A client generated from these specs can't authenticate — /oauth/token doesn't appear in any service spec, so the client-credentials flow that every other operation depends on has to be found outside the spec entirely. Adding it, or a security scheme that names it, would let generated clients and API-aware tooling obtain a token without leaving the specification.
A client generated from these specs can't authenticate —
/oauth/tokendoesn't appear in any service spec, so the client-credentials flow that every other operation depends on has to be found outside the spec entirely. Adding it, or a security scheme that names it, would let generated clients and API-aware tooling obtain a token without leaving the specification.