openapi: 3.0.1
info:
  x-metadata:
    tags:
      - Class Partner
  title: User
  version: '1.0'
  description: >-
    - Retrieve the authenticated user's identity claims and Class profile.

    - Validate an access token and return its metadata.

    - Query the user's party roles based on a specific fund or authorised scope
    url.



    <div class="env-panel" data-component-name="EnvPanel"><div
    class="env-panel__header">Servers</div><div class="env-panel__body"><div
    class="env-row"><div class="env-name">Partner Integration Environment
    (Sandbox)</div><div class="env-url-row"><span
    class="env-url">https://apigateway.class-pie.com.au/api/1.0</span><button
    type="button" class="copy-btn"
    data-copy="https://apigateway.class-pie.com.au/api/1.0"
    aria-label="Copy"><svg viewBox="0 0 16 16" fill="none"
    xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><path
    fill-rule="evenodd" clip-rule="evenodd" d="M5.16667 2.66667C5.16667 2.57462
    5.24129 2.5 5.33333 2.5H12C12.092 2.5 12.1667 2.57462 12.1667
    2.66667V10.6667C12.1667 10.7587 12.092 10.8333 12 10.8333H10H5.33333C5.24129
    10.8333 5.16667 10.7587 5.16667 10.6667V4.66667V2.66667ZM4.16667
    4.16667V2.66667C4.16667 2.02233 4.689 1.5 5.33333 1.5H12C12.6443 1.5 13.1667
    2.02233 13.1667 2.66667V10.6667C13.1667 11.311 12.6443 11.8333 12
    11.8333H10.5V13.3333C10.5 13.6428 10.3771 13.9395 10.1583 14.1583C9.9395
    14.3771 9.64275 14.5 9.33333 14.5H2.66667C2.35725 14.5 2.0605 14.3771
    1.84171 14.1583C1.62292 13.9395 1.5 13.6428 1.5 13.3333V5.33333C1.5 5.02391
    1.62292 4.72717 1.84171 4.50838C2.0605 4.28958 2.35725 4.16667 2.66667
    4.16667H4.16667ZM9.5 11.8333V13.3333C9.5 13.3775 9.48244 13.4199 9.45118
    13.4512C9.41993 13.4824 9.37754 13.5 9.33333 13.5H2.66667C2.62246 13.5
    2.58007 13.4824 2.54882 13.4512C2.51756 13.4199 2.5 13.3775 2.5
    13.3333V5.33333C2.5 5.28913 2.51756 5.24674 2.54882 5.21548C2.58007 5.18423
    2.62246 5.16667 2.66667 5.16667H4.16667V10.6667C4.16667 11.311 4.689 11.8333
    5.33333 11.8333H9.5Z" fill="currentColor"/></svg></button></div></div><div
    class="env-row"><div class="env-name">Production Environment</div><div
    class="env-url-row"><span
    class="env-url">https://apigateway.class.com.au/api/1.0</span><button
    type="button" class="copy-btn"
    data-copy="https://apigateway.class.com.au/api/1.0" aria-label="Copy"><svg
    viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"
    aria-hidden="true"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.16667
    2.66667C5.16667 2.57462 5.24129 2.5 5.33333 2.5H12C12.092 2.5 12.1667
    2.57462 12.1667 2.66667V10.6667C12.1667 10.7587 12.092 10.8333 12
    10.8333H10H5.33333C5.24129 10.8333 5.16667 10.7587 5.16667
    10.6667V4.66667V2.66667ZM4.16667 4.16667V2.66667C4.16667 2.02233 4.689 1.5
    5.33333 1.5H12C12.6443 1.5 13.1667 2.02233 13.1667 2.66667V10.6667C13.1667
    11.311 12.6443 11.8333 12 11.8333H10.5V13.3333C10.5 13.6428 10.3771 13.9395
    10.1583 14.1583C9.9395 14.3771 9.64275 14.5 9.33333 14.5H2.66667C2.35725
    14.5 2.0605 14.3771 1.84171 14.1583C1.62292 13.9395 1.5 13.6428 1.5
    13.3333V5.33333C1.5 5.02391 1.62292 4.72717 1.84171 4.50838C2.0605 4.28958
    2.35725 4.16667 2.66667 4.16667H4.16667ZM9.5 11.8333V13.3333C9.5 13.3775
    9.48244 13.4199 9.45118 13.4512C9.41993 13.4824 9.37754 13.5 9.33333
    13.5H2.66667C2.62246 13.5 2.58007 13.4824 2.54882 13.4512C2.51756 13.4199
    2.5 13.3775 2.5 13.3333V5.33333C2.5 5.28913 2.51756 5.24674 2.54882
    5.21548C2.58007 5.18423 2.62246 5.16667 2.66667
    5.16667H4.16667V10.6667C4.16667 11.311 4.689 11.8333 5.33333 11.8333H9.5Z"
    fill="currentColor"/></svg></button></div></div></div></div>
servers:
  - url: https://apigateway.class-pie.com.au/api/1.0
    description: Partner Integration Environment (Sandbox)
  - url: https://apigateway.class.com.au/api/1.0
    description: Production Environment
paths:
  /u/connect/userinfo:
    get:
      summary: User info
      description: >
        Returns the identity claims of the authenticated user based on the
        scopes granted during authorisation.


        The response includes standard OpenID Connect claims such as name,
        email, phone number, and address, as well as the user's Class profile
        which contains their business-level role and business details.


        The claims returned depend on the scopes requested during the OAuth
        authorisation flow:

        - `openid` — returns the `sub` (subject identifier).

        - `profile` — returns `name`, `given_name`, `family_name`,
        `middle_name`, and `gender`.

        - `email` — returns `email`.

        - `phone` — returns `phone_number`.

        - `address` — returns the `address` object.

        - `class_profile` — returns the `class_profile` object containing the
        user's Class role and business details.
      operationId: UserInfo
      responses:
        '200':
          description: Success (Ok)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Identity_UserInfoResponse'
              example:
                sub: 007e9c1e-1be8-408b-b538-866cad6d3d09
                email: test.user@class.com.au
                name: Mr Test User
                given_name: Test
                family_name: User
                middle_name: Test
                gender: male
                phone_number: '0292783354'
                address:
                  street_address: 238 Pitt Street
                  locality: Sydney
                  region: NSW
                  postal_code: '2000'
                  country: au
                class_profile:
                  class_role: Access Controller
                  business_name: Sample Business
                  business_code: BUSINESS
                  business_address:
                    street_address: 238 Pitt Street
                    locality: Sydney
                    region: NSW
                    postal_code: '2000'
                    country: au
                  business_phone_number: '0292783354'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of authorization errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/UnauthorizedErrorCommon'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of forbidden access errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/ForbiddenErrorCommon'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of internal server errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/InternalErrorCommon'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of unexpected errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/InternalErrorCommon'
      security:
        - Class_oAuth:
            - openid
  /u/connect/roleinfobyfundid:
    get:
      summary: Role info by fund ID
      description: >
        Returns the authenticated user's party roles for a specific fund,
        identified by its unique fund ID (GUID).


        **Party roles** represent the user's relationship to the fund (e.g.
        `ADVISOR`, `ADMIN`, `TRUSTINDIVIDUAL`, `TRUSTCORPORATE`, `MEMBER`). A
        user can hold multiple party roles on the same fund.


        The fund ID (GUID) can be obtained from the `fund-data/fund-list`
        endpoint response.


        An empty `PartyRoles` array indicates that the authenticated user is not
        set up as a related party on the specified fund.
      operationId: RoleInfoByFundId
      parameters:
        - $ref: '#/components/parameters/fundIdParam'
      responses:
        '200':
          description: Success (Ok)
          content:
            application/json:
              schema:
                type: object
                required:
                  - Data
                properties:
                  Data:
                    description: >-
                      The primary data payload containing the user's role
                      information for the specified fund.
                    $ref: '#/components/schemas/Identity_RoleInfoResponse'
                allOf:
                  - $ref: '#/components/schemas/ApiResponseBase'
              example:
                Data:
                  PartyRoles:
                    - ADVISOR
                    - ADMIN
                    - TRUSTINDIVIDUAL
                  MembershipRoles: []
                Errors: []
        '400':
          description: Error Message
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of validation or request errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of authorization errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/UnauthorizedErrorCommon'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of forbidden access errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/ForbiddenErrorCommon'
        '404':
          description: Resource not available or user does not have access to the fund
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of resource not found errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/ResourceUnavailableErrorCommon'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of internal server errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/InternalErrorCommon'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of unexpected errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/InternalErrorCommon'
      security:
        - Class_oAuth: []
  /u/connect/roleinfobyscopeurl:
    get:
      summary: Role info by scope URL
      description: >
        Returns the authenticated user's party roles based on the scope URL that
        was granted during authorisation.


        The `scopeUrl` parameter specifies the target scope to query. This can
        be at the business or fund level:

        - **Business level:** `b/{businessCode}/` — returns roles for the
        specified business.

        - **Fund level:** `f/{businessCode}/{fundCode}/` — returns roles for the
        specified fund within a business.


        The optional `alt` parameter can be set to `includewriteaccess` to
        include a `ScopeWriteAccess` entry in the `PartyRoles` array if the user
        has write permissions on the specified scope.


        **Party roles** represent the user's relationship to the business or
        fund (e.g. `ADVISOR`, `ADMIN`, `TRUSTINDIVIDUAL`, `TRUSTCORPORATE`,
        `MEMBER`).


        An empty `PartyRoles` array indicates that the authenticated user is not
        set up as a related party on the specified business or fund.
      operationId: RoleInfoByScopeUrl
      parameters:
        - $ref: '#/components/parameters/scopeUrlParam'
        - $ref: '#/components/parameters/altParam'
      responses:
        '200':
          description: Success (Ok)
          content:
            application/json:
              schema:
                type: object
                required:
                  - Data
                properties:
                  Data:
                    description: >-
                      The primary data payload containing the user's role
                      information for the specified scope.
                    $ref: '#/components/schemas/Identity_RoleInfoResponse'
                allOf:
                  - $ref: '#/components/schemas/ApiResponseBase'
              examples:
                businessLevel:
                  summary: Business-level role info
                  description: Returns the user's roles scoped to a business.
                  value:
                    Data:
                      PartyRoles:
                        - ADVISOR
                      MembershipRoles: []
                    Errors: []
                fundLevelWithWriteAccess:
                  summary: Fund-level role info with write access
                  description: >-
                    Returns the user's roles scoped to a specific fund,
                    including write access indicator.
                  value:
                    Data:
                      PartyRoles:
                        - ADVISOR
                        - ADMIN
                        - TRUSTINDIVIDUAL
                        - ScopeWriteAccess
                      MembershipRoles: []
                    Errors: []
        '400':
          description: Error Message
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of validation or request errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of authorization errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/UnauthorizedErrorCommon'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of forbidden access errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/ForbiddenErrorCommon'
        '404':
          description: >-
            Resource not available or user does not have access to the specified
            scope
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of resource not found errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/ResourceUnavailableErrorCommon'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of internal server errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/InternalErrorCommon'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                type: object
                properties:
                  Errors:
                    description: A list of unexpected errors.
                    type: array
                    items:
                      $ref: '#/components/schemas/InternalErrorCommon'
      security:
        - Class_oAuth: []
components:
  parameters:
    fundIdParam:
      name: fundId
      in: query
      required: true
      description: >-
        The unique identifier (GUID) of the fund. This can be obtained from the
        `fund-data/fund-list` endpoint.
      schema:
        type: string
        format: uuid
        example: fffa6ce3-48b6-484b-aaf6-2a2ba5563646
    scopeUrlParam:
      name: scopeUrl
      in: query
      required: true
      description: >
        The target scope URL to query. Use the format `b/{businessCode}/` for
        business-level roles or `f/{businessCode}/{fundCode}/` for fund-level
        roles.
      schema:
        type: string
        example: b/demobusiness/
    altParam:
      name: alt
      in: query
      required: false
      description: >-
        Optional modifier to include additional role information. Set to
        `includewriteaccess` to include a `ScopeWriteAccess` entry in the
        `PartyRoles` array if the user has write permissions.
      schema:
        type: string
        enum:
          - includewriteaccess
        example: includewriteaccess
  schemas:
    Identity_UserInfoResponse:
      type: object
      description: >-
        The identity claims of the authenticated user, including standard OpenID
        Connect claims and the Class profile.
      properties:
        sub:
          type: string
          description: The unique subject identifier for the user.
          example: 007e9c1e-1be8-408b-b538-866cad6d3d09
        email:
          type: string
          format: email
          description: >-
            The user's email address. Returned when the `email` scope is
            granted.
          example: test.user@class.com.au
        name:
          type: string
          description: The user's full display name including title.
          example: Mr Test User
        given_name:
          type: string
          description: The user's first name.
          example: Test
        family_name:
          type: string
          description: The user's last name.
          example: User
        middle_name:
          type: string
          description: The user's middle name.
          example: Test
        gender:
          type: string
          description: The user's gender.
          example: male
        phone_number:
          type: string
          description: The user's phone number. Returned when the `phone` scope is granted.
          example: '0292783354'
        address:
          $ref: '#/components/schemas/Identity_UserAddress'
        class_profile:
          $ref: '#/components/schemas/Identity_ClassProfile'
    Identity_UserAddress:
      type: object
      description: >-
        The user's physical address. Returned when the `address` scope is
        granted.
      properties:
        street_address:
          type: string
          description: The street address including street number and name.
          example: 238 Pitt Street
        locality:
          type: string
          description: The city or suburb.
          example: Sydney
        region:
          type: string
          description: The state or territory.
          example: NSW
        postal_code:
          type: string
          description: The postal code.
          example: '2000'
        country:
          type: string
          description: The ISO country code.
          example: au
    Identity_ClassProfile:
      type: object
      description: >-
        The user's Class-specific profile information including their business
        role and business details. Returned when the `class_profile` scope is
        granted.
      properties:
        class_role:
          type: string
          description: >-
            The user's role within the Class business (e.g. Access Controller,
            Fund Administrator, Fund Auditor).
          example: Access Controller
        business_name:
          type: string
          description: The name of the business the user belongs to.
          example: Sample Business
        business_code:
          type: string
          description: The unique code identifying the business in Class.
          example: BUSINESS
        business_address:
          $ref: '#/components/schemas/Identity_UserAddress'
        business_phone_number:
          type: string
          description: The phone number of the business.
          example: '0292783354'
    Identity_IntrospectionResponse:
      type: object
      description: >-
        The metadata of the current access token, including its validity status
        and granted scopes.
      properties:
        active:
          type: boolean
          description: Whether the token is currently active and valid.
          example: true
        scope:
          type: string
          description: A space-separated list of scopes granted to the token.
          example: >-
            address class_profile email openid phone profile offline_access
            target:b/demofund fund.read
        client_id:
          type: string
          description: The OAuth client identifier that the token was issued to.
          example: f12edeac-gf47-4flp-98b3-ff5g12c5d3aa
        username:
          type: string
          description: The username (email) of the resource owner who authorised the token.
          example: test.user@class.com.au
        token_type:
          type: string
          description: The type of token (e.g. `access_token`).
          example: access_token
        sub:
          type: string
          description: The unique subject identifier of the resource owner.
          example: fe14213c-1042-40d3-becf-dd48bee6af2c
    Identity_RoleInfoResponse:
      type: object
      description: The user's party roles for the specified fund or scope.
      properties:
        PartyRoles:
          type: array
          description: >
            A list of the user's fund-level or business-level party roles.
            Possible values include:

            - `ADVISOR` — Financial adviser linked to the fund or business.

            - `ADMIN` — Administrator of the fund.

            - `TRUSTINDIVIDUAL` — Individual trustee of the fund.

            - `TRUSTCORPORATE` — Director of the corporate trustee.

            - `MEMBER` — Member of the fund.

            - `ScopeWriteAccess` — Indicates the user has write access on the
            scope (only returned when `alt=includewriteaccess` is specified on
            the `roleinfobyscopeurl` endpoint).


            An empty array indicates the authenticated user is not set up as a
            related party on the specified fund or business.
          items:
            type: string
          example:
            - ADVISOR
            - ADMIN
            - TRUSTINDIVIDUAL
        MembershipRoles:
          type: array
          description: Typically empty for standard partner integrations.
          items:
            type: string
          example: []
    ApiResponseBase:
      type: object
      description: >-
        Base response object containing the errors array. All API responses
        include this structure.
      properties:
        Errors:
          type: array
          description: >-
            A list of errors returned by the API. An empty array indicates a
            successful response.
          items:
            $ref: '#/components/schemas/ApiError'
    ApiError:
      type: object
      description: Represents an individual error returned by the API.
      properties:
        Code:
          type: string
          description: A machine-readable error code identifying the type of error.
          example: API_PARAMETER_REQUIRED
        Message:
          type: string
          description: A human-readable description of the error.
          example: Parameter 'scopeUrl' is required
    ErrorResponse:
      type: object
      description: Represents a validation or request error.
      properties:
        Code:
          type: string
          description: A machine-readable error code.
          example: API_PARAMETER_REQUIRED
        Message:
          type: string
          description: A human-readable description of the error.
          example: Parameter 'scopeUrl' is required
    UnauthorizedErrorCommon:
      type: object
      description: >-
        Represents an authorization error, typically when the access token is
        missing, expired, or invalid.
      properties:
        Code:
          type: string
          description: A machine-readable error code.
          example: UNAUTHORIZED
        Message:
          type: string
          description: A human-readable description of the error.
          example: The access token is missing, expired, or invalid.
    ForbiddenErrorCommon:
      type: object
      description: >-
        Represents a forbidden access error, typically when the user does not
        have sufficient permissions.
      properties:
        Code:
          type: string
          description: A machine-readable error code.
          example: FORBIDDEN
        Message:
          type: string
          description: A human-readable description of the error.
          example: The authenticated user does not have access to this resource.
    ResourceUnavailableErrorCommon:
      type: object
      description: >-
        Represents a resource not found error, typically when the specified fund
        or business does not exist or the user does not have access.
      properties:
        Code:
          type: string
          description: A machine-readable error code.
          example: RESOURCE_NOT_FOUND
        Message:
          type: string
          description: A human-readable description of the error.
          example: The requested resource was not found or is not accessible.
    InternalErrorCommon:
      type: object
      description: Represents an internal server error.
      properties:
        Code:
          type: string
          description: A machine-readable error code.
          example: INTERNAL_ERROR
        Message:
          type: string
          description: A human-readable description of the error.
          example: An unexpected error occurred. Please try again later.
  securitySchemes:
    Class_oAuth:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://apigateway.class-pie.com.au/connect/authorize
          tokenUrl: https://apigateway.class-pie.com.au/connect/token
          scopes:
            openid: OpenID Connect identity claims
            profile: User profile claims (name, gender)
            email: User email address
            phone: User phone number
            address: User physical address
            class_profile: Class-specific profile including business role and details
            offline_access: Refresh token support for long-lived sessions
