{
  "openapi": "3.1.0",
  "info": {
    "title": "UCap Public API",
    "version": "1.0.0",
    "description": "OAuth 2.0 + PKCE authenticated API for consumer data access, partner sessions, and embedded consent flows.",
    "contact": {
      "name": "UCap Developers",
      "url": "https://phase2.ucap.africa/developers"
    },
    "license": {
      "name": "Proprietary"
    }
  },
  "servers": [
    {
      "url": "https://phase2.ucap.africa/api/public/v1",
      "description": "Production"
    }
  ],
  "tags": [
    {
      "name": "OAuth",
      "description": "Authorization, token issuance, introspection, revocation."
    },
    {
      "name": "Me",
      "description": "Consumer self-service endpoints (require user token)."
    },
    {
      "name": "Sessions",
      "description": "Partner application/consent sessions."
    },
    {
      "name": "System",
      "description": "Health and discovery."
    }
  ],
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "Access token issued by /oauth/token."
      },
      "basicAuth": {
        "type": "http",
        "scheme": "basic",
        "description": "Partner client_id + client_secret (secret clients only)."
      },
      "oauth2": {
        "type": "oauth2",
        "flows": {
          "authorizationCode": {
            "authorizationUrl": "https://phase2.ucap.africa/oauth/authorize",
            "tokenUrl": "https://phase2.ucap.africa/api/public/v1/oauth/token",
            "refreshUrl": "https://phase2.ucap.africa/api/public/v1/oauth/token",
            "scopes": {
              "consumer.profile.read": "Read the consumer's profile, contacts, and addresses.",
              "consumer.profile.write": "Update the consumer's profile, contacts, and addresses.",
              "consumer.documents.read": "List and download the consumer's documents.",
              "consumer.documents.write": "Upload and delete the consumer's documents.",
              "consumer.grants.read": "List consent grants the consumer has issued.",
              "consumer.grants.revoke": "Revoke a consent grant the consumer has issued.",
              "consumer.history.read": "Read activity history for the consumer.",
              "consumer.notifications.read": "Read notifications addressed to the consumer.",
              "consumer.notifications.write": "Mark notifications as read for the consumer.",
              "consumer.consent.read": "Inspect pending consent sessions for the consumer.",
              "consumer.consent.respond": "Approve or deny a pending consent session."
            }
          },
          "clientCredentials": {
            "tokenUrl": "https://phase2.ucap.africa/api/public/v1/oauth/token",
            "scopes": {
              "sessions.create": "Create application sessions for a partner.",
              "sessions.read": "Read application sessions and consented data.",
              "sessions.revoke": "Revoke an application session."
            }
          }
        }
      }
    },
    "schemas": {
      "Error": {
        "type": "object",
        "required": [
          "error"
        ],
        "properties": {
          "error": {
            "type": "string",
            "description": "Machine-readable error code (RFC 6749 where applicable)."
          },
          "error_description": {
            "type": "string"
          }
        }
      },
      "TokenResponse": {
        "type": "object",
        "required": [
          "access_token",
          "token_type",
          "expires_in"
        ],
        "properties": {
          "access_token": {
            "type": "string"
          },
          "token_type": {
            "type": "string",
            "enum": [
              "Bearer"
            ]
          },
          "expires_in": {
            "type": "integer",
            "description": "Seconds until access_token expires."
          },
          "refresh_token": {
            "type": "string"
          },
          "scope": {
            "type": "string",
            "description": "Space-delimited granted scopes."
          },
          "id_token": {
            "type": "string",
            "description": "Issued only when openid scope is granted."
          }
        }
      },
      "Profile": {
        "type": "object",
        "properties": {
          "user_id": {
            "type": "string",
            "format": "uuid"
          },
          "first_name": {
            "type": "string",
            "nullable": true
          },
          "last_name": {
            "type": "string",
            "nullable": true
          },
          "email": {
            "type": "string",
            "format": "email",
            "nullable": true
          },
          "phone": {
            "type": "string",
            "nullable": true
          },
          "account_type": {
            "type": "string",
            "enum": [
              "consumer",
              "staff"
            ]
          },
          "status": {
            "type": "string"
          }
        }
      },
      "Contact": {
        "type": "object",
        "additionalProperties": true
      },
      "Address": {
        "type": "object",
        "additionalProperties": true
      },
      "Document": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "format": "uuid"
          },
          "doc_type": {
            "type": "string"
          },
          "document_date": {
            "type": "string",
            "format": "date",
            "nullable": true
          },
          "is_expired": {
            "type": "boolean"
          },
          "created_at": {
            "type": "string",
            "format": "date-time"
          }
        }
      },
      "Consent": {
        "type": "object",
        "additionalProperties": true
      },
      "Grant": {
        "type": "object",
        "additionalProperties": true
      },
      "HistoryEvent": {
        "type": "object",
        "additionalProperties": true
      },
      "Notification": {
        "type": "object",
        "additionalProperties": true
      },
      "Session": {
        "type": "object",
        "properties": {
          "session_id": {
            "type": "string"
          },
          "session_url": {
            "type": "string",
            "format": "uri"
          },
          "status": {
            "type": "string"
          },
          "expires_at": {
            "type": "string",
            "format": "date-time"
          }
        }
      }
    }
  },
  "paths": {
    "/health": {
      "get": {
        "tags": [
          "System"
        ],
        "summary": "Health check",
        "security": [],
        "responses": {
          "200": {
            "description": "Service is healthy"
          }
        }
      }
    },
    "/oauth/metadata": {
      "get": {
        "tags": [
          "OAuth"
        ],
        "summary": "Authorization-server discovery (RFC 8414)",
        "security": [],
        "responses": {
          "200": {
            "description": "Discovery document"
          }
        }
      }
    },
    "/oauth/authorize": {
      "post": {
        "tags": [
          "OAuth"
        ],
        "summary": "Approve or deny an authorization request",
        "description": "Called by the consent UI at /oauth/authorize. Requires a first-party Supabase access token, NOT an API bearer token.",
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "decision",
                  "response_type",
                  "client_id",
                  "redirect_uri",
                  "scope",
                  "code_challenge",
                  "code_challenge_method"
                ],
                "properties": {
                  "decision": {
                    "type": "string",
                    "enum": [
                      "approve",
                      "deny"
                    ]
                  },
                  "response_type": {
                    "type": "string",
                    "enum": [
                      "code"
                    ]
                  },
                  "client_id": {
                    "type": "string"
                  },
                  "redirect_uri": {
                    "type": "string",
                    "format": "uri"
                  },
                  "scope": {
                    "type": "string"
                  },
                  "state": {
                    "type": "string"
                  },
                  "code_challenge": {
                    "type": "string",
                    "minLength": 43,
                    "maxLength": 128
                  },
                  "code_challenge_method": {
                    "type": "string",
                    "enum": [
                      "S256"
                    ]
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Decision recorded; client should navigate to redirect_to.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "redirect_to"
                  ],
                  "properties": {
                    "redirect_to": {
                      "type": "string",
                      "format": "uri"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/oauth/token": {
      "post": {
        "tags": [
          "OAuth"
        ],
        "summary": "Exchange credentials/code for an access token",
        "security": [
          {
            "basicAuth": []
          },
          {}
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "required": [
                  "grant_type"
                ],
                "properties": {
                  "grant_type": {
                    "type": "string",
                    "enum": [
                      "authorization_code",
                      "client_credentials",
                      "refresh_token"
                    ]
                  },
                  "code": {
                    "type": "string"
                  },
                  "redirect_uri": {
                    "type": "string",
                    "format": "uri"
                  },
                  "code_verifier": {
                    "type": "string"
                  },
                  "client_id": {
                    "type": "string"
                  },
                  "client_secret": {
                    "type": "string"
                  },
                  "scope": {
                    "type": "string"
                  },
                  "refresh_token": {
                    "type": "string"
                  }
                }
              }
            },
            "application/json": {
              "schema": {
                "type": "object",
                "additionalProperties": true
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Issued token",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenResponse"
                }
              }
            }
          },
          "400": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/oauth/revoke": {
      "post": {
        "tags": [
          "OAuth"
        ],
        "summary": "Revoke a token (RFC 7009)",
        "security": [
          {
            "basicAuth": []
          },
          {}
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "required": [
                  "token"
                ],
                "properties": {
                  "token": {
                    "type": "string"
                  },
                  "token_type_hint": {
                    "type": "string",
                    "enum": [
                      "access_token",
                      "refresh_token"
                    ]
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Revoked (or unknown token — RFC 7009 returns 200 either way)."
          }
        }
      }
    },
    "/oauth/introspect": {
      "post": {
        "tags": [
          "OAuth"
        ],
        "summary": "Introspect a token (RFC 7662)",
        "security": [
          {
            "basicAuth": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "required": [
                  "token"
                ],
                "properties": {
                  "token": {
                    "type": "string"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Introspection result",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "active"
                  ],
                  "properties": {
                    "active": {
                      "type": "boolean"
                    },
                    "sub": {
                      "type": "string"
                    },
                    "scope": {
                      "type": "string"
                    },
                    "exp": {
                      "type": "integer"
                    },
                    "client_id": {
                      "type": "string"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "Echo the authenticated principal",
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "responses": {
          "200": {
            "description": "Claims summary"
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/profile": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "Read the consumer's profile",
        "security": [
          {
            "bearerAuth": [
              "consumer.profile.read"
            ]
          }
        ],
        "responses": {
          "200": {
            "description": "Profile",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Profile"
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      },
      "patch": {
        "tags": [
          "Me"
        ],
        "summary": "Update the consumer's profile",
        "security": [
          {
            "bearerAuth": [
              "consumer.profile.write"
            ]
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "additionalProperties": true
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Updated profile"
          },
          "400": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/contacts": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "List the consumer's contact channels",
        "security": [
          {
            "bearerAuth": [
              "consumer.profile.read"
            ]
          }
        ],
        "responses": {
          "200": {
            "description": "Contacts",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/Contact"
                  }
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/addresses": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "List the consumer's addresses",
        "security": [
          {
            "bearerAuth": [
              "consumer.profile.read"
            ]
          }
        ],
        "responses": {
          "200": {
            "description": "Addresses",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/Address"
                  }
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/documents": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "List the consumer's documents",
        "security": [
          {
            "bearerAuth": [
              "consumer.documents.read"
            ]
          }
        ],
        "responses": {
          "200": {
            "description": "Documents (storage_path is never returned)",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/Document"
                  }
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/documents/{id}/download": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "Get a short-lived signed URL for a document",
        "security": [
          {
            "bearerAuth": [
              "consumer.documents.read"
            ]
          }
        ],
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Signed URL"
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "404": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/consents": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "List pending and historical consent sessions",
        "security": [
          {
            "bearerAuth": [
              "consumer.consent.read"
            ]
          }
        ],
        "responses": {
          "200": {
            "description": "Consents",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/Consent"
                  }
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/consents/{id}/revoke": {
      "post": {
        "tags": [
          "Me"
        ],
        "summary": "Revoke a consent grant",
        "security": [
          {
            "bearerAuth": [
              "consumer.grants.revoke"
            ]
          }
        ],
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Revoked"
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "404": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/grants": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "List consent grants the consumer has issued",
        "security": [
          {
            "bearerAuth": [
              "consumer.grants.read"
            ]
          }
        ],
        "responses": {
          "200": {
            "description": "Grants",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/Grant"
                  }
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/history": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "Activity history for the consumer",
        "security": [
          {
            "bearerAuth": [
              "consumer.history.read"
            ]
          }
        ],
        "responses": {
          "200": {
            "description": "History events",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/HistoryEvent"
                  }
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/me/notifications": {
      "get": {
        "tags": [
          "Me"
        ],
        "summary": "List notifications addressed to the consumer",
        "security": [
          {
            "bearerAuth": [
              "consumer.notifications.read"
            ]
          }
        ],
        "responses": {
          "200": {
            "description": "Notifications",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/Notification"
                  }
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/sessions": {
      "post": {
        "tags": [
          "Sessions"
        ],
        "summary": "Create a consent session (secret-client S2S)",
        "security": [
          {
            "basicAuth": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "additionalProperties": true
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Created session",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Session"
                }
              }
            }
          },
          "400": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/sessions/embed": {
      "post": {
        "tags": [
          "Sessions"
        ],
        "summary": "Create an embed session (public client + Origin allowlist)",
        "security": [],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "additionalProperties": true
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Created embed session"
          },
          "400": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/sessions/{id}": {
      "get": {
        "tags": [
          "Sessions"
        ],
        "summary": "Read a session by id",
        "security": [
          {
            "basicAuth": []
          },
          {
            "bearerAuth": [
              "sessions.read"
            ]
          }
        ],
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Session"
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "404": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/sessions/{id}/data": {
      "get": {
        "tags": [
          "Sessions"
        ],
        "summary": "Read the consented data for a session",
        "security": [
          {
            "basicAuth": []
          },
          {
            "bearerAuth": [
              "sessions.read"
            ]
          }
        ],
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Session data"
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "404": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/sessions/{id}/revoke": {
      "post": {
        "tags": [
          "Sessions"
        ],
        "summary": "Revoke an issued session",
        "security": [
          {
            "basicAuth": []
          },
          {
            "bearerAuth": [
              "sessions.revoke"
            ]
          }
        ],
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Revoked"
          },
          "401": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "404": {
            "description": "Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    }
  },
  "x-scopes": {
    "consumer.profile.read": "Read the consumer's profile, contacts, and addresses.",
    "consumer.profile.write": "Update the consumer's profile, contacts, and addresses.",
    "consumer.documents.read": "List and download the consumer's documents.",
    "consumer.documents.write": "Upload and delete the consumer's documents.",
    "consumer.grants.read": "List consent grants the consumer has issued.",
    "consumer.grants.revoke": "Revoke a consent grant the consumer has issued.",
    "consumer.history.read": "Read activity history for the consumer.",
    "consumer.notifications.read": "Read notifications addressed to the consumer.",
    "consumer.notifications.write": "Mark notifications as read for the consumer.",
    "consumer.consent.read": "Inspect pending consent sessions for the consumer.",
    "consumer.consent.respond": "Approve or deny a pending consent session.",
    "partner.products.read": "List the partner's products.",
    "partner.products.write": "Create, update, and delete the partner's products.",
    "partner.members.read": "List the partner's staff members.",
    "partner.members.write": "Invite, update, and remove the partner's staff members.",
    "partner.api_keys.read": "List the partner's API client metadata.",
    "partner.api_keys.write": "Create or revoke the partner's API clients.",
    "partner.webhooks.read": "List the partner's webhooks and delivery history.",
    "partner.webhooks.write": "Create, update, delete, and test the partner's webhooks.",
    "partner.billing.read": "Read the partner's billing summary and usage.",
    "partner.requests.read": "List inbound consent/application requests for the partner.",
    "partner.requests.write": "Act on inbound requests for the partner.",
    "sessions.create": "Create application sessions for a partner.",
    "sessions.read": "Read application sessions and consented data.",
    "sessions.revoke": "Revoke an application session."
  }
}