{
 "additionalProperties": false,
 "createOnlyProperties": [
  "/properties/Name",
  "/properties/CredentialProviderVendor"
 ],
 "definitions": {
  "AtlassianOauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecret": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecretConfig": {
     "$ref": "#/definitions/SecretReference"
    },
    "ClientSecretSource": {
     "enum": [
      "MANAGED",
      "EXTERNAL"
     ],
     "type": "string"
    }
   },
   "required": [
    "ClientId"
   ],
   "type": "object"
  },
  "ClientSecretArn": {
   "additionalProperties": false,
   "properties": {
    "SecretArn": {
     "pattern": "^arn:(aws|aws-us-gov):secretsmanager:[A-Za-z0-9-]{1,64}:[0-9]{12}:secret:[a-zA-Z0-9-_/+=.@!]+$",
     "type": "string"
    }
   },
   "required": [
    "SecretArn"
   ],
   "type": "object"
  },
  "CustomOauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "ClientAuthenticationMethod": {
     "enum": [
      "CLIENT_SECRET_BASIC",
      "CLIENT_SECRET_POST",
      "AWS_IAM_ID_TOKEN_JWT"
     ],
     "type": "string"
    },
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecret": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecretConfig": {
     "$ref": "#/definitions/SecretReference"
    },
    "ClientSecretSource": {
     "enum": [
      "MANAGED",
      "EXTERNAL"
     ],
     "type": "string"
    },
    "OauthDiscovery": {
     "$ref": "#/definitions/Oauth2Discovery"
    },
    "OnBehalfOfTokenExchangeConfig": {
     "$ref": "#/definitions/OnBehalfOfTokenExchangeConfig"
    }
   },
   "required": [
    "OauthDiscovery"
   ],
   "type": "object"
  },
  "GithubOauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecret": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecretConfig": {
     "$ref": "#/definitions/SecretReference"
    },
    "ClientSecretSource": {
     "enum": [
      "MANAGED",
      "EXTERNAL"
     ],
     "type": "string"
    }
   },
   "required": [
    "ClientId"
   ],
   "type": "object"
  },
  "GoogleOauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecret": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecretConfig": {
     "$ref": "#/definitions/SecretReference"
    },
    "ClientSecretSource": {
     "enum": [
      "MANAGED",
      "EXTERNAL"
     ],
     "type": "string"
    }
   },
   "required": [
    "ClientId"
   ],
   "type": "object"
  },
  "IncludedOauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "AuthorizationEndpoint": {
     "type": "string"
    },
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecret": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecretConfig": {
     "$ref": "#/definitions/SecretReference"
    },
    "ClientSecretSource": {
     "enum": [
      "MANAGED",
      "EXTERNAL"
     ],
     "type": "string"
    },
    "Issuer": {
     "type": "string"
    },
    "TokenEndpoint": {
     "type": "string"
    }
   },
   "required": [
    "ClientId"
   ],
   "type": "object"
  },
  "LinkedinOauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecret": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecretConfig": {
     "$ref": "#/definitions/SecretReference"
    },
    "ClientSecretSource": {
     "enum": [
      "MANAGED",
      "EXTERNAL"
     ],
     "type": "string"
    }
   },
   "required": [
    "ClientId"
   ],
   "type": "object"
  },
  "MicrosoftOauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecret": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecretConfig": {
     "$ref": "#/definitions/SecretReference"
    },
    "ClientSecretSource": {
     "enum": [
      "MANAGED",
      "EXTERNAL"
     ],
     "type": "string"
    },
    "TenantId": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    }
   },
   "required": [
    "ClientId"
   ],
   "type": "object"
  },
  "Oauth2AuthorizationServerMetadata": {
   "additionalProperties": false,
   "properties": {
    "AuthorizationEndpoint": {
     "type": "string"
    },
    "Issuer": {
     "type": "string"
    },
    "ResponseTypes": {
     "insertionOrder": false,
     "items": {
      "type": "string"
     },
     "type": "array"
    },
    "TokenEndpoint": {
     "type": "string"
    }
   },
   "required": [
    "Issuer",
    "AuthorizationEndpoint",
    "TokenEndpoint"
   ],
   "type": "object"
  },
  "Oauth2Discovery": {
   "additionalProperties": false,
   "properties": {
    "AuthorizationServerMetadata": {
     "$ref": "#/definitions/Oauth2AuthorizationServerMetadata"
    },
    "DiscoveryUrl": {
     "pattern": "^.+/\\.well-known/openid-configuration$",
     "type": "string"
    }
   },
   "type": "object"
  },
  "Oauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "AtlassianOauth2ProviderConfig": {
     "$ref": "#/definitions/AtlassianOauth2ProviderConfigInput"
    },
    "CustomOauth2ProviderConfig": {
     "$ref": "#/definitions/CustomOauth2ProviderConfigInput"
    },
    "GithubOauth2ProviderConfig": {
     "$ref": "#/definitions/GithubOauth2ProviderConfigInput"
    },
    "GoogleOauth2ProviderConfig": {
     "$ref": "#/definitions/GoogleOauth2ProviderConfigInput"
    },
    "IncludedOauth2ProviderConfig": {
     "$ref": "#/definitions/IncludedOauth2ProviderConfigInput"
    },
    "LinkedinOauth2ProviderConfig": {
     "$ref": "#/definitions/LinkedinOauth2ProviderConfigInput"
    },
    "MicrosoftOauth2ProviderConfig": {
     "$ref": "#/definitions/MicrosoftOauth2ProviderConfigInput"
    },
    "SalesforceOauth2ProviderConfig": {
     "$ref": "#/definitions/SalesforceOauth2ProviderConfigInput"
    },
    "SlackOauth2ProviderConfig": {
     "$ref": "#/definitions/SlackOauth2ProviderConfigInput"
    }
   },
   "type": "object"
  },
  "Oauth2ProviderConfigOutput": {
   "additionalProperties": false,
   "properties": {
    "ClientAuthenticationMethod": {
     "enum": [
      "CLIENT_SECRET_BASIC",
      "CLIENT_SECRET_POST",
      "AWS_IAM_ID_TOKEN_JWT"
     ],
     "type": "string"
    },
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "OauthDiscovery": {
     "$ref": "#/definitions/Oauth2Discovery"
    },
    "OnBehalfOfTokenExchangeConfig": {
     "$ref": "#/definitions/OnBehalfOfTokenExchangeConfig"
    }
   },
   "type": "object"
  },
  "OnBehalfOfTokenExchangeConfig": {
   "additionalProperties": false,
   "properties": {
    "GrantType": {
     "enum": [
      "TOKEN_EXCHANGE",
      "JWT_AUTHORIZATION_GRANT"
     ],
     "type": "string"
    },
    "TokenExchangeGrantTypeConfig": {
     "$ref": "#/definitions/TokenExchangeGrantTypeConfig"
    }
   },
   "required": [
    "GrantType"
   ],
   "type": "object"
  },
  "SalesforceOauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecret": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecretConfig": {
     "$ref": "#/definitions/SecretReference"
    },
    "ClientSecretSource": {
     "enum": [
      "MANAGED",
      "EXTERNAL"
     ],
     "type": "string"
    }
   },
   "required": [
    "ClientId"
   ],
   "type": "object"
  },
  "SecretReference": {
   "additionalProperties": false,
   "properties": {
    "JsonKey": {
     "maxLength": 128,
     "minLength": 1,
     "type": "string"
    },
    "SecretId": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    }
   },
   "required": [
    "SecretId",
    "JsonKey"
   ],
   "type": "object"
  },
  "SlackOauth2ProviderConfigInput": {
   "additionalProperties": false,
   "properties": {
    "ClientId": {
     "maxLength": 256,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecret": {
     "maxLength": 2048,
     "minLength": 1,
     "type": "string"
    },
    "ClientSecretConfig": {
     "$ref": "#/definitions/SecretReference"
    },
    "ClientSecretSource": {
     "enum": [
      "MANAGED",
      "EXTERNAL"
     ],
     "type": "string"
    }
   },
   "required": [
    "ClientId"
   ],
   "type": "object"
  },
  "Tag": {
   "additionalProperties": false,
   "properties": {
    "Key": {
     "maxLength": 128,
     "minLength": 1,
     "pattern": "^[a-zA-Z0-9\\s._:/=+@-]*$",
     "type": "string"
    },
    "Value": {
     "maxLength": 256,
     "minLength": 0,
     "pattern": "^[a-zA-Z0-9\\s._:/=+@-]*$",
     "type": "string"
    }
   },
   "required": [
    "Key",
    "Value"
   ],
   "type": "object"
  },
  "TokenExchangeGrantTypeConfig": {
   "additionalProperties": false,
   "properties": {
    "ActorTokenContent": {
     "enum": [
      "NONE",
      "M2M",
      "AWS_IAM_ID_TOKEN_JWT"
     ],
     "type": "string"
    },
    "ActorTokenScopes": {
     "insertionOrder": false,
     "items": {
      "type": "string"
     },
     "type": "array"
    }
   },
   "required": [
    "ActorTokenContent"
   ],
   "type": "object"
  }
 },
 "primaryIdentifier": [
  "/properties/CredentialProviderArn"
 ],
 "properties": {
  "CallbackUrl": {
   "type": "string"
  },
  "ClientSecretArn": {
   "$ref": "#/definitions/ClientSecretArn"
  },
  "ClientSecretJsonKey": {
   "maxLength": 128,
   "minLength": 1,
   "type": "string"
  },
  "ClientSecretSource": {
   "enum": [
    "MANAGED",
    "EXTERNAL"
   ],
   "type": "string"
  },
  "CreatedTime": {
   "format": "date-time",
   "type": "string"
  },
  "CredentialProviderArn": {
   "pattern": "^arn:(aws|aws-us-gov):bedrock-agentcore:[A-Za-z0-9-]{1,64}:[0-9]{12}:token-vault/[a-zA-Z0-9-.]+/oauth2credentialprovider/[a-zA-Z0-9-]+$",
   "type": "string"
  },
  "CredentialProviderVendor": {
   "enum": [
    "GoogleOauth2",
    "GithubOauth2",
    "SlackOauth2",
    "SalesforceOauth2",
    "MicrosoftOauth2",
    "CustomOauth2",
    "AtlassianOauth2",
    "LinkedinOauth2",
    "XOauth2",
    "OktaOauth2",
    "OneLoginOauth2",
    "PingOneOauth2",
    "FacebookOauth2",
    "YandexOauth2",
    "RedditOauth2",
    "ZoomOauth2",
    "TwitchOauth2",
    "SpotifyOauth2",
    "DropboxOauth2",
    "NotionOauth2",
    "HubspotOauth2",
    "CyberArkOauth2",
    "FusionAuthOauth2",
    "Auth0Oauth2",
    "CognitoOauth2"
   ],
   "type": "string"
  },
  "LastUpdatedTime": {
   "format": "date-time",
   "type": "string"
  },
  "Name": {
   "maxLength": 128,
   "minLength": 1,
   "pattern": "^[a-zA-Z0-9\\-_]+$",
   "type": "string"
  },
  "Oauth2ProviderConfigInput": {
   "$ref": "#/definitions/Oauth2ProviderConfigInput"
  },
  "Oauth2ProviderConfigOutput": {
   "$ref": "#/definitions/Oauth2ProviderConfigOutput"
  },
  "Tags": {
   "insertionOrder": false,
   "items": {
    "$ref": "#/definitions/Tag"
   },
   "maxItems": 50,
   "type": "array"
  }
 },
 "readOnlyProperties": [
  "/properties/CredentialProviderArn",
  "/properties/ClientSecretArn",
  "/properties/ClientSecretJsonKey",
  "/properties/ClientSecretSource",
  "/properties/CallbackUrl",
  "/properties/Oauth2ProviderConfigOutput",
  "/properties/CreatedTime",
  "/properties/LastUpdatedTime"
 ],
 "required": [
  "Name",
  "CredentialProviderVendor"
 ],
 "tagging": {
  "cloudFormationSystemTags": true,
  "tagOnCreate": true,
  "tagProperty": "/properties/Tags",
  "tagUpdatable": true,
  "taggable": true
 },
 "typeName": "AWS::BedrockAgentCore::OAuth2CredentialProvider",
 "writeOnlyProperties": [
  "/properties/Oauth2ProviderConfigInput"
 ]
}
