openapi: 3.0.3
info:
  version: 1.0.0
  title: Support for cases where multiple alternate security types (AND, OR, AND OR)
    are listed
  description: https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#securitySchemeObject
servers:
  - url: https://httpbin.org
paths:
  '/anything/and':
    post:
      summary: Multiple forms of auth are required (&&)
      responses:
        '401':
          description: Unauthorized
      security:
        - apiKey_header: []
          basic: []
          oauth2:
            - write:things
  '/anything/or':
    post:
      summary: Two forms of auth can be used, only one is required (||)
      responses:
        '401':
          description: Unauthorized
      security:
        - oauth2:
            - write:things
        - apiKey_header: []
  '/anything/and-or':
    post:
      summary: Two security flows are present, one of which has multiple forms of
        required auth (&& ||)
      responses:
        '401':
          description: Unauthorized
      security:
        - oauth2:
            - write:things
          apiKey_header: []
        - oauth2_alternate:
            - write:things
  '/anything/many-and-or':
    post:
      summary: Many security flows are present, each with multiple forms of required
        auth (&& ||)
      responses:
        '401':
          description: Unauthorized
      security:
        - oauth2: []
          basic: []
        - bearer: []
          bearer_jwt: []
        - bearer_jwt: []
        - basic: []
        - basic: []
          bearer: []
        - apiKey_cookie: []
          apiKey_header: []
          apiKey_query: []
components:
  securitySchemes:
    apiKey_cookie:
      type: apiKey
      in: cookie
      name: api_key
      description: An API key that will be supplied in a named cookie. https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#security-scheme-object
    apiKey_header:
      type: apiKey
      in: header
      name: X-API-KEY
      description: An API key that will be supplied in a named header. https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#security-scheme-objec
    apiKey_query:
      type: apiKey
      in: query
      name: apiKey
      description: An API key that will be supplied in a named query parameter. https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#security-scheme-objec
    basic:
      type: http
      scheme: basic
      description: Basic auth that takes a base64'd combination of `user:password`.
        https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#basic-authentication-sample
    bearer:
      type: http
      scheme: bearer
      description: A bearer token that will be supplied within an `Authentication`
        header as `bearer <token>`. https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#basic-authentication-sample
    bearer_jwt:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: A special kind of bearer token that will be supplied within an
        `Authentication` header as `<bearerFormat> <token>` (and in this case `jwt
        <token>`). https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#jwt-bearer-sample
    oauth2:
      type: oauth2
      description: An OAuth 2 security flow. https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#fixed-fields-23
      flows:
        authorizationCode:
          authorizationUrl: http://example.com/oauth/dialog
          tokenUrl: http://example.com/oauth/token
          scopes:
            write:things: Add things to your account
        clientCredentials:
          tokenUrl: http://example.com/oauth/token
          scopes:
            write:things: Add things to your account
        implicit:
          authorizationUrl: http://example.com/oauth/dialog
          scopes:
            write:things: Add things to your account
        password:
          tokenUrl: http://example.com/oauth/token
          scopes:
            write:things: Add things to your account
    oauth2_alternate:
      type: oauth2
      description: An alternate OAuth 2 security flow. Functions identially to the
        other `oauth2` scheme, just with alternate URLs to authenticate against. https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#fixed-fields-23
      flows:
        implicit:
          authorizationUrl: http://alt.example.com/oauth/dialog
          scopes:
            write:things: Add things to your account