From 001c51a7401f646d765c07d92593913d90a2ba47 Mon Sep 17 00:00:00 2001
From: Travis Ralston <travpc@gmail.com>
Date: Tue, 3 Sep 2019 15:09:59 -0600
Subject: [PATCH] /3pid/delete and /deactivate don't take an id_access_token

---
 api/client-server/administrative_contact.yaml | 9 ++++-----
 api/client-server/registration.yaml           | 9 ++++-----
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/api/client-server/administrative_contact.yaml b/api/client-server/administrative_contact.yaml
index 30153bb0..4b8e1d63 100644
--- a/api/client-server/administrative_contact.yaml
+++ b/api/client-server/administrative_contact.yaml
@@ -176,6 +176,10 @@ paths:
       description: |-
         Removes a third party identifier from the user's account. This might not
         cause an unbind of the identifier from the identity server.
+
+        Unlike other endpoints, this endpoint does not take an ``id_access_token``
+        parameter because the homeserver is expected to sign the request to the
+        identity server instead.
       operationId: delete3pidFromAccount
       security:
         - accessToken: []
@@ -193,11 +197,6 @@ paths:
                     homeserver does not know the original ``id_server``, it MUST return
                     a ``id_server_unbind_result`` of ``no-support``.
                 example: "example.org"
-              id_access_token:
-                type: string
-                description: |-
-                  An access token previously registered with the identity server. Required
-                  if an ``id_server`` is specified.
               medium:
                 type: string
                 description: The medium of the third party identifier being removed.
diff --git a/api/client-server/registration.yaml b/api/client-server/registration.yaml
index a747e38b..596dfe34 100644
--- a/api/client-server/registration.yaml
+++ b/api/client-server/registration.yaml
@@ -519,6 +519,10 @@ paths:
 
         The homeserver may change the flows available depending on whether a
         valid access token is provided.
+
+        Unlike other endpoints, this endpoint does not take an ``id_access_token``
+        parameter because the homeserver is expected to sign the request to the
+        identity server instead.
       security:
         - accessToken: []
       operationId: deactivateAccount
@@ -542,11 +546,6 @@ paths:
                   it must return an ``id_server_unbind_result`` of
                   ``no-support``.
                 example: "example.org"
-              id_access_token:
-                type: string
-                description: |-
-                  An access token previously registered with the identity server. Required if an
-                  ``id_server`` is supplied.
       responses:
         200:
           description: The account has been deactivated.