{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/stormmcp/json-schema/stormmcp-oauth-redirect-request-schema.json",
  "title": "OAuthRedirectRequest",
  "description": "Request model for OAuth redirect URL generation.",
  "x-generated": "2026-11-10",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/stormmcp-oauth-api-openapi.yml#/components/schemas/OAuthRedirectRequest",
  "type": "object",
  "properties": {
    "redirectUrl": {
      "type": [
        "null",
        "string"
      ],
      "description": "Gets or sets the redirect URL where the user should be sent after OAuth completion.\nWhen empty or null, the backend uses Global OAuth (auth.airia.ai) with the callback URL\nderived from the current request's host. When provided, the frontend-relay pattern is used."
    },
    "level": {
      "oneOf": [
        {
          "type": "null"
        },
        {
          "description": "Gets or sets the target level for the OAuth configuration.\nIf not specified, defaults to Personal.",
          "$ref": "#/$defs/Level"
        }
      ]
    },
    "credentialProviderConfigId": {
      "type": [
        "null",
        "string"
      ],
      "description": "Gets or sets the UCS OAuth Provider Configuration ID to use for this redirect.\nWhen provided, overrides the CredentialProviderConfigId stored on the Gateway\nProviderConfiguration. This supports scenarios where multiple OAuth apps exist\nfor the same library and the caller needs to target a specific one.",
      "format": "uuid"
    },
    "replaceExistingConfig": {
      "type": [
        "null",
        "boolean"
      ],
      "description": "    Gets or sets a value indicating whether the existing DCR registration should be\n    replaced with a fresh one for DCR-style providers. When `true` and the integration\n    already has a `CredentialProviderConfigId`, the redirect flow skips the\n    \"reuse existing DCR\" branch and falls through to fresh DCR registration. The\n    existing name-collision recovery (PersonalNameAlreadyExists / TenantNameAlreadyExists)\n    then retires the stale UCS provider configuration before re-registering, which is\n    the equivalent of a Disconnect + Reconnect performed in a single click.\n    Recovery affordance for the case where an upstream OAuth provider has rotated or\ninvalidated a DCR client registration server-side (e.g., Atlassian's hosted MCP):\nthe stored CredentialProviderConfigId is still present in UCS but its\nunderlying client_id no longer authenticates, so a standard \"reuse\" reconnect\nis doomed to fail. Setting this flag forces the gateway to issue a new registration.\n    Has no effect for Manual OAuth integrations (the user-managed\nRemoteManualOAuthConfiguration), since the OAuth client is owned by the user\nand cannot be auto-rotated. Has no effect when no existing integration is present\n(fresh DCR is already the default in that branch).\n    Nullable to defend against under-posting: an absent value is treated as\nfalse (the safe default), distinguishable from an explicit false in\nfuture behavior if needed."
    },
    "uriVariableValues": {
      "type": [
        "null",
        "object"
      ],
      "additionalProperties": {
        "type": "string"
      },
      "description": "Gets or sets personal URI variable values supplied with a reauthenticate\n(bool? OAuthRedirectRequest.ReplaceExistingConfig). A personal key here replaces the stored\nvalue on the new DCR row. Shared keys are left on the stored row."
    },
    "scopes": {
      "type": [
        "null",
        "array"
      ],
      "items": {
        "type": "string"
      },
      "description": "Gets or sets the scopes to request instead of the stored Manual OAuth scopes (MCPG-2016). Lets\nthe scopes editor try an unsaved list. Honoured only when bool? OAuthRedirectRequest.ValidateOnly is set: an\nordinary connect always uses the saved row, so a caller cannot widen an admin-saved scope set.\nIgnored when null or empty."
    },
    "validateOnly": {
      "type": [
        "null",
        "boolean"
      ],
      "description": "Gets or sets a value indicating whether this redirect is a validate-only consent (MCPG-2016):\nthe provider's consent screen is the scope check, and on success the callback deliberately does\nnot exchange the authorization code, so no credential is stored and the current connection is\nuntouched. Requires a saved Manual OAuth configuration with an interactive grant."
    }
  },
  "$defs": {
    "Level": {
      "enum": [
        "Personal",
        "Tenant"
      ]
    }
  }
}