{
  "openapi": "3.1.1",
  "info": {
    "title": "OAuth Permission Explorer API",
    "version": "1.0.0",
    "summary": "What an OAuth consent request really allows: scopes, risky combinations and flow problems.",
    "description": "Every endpoint performs the same calculation as the human page and returns inputs, result, units, assumptions, sources, warnings and computedAt. MCP endpoint: /mcp."
  },
  "servers": [
    {
      "url": "https://oauthpermissionexplorer.usefulweb.site"
    }
  ],
  "paths": {
    "/api/v1/calculate": {
      "post": {
        "operationId": "calculate",
        "summary": "What an OAuth consent request really allows: scopes, risky combinations and flow problems.",
        "description": "Paste OAuth scopes or a full authorization URL for Google, GitHub, Microsoft Graph, Slack or generic OpenID Connect. Every scope is explained from the provider's official documentation with a sensitivity rating; risky combinations (read + send mail, offline access to files, push code + delete repositories, CI workflow edits) and unsafe request settings (implicit flow, missing PKCE or state, plain-HTTP redirect) are flagged. Unknown scopes are listed, never guessed.\n\nMethodology:\n- Input is split on spaces/commas; a full URL is parsed for scope, user_scope (Slack), client_id, redirect_uri, response_type, prompt, access_type, code_challenge(_method), state and nonce.\n- Provider = your choice, else the authorization host (accounts.google.com, github.com, login.microsoftonline.com, slack.com), else the provider most scopes uniquely belong to. Microsoft Graph scopes match with or without the https://graph.microsoft.com/ prefix, case-insensitively.\n- Scope descriptions come from a curated dataset copied from each provider's official scope reference (URL per scope). Only scopes found on those pages are included; anything else is reported as unknown.\n- Sensitivity (low/medium/high/critical) is an editorial rating of what a leaked token could do; Google's own Non-sensitive/Sensitive/Restricted class and Microsoft's admin-consent flag are shown where documented.\n- Risky combinations are rules over capabilities (e.g. mail.read + mail.send, repo.write + repo.delete, offline + files.read). Flow checks follow RFC 9700 (OAuth 2.0 Security BCP) and RFC 7636 (PKCE).",
        "tags": [
          "security"
        ],
        "x-mcp-tool": "oauth_permission_explorer",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/OauthPermissionExplorerInput"
              },
              "examples": {
                "example1": {
                  "summary": "Google consent URL with Gmail + offline access",
                  "value": {
                    "request": "https://accounts.google.com/o/oauth2/v2/auth?client_id=123.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fapp.example%2Fcb&response_type=code&access_type=offline&prompt=consent&scope=openid%20email%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fgmail.readonly%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fgmail.send&state=xyz",
                    "provider": "auto"
                  }
                },
                "example2": {
                  "summary": "GitHub token scopes",
                  "value": {
                    "request": "repo delete_repo workflow read:org",
                    "provider": "github"
                  }
                },
                "example3": {
                  "summary": "Microsoft Graph implicit flow",
                  "value": {
                    "request": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=abc&response_type=token&redirect_uri=http%3A%2F%2Fapp.example%2Fcb&scope=offline_access%20Mail.Send%20Files.ReadWrite.All%20User.Read",
                    "provider": "auto"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Calculation result envelope.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OauthPermissionExplorerResult"
                }
              }
            }
          },
          "400": {
            "description": "Malformed JSON body.",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "422": {
            "description": "Invalid input (see errors[]).",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit exceeded (see Retry-After).",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          }
        }
      }
    },
    "/api/v1/tool": {
      "get": {
        "operationId": "getToolDefinition",
        "summary": "Inputs, output schema and examples for this tool",
        "responses": {
          "200": {
            "description": "Tool definition.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "Problem": {
        "type": "object",
        "description": "RFC 9457 problem details. 422 responses include per-field `errors`.",
        "required": [
          "type",
          "title",
          "status",
          "detail"
        ],
        "properties": {
          "type": {
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "status": {
            "type": "integer"
          },
          "detail": {
            "type": "string"
          },
          "code": {
            "type": "string"
          },
          "errors": {
            "type": "array",
            "items": {
              "type": "object",
              "required": [
                "field",
                "message"
              ],
              "properties": {
                "field": {
                  "type": "string"
                },
                "message": {
                  "type": "string"
                }
              }
            }
          }
        }
      },
      "OauthPermissionExplorerInput": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "request": {
            "title": "Scopes or authorization URL",
            "description": "Scopes separated by spaces or commas, or the whole URL from the consent link.",
            "type": "string",
            "maxLength": 20000
          },
          "provider": {
            "title": "Provider",
            "type": "string",
            "enum": [
              "auto",
              "google",
              "github",
              "microsoft",
              "slack",
              "oidc"
            ],
            "default": "auto"
          }
        },
        "required": [
          "request"
        ]
      },
      "OauthPermissionExplorerResult": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "schemaVersion",
          "tool",
          "computedAt",
          "inputs",
          "summary",
          "result",
          "units",
          "assumptions",
          "sources",
          "warnings",
          "presentation",
          "links"
        ],
        "properties": {
          "schemaVersion": {
            "type": "string",
            "const": "1.0"
          },
          "tool": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "id",
              "name",
              "version"
            ],
            "properties": {
              "id": {
                "type": "string"
              },
              "name": {
                "type": "string"
              },
              "version": {
                "type": "string"
              }
            }
          },
          "computedAt": {
            "type": "string",
            "format": "date-time"
          },
          "inputs": {
            "type": "object",
            "description": "Normalised inputs actually used, including applied defaults."
          },
          "summary": {
            "type": "string"
          },
          "result": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "provider",
              "providerDetection",
              "request",
              "scopes",
              "unknownScopes",
              "riskyCombinations",
              "flowNotes",
              "overallRisk",
              "counts"
            ],
            "properties": {
              "provider": {
                "type": [
                  "string",
                  "null"
                ]
              },
              "providerDetection": {
                "type": "string",
                "enum": [
                  "explicit",
                  "url",
                  "detected",
                  "none"
                ]
              },
              "request": {
                "type": [
                  "object",
                  "null"
                ],
                "additionalProperties": false,
                "required": [
                  "host",
                  "clientId",
                  "redirectUri",
                  "responseType",
                  "prompt",
                  "accessType",
                  "codeChallengeMethod",
                  "hasPkce",
                  "hasState",
                  "hasNonce"
                ],
                "properties": {
                  "host": {
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "clientId": {
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "redirectUri": {
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "responseType": {
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "prompt": {
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "accessType": {
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "codeChallengeMethod": {
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "hasPkce": {
                    "type": "boolean"
                  },
                  "hasState": {
                    "type": "boolean"
                  },
                  "hasNonce": {
                    "type": "boolean"
                  }
                }
              },
              "scopes": {
                "type": "array",
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "scope",
                    "provider",
                    "known",
                    "description",
                    "sensitivity",
                    "capabilities",
                    "providerClass",
                    "adminConsentRequired",
                    "tokenType",
                    "sourceUrl"
                  ],
                  "properties": {
                    "scope": {
                      "type": "string"
                    },
                    "provider": {
                      "type": [
                        "string",
                        "null"
                      ]
                    },
                    "known": {
                      "type": "boolean"
                    },
                    "description": {
                      "type": [
                        "string",
                        "null"
                      ]
                    },
                    "sensitivity": {
                      "type": "string",
                      "enum": [
                        "low",
                        "medium",
                        "high",
                        "critical",
                        "unknown"
                      ]
                    },
                    "capabilities": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "providerClass": {
                      "type": [
                        "string",
                        "null"
                      ]
                    },
                    "adminConsentRequired": {
                      "type": [
                        "boolean",
                        "null"
                      ]
                    },
                    "tokenType": {
                      "type": [
                        "string",
                        "null"
                      ]
                    },
                    "sourceUrl": {
                      "type": [
                        "string",
                        "null"
                      ]
                    }
                  }
                }
              },
              "unknownScopes": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "riskyCombinations": {
                "type": "array",
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "id",
                    "label",
                    "severity",
                    "scopes",
                    "why"
                  ],
                  "properties": {
                    "id": {
                      "type": "string"
                    },
                    "label": {
                      "type": "string"
                    },
                    "severity": {
                      "type": "string",
                      "enum": [
                        "low",
                        "medium",
                        "high",
                        "critical"
                      ]
                    },
                    "scopes": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "why": {
                      "type": "string"
                    }
                  }
                }
              },
              "flowNotes": {
                "type": "array",
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "severity",
                    "note"
                  ],
                  "properties": {
                    "severity": {
                      "type": "string",
                      "enum": [
                        "high",
                        "medium",
                        "low",
                        "info"
                      ]
                    },
                    "note": {
                      "type": "string"
                    }
                  }
                }
              },
              "overallRisk": {
                "type": "string",
                "enum": [
                  "low",
                  "medium",
                  "high",
                  "critical",
                  "unknown"
                ]
              },
              "counts": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "total",
                  "known",
                  "unknown",
                  "critical",
                  "high"
                ],
                "properties": {
                  "total": {
                    "type": "integer"
                  },
                  "known": {
                    "type": "integer"
                  },
                  "unknown": {
                    "type": "integer"
                  },
                  "critical": {
                    "type": "integer"
                  },
                  "high": {
                    "type": "integer"
                  }
                }
              }
            }
          },
          "units": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            }
          },
          "assumptions": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "sources": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "title"
              ],
              "properties": {
                "title": {
                  "type": "string"
                },
                "url": {
                  "type": "string"
                },
                "publisher": {
                  "type": "string"
                },
                "retrievedAt": {
                  "type": "string"
                },
                "note": {
                  "type": "string"
                }
              }
            }
          },
          "warnings": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "presentation": {
            "type": "array",
            "items": {
              "type": "object"
            },
            "description": "Display blocks used by the human page (same data)."
          },
          "links": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "human",
              "api",
              "openapi",
              "methodology"
            ],
            "properties": {
              "human": {
                "type": "string",
                "format": "uri"
              },
              "api": {
                "type": "string",
                "format": "uri"
              },
              "openapi": {
                "type": "string",
                "format": "uri"
              },
              "methodology": {
                "type": "string",
                "format": "uri"
              }
            }
          }
        }
      }
    }
  }
}