Update authentication API spec

[sajith-subramanian]

• Lower rate limits for authorize and introspect to 100/min
• Rename schema components to PascalCase (e.g., jwks→Jwks, clientId→ClientId)
• Add error responses (400/401/429/500) to token, revoke, introspect, userinfo, logout endpoints
• Add create prompt value and improve nonce/state parameter docs
• Add client_secret body param to token endpoint
• Add required field for token introspect request
• Expand OidcSpec and userinfo examples; move from x-examples to inline examples
• Rename thumbnails→user_thumbnails, is_2fa_enabled→is_twofa_enabled
• Add twofa_type, contact_mode, user_source_type fields to UserInfo
• Add server overrides for /userinfo pointing to api.aps.autodesk.com
• Increase scope character limit from 2000 to 3000
• Fix introspect_endpoint (was introspection_endpoint) in OidcSpec
• Remove required constraints from TwoLeggedToken/ThreeLeggedToken

[Copilot]

Pull request overview

Updates the Authentication OpenAPI specification to reflect revised rate limits, schema/component naming, and expanded endpoint behaviors (responses, parameters, and examples) for OAuth/OIDC flows.

Changes:

• Updates rate-limit documentation and improves authorization parameter documentation (nonce/state/prompt/scope).
• Renames schema components to PascalCase and expands inline examples (JWKS, token responses, introspect, OIDC discovery, userinfo).
• Adds/extends error responses and updates /userinfo host overrides plus UserInfo fields/renames.

Comments suppressed due to low confidence (2)

authentication/authentication.yaml:358

• PR description says introspect should document 400/401/429/500 responses, but the spec currently omits a 429 response for rate limiting. Add a 429 response to match the documented behavior elsewhere (for example, token/userinfo).

        '400':
          description: The request is missing the required ``token`` parameter, or the ``client_id`` was supplied in the request body when Authorization headers are present.
        '401':
          description: The client credentials are invalid.
        '500':
          description: Generic internal server error.

authentication/authentication.yaml:433

• PR description says logout should include error responses (400/401/429/500), but the spec only adds a 500 response here. Either add the missing 400/401/429 responses (with appropriate descriptions) or update the PR description to reflect the intended scope.

      responses:
        '302':
          description: The user was successfully logged out.
        '500':
          description: Generic internal server error.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.