumResponseLength
            - maximumResponseLength
          properties:
            expiresAt:
              description: The timestamp when this challenge expires. The user must submit their challenge response before this time in order for it to be valid.
              $ref: '#/components/schemas/readOnlyTimestamp'
            minimumResponseLength:
              description: The minimum number of characters required for the response for this factor. For example, a one-time passcode might have a minimum of 6 characters but a `securityQuestions` response might have a minimum of 2 characters.
              type: integer
              format: int32
              minimum: 1
              maximum: 8
            maximumResponseLength:
              description: The maximum number of characters required for the response for this factor. For example, a `sms` one-time passcode might have a maximum of 8 characters but a `securityQuestions` response might have a maximum of 255 characters.
              type: integer
              format: int32
              minimum: 2
              maximum: 255
      example:
        operationId: createTransfer
        factor: sms
        challengeId: b8cae0901002bba4e2a7
        expiresAt: '2023-01-05T08:50:33.375Z'
        minimumResponseLength: 8
        maximumResponseLength: 8
    challengeResponseItem:
      x-apiture-version: 1.1.0
      title: Challenge Response Item (v1.1.0)
      description: A user's response to challenge.
      type: object
      required:
        - response
      properties:
        promptId:
          description: The unique ID of the prompt corresponding to this response. This property is only used if the challenge factor is `securityQuestions`.
          $ref: '#/components/schemas/challengePromptId'
        response:
          description: The response to the challenge, as entered by the user. The system ignores leading/trailing whitespace and ignores case when verifying the response. The actual minimum and maximum characters for the response are set by the `minimumResponseLength` and `maximumResponseLength` properties of the [`startedIdentityChallenge`](#schema-startedIdentityChallenge).
          type: string
          format: text
          maxLength: 255
      examples:
        - response: '939733'
        - promptId: q4
          response: Kinston High School
    challengeResponse:
      x-apiture-version: 1.4.0
      title: Challenge Response (v1.4.0)
      description: The user's response(s) to the challenge, submitted for verification against expected responses.
      x-apiture-fragment: true
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - type: object
          required:
            - factor
            - operationId
            - challengeId
            - responses
          properties:
            challengeId:
              description: The ID of the challenge. This is the `challengeId` from the corresponding challenge in the 403 problem response.
              $ref: '#/components/schemas/resourceId'
            factor:
              description: The type of challenge delivery factor, chosen from the `requiredIdentityChallenge` problem response.
              $ref: '#/components/schemas/challengeFactorType'
            factorId:
              description: |-
                The ID of the user-selected factor from the challenge.

                *Note*: The `factorId` will become `required` in a future update to this schema.
              $ref: '#/components/schemas/challengeFactorId'
            operationId:
              $ref: '#/components/schemas/challengeOperationId'
            responses:
              description: The text entered by the user in response to the challenge. This may be the code sent via SMS, email, or voice, or it may be the answers to the security questions.
              type: array
              uniqueItems: true
              minItems: 1
              maxItems: 8
              items:
                $ref: '#/components/schemas/challengeResponseItem'
      examples:
        - factor: securityQuestions
          operationId: createTransfer
          factorId: be6177eff07649128e40
          challengeId: dec42c64402319a59ec7
          responses:
            - promptId: q1
              response: Smith
            - promptId: q4
              response: Kinston High School
            - promptId: q9
              response: Walter
        - factor: sms
          operationId: createTransfer
          factorId: 9f6305571a38f8d584ac
          challengeId: dec42c64402319a59ec7
          responses:
            - response: '987303'
    identityChallengeResponse:
      x-apiture-version: 1.4.0
      title: Identity Challenge Response (v1.4.0)
      description: A banking customer response(s) to an identity challenge.
      allOf:
        - $ref: '#/components/schemas/challengeResponse'
    challengeResult:
      x-apiture-version: 1.1.0
      title: Challenge Result (v1.1.0)
      description: |+
        The result from verifying a user's response(s) to challenge.

        <strong><code>challengeResult</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>verified</code></strong></td><td>Verified: <p>The user&#39;s response was successfully verified</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>synchronizationRequired</code></strong></td><td>Synchronization Required: <p>The user should re-submit two recent, consecutive one-time passcodes from the authenticator token application or device to allow the system to synchronize with it</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>failed</code></strong></td><td>Failed: <p>The user&#39;s response failed validation</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>locked</code></strong></td><td>Locked: <p>The user failed the identity challenge too many times and has been locked out</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>expired</code></strong></td><td>Expired: <p>The corresponding identity challenge has expired</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: challengeResult
      enum:
        - verified
        - synchronizationRequired
        - failed
        - expired
        - locked
    challengeAllows:
      title: Challenge Allows (v1.0.0)
      description: Indicates what features of the challenge are allowed after verification has failed. **Note:** If a `retry`, `restart`, or `reverify` flag is omitted, the client can call those those operations, but they may fail with a `challengeBlocked` error.
      type: object
      properties:
        retry:
          description: If `true`, the user may retry the challenge by selecting any of the original challenge factors and starting/verifying that factor. If `false`, the client should not allow the user to retry identity verification by selecting one of the original challenge factors and starting/verifying it.
          type: boolean
        restart:
          description: If `true`, the client may [restart this challenge factor](#op-startIdentityChallenge). If `false`, the client should not [restart the challenge](#op-startIdentityChallenge).
          type: boolean
        reverify:
          description: If `true`, the user may enter a new response to the same challenge factor and the client invoke the [`verifyIdentityChallenge`](#op-verifyIdentityChallenge) after failing verification. For example, if the user typed a one-time passcode incorrectly, the user can enter and verify a new code. If `false`, the client should not allow the user to [enter and validate a new response to the same challenge factor](#op-verifyIdentityChallenge) after failing verification.
          type: boolean
      x-apiture-version: 1.0.0
    verifiedIdentityChallenge:
      x-apiture-version: 1.4.0
      title: Verified Challenge (v1.4.0)
      description: The response from verifying the challenge.
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - type: object
          required:
            - factor
            - challengeId
            - result
          properties:
            challengeId:
              description: The ID of the selected challenge. This is the `id` from the corresponding challenge in the 403 problem response.
              $ref: '#/components/schemas/resourceId'
            factor:
              description: The type of challenge.
              $ref: '#/components/schemas/challengeFactorType'
            factorId:
              description: |-
                The ID of the user-selected factor from the challenge.

                *Note*: The `factorId` will become `required` in a future update to this schema.
              $ref: '#/components/schemas/challengeFactorId'
            operationId:
              description: The ID of the API operation in which the user must complete the challenge, from the `requiredIdentityChallenge` problem response.
              $ref: '#/components/schemas/challengeOperationId'
            result:
              $ref: '#/components/schemas/challengeResult'
            allows:
              description: Indicates if the user may retry or restart the challenge or verification. This property exists if the `result` is `failed` or `expired`.
              $ref: '#/components/schemas/challengeAllows'
            challengeToken:
              description: The value that the client must send in the `Challenge` request header when retrying the operation that required a challenge. This property is not present if the result is `failed`.
              $ref: '#/components/schemas/challengeToken'
      examples:
        - challengeId: b8cae0901002bba4e2a7
          operationId: createTransfer
          factor: sms
          result: verified
          challengeToken: 91a2a7724d6e82f5cd73
        - challengeId: b8cae0901002bba4e2a7
          operationId: createTransfer
          factor: sms
          result: failed
          allows:
            retry: false
            restart: false
            reverify: true
    challengeToken:
      x-apiture-version: 1.1.0
      title: Challenge Token (v1.1.0)
      description: The value of the identity `Challenge` request header that the client must send when retrying an operation which required a challenge.
      type: string
      pattern: ^[-_:.~%$a-zA-Z0-9]{6,255}$
      minLength: 6
      maxLength: 255
    problemResponse:
      title: Problem Response (v0.4.1)
      x-apiture-version: 0.4.1
      description: API problem or error response, as per [RFC 9457 application/problem+json](https://tools.ietf.org/html/rfc9457).
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/apiProblem'
      example:
        id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
        type: https://static.api.apiture.com/errors/noSuchAccount/v1.0.0
        title: Account Not Found
        status: 422
        occurredAt: '2022-04-25T12:42:21.375Z'
        detail: No account exists for the given account reference
        instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/problemResponse
    abstractBody:
      title: Abstract Body (v0.2.0)
      x-apiture-version: 0.2.0
      description: An abstract schema used to define other request and response body model schemas.
      x-apiture-fragment: true
      type: object
      properties: {}
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/abstractBody
    resourceId:
      x-apiture-version: 1.0.1
      title: Resource Identifier (v1.0.1)
      description: The unique, opaque system identifier for a resource. This case-sensitive ID is also used as path parameters in URLs or in other properties or parameters that reference a resource by ID rather than URL.
      type: string
      pattern: ^[-_:.~$a-zA-Z0-9]{6,48}$
      minLength: 6
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/resourceId
    challengeFactorType:
      title: Challenge Factor Type (v1.0.0)
      description: |+
        The name of challenge factor.

        <strong><code>challengeFactorType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>sms</code></strong></td><td>SMS: <p>One-time passcode sent to the primary mobile phone number</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>email</code></strong></td><td>Email: <p>One-time passcode sent to the primary email address</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>voice</code></strong></td><td>Voice: <p>One-time passcode communicated via automated voice phone call</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>authenticatorToken</code></strong></td><td>authenticator Token: <p>One-time passcode issued by a pre-registered hardware device, such as a token key fob, or an authenticator app</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>securityQuestions</code></strong></td><td>Security Questions: <p>Prompt with the user&#39;s security questions registered with their security profile</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: challengeFactorType
      enum:
        - sms
        - email
        - voice
        - securityQuestions
        - authenticatorToken
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactorType
      x-apiture-version: 1.0.0
    challengeFactorId:
      title: Challenge Factor ID (v1.0.0)
      description: The ID of an a challenge factor. This ID is unique within the factors offered with a challenge.
      type: string
      pattern: ^[-a-zA-Z0-9$_]{3,48}$
      minLength: 3
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactorId
      x-apiture-version: 1.0.0
    challengeOperationId:
      x-apiture-version: 1.0.1
      title: Challenge Operation ID (v1.0.1)
      description: The ID of an operation/action for which the user must verify their identity via an identity challenge. This is passed when starting a challenge factor or when validating the identity challenge responses.
      type: string
      pattern: ^[-a-zA-Z0-9$_]{6,48}$
      minLength: 6
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeOperationId
    readOnlyTimestamp:
      title: Read-Only Timestamp (v1.0.0)
      description: 'A readonly or derived timestamp (an instant in time) formatted in [RFC 3339](https://tools.ietf.org/html/rfc3339) `date-time` UTC format: `YYYY-MM-DDThh:mm:ss.sssZ`.'
      type: string
      minLength: 20
      maxLength: 30
      format: date-time
      readOnly: true
      example: '2021-10-30T19:06:04.250Z'
      x-apiture-since: 0.4.0
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/readOnlyTimestamp
      x-apiture-version: 1.0.0
    challengePromptId:
      title: Challenge Prompt ID (v1.0.0)
      description: The unique ID of a prompt (such as a security question) in a challenge factor.
      type: string
      pattern: ^[-_:.~$a-zA-Z0-9]+$
      minLength: 1
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengePromptId
      x-apiture-version: 1.0.0
    apiProblem:
      x-apiture-version: 1.2.1
      title: API Problem (v1.2.1)
      description: API problem or error, as per [RFC 7807 application/problem+json](https://tools.ietf.org/html/rfc7807).
      type: object
      properties:
        type:
          type: string
          format: uri-reference
          description: |
            A [URI reference (RFC3986)](https://tools.ietf.org/html/rfc3986) that identifies the problem type. If present, this is the URL of human-readable HTML documentation for the problem type. When this member is not present, its value is assumed to be `"about:blank"`.
          example: https://static.api.apiture.com/errors/forbidden/v1.0.0
          maxLength: 2048
        title:
          type: string
          description: |
            A short, human-readable summary of the problem type. The title is usually the same for all problem with the same `type`.
          maxLength: 120
          format: text
          example: User is not authorized to perform the requested action or access the requested resource.
        status:
          type: integer
          format: int32
          description: |
            The [HTTP status code](https://datatracker.ietf.org/doc/html/rfc7231#section-6) for this occurrence of the problem.
          minimum: 100
          maximum: 599
          example: 403
        detail:
          type: string
          description: |
            A human-readable explanation specific to this occurrence of the problem.
          maxLength: 256
          format: text
          example: User is not authorized to perform this operation.
        instance:
          type: string
          format: uri-reference
          description: |
            A URI reference that identifies the specific occurrence of the problem. This is the URI of an API resource that the problem is related to, with a unique error correlation ID URI fragment
          example: https://prduction.api.apiture.com/banking/accounts/ad80fc3e722q5402a#189c13ff-c54c-45f7-b8e0-c88984ba724d
          maxLength: 2048
        id:
          description: The unique identifier for this problem. This is an immutable opaque string.
          $ref: '#/components/schemas/readOnlyResourceId'
        occurredAt:
          description: The timestamp when the problem occurred, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC.
          $ref: '#/components/schemas/readOnlyTimestamp'
        problems:
          description: Optional root-causes if there are multiple problems in the request or API call processing.
          type: array
          maxItems: 128
          items:
            $ref: '#/components/schemas/apiProblem'
        attributes:
          type: object
          description: Additional optional attributes related to the problem. This data conforms to the schema associated with the error type.
      example:
        id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
        type: https://static.api.apiture.com/errors/accountNotFound/v1.0.0
        title: Account Not Found
        status: 422
        occurredAt: '2022-04-25T12:42:21.375Z'
        detail: No account exists at the given account_url
        instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/apiProblem
    readOnlyResourceId:
      x-apiture-version: 1.0.1
      title: Read-only Resource Identifier (v1.0.1)
      description: The unique, opaque system-assigned identifier for a resource. This case-sensitive ID is also used in URLs as path parameters or in other properties or parameters that reference a resource by ID rather than URL. Resource IDs are immutable.
      readOnly: true
      allOf:
        - $ref: '#/components/schemas/resourceId'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/readOnlyResourceId
    requiredIdentityChallenge:
      x-apiture-version: 1.2.3
      title: Required Challenge (v1.2.3)
      description: A request from the service for the user to verify their identity. This contains a challenge ID, the corresponding operation ID, and a list of challenge factors for identity verification. The user must complete one of these challenge factors to satisfy the challenge. This schema defines the attributes in the 401 [Unauthorized problem response](#schema-apiProblem) when the 401 problem type name is `challengeRequired`. See the "Challenge API" for details.
      type: object
      required:
        - operationId
        - challengeId
        - factors
      properties:
        operationId:
          $ref: '#/components/schemas/challengeOperationId'
        challengeId:
          description: The unique ID of this challenge instance. This is an opaque string. This is passed when starting a challenge factor or when validating the identity challenge responses.
          $ref: '#/components/schemas/readOnlyResourceId'
        factors:
          description: 'A list of challenge factors. The user must complete one of these challenge factors. The `labels` in each factor identify one or more channels the user may use, such as a list of email addresses the system may use to send a one-time passcode to the user. ***Note**: The same channel may be used by multiple factors in the array of factors. For example, the user''s primary mobile phone number may be used for both an `sms` factor and a `voice` factor.'
          type: array
          minItems: 1
          maxItems: 8
          items:
            $ref: '#/components/schemas/challengeFactor'
      example:
        operationId: createTransfer
        challengeId: 0504076c566a3cf7009c
        factors:
          - type: sms
            labels:
              - '9876'
            id: 85c0ee5753fcd0b0953f
          - type: voice
            labels:
              - '9876'
            id: d089e10a80a8627df37b
          - type: voice
            labels:
              - '6754'
            id: 10506ecf9d1c2ee00403
          - type: email
            labels:
              - an****nk@example.com
              - an****98@example.com
            id: e917d671cb2f030b56f1
          - type: authenticatorToken
            labels:
              - Acme fob
            id: fe6c452d7da0bbb4e407
          - type: securityQuestions
            securityQuestions:
              questions:
                - id: q1
                  prompt: What is your mother's maiden name?
                - id: q4
                  prompt: What is your high school's name?
                - id: q9
                  prompt: What is the name of your first pet?
            id: df33c6f88a37d6b3f0a6
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/requiredIdentityChallenge
    challengeFactor:
      x-apiture-version: 1.2.1
      title: Challenge Factor (v1.2.1)
      description: A challenge factor. See [`requiredIdentityChallenge`](#schema-requiredIdentityChallenge) for multiple examples.
      type: object
      required:
        - type
      properties:
        id:
          description: |-
            The ID of an a challenge factor. This ID is unique within the challenge factors associated with a challenge. The client should pass this `id` value as the `factorId` when starting or verifying a challenge factor.

            *Note*: The `id` will become `required` in a future update to this schema.
          $ref: '#/components/schemas/challengeFactorId'
        type:
          $ref: '#/components/schemas/challengeFactorType'
        labels:
          description: A list of text label which identifies the channel(s) through which the user completes the challenge. For an `sms` or `voice` challenge, the only label item is the last four digits of the corresponding phone number. For an `email` challenge, each label is the masked email address.
          type: array
          minItems: 1
          maxItems: 4
          items:
            type: string
            maxLength: 300
            format: text
        securityQuestions:
          $ref: '#/components/schemas/challengeSecurityQuestions'
      example:
        type: sms
        labels:
          - '9876'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactor
    challengeSecurityQuestions:
      x-apiture-version: 1.0.1
      title: Challenge Security Questions (v1.0.1)
      description: Describes a `securityQuestions` challenge. This is omitted if the challenge `type` is not `securityQuestions`.
      type: object
      required:
        - questions
      properties:
        questions:
          description: The array of security questions.
          type: array
          minItems: 1
          maxItems: 8
          items:
            $ref: '#/components/schemas/challengeSecurityQuestion'
      example:
        questions:
          - id: q1
            prompt: What is your mother's maiden name?
          - id: q4
            prompt: What is your high school's name?
          - id: q9
            prompt: What is the name of your first pet?
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeSecurityQuestions
    challengeSecurityQuestion:
      x-apiture-version: 1.0.1
      title: Challenge Security Question (v1.0.1)
      description: A single security question within the `questions` array of the [`challengeSecurityQuestions`](#schema-challengeSecurityQuestions)
      type: object
      required:
        - id
        - prompt
      properties:
        id:
          description: The unique ID of security question prompt. This should be included in the [`challengeVerification`](#schema-challengeVerification) response as the `promptId`.
          $ref: '#/components/schemas/challengePromptId'
        prompt:
          description: The text prompt of this security question.
          type: string
          format: text
          maxLength: 80
      example:
        id: 74699fa628911e762ea5
        prompt: What is your mother's maiden name?
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeSecurityQuestion
  x-apiture-errors:
    invalidChallengeId:
      description: The provided `challengeId` is invalid, expired, already claimed, or does not match the `factor` or context.
      remediation: Provide the corresponding `operationId`, `factor` and `id` from the challenge.
    invalidChallengeFactorState:
      description: The selected challenge factor is not active.
      remediation: Start the challenge factor to set it as active before verifying a user response.
    invalidChallengeOperationId:
      description: The `operationId` is invalid.
      remediation: Use the `operationId` from the corresponding challenge.
    invalidChallengeFactor:
      description: The `factor` in the request does not match available factors.
      remediation: Use a `factor` that corresponds to the `challengeId` from the corresponding challenge.
    wrongNumberOfResponses:
      description: The challenge verification sent the wrong number of response strings.
      remediation: Send only one response for one-time passcode challenges, or send exactly one response for each security question.
    challengeBlocked:
      description: The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
      remediation: Have the user end their login session and login again.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/challengeBlocked
    badRequest:
      description: The request body and/or parameters was not well-formed.
      remediation: Correct any syntax or schema errors in the request body or parameters.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/badRequest
    unauthorized:
      description: The request lacks valid authentication credentials for the target resource or operation.
      remediation: Authenticate the user and pass the required authorization with the request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/unauthorized
    forbidden:
      description: The user or agent is not allowed to perform this operation; authentication credentials were provided in the request, but the server considers them insufficient to grant access.
      remediation: Check the user's permissions and entitlements before attempting the operation.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/forbidden
    customerDisabled:
      description: The customer is disabled.
      remediation: Have the customer contact the financial institution for support.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/customerDisabled
    antiMalwareRequired:
      description: The financial institution requires the customer to have anti-malware software installed.
      remediation: Direct the user to the software requirements guide to install the correct anti-malware software.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/antiMalwareRequired
    modificationForbidden:
      description: The customer is properly authenticated but not authorized to create, modify, or delete resources.
      remediation: Avoid modification operation for customers with read-only authorization.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/modificationForbidden
    challengeRequired:
      description: The operation requires the customer to complete an identity challenge.
      remediation: Complete the challenge as per the problem response, and add an additional `Challenge` header to the call.
      attributes:
        $ref: '#/components/schemas/requiredIdentityChallenge'
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/challengeRequired
    noIdentityChallengeFactors:
      description: This operation requires an identity challenge, but the user does not have the necessary registered authentication factors.
      remediation: Have the user register one or more challenge security code delivery factors.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/noIdentityChallengeFactors
    invalidIdentityChallengeHeader:
      description: The additional on-time `Challenge` header in this request is expired, already used, or otherwise invalid.
      remediation: Supply a valid, unexpired, unclaimed `Challenge` header in the request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/invalidIdentityChallengeHeader
    tooManyRequests:
      description: The client has sent too many requests in a given amount of time, exceeding rate limiting.
      remediation: Slow down the rate of API calls.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/tooManyRequests
  responses:
    '400':
      description: |
        Bad Request. The request body, request headers, and/or query parameters are not well-formed.

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/badRequest/v1.0.0`](https://static.api.apiture.com/errors/badRequest/v1.0.0)<br>
          The request body and/or parameters was not well-formed.
          Remediation: Correct any syntax or schema errors in the request body or parameters.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/badRequest'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/badRequest/v1.0.0
              title: Bad Request
              status: 400
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: Input did not parse as JSON
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/badRequest/v1.0.0
              title: Bad Request
              status: 400
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: Input did not parse as JSON
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/400
    '401':
      description: |
        Unauthorized. The operation requires authentication but no authentication or insufficient authentication was given.

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/unauthorized/v1.0.0`](https://static.api.apiture.com/errors/unauthorized/v1.0.0)<br>
          The request lacks valid authentication credentials for the target resource or operation.
          Remediation: Authenticate the user and pass the required authorization with the request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/unauthorized'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unauthorized/v1.0.0
              title: Unauthorized
              status: 401
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request lacks valid authentication credentials
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unauthorized/v1.0.0
              title: Unauthorized
              status: 401
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request lacks valid authentication credentials
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/401
    '403':
      description: |
        Forbidden. The authenticated caller is not authorized to perform the requested operation.

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/forbidden/v1.0.0`](https://static.api.apiture.com/errors/forbidden/v1.0.0)<br>
          The user or agent is not allowed to perform this operation; authentication credentials were provided in the request, but the server considers them insufficient to grant access.
          Remediation: Check the user's permissions and entitlements before attempting the operation.

        * [`https://static.api.apiture.com/errors/customerDisabled/v1.0.0`](https://static.api.apiture.com/errors/customerDisabled/v1.0.0)<br>
          The customer is disabled.
          Remediation: Have the customer contact the financial institution for support.

        * [`https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0`](https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0)<br>
          The financial institution requires the customer to have anti-malware software installed.
          Remediation: Direct the user to the software requirements guide to install the correct anti-malware software.

        * [`https://static.api.apiture.com/errors/modificationForbidden/v1.0.0`](https://static.api.apiture.com/errors/modificationForbidden/v1.0.0)<br>
          The customer is properly authenticated but not authorized to create, modify, or delete resources.
          Remediation: Avoid modification operation for customers with read-only authorization.

        * [`https://static.api.apiture.com/errors/challengeRequired/v1.0.0`](https://static.api.apiture.com/errors/challengeRequired/v1.0.0)<br>
          The operation requires the customer to complete an identity challenge.
          Remediation: Complete the challenge as per the problem response, and add an additional `Challenge` header to the call.
        The `attributes` object in the error may have the properties defined by the [`requiredIdentityChallenge` schema](#schema-requiredIdentityChallenge).
        * [`https://static.api.apiture.com/errors/challengeBlocked/v1.0.0`](https://static.api.apiture.com/errors/challengeBlocked/v1.0.0)<br>
          The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
          Remediation: Have the user end their login session and login again.

        * [`https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0`](https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0)<br>
          This operation requires an identity challenge, but the user does not have the necessary registered authentication factors.
          Remediation: Have the user register one or more challenge security code delivery factors.

        * [`https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0`](https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0)<br>
          The additional on-time `Challenge` header in this request is expired, already used, or otherwise invalid.
          Remediation: Supply a valid, unexpired, unclaimed `Challenge` header in the request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/forbidden'
        - $ref: '#/components/x-apiture-errors/customerDisabled'
        - $ref: '#/components/x-apiture-errors/antiMalwareRequired'
        - $ref: '#/components/x-apiture-errors/modificationForbidden'
        - $ref: '#/components/x-apiture-errors/challengeRequired'
        - $ref: '#/components/x-apiture-errors/challengeBlocked'
        - $ref: '#/components/x-apiture-errors/noIdentityChallengeFactors'
        - $ref: '#/components/x-apiture-errors/invalidIdentityChallengeHeader'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/forbidden/v1.0.0
              title: Forbidden
              status: 403
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request has valid authentication, but the authenticated agent is forbidden from accessing this resource or operation
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/forbidden/v1.0.0
              title: Forbidden
              status: 403
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request has valid authentication, but the authenticated agent is forbidden from accessing this resource or operation
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/403
    '429':
      description: |
        Too Many Requests. The client has sent too many requests in a given amount of time.

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/tooManyRequests/v1.0.0`](https://static.api.apiture.com/errors/tooManyRequests/v1.0.0)<br>
          The client has sent too many requests in a given amount of time, exceeding rate limiting.
          Remediation: Slow down the rate of API calls.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/tooManyRequests'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/tooManyRequests/v1.0.0
              title: Too Many Requests
              status: 429
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The user has sent too many requests in a given amount of time.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/tooManyRequests/v1.0.0
              title: Too Many Requests
              status: 429
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The user has sent too many requests in a given amount of time.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/429
    4XX:
      description: Client Request Problem. The client request had a problem not listed under another specific 400-level HTTP response code. View the `detail` in the problem response for additional details.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/methodNotAllowed/v1.0.0
              title: Method Not Allowed
              status: 405
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: This HTTP method is not allowed for the given resource URL.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/methodNotAllowed/v1.0.0
              title: Method Not Allowed
              status: 405
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: This HTTP method is not allowed for the given resource URL.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/4XX
    5XX:
      description: Server Problem. The server encountered a problem not listed under another specific 500-level HTTP response code. View the `detail` in the problem response for additional details.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/gatewayTimeout/v1.0.0
              title: Insufficient Storage
              status: 507
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The server is unable to store the representation needed to successfully complete the request.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/gatewayTimeout/v1.0.0
              title: Insufficient Storage
              status: 507
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The server is unable to store the representation needed to successfully complete the request.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/5XX
x-resolved-from: ../../challenges/status-codes-openapi.yaml
x-resolved-at: '2024-10-01T15:36:27.317Z'
x-apiture-annotated-at: '2024-10-01T15:36:27.535Z'
