{ "openapi": "3.0.1", "info": { "x-metadata": { "tags": [ "Class Partner" ] }, "title": "User", "version": "1.0", "description": "- Retrieve the authenticated user's identity claims and Class profile.\n- Validate an access token and return its metadata.\n- Query the user's party roles based on a specific fund or authorised scope url.\n\n\n
Servers
Partner Integration Environment (Sandbox)
https://apigateway.class-pie.com.au/api/1.0
Production Environment
https://apigateway.class.com.au/api/1.0
" }, "servers": [ { "url": "https://apigateway.class-pie.com.au/api/1.0", "description": "Partner Integration Environment (Sandbox)" }, { "url": "https://apigateway.class.com.au/api/1.0", "description": "Production Environment" } ], "paths": { "/u/connect/userinfo": { "get": { "summary": "User info", "description": "Returns the identity claims of the authenticated user based on the scopes granted during authorisation.\n\nThe response includes standard OpenID Connect claims such as name, email, phone number, and address, as well as the user's Class profile which contains their business-level role and business details.\n\nThe claims returned depend on the scopes requested during the OAuth authorisation flow:\n- `openid` — returns the `sub` (subject identifier).\n- `profile` — returns `name`, `given_name`, `family_name`, `middle_name`, and `gender`.\n- `email` — returns `email`.\n- `phone` — returns `phone_number`.\n- `address` — returns the `address` object.\n- `class_profile` — returns the `class_profile` object containing the user's Class role and business details.\n", "operationId": "UserInfo", "responses": { "200": { "description": "Success (Ok)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Identity_UserInfoResponse" }, "example": { "sub": "007e9c1e-1be8-408b-b538-866cad6d3d09", "email": "test.user@class.com.au", "name": "Mr Test User", "given_name": "Test", "family_name": "User", "middle_name": "Test", "gender": "male", "phone_number": "0292783354", "address": { "street_address": "238 Pitt Street", "locality": "Sydney", "region": "NSW", "postal_code": "2000", "country": "au" }, "class_profile": { "class_role": "Access Controller", "business_name": "Sample Business", "business_code": "BUSINESS", "business_address": { "street_address": "238 Pitt Street", "locality": "Sydney", "region": "NSW", "postal_code": "2000", "country": "au" }, "business_phone_number": "0292783354" } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of authorization errors.", "type": "array", "items": { "$ref": "#/components/schemas/UnauthorizedErrorCommon" } } } } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of forbidden access errors.", "type": "array", "items": { "$ref": "#/components/schemas/ForbiddenErrorCommon" } } } } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of internal server errors.", "type": "array", "items": { "$ref": "#/components/schemas/InternalErrorCommon" } } } } } } }, "default": { "description": "Unexpected error", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of unexpected errors.", "type": "array", "items": { "$ref": "#/components/schemas/InternalErrorCommon" } } } } } } } }, "security": [ { "Class_oAuth": [ "openid" ] } ] } }, "/u/connect/roleinfobyfundid": { "get": { "summary": "Role info by fund ID", "description": "Returns the authenticated user's party roles for a specific fund, identified by its unique fund ID (GUID).\n\n**Party roles** represent the user's relationship to the fund (e.g. `ADVISOR`, `ADMIN`, `TRUSTINDIVIDUAL`, `TRUSTCORPORATE`, `MEMBER`). A user can hold multiple party roles on the same fund.\n\nThe fund ID (GUID) can be obtained from the `fund-data/fund-list` endpoint response.\n\nAn empty `PartyRoles` array indicates that the authenticated user is not set up as a related party on the specified fund.\n", "operationId": "RoleInfoByFundId", "parameters": [ { "$ref": "#/components/parameters/fundIdParam" } ], "responses": { "200": { "description": "Success (Ok)", "content": { "application/json": { "schema": { "type": "object", "required": [ "Data" ], "properties": { "Data": { "description": "The primary data payload containing the user's role information for the specified fund.", "$ref": "#/components/schemas/Identity_RoleInfoResponse" } }, "allOf": [ { "$ref": "#/components/schemas/ApiResponseBase" } ] }, "example": { "Data": { "PartyRoles": [ "ADVISOR", "ADMIN", "TRUSTINDIVIDUAL" ], "MembershipRoles": [] }, "Errors": [] } } } }, "400": { "description": "Error Message", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of validation or request errors.", "type": "array", "items": { "$ref": "#/components/schemas/ErrorResponse" } } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of authorization errors.", "type": "array", "items": { "$ref": "#/components/schemas/UnauthorizedErrorCommon" } } } } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of forbidden access errors.", "type": "array", "items": { "$ref": "#/components/schemas/ForbiddenErrorCommon" } } } } } } }, "404": { "description": "Resource not available or user does not have access to the fund", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of resource not found errors.", "type": "array", "items": { "$ref": "#/components/schemas/ResourceUnavailableErrorCommon" } } } } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of internal server errors.", "type": "array", "items": { "$ref": "#/components/schemas/InternalErrorCommon" } } } } } } }, "default": { "description": "Unexpected error", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of unexpected errors.", "type": "array", "items": { "$ref": "#/components/schemas/InternalErrorCommon" } } } } } } } }, "security": [ { "Class_oAuth": [] } ] } }, "/u/connect/roleinfobyscopeurl": { "get": { "summary": "Role info by scope URL", "description": "Returns the authenticated user's party roles based on the scope URL that was granted during authorisation.\n\nThe `scopeUrl` parameter specifies the target scope to query. This can be at the business or fund level:\n- **Business level:** `b/{businessCode}/` — returns roles for the specified business.\n- **Fund level:** `f/{businessCode}/{fundCode}/` — returns roles for the specified fund within a business.\n\nThe optional `alt` parameter can be set to `includewriteaccess` to include a `ScopeWriteAccess` entry in the `PartyRoles` array if the user has write permissions on the specified scope.\n\n**Party roles** represent the user's relationship to the business or fund (e.g. `ADVISOR`, `ADMIN`, `TRUSTINDIVIDUAL`, `TRUSTCORPORATE`, `MEMBER`).\n\nAn empty `PartyRoles` array indicates that the authenticated user is not set up as a related party on the specified business or fund.\n", "operationId": "RoleInfoByScopeUrl", "parameters": [ { "$ref": "#/components/parameters/scopeUrlParam" }, { "$ref": "#/components/parameters/altParam" } ], "responses": { "200": { "description": "Success (Ok)", "content": { "application/json": { "schema": { "type": "object", "required": [ "Data" ], "properties": { "Data": { "description": "The primary data payload containing the user's role information for the specified scope.", "$ref": "#/components/schemas/Identity_RoleInfoResponse" } }, "allOf": [ { "$ref": "#/components/schemas/ApiResponseBase" } ] }, "examples": { "businessLevel": { "summary": "Business-level role info", "description": "Returns the user's roles scoped to a business.", "value": { "Data": { "PartyRoles": [ "ADVISOR" ], "MembershipRoles": [] }, "Errors": [] } }, "fundLevelWithWriteAccess": { "summary": "Fund-level role info with write access", "description": "Returns the user's roles scoped to a specific fund, including write access indicator.", "value": { "Data": { "PartyRoles": [ "ADVISOR", "ADMIN", "TRUSTINDIVIDUAL", "ScopeWriteAccess" ], "MembershipRoles": [] }, "Errors": [] } } } } } }, "400": { "description": "Error Message", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of validation or request errors.", "type": "array", "items": { "$ref": "#/components/schemas/ErrorResponse" } } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of authorization errors.", "type": "array", "items": { "$ref": "#/components/schemas/UnauthorizedErrorCommon" } } } } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of forbidden access errors.", "type": "array", "items": { "$ref": "#/components/schemas/ForbiddenErrorCommon" } } } } } } }, "404": { "description": "Resource not available or user does not have access to the specified scope", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of resource not found errors.", "type": "array", "items": { "$ref": "#/components/schemas/ResourceUnavailableErrorCommon" } } } } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of internal server errors.", "type": "array", "items": { "$ref": "#/components/schemas/InternalErrorCommon" } } } } } } }, "default": { "description": "Unexpected error", "content": { "application/json": { "schema": { "type": "object", "properties": { "Errors": { "description": "A list of unexpected errors.", "type": "array", "items": { "$ref": "#/components/schemas/InternalErrorCommon" } } } } } } } }, "security": [ { "Class_oAuth": [] } ] } } }, "components": { "parameters": { "fundIdParam": { "name": "fundId", "in": "query", "required": true, "description": "The unique identifier (GUID) of the fund. This can be obtained from the `fund-data/fund-list` endpoint.", "schema": { "type": "string", "format": "uuid", "example": "fffa6ce3-48b6-484b-aaf6-2a2ba5563646" } }, "scopeUrlParam": { "name": "scopeUrl", "in": "query", "required": true, "description": "The target scope URL to query. Use the format `b/{businessCode}/` for business-level roles or `f/{businessCode}/{fundCode}/` for fund-level roles.\n", "schema": { "type": "string", "example": "b/demobusiness/" } }, "altParam": { "name": "alt", "in": "query", "required": false, "description": "Optional modifier to include additional role information. Set to `includewriteaccess` to include a `ScopeWriteAccess` entry in the `PartyRoles` array if the user has write permissions.", "schema": { "type": "string", "enum": [ "includewriteaccess" ], "example": "includewriteaccess" } } }, "schemas": { "Identity_UserInfoResponse": { "type": "object", "description": "The identity claims of the authenticated user, including standard OpenID Connect claims and the Class profile.", "properties": { "sub": { "type": "string", "description": "The unique subject identifier for the user.", "example": "007e9c1e-1be8-408b-b538-866cad6d3d09" }, "email": { "type": "string", "format": "email", "description": "The user's email address. Returned when the `email` scope is granted.", "example": "test.user@class.com.au" }, "name": { "type": "string", "description": "The user's full display name including title.", "example": "Mr Test User" }, "given_name": { "type": "string", "description": "The user's first name.", "example": "Test" }, "family_name": { "type": "string", "description": "The user's last name.", "example": "User" }, "middle_name": { "type": "string", "description": "The user's middle name.", "example": "Test" }, "gender": { "type": "string", "description": "The user's gender.", "example": "male" }, "phone_number": { "type": "string", "description": "The user's phone number. Returned when the `phone` scope is granted.", "example": "0292783354" }, "address": { "$ref": "#/components/schemas/Identity_UserAddress" }, "class_profile": { "$ref": "#/components/schemas/Identity_ClassProfile" } } }, "Identity_UserAddress": { "type": "object", "description": "The user's physical address. Returned when the `address` scope is granted.", "properties": { "street_address": { "type": "string", "description": "The street address including street number and name.", "example": "238 Pitt Street" }, "locality": { "type": "string", "description": "The city or suburb.", "example": "Sydney" }, "region": { "type": "string", "description": "The state or territory.", "example": "NSW" }, "postal_code": { "type": "string", "description": "The postal code.", "example": "2000" }, "country": { "type": "string", "description": "The ISO country code.", "example": "au" } } }, "Identity_ClassProfile": { "type": "object", "description": "The user's Class-specific profile information including their business role and business details. Returned when the `class_profile` scope is granted.", "properties": { "class_role": { "type": "string", "description": "The user's role within the Class business (e.g. Access Controller, Fund Administrator, Fund Auditor).", "example": "Access Controller" }, "business_name": { "type": "string", "description": "The name of the business the user belongs to.", "example": "Sample Business" }, "business_code": { "type": "string", "description": "The unique code identifying the business in Class.", "example": "BUSINESS" }, "business_address": { "$ref": "#/components/schemas/Identity_UserAddress" }, "business_phone_number": { "type": "string", "description": "The phone number of the business.", "example": "0292783354" } } }, "Identity_IntrospectionResponse": { "type": "object", "description": "The metadata of the current access token, including its validity status and granted scopes.", "properties": { "active": { "type": "boolean", "description": "Whether the token is currently active and valid.", "example": true }, "scope": { "type": "string", "description": "A space-separated list of scopes granted to the token.", "example": "address class_profile email openid phone profile offline_access target:b/demofund fund.read" }, "client_id": { "type": "string", "description": "The OAuth client identifier that the token was issued to.", "example": "f12edeac-gf47-4flp-98b3-ff5g12c5d3aa" }, "username": { "type": "string", "description": "The username (email) of the resource owner who authorised the token.", "example": "test.user@class.com.au" }, "token_type": { "type": "string", "description": "The type of token (e.g. `access_token`).", "example": "access_token" }, "sub": { "type": "string", "description": "The unique subject identifier of the resource owner.", "example": "fe14213c-1042-40d3-becf-dd48bee6af2c" } } }, "Identity_RoleInfoResponse": { "type": "object", "description": "The user's party roles for the specified fund or scope.", "properties": { "PartyRoles": { "type": "array", "description": "A list of the user's fund-level or business-level party roles. Possible values include:\n- `ADVISOR` — Financial adviser linked to the fund or business.\n- `ADMIN` — Administrator of the fund.\n- `TRUSTINDIVIDUAL` — Individual trustee of the fund.\n- `TRUSTCORPORATE` — Director of the corporate trustee.\n- `MEMBER` — Member of the fund.\n- `ScopeWriteAccess` — Indicates the user has write access on the scope (only returned when `alt=includewriteaccess` is specified on the `roleinfobyscopeurl` endpoint).\n\nAn empty array indicates the authenticated user is not set up as a related party on the specified fund or business.\n", "items": { "type": "string" }, "example": [ "ADVISOR", "ADMIN", "TRUSTINDIVIDUAL" ] }, "MembershipRoles": { "type": "array", "description": "Typically empty for standard partner integrations.", "items": { "type": "string" }, "example": [] } } }, "ApiResponseBase": { "type": "object", "description": "Base response object containing the errors array. All API responses include this structure.", "properties": { "Errors": { "type": "array", "description": "A list of errors returned by the API. An empty array indicates a successful response.", "items": { "$ref": "#/components/schemas/ApiError" } } } }, "ApiError": { "type": "object", "description": "Represents an individual error returned by the API.", "properties": { "Code": { "type": "string", "description": "A machine-readable error code identifying the type of error.", "example": "API_PARAMETER_REQUIRED" }, "Message": { "type": "string", "description": "A human-readable description of the error.", "example": "Parameter 'scopeUrl' is required" } } }, "ErrorResponse": { "type": "object", "description": "Represents a validation or request error.", "properties": { "Code": { "type": "string", "description": "A machine-readable error code.", "example": "API_PARAMETER_REQUIRED" }, "Message": { "type": "string", "description": "A human-readable description of the error.", "example": "Parameter 'scopeUrl' is required" } } }, "UnauthorizedErrorCommon": { "type": "object", "description": "Represents an authorization error, typically when the access token is missing, expired, or invalid.", "properties": { "Code": { "type": "string", "description": "A machine-readable error code.", "example": "UNAUTHORIZED" }, "Message": { "type": "string", "description": "A human-readable description of the error.", "example": "The access token is missing, expired, or invalid." } } }, "ForbiddenErrorCommon": { "type": "object", "description": "Represents a forbidden access error, typically when the user does not have sufficient permissions.", "properties": { "Code": { "type": "string", "description": "A machine-readable error code.", "example": "FORBIDDEN" }, "Message": { "type": "string", "description": "A human-readable description of the error.", "example": "The authenticated user does not have access to this resource." } } }, "ResourceUnavailableErrorCommon": { "type": "object", "description": "Represents a resource not found error, typically when the specified fund or business does not exist or the user does not have access.", "properties": { "Code": { "type": "string", "description": "A machine-readable error code.", "example": "RESOURCE_NOT_FOUND" }, "Message": { "type": "string", "description": "A human-readable description of the error.", "example": "The requested resource was not found or is not accessible." } } }, "InternalErrorCommon": { "type": "object", "description": "Represents an internal server error.", "properties": { "Code": { "type": "string", "description": "A machine-readable error code.", "example": "INTERNAL_ERROR" }, "Message": { "type": "string", "description": "A human-readable description of the error.", "example": "An unexpected error occurred. Please try again later." } } } }, "securitySchemes": { "Class_oAuth": { "type": "oauth2", "flows": { "authorizationCode": { "authorizationUrl": "https://apigateway.class-pie.com.au/connect/authorize", "tokenUrl": "https://apigateway.class-pie.com.au/connect/token", "scopes": { "openid": "OpenID Connect identity claims", "profile": "User profile claims (name, gender)", "email": "User email address", "phone": "User phone number", "address": "User physical address", "class_profile": "Class-specific profile including business role and details", "offline_access": "Refresh token support for long-lived sessions" } } } } } } }