{
  "openapi": "3.1.0",
  "info": {
    "title": "JWT Inspect",
    "version": "1.0.0",
    "summary": "Decode and lint a JWT without verifying secrets.",
    "description": "Decodes a compact JWT or JWE and reports structural and claim problems, including an expired exp. Signatures are never verified. Secrets sent alongside a token are rejected and not echoed. Nothing is stored."
  },
  "servers": [
    {
      "url": "https://jwt-inspect.over9000.cc"
    }
  ],
  "paths": {
    "/api/health": {
      "get": {
        "operationId": "health",
        "summary": "Liveness",
        "responses": {
          "200": {
            "description": "The service is up. verified is always false.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "ok",
                    "service",
                    "verified"
                  ],
                  "properties": {
                    "ok": {
                      "type": "boolean",
                      "const": true
                    },
                    "service": {
                      "type": "string",
                      "const": "jwt-inspect"
                    },
                    "verified": {
                      "type": "boolean",
                      "const": false
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "/api/openapi.json": {
      "get": {
        "operationId": "openapi",
        "summary": "This document",
        "responses": {
          "200": {
            "description": "OpenAPI 3.1 JSON."
          }
        }
      }
    },
    "/api/inspect": {
      "get": {
        "operationId": "inspectGet",
        "summary": "Lint a token from the query string",
        "description": "POST is preferred. Query strings are often written to access logs.",
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "maxLength": 20000
            },
            "description": "Compact JWT. jwt is accepted as an alias."
          }
        ],
        "responses": {
          "200": {
            "description": "Inspection report. lint_ok is false when any finding is an error. verified is always false.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Inspection"
                }
              }
            }
          },
          "400": {
            "description": "The token query parameter is missing.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "413": {
            "description": "The token exceeds 20000 characters."
          }
        }
      },
      "post": {
        "operationId": "inspectPost",
        "summary": "Lint a token from a JSON, form, or plain-text body",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "token": {
                    "type": "string"
                  },
                  "jwt": {
                    "type": "string"
                  },
                  "access_token": {
                    "type": "string"
                  }
                }
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "token": {
                    "type": "string"
                  }
                }
              }
            },
            "text/plain": {
              "schema": {
                "type": "string"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Inspection report.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Inspection"
                }
              }
            }
          },
          "400": {
            "description": "Missing token, invalid JSON, or a secret field was rejected."
          },
          "413": {
            "description": "Body or token is too large."
          },
          "415": {
            "description": "Unsupported content type."
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "Error": {
        "type": "object",
        "required": [
          "ok",
          "error"
        ],
        "properties": {
          "ok": {
            "type": "boolean",
            "const": false
          },
          "error": {
            "type": "object",
            "required": [
              "code",
              "message"
            ],
            "properties": {
              "code": {
                "type": "string"
              },
              "message": {
                "type": "string"
              }
            }
          }
        }
      },
      "Inspection": {
        "type": "object",
        "required": [
          "ok",
          "lint_ok",
          "verified",
          "findings",
          "note"
        ],
        "properties": {
          "ok": {
            "type": "boolean",
            "const": true
          },
          "lint_ok": {
            "type": "boolean"
          },
          "verified": {
            "type": "boolean",
            "const": false
          },
          "kind": {
            "type": "string",
            "enum": [
              "jws",
              "jwe",
              "malformed"
            ]
          },
          "note": {
            "type": "string"
          },
          "algorithm": {
            "type": [
              "string",
              "null"
            ]
          },
          "header": {},
          "payload": {},
          "findings": {
            "type": "array",
            "items": {
              "type": "object",
              "required": [
                "id",
                "severity",
                "message"
              ],
              "properties": {
                "id": {
                  "type": "string"
                },
                "severity": {
                  "type": "string",
                  "enum": [
                    "error",
                    "warning",
                    "info"
                  ]
                },
                "message": {
                  "type": "string"
                },
                "path": {
                  "type": "string"
                }
              }
            }
          }
        }
      }
    }
  }
}