{
  "type": "record",
  "Aspect": {
    "name": "oauthAuthorizationServerProperties"
  },
  "name": "OAuthAuthorizationServerProperties",
  "namespace": "com.linkedin.pegasus2avro.oauth",
  "fields": [
    {
      "Searchable": {
        "boostScore": 10.0,
        "enableAutocomplete": true,
        "fieldType": "WORD_GRAM"
      },
      "type": "string",
      "name": "displayName",
      "doc": "Display name shown in UI.\nExamples: Glean, Snowflake via Okta, Internal Tools API"
    },
    {
      "Searchable": {
        "fieldType": "TEXT",
        "hasValuesFieldName": "hasDescription"
      },
      "type": [
        "null",
        "string"
      ],
      "name": "description",
      "default": null,
      "doc": "Description of what this authorization server provides access to."
    },
    {
      "type": [
        "null",
        "string"
      ],
      "name": "clientId",
      "default": null,
      "doc": "OAuth client ID (public, safe to expose in UI)."
    },
    {
      "java": {
        "class": "com.linkedin.pegasus2avro.common.urn.Urn"
      },
      "type": [
        "null",
        "string"
      ],
      "name": "clientSecretUrn",
      "default": null,
      "doc": "URN of DataHubSecret containing OAuth client secret.\nNever stored as plain string - always encrypted.",
      "Urn": "Urn"
    },
    {
      "type": [
        "null",
        "string"
      ],
      "name": "authorizationUrl",
      "default": null,
      "doc": "OAuth authorization endpoint URL.\nExample: https://accounts.google.com/o/oauth2/v2/auth"
    },
    {
      "type": [
        "null",
        "string"
      ],
      "name": "tokenUrl",
      "default": null,
      "doc": "OAuth token endpoint URL.\nExample: https://oauth2.googleapis.com/token"
    },
    {
      "type": [
        "null",
        {
          "type": "array",
          "items": "string"
        }
      ],
      "name": "scopes",
      "default": null,
      "doc": "Default OAuth scopes to request.\nStored as array for UI chip rendering and scope merging."
    },
    {
      "type": {
        "type": "enum",
        "symbolDocs": {
          "BASIC": "HTTP Basic Auth: client_id:client_secret in Authorization header.",
          "CUSTOM": "Custom auth scheme: uses authScheme field to format the Authorization header.\nFormat: Authorization: {authScheme} {client_secret}\nExample: Token for dbt Cloud produces Authorization: Token {client_secret}",
          "NONE": "No client authentication (for public clients).",
          "POST_BODY": "Form POST body: client_id and client_secret as form parameters."
        },
        "name": "TokenAuthMethod",
        "namespace": "com.linkedin.pegasus2avro.oauth",
        "symbols": [
          "BASIC",
          "POST_BODY",
          "NONE",
          "CUSTOM"
        ]
      },
      "name": "tokenAuthMethod",
      "default": "POST_BODY",
      "doc": "How to authenticate at the token endpoint.\n- BASIC: client_id:client_secret in Authorization header\n- POST_BODY: client_id and client_secret in request body\n- NONE: No client authentication (public clients)\n- CUSTOM: Custom auth scheme using authScheme field (e.g., \"Token\" for dbt Cloud)"
    },
    {
      "type": [
        "null",
        {
          "type": "map",
          "values": "string"
        }
      ],
      "name": "additionalTokenParams",
      "default": null,
      "doc": "Additional parameters for token requests.\nExamples: Auth0 audience, Azure AD resource"
    },
    {
      "type": [
        "null",
        {
          "type": "map",
          "values": "string"
        }
      ],
      "name": "additionalAuthParams",
      "default": null,
      "doc": "Additional parameters for authorization URL.\nExamples: prompt=consent, tenant=my-org"
    },
    {
      "type": {
        "type": "enum",
        "symbolDocs": {
          "HEADER": "Send credential in HTTP header.",
          "QUERY_PARAM": "Send credential as query parameter."
        },
        "name": "AuthLocation",
        "namespace": "com.linkedin.pegasus2avro.oauth",
        "symbols": [
          "HEADER",
          "QUERY_PARAM"
        ]
      },
      "name": "authLocation",
      "default": "HEADER",
      "doc": "Where to inject the credential in HTTP requests."
    },
    {
      "type": "string",
      "name": "authHeaderName",
      "default": "Authorization",
      "doc": "For HEADER: which header name.\nDefault: Authorization"
    },
    {
      "type": [
        "string",
        "null"
      ],
      "name": "authScheme",
      "default": "Bearer",
      "doc": "For HEADER: scheme prefix before the token.\nDefault: Bearer (produces Authorization: Bearer TOKEN).\nSet to empty string for raw token (e.g., X-API-Key: TOKEN)."
    },
    {
      "type": [
        "null",
        "string"
      ],
      "name": "authQueryParam",
      "default": null,
      "doc": "For QUERY_PARAM: parameter name.\nExample: access_token produces ?access_token=TOKEN"
    }
  ],
  "doc": "Properties of an OAuth Authorization Server.\n\nThis represents an authorization server that DataHub can use to obtain tokens\nfor calling external APIs (OUTBOUND OAuth). It may be:\n- The service's own OAuth server (e.g., Glean, GitHub)\n- A third-party IDP configured for a service (e.g., Okta, Azure AD)\n\nThis entity contains OAuth configuration (how to get tokens) and auth injection\nsettings (how to use tokens). Actual credentials are stored separately in\nDataHubConnection entities.\n\nFor API key services, set supportedCredentialTypes to [API_KEY]. The auth injection\nsettings will be used, but OAuth config fields are optional."
}