openapi: 3.1.0
info:
  title: Webhook Clients
  description: |-
    This API provides developer self-service of webhook clients. A webhook client is a web service with an authenticated URL where Apiture Digital Banking (ADB) sends digital banking event messages via HTTP `POST`. See the Events Administration for a catalog of event categories and event types.

    The primary consumer of this internal API is the Apiture Developer Portal.

    This API supports the following partner self-service operations for Dev Portal users (using `accessToken` security):

      * [List the partner's webhook clients](#op-listWebhookClients).
      * [Create a new webhook client application](#op-createWebhookClient) - register a new webhook client.
      * [Submit a webhook client](#op-submitWebhookClient) -
        Submit for review, approval, and activation.
      * [Suspend a webhook client](#op-suspendWebhookClient) - Stop sending messages, but leave webhook in the system.
      * [Resume a webhook client](#op-resumeWebhookClient) - Resume sending messages to a suspended webhook.
      * [Patch a webhook](#op-patchWebhookClient) - change the description or authentication.
      * [Replace a webhook](#op-replaceWebhookClient) - change the webhook URL.
        This is done by _replacing_ a source webhook client with another webhook client resource
        derived from the source, but with new values.
        * This process also requires administrator review/approval of the replacement.
        * When an administrator approves the replacement, the system deactivates the source
        webhook client and activates the new one.
      * [Invite webhook client owners](#op-inviteWebhookClientOwners) - invite and add
        other owners at the institution. Only owners may modify webhook clients.
      * [Delete](#op-deleteWebhookClient) - delete a `suspended` or `inactive` webhook client.

    See also the Webhook Clients administrator API for Dev Portal Administrators
  version: 0.2.0
  contact:
    name: Apiture
    url: https://developer.apiture.com/help/support/
    email: api@apiture.com
  termsOfService: https://developer.apiture.com/docs/Apiture-API-License-Agreement.pdf
  license:
    name: Apiture API License
    url: https://developer.apiture.com/docs/Apiture-API-License-Agreement.pdf
x-apiture-namespace: devWebhookClients
x-apiture-package-name: dev-webhook-clients
servers:
  - url: /dev
tags:
  - name: Webhook Clients
    description: Webhook Client Management
  - name: Webhook Client Actions
    description: Actions related to Webhook Clients
paths:
  /webhookCategories:
    get:
      summary: List Webhook categories
      description: Return a list of webhook event categories that may be used in the `categories` list of a webhook client.
      operationId: listWebhookCategories
      x-apiture-api: devWebhookClients
      tags:
        - Webhook Clients
      x-apiture-group: webhookClients
      security:
        - accessToken:
            - data/read
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhookCategories'
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookCategories'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: listWebhookCategories
  /webhookClients:
    get:
      summary: Fetch the list of a partner's existing webhook clients
      description: Fetch the list of existing webhook clients.
      operationId: listWebhookClients
      x-apiture-api: devWebhookClients
      tags:
        - Webhook Clients
      x-apiture-group: webhookClients
      security:
        - accessToken:
            - data/read
      parameters:
        - name: institution
          description: Include in the list only webhook clients which listen to events from the financial institution whose institution ID matches this string.
          in: query
          schema:
            $ref: '#/components/schemas/institutionId'
        - name: environment
          description: Include in the list only webhook clients which listen to events from the API environments whose environments ID matches this string.
          in: query
          schema:
            $ref: '#/components/schemas/resourceId'
        - $ref: '#/components/parameters/startQueryParam'
        - $ref: '#/components/parameters/limitQueryParam'
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhookClients'
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookClients'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: listWebhookClients
    post:
      summary: Create New Webhook Client
      description: Create a new webhook client.
      operationId: createWebhookClient
      x-apiture-api: devWebhookClients
      tags:
        - Webhook Clients
      x-apiture-group: webhookClients
      security:
        - accessToken:
            - data/write
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/newWebhookClient'
          application/vnd.restful+json:
            schema:
              $ref: '#/components/schemas/newWebhookClient'
      responses:
        '201':
          description: Created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhookClient'
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookClient'
          headers:
            Location:
              description: The URI of the new webhook client.
              schema:
                type: string
                format: uri-reference
                maxLength: 400
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          $ref: '#/components/responses/422webhookClient'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: createWebhookClient
  /webhookClients/{webhookClientId}:
    parameters:
      - $ref: '#/components/parameters/webhookClientIdPathParam'
    get:
      summary: Get a Webhook Client
      description: Return the JSON representation of webhook client.
      operationId: getWebhookClient
      x-apiture-api: devWebhookClients
      tags:
        - Webhook Clients
      x-apiture-group: webhookClients
      security:
        - accessToken:
            - data/read
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhookClient'
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookClient'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: getWebhookClient
    patch:
      operationId: patchWebhookClient
      x-apiture-api: devWebhookClients
      summary: Patch Webhook Client
      description: Patch (update) mutable properties of the webhook client as per [JSON Merge Patch](https://datatracker.ietf.org/doc/html/rfc7396) format and processing rules. Only fields in the request body are updated on the resource; fields which are omitted are not updated.
      tags:
        - Webhook Clients
      x-apiture-group: webhookClients
      requestBody:
        required: true
        description: The patch to apply to this webhook client.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/webhookClientPatch'
      responses:
        '200':
          description: OK. The service updated the webhook client. The updated webhook client is returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhookClient'
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookClient'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '422':
          $ref: '#/components/responses/422webhookClient'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      security:
        - accessToken:
            - data/write
      x-apiture-permission: patchWebhookClient
    delete:
      operationId: deleteWebhookClient
      x-apiture-api: devWebhookClients
      summary: Delete Webhook Client
      description: Delete the webhook client. Deletion is not allowed if the webhook state is `active`. ([Suspend](#op-suspendWebhookClient) active webhook clients before attempting to delete them.)
      tags:
        - Webhook Clients
      x-apiture-group: webhookClients
      responses:
        '204':
          description: No content.
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          description: |
            Conflict. The request conflicts with the state of the application.

            This problem response may have one of the following `type` values:
            * [`https://static.api.apiture.com/errors/conflict/v1.0.0`](https://static.api.apiture.com/errors/conflict/v1.0.0)<br>
              The request could not be completed due to a conflict with the current state of the target resource.
              Remediation: Try another operation that is allowed.

            * [`https://static.api.apiture.com/errors/invalidStateForDelete/v1.0.0`](https://static.api.apiture.com/errors/invalidStateForDelete/v1.0.0)<br>
              The webhook client cannot be deleted when in the current state.
              Remediation: The webhook client state must be one of `inactive`, `suspended` or `rejected`.
          x-apiture-errors:
            - $ref: '#/components/x-apiture-errors/conflict'
            - invalidStateForDelete
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/problemResponse'
            application/json:
              schema:
                $ref: '#/components/schemas/problemResponse'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      security:
        - accessToken:
            - data/write
      x-apiture-permission: deleteWebhookClient
  /webhookClients/{webhookClientId}/replacement:
    parameters:
      - $ref: '#/components/parameters/webhookClientIdPathParam'
    post:
      summary: Replace this webhook client with a revised webhook client.
      operationId: replaceWebhookClient
      x-apiture-api: devWebhookClients
      x-apiture-group: webhookClients
      description: |-
        Key account identifying attributes of a webhook client are not mutable; [`patchWebhookClient`](#op-patchWebhookClient) only allows changing the `description` and authentication. Instead of mutating a webhook client, this operation _replaces_ a webhook client with a revised instance based on properties in the request body. The replacement is a 1-to-1 copy of the source webhook client and its nested objects, with properties provided in the request body replacing corresponding properties in the source webhook client as per [JSON Merge Patch (RFC 7386)](https://datatracker.ietf.org/doc/html/rfc7386) semantics. The replacement webhook client is assigned a new unique `id`.

        *Note*: When the replacement webhook client is activated, the source webhook client is marked as `inactive`. The webhook client owner should then [delete](#op-deleteWebhookClient) it.
      tags:
        - Webhook Client Actions
      security:
        - accessToken:
            - data/write
      requestBody:
        required: true
        description: The patch to apply to this webhook client.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/webhookClientReplacement'
      responses:
        '201':
          description: Created. A replacement webhook client was created. The replacement webhook client is returned in the response body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhookClient'
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookClient'
          headers:
            Location:
              description: The URI of the new (replacement) webhook client.
              schema:
                type: string
                format: uri-reference
                maxLength: 2048
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409webhookClient'
        '422':
          $ref: '#/components/responses/422webhookClient'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: replaceWebhookClient
  /webhookClients/{webhookClientId}/suspended:
    parameters:
      - $ref: '#/components/parameters/webhookClientIdPathParam'
    post:
      summary: Suspend the webhook
      description: |-
        Suspend the webhook. The system will stop sending messages to the webhook URL. This sets the `state` of the webhook client to `suspended`. This can be reversed by the [`resumeWebhookClient`](#op-resumeWebhookClient) operation for self-service management for webhook client owners.

        This operation is idempotent and has no effect if the webhook client's `state` is `suspended`.

        This operation is not allowed unless the state is `suspended` or `active`.
      operationId: suspendWebhookClient
      x-apiture-api: devWebhookClients
      tags:
        - Webhook Client Actions
      x-apiture-group: webhookClientsAdministration
      security:
        - accessToken:
            - data/write
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhookClient'
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookClient'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409webhookClient'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: suspendWebhookClient
  /webhookClients/{webhookClientId}/resumed:
    parameters:
      - $ref: '#/components/parameters/webhookClientIdPathParam'
    post:
      summary: Resume the webhook
      description: |-
        Resume sending event messages to a suspended webhook. This sets the `state` of the webhook client to `active`.

        This operation is idempotent and has no effect if the webhook client's `state` is `active`.

        This operation is not allowed unless the state is `suspended` or `active`.
      operationId: resumeWebhookClient
      x-apiture-api: devWebhookClients
      tags:
        - Webhook Client Actions
      x-apiture-group: webhookClientActions
      security:
        - accessToken:
            - data/write
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhookClient'
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookClient'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409webhookClient'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: resumeWebhookClient
  /webhookClients/{webhookClientId}/submitted:
    parameters:
      - $ref: '#/components/parameters/webhookClientIdPathParam'
    post:
      summary: Submit the webhook
      description: Submit the webhook client for review, approval, and activation. This is only allowed for `inactive` or `submitted` webhook clients.
      operationId: submitWebhookClient
      x-apiture-api: devWebhookClients
      tags:
        - Webhook Client Actions
      x-apiture-group: webhookClientActions
      security:
        - accessToken:
            - data/write
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhookClient'
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookClient'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409webhookClient'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: submitWebhookClient
  /webhookClients/{webhookClientId}/jointOwnerInvitations:
    parameters:
      - $ref: '#/components/parameters/webhookClientIdPathParam'
    post:
      summary: Invite Webhook Client joint owners
      description: |-
        Invite joint owners to this webhook client. This operation adds the owner by their email address, and sends them an invitation email. The recipients must register on the Apture Developer Portal with the same email address as in the invitation.

        This API does not track which people it has sent invitations to; it unconditionally emails each invitee even if they have been invited in the past or already appear in the list of owners. Only owners may view/modify the client ID/secret or suspend/resume or modify/remove the webhook client.
      operationId: inviteWebhookClientOwners
      x-apiture-api: devWebhookClients
      x-apiture-group: webhookClients
      tags:
        - Webhook Clients
      security:
        - accessToken:
            - data/write
      requestBody:
        content:
          application/vnd.restful+json:
            schema:
              $ref: '#/components/schemas/newWebhookClientOwnerInvitation'
          application/json:
            schema:
              $ref: '#/components/schemas/newWebhookClientOwnerInvitation'
        description: The data necessary to create a new joint owner invitation.
        required: true
      responses:
        '202':
          description: Accepted.
          content:
            application/vnd.restful+json:
              schema:
                $ref: '#/components/schemas/webhookClientOwnerInvitation'
            application/json:
              schema:
                $ref: '#/components/schemas/webhookClientOwnerInvitation'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          description: |
            Unprocessable Entity.

            This problem response may have one of the following `type` values:
            * [`https://static.api.apiture.com/errors/unprocessableEntity/v1.0.0`](https://static.api.apiture.com/errors/unprocessableEntity/v1.0.0)<br>
              The syntax of the request entity is correct but was unable to process the contained instructions.
              Remediation: Provide a semantically correct request.

            * [`https://static.api.apiture.com/errors/invalidOwnerDomain/v1.0.0`](https://static.api.apiture.com/errors/invalidOwnerDomain/v1.0.0)<br>
              The email domain of the invitee does not match the partner/owner of this webhook client.
              Remediation: Invite owners via email addresses with the same email domain.
          x-apiture-errors:
            - $ref: '#/components/x-apiture-errors/unprocessableEntity'
            - invalidOwnerDomain
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/problemResponse'
            application/json:
              schema:
                $ref: '#/components/schemas/problemResponse'
        '409':
          description: |
            Conflict.

            This problem response may have one of the following `type` values:
            * [`https://static.api.apiture.com/errors/conflict/v1.0.0`](https://static.api.apiture.com/errors/conflict/v1.0.0)<br>
              The request could not be completed due to a conflict with the current state of the target resource.
              Remediation: Try another operation that is allowed.

            * [`https://static.api.apiture.com/errors/tooManyOwners/v1.0.0`](https://static.api.apiture.com/errors/tooManyOwners/v1.0.0)<br>
              The webhook client has the maximum number of owners.
              Remediation: Remove another owner before adding more owners.
          x-apiture-errors:
            - $ref: '#/components/x-apiture-errors/conflict'
            - tooManyOwners
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/problemResponse'
            application/json:
              schema:
                $ref: '#/components/schemas/problemResponse'
        '422':
          description: |
            Unprocessable Entity

            This problem response may have one of the following `type` values:
            * [`https://static.api.apiture.com/errors/unprocessableEntity/v1.0.0`](https://static.api.apiture.com/errors/unprocessableEntity/v1.0.0)<br>
              The syntax of the request entity is correct but was unable to process the contained instructions.
              Remediation: Provide a semantically correct request.

            * [`https://static.api.apiture.com/errors/invalidOwnerEmailDomain/v1.0.0`](https://static.api.apiture.com/errors/invalidOwnerEmailDomain/v1.0.0)<br>
              The email address in an owner invitation does not match the webhook client's partner domain.
              Remediation: Owner email addresses must match the webhook client's partner domain.
          x-apiture-errors:
            - $ref: '#/components/x-apiture-errors/unprocessableEntity'
            - invalidOwnerEmailDomain
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/problemResponse'
            application/json:
              schema:
                $ref: '#/components/schemas/problemResponse'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      x-apiture-permission: inviteWebhookClientOwners
components:
  parameters:
    webhookClientIdPathParam:
      name: webhookClientId
      description: The `id` of the webhook client instance.
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/webhookClientId'
    startQueryParam:
      name: start
      in: query
      description: The location of the next item in the collection. This is an opaque cursor supplied by the API service. Omit this to start at the beginning of the collection. The client does not define this value; the API services automatically pass the `?start=` parameter on the `nextPage_url`.
      schema:
        type: string
        maxLength: 256
        pattern: ^[-a-zA-Z0-9.,-=_+:;@$]{0,256}$
        default: ''
      x-resolved-from: ../../common/openapi.yaml#/components/parameters/startQueryParam
    limitQueryParam:
      name: limit
      in: query
      description: The maximum number of items to return in this paged response.
      schema:
        type: integer
        format: int32
        minimum: 0
        maximum: 1000
        default: 100
      x-resolved-from: ../../common/openapi.yaml#/components/parameters/limitQueryParam
  schemas:
    newWebhookClientOwnerInvitation:
      title: New Webhook Client Owner Invitation (v1.0.0)
      description: An invitation to invite another person to be an owner of the webhook client.
      required:
        - message
        - invitees
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/webhookClientOwnerInvitationFields'
      example:
        message: I have invited you to be co-owners of the Apiture POC webhook client.
        invitees:
          - firstName: John
            lastName: Smith
            emailAddress: john.smith@example.com
      x-apiture-version: 1.0.0
    webhookClientOwnerInvitation:
      title: Webhook Client Owner Invitation (v1.0.0)
      description: An invitation to invite another person to be an owner of the webhook client.
      required:
        - message
        - invitees
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/webhookClientOwnerInvitationFields'
      example:
        message: I have invited you to be co-owners of the Apiture POC webhook client.
        invitees:
          - firstName: John
            lastName: Smith
            emailAddress: john.smith@example.com
      x-apiture-version: 1.0.0
    webhookClientOwnerInvitationFields:
      title: Webhook Client Owner Invitation Fields (v1.0.0)
      description: Fields of an Invitation to add a new webhook client owner. This is fragment schema, used to construct other schemas.
      x-apiture-fragment: true
      type: object
      properties:
        message:
          description: The body of the message from the webhook owner to the invitees. The message is Markdown which can be formatted with rich text.
          type: string
          format: markdown
          minLength: 16
          maxLength: 512
        invitees:
          description: The list of invitees.
          type: array
          minItems: 1
          maxItems: 8
          items:
            $ref: '#/components/schemas/webhookClientOwnerInvitee'
      x-apiture-version: 1.0.0
    webhookClientOwnerInvitee:
      title: Webhook Client Owner Invitee (v1.0.0)
      description: Representation of new webhook client owner invitee.
      required:
        - firstName
        - lastName
        - emailAddress
      type: object
      properties:
        firstName:
          description: The first name of the invitee.
          type: string
          format: text
          maxLength: 64
        lastName:
          description: The last name of the invitee.
          format: text
          type: string
          maxLength: 64
        emailAddress:
          description: The email address of the invitee.
          type: string
          format: email
          maxLength: 128
      example:
        firstName: John
        lastName: Smith
        emailAddress: john.smith@example.com
      x-apiture-version: 1.0.0
    webhookClientId:
      x-apiture-version: 1.0.1
      title: Webhook Client Id (v1.0.1)
      description: The unique immutable, opaque identifier of a webhook client.
      allOf:
        - $ref: '#/components/schemas/resourceId'
      example: 510d681e-ff04-4e66-8b7f-e83973c867e9
    webhookClientState:
      title: Webhook Client State (v1.0.0)
      type: string
      description: |+
        The state of the webhook.

        <strong><code>webhookClientState</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>inactive</code></strong></td><td>Inactive: <p>The client webhook is inactive; the system does not attempt to send messages to it until an administrtaor activates it</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>active</code></strong></td><td>Active: <p>The client webhook is verified and active; the system attempts to send messages to it.</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>submitted</code></strong></td><td>Submitted: <p>The webhook client owner has submitted the webhook for review, approval, and provisioning</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>suspended</code></strong></td><td>Suspended: <p>The client webhook owner has suspended the client webhook; the system does not attempt to send messages to it until an owner resumes the webhook</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>rejected</code></strong></td><td>Rejected: <p>An administrator has rejected (not approved) a webhook client registration</p>
        </td>
            </tr>
        </table>

      x-apiture-enum: webhookClientState
      enum:
        - inactive
        - submitted
        - active
        - suspended
        - rejected
      x-apiture-version: 1.0.0
    immutableWebhookClientFields:
      x-apiture-version: 1.0.1
      title: Immutable Webhook Client Fields (v1.0.1)
      description: Fields used to compose other webhook client schemas.
      x-apiture-fragment: true
      allOf:
        - type: object
          properties:
            id:
              description: The opaque, immutable ID of this webhook client resource.
              $ref: '#/components/schemas/webhookClientId'
            environmentId:
              description: The ID of an API environment from which the the client receives event messages.
              $ref: '#/components/schemas/resourceId'
            state:
              $ref: '#/components/schemas/webhookClientState'
            verified:
              description: If `true`, the system has verified that the webhook `url` works. See the `verifyWebhookClient` operation in the Webhook Client Administration API.
              type: boolean
      example:
        id: b8353f052227c0ca7627
        environmentId: 66c4f3e301fbb635a249
        state: active
        verified: true
    webhookClientAuthorizationType:
      title: Webhook Client Authorization Type (v1.0.0)
      description: |+
        Indicates which type of authorization ADB must use when invoking the webhook

        <strong><code>webhookClientAuthorizationType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>basic</code></strong></td><td>HTTP Basic Authorization: <p>Basic HTTP Authoriziation (encoded username and password)</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>oauthClientCredentials</code></strong></td><td>OAuth2 Client Credentials Authorization: <p>OAuth2 Client Credentials flow: Pass the encoded <code>clientId</code> and <code>clientSecret</code> to the <code>token_url</code> (OAuth2 <code>token_endpoint</code>) to obtain an access token and <code>token_type</code> (usually <code>Bearer</code>) and pass an <code>Authorization</code> header with the <code>token_type</code> and access token value</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: webhookClientAuthorizationType
      enum:
        - basic
        - oauthClientCredentials
      x-apiture-version: 1.0.0
    mutableWebhookClientFields:
      title: Mutable Webhook Client Fields (v1.0.0)
      description: Fields used to compose other webhook client schemas.
      x-apiture-fragment: true
      properties:
        description:
          type: string
          format: text
          description: The description of this webhook client.
          minLength: 10
          maxLength: 2048
          example: HOACorp Finco development component webhook
        url:
          type: string
          description: The webhooks URL where webhooks are sent via `POST`.
          example: https://webhooks.example.com/my-adb-listener
          format: uri
          pattern: ^https:\/\.*
          maxLength: 2048
        categories:
          type: array
          description: The categories of event types to send to the webhook.
          maxItems: 200
          uniqueItems: true
          items:
            $ref: '#/components/schemas/eventMessageCategory'
        owners:
          description: A list of people who are owners of this webhook client. Only owners may update (including modifying the list of owners) or delete a webhook client. The array elements are email addresses (normalized to lowercase).
          type: array
          items:
            type: string
            description: The email address of an owner. The owner must register and log in to the Apiture Developer Portal with this email address to enable owner actions. Use the [`inviteWebhookClientOwners`](#op-inviteWebhookClientOwners) to invite other owners. Owners may [`patch webhook client`](#op-patchWebhookClient) to remove owners.
            maxLength: 255
            format: email
          minItems: 1
          maxItems: 8
        authorizationType:
          $ref: '#/components/schemas/webhookClientAuthorizationType'
      example:
        description: My fraud monitoring webhook.
        url: https://webhooks.example.com/fraud/monitoring
        categories:
          - accounts
          - externalAccounts
          - authentication
          - entitlements
          - transfers
        authorizationType: basic
        owners:
          - walter.white@example.com
          - walter.grey@example.com
          - walter.black@example.com
      x-apiture-version: 1.0.0
    webhookClientBasicAuthorizationFields:
      title: Webhook Client Basic Authorization Fields (v1.0.0)
      description: Webhook Client Basic Authorization Fields.
      type: object
      properties:
        username:
          type: string
          format: text
          maxLength: 48
          description: The HTTP Basic Authorization username.
        password:
          type: string
          format: text
          maxLength: 48
          description: The HTTP Basic authorization password.
      example:
        username: wh-client-0123
        password: Z=<T$UgK#/RZxyJb1
      x-apiture-version: 1.0.0
    webhookClientBasicAuthorizationPatch:
      title: Webhook Client Basic Authorization (v1.0.0)
      description: The webhook authorization details for HTTP `Basic` authentication.
      type: object
      allOf:
        - $ref: '#/components/schemas/webhookClientBasicAuthorizationFields'
      example:
        username: wh-client-0123
        password: Z=<T$UgK#/RZxyJb1
      x-apiture-version: 1.0.0
    newWebhookClientBasicAuthorization:
      title: New Webhook Client Basic Authorization (v1.0.0)
      description: The webhook authorization values for HTTP `Basic` authentication.
      type: object
      required:
        - username
        - password
      allOf:
        - $ref: '#/components/schemas/webhookClientBasicAuthorizationFields'
      example:
        username: webhook-client-0123
        password: Z=<T$UgK#/RZxyJb1
      x-apiture-version: 1.0.0
    webhookClientBasicAuthorization:
      title: Webhook Client Basic Authorization (v1.0.0)
      description: 'The webhook authorization details with basic authentication. *Note*: For security reasons, the `password` is not returned in responses.'
      type: object
      required:
        - username
      allOf:
        - $ref: '#/components/schemas/webhookClientBasicAuthorizationFields'
      example:
        username: webhook-client-0123
        password: Z=<T$UgK#/RZxyJb1
      x-apiture-version: 1.0.0
    webhookClientOAuthAuthorizationFields:
      title: Webhook Client OAuth Authorization Fields (v1.0.0)
      description: Webhook Client OAuth Authorization Fields.
      x-apiture-fragment: true
      properties:
        token_url:
          type: string
          format: uri
          maxLength: 2048
          description: The OAuth2 `token_endpoint`.
        clientId:
          type: string
          format: text
          maxLength: 100
          description: The OAuth2 Client ID.
        clientSecret:
          type: string
          description: The OAuth2 Client Secret.
          format: text
          maxLength: 100
        scope:
          type: string
          format: text
          maxLength: 100
          description: The OAuth2 scope.
      example:
        token_url: https://www.example.com/auth/token
        clientId: 6f16b758-0b5e-4c4a-9746-c6d93dbda51b
        clientSecret: hEl4+89d%^/dP*@djZ=<T$UgK#/RZxyJb1
        scope: events/push
      x-apiture-version: 1.0.0
    webhookClientOAuthAuthorizationPatch:
      title: Webhook Client OAuth Authorization (v1.0.0)
      description: The webhook authorization details for OAuth2 client credentials grant flow.
      type: object
      allOf:
        - $ref: '#/components/schemas/webhookClientOAuthAuthorizationFields'
      example:
        token_url: https://www.example.com/auth/token
        clientId: 6f16b758-0b5e-4c4a-9746-c6d93dbda51b
        clientSecret: hEl4+89d%^/dP*@djZ=<T$UgK#/RZxyJb1
        scope: events/push
      x-apiture-version: 1.0.0
    newWebhookClientOAuthAuthorization:
      title: Webhook Client OAuth Authorization (v1.0.0)
      description: The webhook authorization details for OAuth2 client credentials grant flow.
      type: object
      required:
        - token_url
        - clientId
        - clientSecret
        - scope
      allOf:
        - $ref: '#/components/schemas/webhookClientOAuthAuthorizationFields'
      example:
        token_url: https://www.example.com/auth/token
        clientId: 6f16b758-0b5e-4c4a-9746-c6d93dbda51b
        clientSecret: hEl4+89d%^/dP*@djZ=<T$UgK#/RZxyJb1
        scope: events/push
      x-apiture-version: 1.0.0
    webhookClientOAuthAuthorization:
      title: Webhook Client OAuth Authorization (v1.0.0)
      description: 'The webhook authorization details for OAuth2 client credentials grant flow. *Note*: For security reasons, the `clientSecret` is not returned in responses.'
      type: object
      required:
        - token_url
        - clientId
        - scope
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/webhookClientOAuthAuthorizationFields'
      example:
        token_url: https://www.example.com/auth/token
        clientId: 6f16b758-0b5e-4c4a-9746-c6d93dbda51b
        clientSecret: hEl4+89d%^/dP*@djZ=<T$UgK#/RZxyJb1
        scope: events/push
      x-apiture-version: 1.0.0
    initialWebhookClientFields:
      title: Initial Webhook Client Fields (v1.0.0)
      description: Initial Webhook Client Fields used to construct other schemas.
      x-apiture-fragment: true
      properties:
        environmentId:
          description: The ID of an API environment from which the the client receives event messages.
          $ref: '#/components/schemas/resourceId'
        description:
          type: string
          format: text
          description: The description of the webhook client.
          minLength: 10
          maxLength: 2048
          example: HOACorp Finco development component webhook
        url:
          type: string
          description: The url where Apiture Digital Banking will `POST` messages.
          example: https://webhooks.example.com/fraud/monitoring
          format: uri
          maxLength: 2048
        categories:
          type: array
          description: The categories of event types to send to the webhook.
          maxItems: 200
          items:
            $ref: '#/components/schemas/eventMessageCategory'
        authorizationType:
          $ref: '#/components/schemas/webhookClientAuthorizationType'
        basicAuthorization:
          description: The webhook authorization values for HTTP `Basic` authentication. This object is _required_ if the `authorizationType` is `basic` and ignored otherwise.
          $ref: '#/components/schemas/newWebhookClientBasicAuthorization'
        oauthClientCredentialsAuthorization:
          description: The webhook authorization values for OAuth2 client credentials flow authentication. This object is _required_ if the `authorizationType` is `oathClientCredentials` and ignored otherwise.
          $ref: '#/components/schemas/newWebhookClientOAuthAuthorization'
      x-apiture-version: 1.0.0
    newWebhookClient:
      title: New Webhook Client (v1.0.0)
      description: A new webhook client. If `authorizationType` is `basic`, the request _must_ include the `basicAuthorization` object. Otherwise, if `authorizationType` is `oauthClientCredentials`, the request _must_ include the `oauthClientCredentialsAuthorization` object.
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/initialWebhookClientFields'
        - properties:
            environmentId:
              description: The ID of an API environment from which the the client receives event messages.
              $ref: '#/components/schemas/resourceId'
      required:
        - description
        - url
        - categories
        - environmentId
        - authorizationType
      example:
        url: https://webhooks.example.com/fraud/monitoring
        environmentId: e170754f-7061-41e8-9f36-6eaae9e68936
        description: My live fraud monitoring listener
        categories:
          - accounts
          - externalAccounts
          - authentication
          - entitlements
          - transfers
        authorizationType: oauthClientCredentials
        oauthClientCredentialsAuthorization:
          token_url: https://www.example.com/auth/token
          clientId: 6f16b758-0b5e-4c4a-9746-c6d93dbda51b
          clientSecret: hEl4+89d%^/dP*@djZ=<T$UgK#/RZxyJb1
          scope: events/push
      x-apiture-version: 1.0.0
    webhookClientReplacement:
      title: Webhook Client Replacement (v1.0.0)
      description: Request body to replace a webhook client. If the request changes `authorizationType` to `basic`, the request _must_ include the `basicAuthorization` object. Otherwise, if the request changes `authorizationType` to `oauthClientCredentials`, the request _must_ include the `oauthClientCredentialsAuthorization` object.
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/initialWebhookClientFields'
      example:
        url: https://webhooks.example.com/fraud/live-monitoring
        description: My live fraud monitoring listener
        categories:
          - accounts
          - externalAccounts
          - authentication
          - entitlements
          - transfers
        authorizationType: oauthClientCredentials
        oauthClientCredentialsAuthorization:
          token_url: https://www.example.com/auth/token
          clientId: 975d04b3-192f-49c7-bfc2-639e2608fcd3
          clientSecret: '@djZ=<T$UgK#/RZxyJb1hEl4+89d%^/dP*'
          scope: events/push
      x-apiture-version: 1.0.0
    webhookClientFields:
      x-apiture-version: 1.0.1
      title: Webhook Client Fields (v1.0.1)
      description: Fragment schema used to construct other webhook client schemas.
      x-apiture-fragment: true
      allOf:
        - $ref: '#/components/schemas/mutableWebhookClientFields'
        - $ref: '#/components/schemas/immutableWebhookClientFields'
      example:
        id: b8353f052227c0ca7627
        state: active
        verified: true
        description: My fraud monitoring webhook.
        url: https://webhooks.example.com/fraud/monitoring
        categories:
          - accounts
          - externalAccounts
          - authentication
          - entitlements
          - transfers
        authorizationType: basic
        owners:
          - walter.white@example.com
          - walter.grey@example.com
          - walter.black@example.com
    webhookClientItem:
      x-apiture-version: 1.0.1
      title: Webhook Client Item (v1.0.1)
      description: An item in a list or collection of webhook clients.
      required:
        - id
        - description
        - environmentId
        - url
        - authorizationType
        - state
        - verified
      allOf:
        - $ref: '#/components/schemas/webhookClientFields'
      example:
        id: 0836e727e8d74a0fa5d83950
        environmentId: daafc39caac452708618a117
        state: active
        verified: true
        url: https://webhooks.example.com/fraud/live-monitoring
        description: My live fraud monitoring listener
        categories:
          - accounts
          - externalAccounts
          - authentication
          - entitlements
          - transfers
        authorizationType: oauthClientCredentials
    webhookClient:
      x-apiture-version: 1.0.1
      title: Webhook Client (v1.0.1)
      description: A webhook client.
      type: object
      required:
        - id
        - description
        - environmentId
        - url
        - categories
        - authorizationType
        - state
        - verified
        - createdAt
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/webhookClientFields'
        - $ref: '#/components/schemas/timestampFields'
        - type: object
          properties:
            basicAuthorization:
              description: The webhook authorization values for HTTP `Basic` authentication. This object is present if the `authorizationType` is `basic` and absent otherwise.
              allOf:
                - $ref: '#/components/schemas/webhookClientBasicAuthorization'
            oauthClientCredentialsAuthorization:
              description: The webhook authorization values for OAuth2 client credentials flow authentication. This object is present if the `authorizationType` is `oathClientCredentials` and absent otherwise.
              allOf:
                - $ref: '#/components/schemas/webhookClientOAuthAuthorization'
      example:
        id: 0836e727e8d74a0fa5d83950
        environmentId: daafc39caac452708618a117
        state: active
        verified: true
        url: https://webhooks.example.com/fraud/live-monitoring
        description: My live fraud monitoring listener
        categories:
          - accounts
          - externalAccounts
          - authentication
          - entitlements
          - transfers
        authorizationType: oauthClientCredentials
        oauthClientCredentialsAuthorization:
          token_url: https://www.example.com/auth/token
          clientId: 6f16b758-0b5e-4c4a-9746-c6d93dbda51b
          clientSecret: hEl4+89d%^/dP*@djZ=<T$UgK#/RZxyJb1
          scope: events/push
        owners:
          - walter.white@example.com
          - walter.grey@example.com
          - walter.black@example.com
        createdAt: '2024-06-10T09:13:47.375Z'
        updatedAt: '2024-06-10T12:19:30.0Z'
    webhookClientPatch:
      title: Webhook Client Patch (v1.0.0)
      description: Request body to patch a webhook client. If `authorizationType` is `basic`, the request _must_ include the `basicAuthorization` object. Otherwise, if `authorizationType` is `oauthClientCredentials`, the request _must_ include the `oauthClientCredentialsAuthorization` object.
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/mutableWebhookClientFields'
        - properties:
            basicAuthorization:
              description: The webhook authorization values for HTTP `Basic` authentication. This object is _required_ if the patch _changes_ the `authorizationType` to `basic`, may be supplied if the `authorizationType` is `basic`, and ignored otherwise.
              allOf:
                - $ref: '#/components/schemas/webhookClientBasicAuthorizationPatch'
            oauthClientCredentialsAuthorization:
              description: The webhook authorization values for OAuth2 client credentials flow authentication. This object is _required_ if the patch _changes_ the `authorizationType` to `oathClientCredentials`, may be supplied if the `authorizationType` is `oathClientCredentials`, and ignored otherwise.
              allOf:
                - $ref: '#/components/schemas/webhookClientOAuthAuthorizationPatch'
      example:
        description: My fraud monitoring webhook.
        url: https://webhooks.example.com/fraud/monitoring
        categories:
          - accounts
          - externalAccounts
          - authentication
          - entitlements
          - transfers
        authorizationType: oauthClientCredentials
        oauthClientCredentialsAuthorization:
          token_url: https://www.example.com/auth/token
          clientId: 6f16b758-0b5e-4c4a-9746-c6d93dbda51b
          clientSecret: hEl4+89d%^/dP*@djZ=<T$UgK#/RZxyJb1
          scope: events/push
        owners:
          - walter.white@example.com
          - walter.grey@example.com
          - walter.black@example.com
      x-apiture-version: 1.0.0
    webhookClients:
      x-apiture-version: 1.0.1
      title: Webhook Clients (v1.0.1)
      description: A list of the partner's webhooks client.
      type: object
      required:
        - items
      allOf:
        - $ref: '#/components/schemas/abstractPagedBody'
        - type: object
          properties:
            items:
              description: The webhooks in this page of the webhook clients.
              type: array
              maxItems: 1000
              items:
                $ref: '#/components/schemas/webhookClientItem'
      example:
        nextPage_url: https://api.developer.apiture.com/devWebhookClients/webhookClients?start=cursor123&limit=100
        limit: 100
        items:
          - id: 0836e727e8d74a0fa5d83950
            environmentId: daafc39caac452708618a117
            state: active
            verified: true
            url: https://webhooks.example.com/fraud/live-monitoring
            description: My live fraud monitoring listener
            categories:
              - accounts
              - externalAccounts
              - authentication
              - entitlements
              - transfers
            authorizationType: oauthClientCredentials
            oauthClientCredentialsAuthorization:
              token_url: https://www.example.com/auth/token
              scope: events/push
            createdAt: '2024-06-10T09:13:47.375Z'
    webhookCategories:
      title: Webhook Categories (v1.0.0)
      description: A list of categories a webhook can subscribe to.
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - type: object
          properties:
            items:
              description: A banking event category a webhook may subscribe to.
              type: array
              minItems: 4
              maxItems: 200
              items:
                $ref: '#/components/schemas/eventMessageCategory'
      example:
        items:
          - accountApplications
          - accounts
          - authentication
          - businessAchTransfers
          - entitlements
          - externalAccounts
          - overdraftProtection
          - profile
          - system
          - transfers
          - wireTransfers
      x-apiture-version: 1.0.0
    institutionId:
      x-apiture-version: 1.1.0
      title: Institution ID (v1.1.0)
      description: The unique immutable identifier of a financial institution.
      type: string
      pattern: ^[A-Z0-9_]{2,8}$
      maxLength: 8
      minLength: 2
      example: TIBURON
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/institutionId
    resourceId:
      x-apiture-version: 1.0.1
      title: Resource Identifier (v1.0.1)
      description: The unique, opaque system identifier for a resource. This case-sensitive ID is also used as path parameters in URLs or in other properties or parameters that reference a resource by ID rather than URL.
      type: string
      pattern: ^[-_:.~$a-zA-Z0-9]{6,48}$
      minLength: 6
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/resourceId
    problemResponse:
      title: Problem Response (v0.4.1)
      x-apiture-version: 0.4.1
      description: API problem or error response, as per [RFC 9457 application/problem+json](https://tools.ietf.org/html/rfc9457).
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/apiProblem'
      example:
        id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
        type: https://static.api.apiture.com/errors/noSuchAccount/v1.0.0
        title: Account Not Found
        status: 422
        occurredAt: '2022-04-25T12:42:21.375Z'
        detail: No account exists for the given account reference
        instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/problemResponse
    abstractBody:
      title: Abstract Body (v0.2.0)
      x-apiture-version: 0.2.0
      description: An abstract schema used to define other request and response body model schemas.
      x-apiture-fragment: true
      type: object
      properties: {}
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/abstractBody
    eventMessageCategory:
      x-apiture-version: 1.1.0
      title: Event Message Category (v1.1.0)
      description: An identifier for the category of the event. Multiple message types can belong to a category. This is a _lowerCamelCase_ string.
      type: string
      minLength: 4
      maxLength: 40
      pattern: ^[a-z][a-zA-Z0-9]{3,39}$
      example: wireTransfers
      x-resolved-from: ../../adminEvents/openapi.yaml#/components/schemas/eventMessageCategory
    timestampFields:
      x-apiture-version: 1.1.0
      title: Timestamp Fields (v1.1.0)
      description: Timestamps which describe when a resource was created or last updated.
      x-apiture-fragment: true
      allOf:
        - $ref: '#/components/schemas/createdAtField'
        - type: object
          properties:
            updatedAt:
              description: The date-time when the resource was last updated, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC. This is derived and immutable.
              $ref: '#/components/schemas/readOnlyTimestamp'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/timestampFields
    abstractPagedBody:
      title: Abstract Paged Body (v0.5.1)
      x-apiture-version: 0.5.1
      description: An abstract schema used to define paginated collections of resources. Collection classes which extend this schema define an array of `items` which represent a page of data.
      x-apiture-fragment: true
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/abstractPagedBodyFields'
        - type: object
          properties:
            start:
              description: The opaque cursor that specifies the starting location of this page of items.
              type: string
              format: text
              maxLength: 256
      example:
        start: 1922a8531e8384cfa71b
        limit: 100
        nextPage_url: https://static.api.apiture.com/banking/resources?start=8b76b4a97dccad88890e&limit=100
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/abstractPagedBody
    apiProblem:
      x-apiture-version: 1.2.1
      title: API Problem (v1.2.1)
      description: API problem or error, as per [RFC 7807 application/problem+json](https://tools.ietf.org/html/rfc7807).
      type: object
      properties:
        type:
          type: string
          format: uri-reference
          description: |
            A [URI reference (RFC3986)](https://tools.ietf.org/html/rfc3986) that identifies the problem type. If present, this is the URL of human-readable HTML documentation for the problem type. When this member is not present, its value is assumed to be `"about:blank"`.
          example: https://static.api.apiture.com/errors/forbidden/v1.0.0
          maxLength: 2048
        title:
          type: string
          description: |
            A short, human-readable summary of the problem type. The title is usually the same for all problem with the same `type`.
          maxLength: 120
          format: text
          example: User is not authorized to perform the requested action or access the requested resource.
        status:
          type: integer
          format: int32
          description: |
            The [HTTP status code](https://datatracker.ietf.org/doc/html/rfc7231#section-6) for this occurrence of the problem.
          minimum: 100
          maximum: 599
          example: 403
        detail:
          type: string
          description: |
            A human-readable explanation specific to this occurrence of the problem.
          maxLength: 256
          format: text
          example: User is not authorized to perform this operation.
        instance:
          type: string
          format: uri-reference
          description: |
            A URI reference that identifies the specific occurrence of the problem. This is the URI of an API resource that the problem is related to, with a unique error correlation ID URI fragment
          example: https://prduction.api.apiture.com/banking/accounts/ad80fc3e722q5402a#189c13ff-c54c-45f7-b8e0-c88984ba724d
          maxLength: 2048
        id:
          description: The unique identifier for this problem. This is an immutable opaque string.
          $ref: '#/components/schemas/readOnlyResourceId'
        occurredAt:
          description: The timestamp when the problem occurred, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC.
          $ref: '#/components/schemas/readOnlyTimestamp'
        problems:
          description: Optional root-causes if there are multiple problems in the request or API call processing.
          type: array
          maxItems: 128
          items:
            $ref: '#/components/schemas/apiProblem'
        attributes:
          type: object
          description: Additional optional attributes related to the problem. This data conforms to the schema associated with the error type.
      example:
        id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
        type: https://static.api.apiture.com/errors/accountNotFound/v1.0.0
        title: Account Not Found
        status: 422
        occurredAt: '2022-04-25T12:42:21.375Z'
        detail: No account exists at the given account_url
        instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/apiProblem
    requiredIdentityChallenge:
      x-apiture-version: 1.2.3
      title: Required Challenge (v1.2.3)
      description: A request from the service for the user to verify their identity. This contains a challenge ID, the corresponding operation ID, and a list of challenge factors for identity verification. The user must complete one of these challenge factors to satisfy the challenge. This schema defines the attributes in the 401 [Unauthorized problem response](#schema-apiProblem) when the 401 problem type name is `challengeRequired`. See the "Challenge API" for details.
      type: object
      required:
        - operationId
        - challengeId
        - factors
      properties:
        operationId:
          $ref: '#/components/schemas/challengeOperationId'
        challengeId:
          description: The unique ID of this challenge instance. This is an opaque string. This is passed when starting a challenge factor or when validating the identity challenge responses.
          $ref: '#/components/schemas/readOnlyResourceId'
        factors:
          description: 'A list of challenge factors. The user must complete one of these challenge factors. The `labels` in each factor identify one or more channels the user may use, such as a list of email addresses the system may use to send a one-time passcode to the user. ***Note**: The same channel may be used by multiple factors in the array of factors. For example, the user''s primary mobile phone number may be used for both an `sms` factor and a `voice` factor.'
          type: array
          minItems: 1
          maxItems: 8
          items:
            $ref: '#/components/schemas/challengeFactor'
      example:
        operationId: createTransfer
        challengeId: 0504076c566a3cf7009c
        factors:
          - type: sms
            labels:
              - '9876'
            id: 85c0ee5753fcd0b0953f
          - type: voice
            labels:
              - '9876'
            id: d089e10a80a8627df37b
          - type: voice
            labels:
              - '6754'
            id: 10506ecf9d1c2ee00403
          - type: email
            labels:
              - an****nk@example.com
              - an****98@example.com
            id: e917d671cb2f030b56f1
          - type: authenticatorToken
            labels:
              - Acme fob
            id: fe6c452d7da0bbb4e407
          - type: securityQuestions
            securityQuestions:
              questions:
                - id: q1
                  prompt: What is your mother's maiden name?
                - id: q4
                  prompt: What is your high school's name?
                - id: q9
                  prompt: What is the name of your first pet?
            id: df33c6f88a37d6b3f0a6
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/requiredIdentityChallenge
    createdAtField:
      description: A field used to represent the `createdAt` date-time for a resource.
      x-apiture-fragment: true
      type: object
      properties:
        createdAt:
          description: The date-time when this resource was created, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC. This is derived and immutable.
          $ref: '#/components/schemas/readOnlyTimestamp'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/createdAtField
      x-apiture-version: 1.0.0
      title: ' (v1.0.0)'
    readOnlyTimestamp:
      title: Read-Only Timestamp (v1.0.0)
      description: 'A readonly or derived timestamp (an instant in time) formatted in [RFC 3339](https://tools.ietf.org/html/rfc3339) `date-time` UTC format: `YYYY-MM-DDThh:mm:ss.sssZ`.'
      type: string
      minLength: 20
      maxLength: 30
      format: date-time
      readOnly: true
      example: '2021-10-30T19:06:04.250Z'
      x-apiture-since: 0.4.0
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/readOnlyTimestamp
      x-apiture-version: 1.0.0
    abstractPagedBodyFields:
      x-apiture-version: 1.1.1
      title: Abstract Paged Body Fields (v1.1.1)
      description: Common properties of collection page responses.
      x-apiture-fragment: true
      type: object
      required:
        - limit
      properties:
        limit:
          description: The number of items requested for this page response. The length of the `items` array may be less that `limit`.
          type: integer
          format: int32
          minimum: 0
          maximum: 10000
        nextPage_url:
          description: The URL of the next page of resources. If this URL is omitted, there are no more resources in the collection.
          readOnly: true
          maxLength: 8000
          type: string
          format: uri-reference
          example: https://static.api.apiture.com/banking/resources/8b76b4a97dccad88890e
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/abstractPagedBodyFields
    readOnlyResourceId:
      x-apiture-version: 1.0.1
      title: Read-only Resource Identifier (v1.0.1)
      description: The unique, opaque system-assigned identifier for a resource. This case-sensitive ID is also used in URLs as path parameters or in other properties or parameters that reference a resource by ID rather than URL. Resource IDs are immutable.
      readOnly: true
      allOf:
        - $ref: '#/components/schemas/resourceId'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/readOnlyResourceId
    challengeOperationId:
      x-apiture-version: 1.0.1
      title: Challenge Operation ID (v1.0.1)
      description: The ID of an operation/action for which the user must verify their identity via an identity challenge. This is passed when starting a challenge factor or when validating the identity challenge responses.
      type: string
      pattern: ^[-a-zA-Z0-9$_]{6,48}$
      minLength: 6
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeOperationId
    challengeFactor:
      x-apiture-version: 1.2.1
      title: Challenge Factor (v1.2.1)
      description: A challenge factor. See [`requiredIdentityChallenge`](#schema-requiredIdentityChallenge) for multiple examples.
      type: object
      required:
        - type
      properties:
        id:
          description: |-
            The ID of an a challenge factor. This ID is unique within the challenge factors associated with a challenge. The client should pass this `id` value as the `factorId` when starting or verifying a challenge factor.

            *Note*: The `id` will become `required` in a future update to this schema.
          $ref: '#/components/schemas/challengeFactorId'
        type:
          $ref: '#/components/schemas/challengeFactorType'
        labels:
          description: A list of text label which identifies the channel(s) through which the user completes the challenge. For an `sms` or `voice` challenge, the only label item is the last four digits of the corresponding phone number. For an `email` challenge, each label is the masked email address.
          type: array
          minItems: 1
          maxItems: 4
          items:
            type: string
            maxLength: 300
            format: text
        securityQuestions:
          $ref: '#/components/schemas/challengeSecurityQuestions'
      example:
        type: sms
        labels:
          - '9876'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactor
    challengeFactorId:
      title: Challenge Factor ID (v1.0.0)
      description: The ID of an a challenge factor. This ID is unique within the factors offered with a challenge.
      type: string
      pattern: ^[-a-zA-Z0-9$_]{3,48}$
      minLength: 3
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactorId
      x-apiture-version: 1.0.0
    challengeFactorType:
      title: Challenge Factor Type (v1.0.0)
      description: |+
        The name of challenge factor.

        <strong><code>challengeFactorType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>sms</code></strong></td><td>SMS: <p>One-time passcode sent to the primary mobile phone number</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>email</code></strong></td><td>Email: <p>One-time passcode sent to the primary email address</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>voice</code></strong></td><td>Voice: <p>One-time passcode communicated via automated voice phone call</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>authenticatorToken</code></strong></td><td>authenticator Token: <p>One-time passcode issued by a pre-registered hardware device, such as a token key fob, or an authenticator app</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>securityQuestions</code></strong></td><td>Security Questions: <p>Prompt with the user&#39;s security questions registered with their security profile</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: challengeFactorType
      enum:
        - sms
        - email
        - voice
        - securityQuestions
        - authenticatorToken
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactorType
      x-apiture-version: 1.0.0
    challengeSecurityQuestions:
      x-apiture-version: 1.0.1
      title: Challenge Security Questions (v1.0.1)
      description: Describes a `securityQuestions` challenge. This is omitted if the challenge `type` is not `securityQuestions`.
      type: object
      required:
        - questions
      properties:
        questions:
          description: The array of security questions.
          type: array
          minItems: 1
          maxItems: 8
          items:
            $ref: '#/components/schemas/challengeSecurityQuestion'
      example:
        questions:
          - id: q1
            prompt: What is your mother's maiden name?
          - id: q4
            prompt: What is your high school's name?
          - id: q9
            prompt: What is the name of your first pet?
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeSecurityQuestions
    challengeSecurityQuestion:
      x-apiture-version: 1.0.1
      title: Challenge Security Question (v1.0.1)
      description: A single security question within the `questions` array of the [`challengeSecurityQuestions`](#schema-challengeSecurityQuestions)
      type: object
      required:
        - id
        - prompt
      properties:
        id:
          description: The unique ID of security question prompt. This should be included in the [`challengeVerification`](#schema-challengeVerification) response as the `promptId`.
          $ref: '#/components/schemas/challengePromptId'
        prompt:
          description: The text prompt of this security question.
          type: string
          format: text
          maxLength: 80
      example:
        id: 74699fa628911e762ea5
        prompt: What is your mother's maiden name?
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeSecurityQuestion
    challengePromptId:
      title: Challenge Prompt ID (v1.0.0)
      description: The unique ID of a prompt (such as a security question) in a challenge factor.
      type: string
      pattern: ^[-_:.~$a-zA-Z0-9]+$
      minLength: 1
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengePromptId
      x-apiture-version: 1.0.0
  responses:
    '400':
      description: |
        Bad Request. The request body, request headers, and/or query parameters are not well-formed.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/badRequest/v1.0.0`](https://static.api.apiture.com/errors/badRequest/v1.0.0)<br>
          The request body and/or parameters was not well-formed.
          Remediation: Correct any syntax or schema errors in the request body or parameters.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/badRequest'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/badRequest/v1.0.0
              title: Bad Request
              status: 400
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: Input did not parse as JSON
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/badRequest/v1.0.0
              title: Bad Request
              status: 400
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: Input did not parse as JSON
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/400
    '401':
      description: |
        Unauthorized. The operation requires authentication but no authentication or insufficient authentication was given.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/unauthorized/v1.0.0`](https://static.api.apiture.com/errors/unauthorized/v1.0.0)<br>
          The request lacks valid authentication credentials for the target resource or operation.
          Remediation: Authenticate the user and pass the required authorization with the request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/unauthorized'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unauthorized/v1.0.0
              title: Unauthorized
              status: 401
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request lacks valid authentication credentials
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unauthorized/v1.0.0
              title: Unauthorized
              status: 401
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request lacks valid authentication credentials
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/401
    '403':
      description: |
        Forbidden. The authenticated caller is not authorized to perform the requested operation.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/forbidden/v1.0.0`](https://static.api.apiture.com/errors/forbidden/v1.0.0)<br>
          The user or agent is not allowed to perform this operation; authentication credentials were provided in the request, but the server considers them insufficient to grant access.
          Remediation: Check the user's permissions and entitlements before attempting the operation.

        * [`https://static.api.apiture.com/errors/customerDisabled/v1.0.0`](https://static.api.apiture.com/errors/customerDisabled/v1.0.0)<br>
          The customer is disabled.
          Remediation: Have the customer contact the financial institution for support.

        * [`https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0`](https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0)<br>
          The financial institution requires the customer to have anti-malware software installed.
          Remediation: Direct the user to the software requirements guide to install the correct anti-malware software.

        * [`https://static.api.apiture.com/errors/modificationForbidden/v1.0.0`](https://static.api.apiture.com/errors/modificationForbidden/v1.0.0)<br>
          The customer is properly authenticated but not authorized to create, modify, or delete resources.
          Remediation: Avoid modification operation for customers with read-only authorization.

        * [`https://static.api.apiture.com/errors/challengeRequired/v1.0.0`](https://static.api.apiture.com/errors/challengeRequired/v1.0.0)<br>
          The operation requires the customer to complete an identity challenge.
          Remediation: Complete the challenge as per the problem response, and add an additional `Challenge` header to the call.
        The `attributes` object in the error may have the properties defined by the [`requiredIdentityChallenge` schema](#schema-requiredIdentityChallenge).
        * [`https://static.api.apiture.com/errors/challengeBlocked/v1.0.0`](https://static.api.apiture.com/errors/challengeBlocked/v1.0.0)<br>
          The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
          Remediation: Have the user end their login session and login again.

        * [`https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0`](https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0)<br>
          This operation requires an identity challenge, but the user does not have the necessary registered authentication factors.
          Remediation: Have the user register one or more challenge security code delivery factors.

        * [`https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0`](https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0)<br>
          The additional on-time `Challenge` header in this request is expired, already used, or otherwise invalid.
          Remediation: Supply a valid, unexpired, unclaimed `Challenge` header in the request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/forbidden'
        - $ref: '#/components/x-apiture-errors/customerDisabled'
        - $ref: '#/components/x-apiture-errors/antiMalwareRequired'
        - $ref: '#/components/x-apiture-errors/modificationForbidden'
        - $ref: '#/components/x-apiture-errors/challengeRequired'
        - $ref: '#/components/x-apiture-errors/challengeBlocked'
        - $ref: '#/components/x-apiture-errors/noIdentityChallengeFactors'
        - $ref: '#/components/x-apiture-errors/invalidIdentityChallengeHeader'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/forbidden/v1.0.0
              title: Forbidden
              status: 403
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request has valid authentication, but the authenticated agent is forbidden from accessing this resource or operation
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/forbidden/v1.0.0
              title: Forbidden
              status: 403
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request has valid authentication, but the authenticated agent is forbidden from accessing this resource or operation
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/403
    '404':
      description: |
        Not found. There is no such resource at the request URL.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/notFound/v1.0.0`](https://static.api.apiture.com/errors/notFound/v1.0.0)<br>
          The resource at the requested URL does not exist.
          Remediation: Use the URL of an existing resource.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/notFound'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/notFound/v1.0.0
              title: Not Found
              status: 404
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The resource at the request URL does not exist.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/notFound/v1.0.0
              title: Not Found
              status: 404
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The resource at the request URL does not exist.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/404
    '429':
      description: |
        Too Many Requests. The client has sent too many requests in a given amount of time.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/tooManyRequests/v1.0.0`](https://static.api.apiture.com/errors/tooManyRequests/v1.0.0)<br>
          The client has sent too many requests in a given amount of time, exceeding rate limiting.
          Remediation: Slow down the rate of API calls.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/tooManyRequests'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/tooManyRequests/v1.0.0
              title: Too Many Requests
              status: 429
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The user has sent too many requests in a given amount of time.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/tooManyRequests/v1.0.0
              title: Too Many Requests
              status: 429
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The user has sent too many requests in a given amount of time.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/429
    422webhookClient:
      description: |
        Unprocessable Entity.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/invalidWebhookClientAuthorization/v1.0.0`](https://static.api.apiture.com/errors/invalidWebhookClientAuthorization/v1.0.0)<br>
          Request body does not match the given `authorizationType`.
          Remediation: If `authorizationType` is `basic`, provide the `basicAuthorization` object; if `authorizationType` is `oauthClientCredentials`, provide the `oauthClientCredentialsAuthorization` object.

        * [`https://static.api.apiture.com/errors/invalidWebhookCategory/v1.0.0`](https://static.api.apiture.com/errors/invalidWebhookCategory/v1.0.0)<br>
          A webhook category is not in the list of supported categories.
          Remediation: Pass only categories as returned by the `listWebhookCategories` operation.
      x-apiture-errors:
        - invalidWebhookClientAuthorization
        - invalidWebhookCategory
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
    409webhookClient:
      description: |
        Conflict.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/invalidWebhookClientAuthorization/v1.0.0`](https://static.api.apiture.com/errors/invalidWebhookClientAuthorization/v1.0.0)<br>
          Request body does not match the given `authorizationType`.
          Remediation: If `authorizationType` is `basic`, provide the `basicAuthorization` object; if `authorizationType` is `oauthClientCredentials`, provide the `oauthClientCredentialsAuthorization` object.

        * [`https://static.api.apiture.com/errors/invalidWebhookCategory/v1.0.0`](https://static.api.apiture.com/errors/invalidWebhookCategory/v1.0.0)<br>
          A webhook category is not in the list of supported categories.
          Remediation: Pass only categories as returned by the `listWebhookCategories` operation.

        * [`https://static.api.apiture.com/errors/invalidWebhookClientState/v1.0.0`](https://static.api.apiture.com/errors/invalidWebhookClientState/v1.0.0)<br>
          The requested operation is not allowed for a webhook in current state.
          Remediation: Only invoke operations allowed for the given state.
      x-apiture-errors:
        - invalidWebhookClientAuthorization
        - invalidWebhookCategory
        - invalidWebhookClientState
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
    4XX:
      description: Client Request Problem. The client request had a problem not listed under another specific 400-level HTTP response code. View the `detail` in the problem response for additional details.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/methodNotAllowed/v1.0.0
              title: Method Not Allowed
              status: 405
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: This HTTP method is not allowed for the given resource URL.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/methodNotAllowed/v1.0.0
              title: Method Not Allowed
              status: 405
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: This HTTP method is not allowed for the given resource URL.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/4XX
    5XX:
      description: Server Problem. The server encountered a problem not listed under another specific 500-level HTTP response code. View the `detail` in the problem response for additional details.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/gatewayTimeout/v1.0.0
              title: Insufficient Storage
              status: 507
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The server is unable to store the representation needed to successfully complete the request.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/gatewayTimeout/v1.0.0
              title: Insufficient Storage
              status: 507
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The server is unable to store the representation needed to successfully complete the request.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/5XX
  x-apiture-errors:
    tooManyOwners:
      description: The webhook client has the maximum number of owners.
      remediation: Remove another owner before adding more owners.
    invalidOwnerDomain:
      description: The email domain of the invitee does not match the partner/owner of this webhook client.
      remediation: Invite owners via email addresses with the same email domain.
    invalidWebhookClientAuthorization:
      description: Request body does not match the given `authorizationType`
      remediation: If `authorizationType` is `basic`, provide the `basicAuthorization` object; if `authorizationType` is `oauthClientCredentials`, provide the `oauthClientCredentialsAuthorization` object.
    invalidWebhookCategory:
      description: A webhook category is not in the list of supported categories.
      remediation: Pass only categories as returned by the `listWebhookCategories` operation.
    invalidWebhookClientState:
      description: The requested operation is not allowed for a webhook in current state.
      remediation: Only invoke operations allowed for the given state.
    invalidStateForDelete:
      description: The webhook client cannot be deleted when in the current state.
      remediation: The webhook client state must be one of `inactive`, `suspended` or `rejected`.
    invalidOwnerEmailDomain:
      description: The email address in an owner invitation does not match the webhook client's partner domain.
      remediation: Owner email addresses must match the webhook client's partner domain.
    conflict:
      description: The request could not be completed due to a conflict with the current state of the target resource.
      remediation: Try another operation that is allowed.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/conflict
    unprocessableEntity:
      description: The syntax of the request entity is correct but was unable to process the contained instructions.
      remediation: Provide a semantically correct request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/unprocessableEntity
    badRequest:
      description: The request body and/or parameters was not well-formed.
      remediation: Correct any syntax or schema errors in the request body or parameters.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/badRequest
    unauthorized:
      description: The request lacks valid authentication credentials for the target resource or operation.
      remediation: Authenticate the user and pass the required authorization with the request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/unauthorized
    forbidden:
      description: The user or agent is not allowed to perform this operation; authentication credentials were provided in the request, but the server considers them insufficient to grant access.
      remediation: Check the user's permissions and entitlements before attempting the operation.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/forbidden
    customerDisabled:
      description: The customer is disabled.
      remediation: Have the customer contact the financial institution for support.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/customerDisabled
    antiMalwareRequired:
      description: The financial institution requires the customer to have anti-malware software installed.
      remediation: Direct the user to the software requirements guide to install the correct anti-malware software.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/antiMalwareRequired
    modificationForbidden:
      description: The customer is properly authenticated but not authorized to create, modify, or delete resources.
      remediation: Avoid modification operation for customers with read-only authorization.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/modificationForbidden
    challengeRequired:
      description: The operation requires the customer to complete an identity challenge.
      remediation: Complete the challenge as per the problem response, and add an additional `Challenge` header to the call.
      attributes:
        $ref: '#/components/schemas/requiredIdentityChallenge'
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/challengeRequired
    challengeBlocked:
      description: The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
      remediation: Have the user end their login session and login again.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/challengeBlocked
    noIdentityChallengeFactors:
      description: This operation requires an identity challenge, but the user does not have the necessary registered authentication factors.
      remediation: Have the user register one or more challenge security code delivery factors.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/noIdentityChallengeFactors
    invalidIdentityChallengeHeader:
      description: The additional on-time `Challenge` header in this request is expired, already used, or otherwise invalid.
      remediation: Supply a valid, unexpired, unclaimed `Challenge` header in the request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/invalidIdentityChallengeHeader
    notFound:
      description: The resource at the requested URL does not exist.
      remediation: Use the URL of an existing resource.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/notFound
    tooManyRequests:
      description: The client has sent too many requests in a given amount of time, exceeding rate limiting.
      remediation: Slow down the rate of API calls.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/tooManyRequests
  securitySchemes:
    accessToken:
      type: openIdConnect
      description: OpenId Connect (OIDC) authentication/authorization. The client uses the `authorization_endpoint` and `token_endpoint` to obtain an access token to pass in the `Authorization` header. Those endpoints are available via the OIDC Configuration URL. The actual URL may vary with each financial institution. See details at [Secure Access](https://dx.apiture.com/docs/api/concepts/api-keys/).
      openIdConnectUrl: https://auth.apiture.com/oidc/.well-known/openid-configuration
      x-resolved-from: ../../common/openapi.yaml#/components/securitySchemes/accessToken
x-resolved-from: ../../devWebhookClients/status-codes-openapi.yaml
x-resolved-at: '2024-12-09T22:14:05.597Z'
x-apiture-annotated-at: '2024-12-09T22:14:05.855Z'
