swagger: '2.0'
info:
  title: Auth API
  description: |
    Authentication flows and policies.

    Key endpoints:
    - POST /api/auth/password/forgot/
    - POST /api/auth/password-change/
    - POST /api/auth/login/start/ (example)
    - GET  /api/auth/session-policy/
    - PATCH/PUT /api/auth/session-policy/
    - GET  /api/auth/session-policy/effective[?as_simplejwt=true]
  contact:
    email: eomoro@krb.go.ke
  license:
    name: BSD License
  version: v1
host: aprpms.devsgraphics.com
schemes:
- http
basePath: /api/auth
consumes:
- application/json
produces:
- application/json
securityDefinitions:
  Basic:
    type: basic
security:
- Basic: []
paths:
  /accesslist-moderation/{id}/reject/:
    post:
      operationId: accesslist-moderation_reject
      description: Admin-only moderation actions for AccessList entries.
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/Empty'
      responses:
        '201':
          description: ''
          schema:
            $ref: '#/definitions/Empty'
      tags:
      - accesslist-moderation
    parameters:
    - name: id
      in: path
      description: A UUID string identifying this Access List Entry.
      required: true
      type: string
      format: uuid
  /accesslist-moderation/{id}/verify/:
    post:
      operationId: accesslist-moderation_verify
      description: Admin-only moderation actions for AccessList entries.
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/Empty'
      responses:
        '201':
          description: ''
          schema:
            $ref: '#/definitions/Empty'
      tags:
      - accesslist-moderation
    parameters:
    - name: id
      in: path
      description: A UUID string identifying this Access List Entry.
      required: true
      type: string
      format: uuid
  /active-sessions/:
    get:
      operationId: auth_active_sessions_list
      summary: List active sessions (DB Sessions)
      description: |-
        Lists all currently active DB-backed sessions and the associated users.
        Admin-only for safety.
      parameters: []
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/ActiveSessionList'
      tags:
      - active-sessions
    parameters: []
  /admin-add-user/:
    post:
      operationId: admin-add-user_create
      description: 'Admin-only: Create a user directly and email a set-password link.'
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/AdminAddUser'
      responses:
        '201':
          description: ''
          schema:
            $ref: '#/definitions/AdminAddUser'
      tags:
      - admin-add-user
    parameters: []
  /login-attempts/:
    get:
      operationId: auth_login_attempts_list
      summary: List login attempts (read-only)
      description: |-
        Read-only audit of login attempts. Admin-only.
        Supports lightweight filtering via query params:
          - ?method=PASSWORD|OTP
          - ?stage=CREDENTIAL_SUBMIT|OTP_REQUEST|OTP_VERIFY
          - ?status=SUCCESS|FAILURE
          - ?user_id=<uuid>
          - ?q=<search text>  (username_or_email, ip, ua, reason)
          - ?date_from=YYYY-MM-DDTHH:MM:SS  (inclusive)
          - ?date_to=YYYY-MM-DDTHH:MM:SS    (inclusive)
      parameters:
      - name: page
        in: query
        description: A page number within the paginated result set.
        required: false
        type: integer
      - name: page_size
        in: query
        description: Number of results to return per page.
        required: false
        type: integer
      responses:
        '200':
          description: ''
          schema:
            type: array
            items:
              $ref: '#/definitions/LoginAttempt'
      tags:
      - login-attempts
    parameters: []
  /login-attempts/{id}/:
    get:
      operationId: auth_login_attempts_retrieve
      summary: Retrieve a login attempt
      description: |-
        Read-only audit of login attempts. Admin-only.
        Supports lightweight filtering via query params:
          - ?method=PASSWORD|OTP
          - ?stage=CREDENTIAL_SUBMIT|OTP_REQUEST|OTP_VERIFY
          - ?status=SUCCESS|FAILURE
          - ?user_id=<uuid>
          - ?q=<search text>  (username_or_email, ip, ua, reason)
          - ?date_from=YYYY-MM-DDTHH:MM:SS  (inclusive)
          - ?date_to=YYYY-MM-DDTHH:MM:SS    (inclusive)
      parameters: []
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/LoginAttempt'
      tags:
      - login-attempts
    parameters:
    - name: id
      in: path
      description: A UUID string identifying this Login Attempt.
      required: true
      type: string
      format: uuid
  /login-policy/:
    get:
      operationId: auth_login_policy_get
      summary: Get current login policy (with effective snapshot)
      description: Admin-editable singleton policy.
      parameters: []
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/LoginPolicy'
      tags:
      - login-policy
    parameters: []
  /login-policy/effective/:
    get:
      operationId: auth_login_policy_effective
      summary: Get effective runtime policy (cached snapshot)
      description: Admin-editable singleton policy.
      parameters: []
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/EffectiveLoginPolicy'
      tags:
      - login-policy
    parameters: []
  /login-policy/update/:
    put:
      operationId: login-policy_update_update
      description: Admin-editable singleton policy.
      parameters: []
      responses:
        '200':
          description: ''
      tags:
      - login-policy
    patch:
      operationId: auth_login_policy_update
      summary: Update login policy (singleton)
      description: Admin-editable singleton policy.
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/LoginPolicy'
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/LoginPolicy'
      tags:
      - login-policy
    parameters: []
  /login/login/start/:
    post:
      operationId: auth_login_start
      summary: Start login (check password, then issue OTP)
      description: |-
        Password-first OTP login.

        Flow
        ----
        1) POST /api/auth/login/login/start/  {username_or_email, password}
           - Validates credentials + lockout.
           - Server chooses OTP with purpose="LOGIN" and fixed channel (EMAIL|SMS).
           - Returns OTP envelope (id, expires_at, etc).
        2) POST /api/auth/login/login/verify/ {id, code}
           - On success, returns { user, tokens } (SimpleJWT access+refresh).

        Security
        --------
        - Public endpoints (no authentication classes).
        - Rate-limited by LoginStartThrottle / LoginVerifyThrottle.
        - Lockout policy via LoginPolicy + user.failed_login_attempts / locked_until.
        - Audit is written to LoginAttempt with request fingerprint (IP, UA, device, req id).
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/LoginStartAuth'
      responses:
        '201':
          description: ''
          schema:
            $ref: '#/definitions/LoginStartResponse'
        '400':
          description: Validation error
        '429':
          description: Too many requests
      tags:
      - login
    parameters: []
  /login/login/verify/:
    post:
      operationId: auth_login_verify
      summary: Verify OTP (complete login; returns JWT tokens)
      description: |-
        Password-first OTP login.

        Flow
        ----
        1) POST /api/auth/login/login/start/  {username_or_email, password}
           - Validates credentials + lockout.
           - Server chooses OTP with purpose="LOGIN" and fixed channel (EMAIL|SMS).
           - Returns OTP envelope (id, expires_at, etc).
        2) POST /api/auth/login/login/verify/ {id, code}
           - On success, returns { user, tokens } (SimpleJWT access+refresh).

        Security
        --------
        - Public endpoints (no authentication classes).
        - Rate-limited by LoginStartThrottle / LoginVerifyThrottle.
        - Lockout policy via LoginPolicy + user.failed_login_attempts / locked_until.
        - Audit is written to LoginAttempt with request fingerprint (IP, UA, device, req id).
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/LoginVerify'
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/LoginVerifyResponse'
        '400':
          description: Failed
        '429':
          description: Too many requests
      tags:
      - login
    parameters: []
  /password-change/password/change/commit/:
    post:
      operationId: password_change_commit
      summary: Change password — commit
      description: |-
        Change Password (3-step, with OTP):
          1) POST /api/auth/password/change/otp/request/
          2) POST /api/auth/password/change/otp/verify/
          3) POST /api/auth/password/change/commit/
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/PasswordChangeCommit'
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SimpleOK'
      tags:
      - password-change
    parameters: []
  /password-change/password/change/otp/request/:
    post:
      operationId: password_change_otp_request
      summary: Change password — request OTP
      description: |-
        Change Password (3-step, with OTP):
          1) POST /api/auth/password/change/otp/request/
          2) POST /api/auth/password/change/otp/verify/
          3) POST /api/auth/password/change/commit/
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/PasswordChangeOTPRequest'
      responses:
        '202':
          description: ''
          schema:
            $ref: '#/definitions/PasswordChangeOTPRequest'
      tags:
      - password-change
    parameters: []
  /password-change/password/change/otp/verify/:
    post:
      operationId: password_change_otp_verify
      summary: Change password — verify OTP
      description: |-
        Change Password (3-step, with OTP):
          1) POST /api/auth/password/change/otp/request/
          2) POST /api/auth/password/change/otp/verify/
          3) POST /api/auth/password/change/commit/
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/PasswordChangeOTPVerify'
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/TicketResponse'
      tags:
      - password-change
    parameters: []
  /password/password/forgot/:
    post:
      operationId: password_forgot
      summary: Forgot Password (send reset link to email)
      description: Provide username or email. Always responds neutrally (202). In
        development, response may include a 'debug' object with uid/token/url.
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/PasswordForgot'
      responses:
        '202':
          description: ''
          schema:
            $ref: '#/definitions/PasswordForgotResponse'
      tags:
      - password
    parameters: []
  /password/password/reset/:
    post:
      operationId: password_reset
      summary: Reset Password (using uid+token)
      description: Authentication password flows (public).
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/PasswordReset'
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/PasswordResetResponse'
      tags:
      - password
    parameters: []
  /session-policy/current/:
    get:
      operationId: session-policy_current
      summary: Get Session Policy (singleton)
      description: |-
        Singleton endpoints (NO pk required):
          GET   /api/authn/session-policy/
          PATCH /api/authn/session-policy/
          GET   /api/authn/session-policy/effective/
      parameters:
      - name: page
        in: query
        description: A page number within the paginated result set.
        required: false
        type: integer
      - name: page_size
        in: query
        description: Number of results to return per page.
        required: false
        type: integer
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SessionPolicy'
      tags:
      - session-policy
    parameters: []
  /session-policy/effective/:
    get:
      operationId: session-policy_effective
      summary: Get Effective Session Policy snapshot
      description: |-
        Singleton endpoints (NO pk required):
          GET   /api/authn/session-policy/
          PATCH /api/authn/session-policy/
          GET   /api/authn/session-policy/effective/
      parameters:
      - name: page
        in: query
        description: A page number within the paginated result set.
        required: false
        type: integer
      - name: page_size
        in: query
        description: Number of results to return per page.
        required: false
        type: integer
      - name: as_simplejwt
        in: query
        description: If true, returns a SimpleJWT-ready mapping.
        type: boolean
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/EffectiveSessionPolicy'
      tags:
      - session-policy
    parameters: []
  /session-policy/update_current/:
    patch:
      operationId: session-policy_update_current
      summary: Update Session Policy (partial, singleton)
      description: |-
        Singleton endpoints (NO pk required):
          GET   /api/authn/session-policy/
          PATCH /api/authn/session-policy/
          GET   /api/authn/session-policy/effective/
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/SessionPolicy'
      responses:
        '200':
          description: ''
          schema:
            $ref: '#/definitions/SessionPolicy'
      tags:
      - session-policy
    parameters: []
  /set-password-and-login/:
    post:
      operationId: set-password-and-login_create
      description: |-
        Public endpoint: Accepts uid/token/password, sets the password,
        activates the user, and returns JWT tokens (access & refresh).
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/SetPasswordAndLogin'
      responses:
        '201':
          description: ''
          schema:
            $ref: '#/definitions/SetPasswordAndLogin'
      tags:
      - set-password-and-login
    parameters: []
  /signup/:
    post:
      operationId: auth_signup
      summary: Sign up (Access List)
      description: |-
        Public Sign-Up endpoint that records a self-registration into AccessList.
        No User is created here. Always returns a neutral confirmation payload.
      parameters:
      - name: data
        in: body
        required: true
        schema:
          $ref: '#/definitions/Signup'
      responses:
        '201':
          description: ''
          schema:
            $ref: '#/definitions/SignupResponse'
      tags:
      - signup
    parameters: []
definitions:
  Empty:
    type: object
    properties: {}
  ActiveSessionItem:
    required:
    - id
    - username
    - email
    - session_key
    - expires
    type: object
    properties:
      id:
        title: Id
        type: string
        minLength: 1
      username:
        title: Username
        type: string
        minLength: 1
      email:
        title: Email
        type: string
        format: email
        minLength: 1
      session_key:
        title: Session key
        type: string
        minLength: 1
      expires:
        title: Expires
        type: string
        format: date-time
      ip:
        title: Ip
        type: string
        minLength: 1
        x-nullable: true
      ua:
        title: Ua
        type: string
      last_login:
        title: Last login
        type: string
        format: date-time
        x-nullable: true
  ActiveSessionList:
    required:
    - count
    - results
    type: object
    properties:
      count:
        title: Count
        type: integer
      results:
        type: array
        items:
          $ref: '#/definitions/ActiveSessionItem'
  AdminAddUser:
    required:
    - email
    - first_name
    - last_name
    type: object
    properties:
      email:
        title: Email
        type: string
        format: email
        minLength: 1
      username:
        title: Username
        type: string
      first_name:
        title: First name
        type: string
        minLength: 1
      middle_name:
        title: Middle name
        type: string
      last_name:
        title: Last name
        type: string
        minLength: 1
      designation:
        title: Designation
        type: string
      personal_number:
        title: Personal number
        type: string
      national_id:
        title: National id
        type: string
      mobile_no:
        title: Mobile no
        type: string
      directorate:
        title: Directorate
        type: string
        format: uuid
        x-nullable: true
      department:
        title: Department
        type: string
        format: uuid
        x-nullable: true
      region:
        title: Region
        type: string
        format: uuid
        x-nullable: true
      ok:
        title: Ok
        type: boolean
        readOnly: true
      message:
        title: Message
        type: string
        readOnly: true
        minLength: 1
      user:
        title: User
        type: object
        additionalProperties:
          type: string
          x-nullable: true
        readOnly: true
  LoginAttempt:
    type: object
    properties:
      id:
        title: Id
        type: string
        format: uuid
        readOnly: true
      created_at:
        title: Created at
        type: string
        format: date-time
        readOnly: true
      method:
        title: Method
        description: Login method used (PASSWORD or OTP).
        type: string
        enum:
        - PASSWORD
        - OTP
        readOnly: true
      stage:
        title: Stage
        description: Which step in the flow this record corresponds to.
        type: string
        enum:
        - CREDENTIAL_SUBMIT
        - OTP_REQUEST
        - OTP_VERIFY
        readOnly: true
      status:
        title: Status
        description: Attempt outcome (success/failure).
        type: string
        enum:
        - SUCCESS
        - FAILURE
        readOnly: true
      reason:
        title: Reason
        description: Optional machine reason (e.g. invalid_credentials, invalid_code,
          expired, locked).
        type: string
        readOnly: true
        minLength: 1
      username_or_email:
        title: Username or email
        description: Identifier submitted by client (username/email/phone).
        type: string
        readOnly: true
        minLength: 1
      user:
        title: User
        type: string
        readOnly: true
      otp_id:
        title: Otp id
        description: OTP code ID (if applicable).
        type: string
        format: uuid
        readOnly: true
        x-nullable: true
      otp_channel:
        title: Otp channel
        description: OTP channel if applicable (EMAIL/SMS).
        type: string
        readOnly: true
        minLength: 1
      otp_destination:
        title: Otp destination
        description: OTP destination (email/phone) if applicable.
        type: string
        readOnly: true
        minLength: 1
      ip_address:
        title: Ip address
        description: Client IP address.
        type: string
        readOnly: true
        minLength: 1
        x-nullable: true
      user_agent:
        title: User agent
        description: User-Agent header for device/browser fingerprinting.
        type: string
        readOnly: true
        minLength: 1
      device_id:
        title: Device id
        description: Optional client-provided device ID / fingerprint.
        type: string
        readOnly: true
        minLength: 1
      request_id:
        title: Request id
        description: Optional correlation/request ID for tracing.
        type: string
        readOnly: true
        minLength: 1
  LoginPolicy:
    type: object
    properties:
      max_failed_attempts:
        title: Max failed attempts
        description: Number of failed login verifications allowed before user is locked.
        type: integer
        maximum: 32767
        minimum: 0
      lockout_minutes:
        title: Lockout minutes
        description: How long (minutes) a user remains locked once threshold is reached.
        type: integer
        maximum: 2147483647
        minimum: 0
      attempts_window_minutes:
        title: Attempts window minutes
        description: Rolling time window (minutes) to count failed attempts.
        type: integer
        maximum: 2147483647
        minimum: 0
      reset_attempts_after_minutes:
        title: Reset attempts after minutes
        description: If no attempts within this period, failure counter may be reset.
        type: integer
        maximum: 2147483647
        minimum: 0
      auto_unlock:
        title: Auto unlock
        description: If enabled, users auto-unlock when lockout period elapses.
        type: boolean
      effective:
        title: Effective
        type: object
        readOnly: true
  EffectiveLoginPolicy:
    required:
    - max_failed_attempts
    - lockout_minutes
    - attempts_window_minutes
    - auto_unlock
    - reset_attempts_after_minutes
    type: object
    properties:
      max_failed_attempts:
        title: Max failed attempts
        type: integer
      lockout_minutes:
        title: Lockout minutes
        type: integer
      attempts_window_minutes:
        title: Attempts window minutes
        type: integer
      auto_unlock:
        title: Auto unlock
        type: boolean
      reset_attempts_after_minutes:
        title: Reset attempts after minutes
        type: integer
  LoginStartAuth:
    required:
    - username_or_email
    - password
    type: object
    properties:
      username_or_email:
        title: Username or email
        type: string
        minLength: 1
      password:
        title: Password
        type: string
        minLength: 1
  LoginStartResponse:
    required:
    - id
    - purpose
    - channel
    - destination
    - status
    - expires_at
    type: object
    properties:
      id:
        title: Id
        type: string
        format: uuid
      purpose:
        title: Purpose
        type: string
        minLength: 1
      channel:
        title: Channel
        type: string
        minLength: 1
      destination:
        title: Destination
        type: string
        minLength: 1
      status:
        title: Status
        type: string
        minLength: 1
      expires_at:
        title: Expires at
        type: string
        format: date-time
      sent_at:
        title: Sent at
        type: string
        format: date-time
        x-nullable: true
      code:
        title: Code
        type: string
        minLength: 1
  LoginVerify:
    required:
    - id
    - code
    type: object
    properties:
      id:
        title: Id
        type: string
        format: uuid
      code:
        title: Code
        type: string
        minLength: 1
  LoginVerifyUser:
    required:
    - id
    type: object
    properties:
      id:
        title: Id
        type: string
        minLength: 1
      username:
        title: Username
        type: string
        minLength: 1
        x-nullable: true
      email:
        title: Email
        type: string
        format: email
        minLength: 1
        x-nullable: true
  Tokens:
    required:
    - token_type
    - access
    - refresh
    - expires_in
    type: object
    properties:
      token_type:
        title: Token type
        type: string
        minLength: 1
      access:
        title: Access
        type: string
        minLength: 1
      refresh:
        title: Refresh
        type: string
        minLength: 1
      expires_in:
        title: Expires in
        type: integer
  LoginVerifyResponse:
    required:
    - ok
    - reason
    type: object
    properties:
      ok:
        title: Ok
        type: boolean
      reason:
        title: Reason
        type: string
        minLength: 1
      user:
        $ref: '#/definitions/LoginVerifyUser'
      tokens:
        $ref: '#/definitions/Tokens'
  PasswordChangeCommit:
    required:
    - ticket
    - current_password
    - new_password
    - confirm_password
    type: object
    properties:
      ticket:
        title: Ticket
        type: string
        minLength: 1
      current_password:
        title: Current password
        type: string
        minLength: 1
      new_password:
        title: New password
        type: string
        minLength: 1
      confirm_password:
        title: Confirm password
        type: string
        minLength: 1
      ok:
        title: Ok
        type: boolean
        readOnly: true
  SimpleOK:
    required:
    - ok
    type: object
    properties:
      ok:
        title: Ok
        type: boolean
  PasswordChangeOTPRequest:
    type: object
    properties:
      channel:
        title: Channel
        description: Defaults to EMAIL
        type: string
        enum:
        - SMS
        - EMAIL
      id:
        title: Id
        type: string
        format: uuid
        readOnly: true
      purpose:
        title: Purpose
        type: string
        readOnly: true
        minLength: 1
      channel_out:
        title: Channel out
        type: string
        readOnly: true
        minLength: 1
      destination:
        title: Destination
        type: string
        readOnly: true
        minLength: 1
      status:
        title: Status
        type: string
        readOnly: true
        minLength: 1
      expires_at:
        title: Expires at
        type: string
        format: date-time
        readOnly: true
      sent_at:
        title: Sent at
        type: string
        format: date-time
        readOnly: true
        x-nullable: true
      code:
        title: Code
        type: string
        readOnly: true
        minLength: 1
  PasswordChangeOTPVerify:
    required:
    - id
    - code
    type: object
    properties:
      id:
        title: Id
        type: string
        format: uuid
      code:
        title: Code
        type: string
        minLength: 1
      ok:
        title: Ok
        type: boolean
        readOnly: true
      ticket:
        title: Ticket
        type: string
        readOnly: true
        minLength: 1
      expires_at:
        title: Expires at
        type: string
        format: date-time
        readOnly: true
  TicketResponse:
    required:
    - ok
    - ticket
    - expires_at
    type: object
    properties:
      ok:
        title: Ok
        type: boolean
      ticket:
        title: Ticket
        type: string
        minLength: 1
      expires_at:
        title: Expires at
        type: string
        format: date-time
  PasswordForgot:
    required:
    - username_or_email
    type: object
    properties:
      username_or_email:
        title: Username or email
        type: string
        minLength: 1
      ok:
        title: Ok
        type: boolean
        readOnly: true
      message:
        title: Message
        type: string
        readOnly: true
        minLength: 1
      debug:
        title: Debug
        type: object
        additionalProperties:
          type: string
          x-nullable: true
        readOnly: true
  PasswordForgotResponse:
    required:
    - ok
    - message
    type: object
    properties:
      ok:
        title: Ok
        type: boolean
      message:
        title: Message
        type: string
        minLength: 1
      debug:
        title: Debug
        type: object
        additionalProperties:
          type: string
          x-nullable: true
  PasswordReset:
    required:
    - uid
    - token
    - new_password
    - confirm_password
    type: object
    properties:
      uid:
        title: Uid
        type: string
        minLength: 1
      token:
        title: Token
        type: string
        minLength: 1
      new_password:
        title: New password
        type: string
        minLength: 1
      confirm_password:
        title: Confirm password
        type: string
        minLength: 1
      ok:
        title: Ok
        type: boolean
        readOnly: true
      message:
        title: Message
        type: string
        readOnly: true
        minLength: 1
  PasswordResetResponse:
    required:
    - ok
    - message
    type: object
    properties:
      ok:
        title: Ok
        type: boolean
      message:
        title: Message
        type: string
        minLength: 1
  SessionPolicy:
    required:
    - access_token_minutes
    - refresh_token_days
    - rotate_refresh_tokens
    - blacklist_after_rotation
    - auth_header_types
    type: object
    properties:
      access_token_minutes:
        title: Access token minutes
        type: integer
        minimum: 1
      refresh_token_days:
        title: Refresh token days
        type: integer
        minimum: 1
      rotate_refresh_tokens:
        title: Rotate refresh tokens
        type: boolean
      blacklist_after_rotation:
        title: Blacklist after rotation
        type: boolean
      auth_header_types:
        type: array
        items:
          type: string
          minLength: 1
  EffectiveSessionPolicy:
    required:
    - access_token_minutes
    - refresh_token_days
    - rotate_refresh_tokens
    - blacklist_after_rotation
    - auth_header_types
    type: object
    properties:
      access_token_minutes:
        title: Access token minutes
        type: integer
      refresh_token_days:
        title: Refresh token days
        type: integer
      rotate_refresh_tokens:
        title: Rotate refresh tokens
        type: boolean
      blacklist_after_rotation:
        title: Blacklist after rotation
        type: boolean
      auth_header_types:
        type: array
        items:
          type: string
          minLength: 1
  SetPasswordAndLogin:
    required:
    - uid
    - token
    - password
    type: object
    properties:
      uid:
        title: Uid
        type: string
        minLength: 1
      token:
        title: Token
        type: string
        minLength: 1
      password:
        title: Password
        type: string
        minLength: 8
      ok:
        title: Ok
        type: boolean
        readOnly: true
      message:
        title: Message
        type: string
        readOnly: true
        minLength: 1
      access:
        title: Access
        type: string
        readOnly: true
        minLength: 1
      refresh:
        title: Refresh
        type: string
        readOnly: true
        minLength: 1
      user:
        title: User
        type: object
        additionalProperties:
          type: string
          x-nullable: true
        readOnly: true
  Signup:
    type: object
    properties:
      first_name:
        title: First name
        type: string
      middle_name:
        title: Middle name
        type: string
      last_name:
        title: Last name
        type: string
      email:
        title: Email
        type: string
      phone:
        title: Phone
        type: string
      designation:
        title: Designation
        type: string
      personal_no:
        title: Personal no
        type: string
      national_id:
        title: National id
        type: string
      directorate:
        title: Directorate
        type: string
        format: uuid
        x-nullable: true
      department:
        title: Department
        type: string
        format: uuid
        x-nullable: true
      region:
        title: Region
        type: string
        format: uuid
        x-nullable: true
      ok:
        title: Ok
        type: boolean
        readOnly: true
      message:
        title: Message
        type: string
        readOnly: true
        minLength: 1
      debug:
        title: Debug
        type: object
        additionalProperties:
          type: string
          x-nullable: true
        readOnly: true
  SignupResponse:
    required:
    - ok
    - message
    type: object
    properties:
      ok:
        title: Ok
        type: boolean
      message:
        title: Message
        type: string
        minLength: 1
      debug:
        title: Debug
        type: object
        additionalProperties:
          type: string
          x-nullable: true
