{
  "$id": "https://firefox-ci-tc.services.mozilla.com/schemas/auth/v1/authenticate-hawk-response.json#",
  "$schema": "https://firefox-ci-tc.services.mozilla.com/schemas/common/metaschema.json#",
  "description": "Response from a request to authenticate a hawk request.\n",
  "oneOf": [
    {
      "additionalProperties": false,
      "properties": {
        "clientId": {
          "description": "The `clientId` that made this request.  This may be the `id` supplied in\nthe Authorization header, or in the case of a named temporary credential\nmay be embedded in the payload.  In any case, this clientId can be used\nfor logging, auditing, and identifying the credential but **must** not be\nused for access control.  That's what scopes are for.\n",
          "pattern": "^[A-Za-z0-9!@/:.+|_-]+$",
          "type": "string"
        },
        "expires": {
          "description": "The expiration time that the returned scopes are valid for.\nThis should be treated as the latest time at which the authorization\nis valid. For most cases, where the access being authorized occurs\nimmediately, this field can be ignored, as the value will always be\nin the future.\n",
          "format": "date-time",
          "type": "string"
        },
        "hash": {
          "description": "Payload as extracted from `Authentication` header. This property is\nonly present if a hash is available. You are not required to validate\nthis hash, but if you do, please check `scheme` to ensure that it's\non a scheme you support.\n"
        },
        "scheme": {
          "description": "Authentication scheme the client used. Generally, you don't need to\nread this property unless `hash` is provided and you want to validate\nthe payload hash. Additional values may be added in the future.\n",
          "enum": [
            "hawk"
          ],
          "type": "string"
        },
        "scopes": {
          "description": "List of scopes the client is authorized to access.  Scopes must be\ncomposed of printable ASCII characters and spaces.\n",
          "items": {
            "pattern": "^[ -~]*$",
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "status": {
          "description": "If `auth-success`, the request has successfully authenticated.\nThis does not imply authorization (i.e. scope satisfaction not guaranteed).\n",
          "enum": [
            "auth-success"
          ],
          "type": "string"
        }
      },
      "required": [
        "status",
        "scopes",
        "scheme",
        "clientId",
        "expires"
      ],
      "title": "Authentication Successful Response",
      "type": "object"
    },
    {
      "additionalProperties": false,
      "properties": {
        "message": {
          "description": "Message saying why the authentication failed.\n",
          "type": "string"
        },
        "status": {
          "description": "If `auth-failed`, the request failed to authenticate (e.g., invalid credentials).\n",
          "enum": [
            "auth-failed"
          ],
          "type": "string"
        }
      },
      "required": [
        "status",
        "message"
      ],
      "title": "Authentication Failed Response",
      "type": "object"
    },
    {
      "additionalProperties": false,
      "properties": {
        "expires": {
          "description": "The expiration time that the returned scopes are valid for.\nThis should be treated as the latest time at which the authorization\nis valid. For most cases, where the access being authorized occurs\nimmediately, this field can be ignored, as the value will always be\nin the future.\n",
          "format": "date-time",
          "type": "string"
        },
        "scheme": {
          "description": "Authentication scheme the client used. Generally, you don't need to\nread this property unless `hash` is provided and you want to validate\nthe payload hash. Additional values may be added in the future.\n",
          "enum": [
            "none"
          ],
          "type": "string"
        },
        "scopes": {
          "description": "List of scopes the client is authorized to access.  Scopes must be\ncomposed of printable ASCII characters and spaces.\n",
          "items": {
            "pattern": "^[ -~]*$",
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "status": {
          "description": "If `no-auth`, the request provided no credentials or bewit.\n",
          "enum": [
            "no-auth"
          ],
          "type": "string"
        }
      },
      "required": [
        "status",
        "scheme",
        "scopes",
        "expires"
      ],
      "title": "No Authentication Response",
      "type": "object"
    }
  ],
  "title": "Hawk Signature Authentication Response"
}