---
title: "GET /networks/{networkId}/oidc"
method: GET
path: "/networks/{networkId}/oidc"
---

# GET /networks/{networkId}/oidc

`GET /networks/{networkId}/oidc`

Retrieves the OpenID Connect (OIDC) configuration for a Wickr network, including SSO settings and optional token information if access token parameters are provided.

## Path parameters

- `networkId` string, required

## Query parameters

- `clientId` string
- `code` string
- `grantType` string
- `redirectUri` string
- `url` string
- `clientSecret` string, password
- `codeVerifier` string
- `certificate` string

## Response `200`

Success

- GetOidcInfoResponse
  - `openidConnectInfo` object — The OpenID Connect configuration information for the network, including issuer, client ID, scopes, and other SSO settings.
    - `applicationName` string — The name of the OIDC application as registered with the identity provider.
    - `clientId` string — The OAuth client ID assigned by the identity provider for authentication requests.
    - `companyId` string, required — Custom identifier your end users will use to sign in with SSO.
    - `scopes` string, required — The OAuth scopes requested from the identity provider, which determine what user information is accessible (e.g., 'openid profile email').
    - `issuer` string, required — The issuer URL of the identity provider, which serves as the base URL for OIDC endpoints and configuration discovery.
    - `clientSecret` string, password — The OAuth client secret used to authenticate the application with the identity provider.
    - `secret` string, password — An additional secret credential used by the identity provider for authentication.
    - `redirectUrl` string — The callback URL where the identity provider redirects users after successful authentication. This URL must be registered with the identity provider.
    - `userId` string — The claim field from the OIDC token to use as the unique user identifier (e.g., 'email', 'sub', or a custom claim).
    - `customUsername` string — A custom field mapping to extract the username from the OIDC token when the standard username claim is insufficient.
    - `caCertificate` string — The X.509 CA certificate for validating SSL/TLS connections to the identity provider when using self-signed or enterprise certificates.
    - `applicationId` integer — The unique identifier for the registered OIDC application. Valid range is 1-10.
    - `ssoTokenBufferMinutes` integer — The grace period in minutes before the SSO token expires when the system should proactively refresh the token to maintain seamless user access.
    - `extraAuthParams` string — Additional authentication parameters to include in the OIDC authorization request as a query string. Useful for provider-specific extensions.
  - `tokenInfo` object — OAuth token information including access token, refresh token, and expiration details (only present if token parameters were provided in the request).
    - `codeVerifier` string — The PKCE (Proof Key for Code Exchange) code verifier, a cryptographically random string used to enhance security in the OAuth flow.
    - `codeChallenge` string — The PKCE code challenge, a transformed version of the code verifier sent during the authorization request for verification.
    - `accessToken` string — The OAuth access token that can be used to access protected resources on behalf of the authenticated user.
    - `idToken` string — The OpenID Connect ID token containing user identity information and authentication context as a signed JWT.
    - `refreshToken` string — The OAuth refresh token that can be used to obtain new access tokens without requiring the user to re-authenticate.
    - `tokenType` string — The type of access token issued, typically 'Bearer', which indicates how the token should be used in API requests.
    - `expiresIn` integer — The lifetime of the access token in seconds, indicating when the token will expire and need to be refreshed.

## Other responses

- `480` — ValidationError
- `481` — BadRequestError
- `482` — ResourceNotFoundError
- `483` — ForbiddenError
- `484` — UnauthorizedError
- `485` — InternalServerError
- `486` — RateLimitError

---

[API](https://skmtc.net/aws/apis/wickr.md) · [All operations](https://skmtc.net/aws/apis/wickr/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/wickr/versions/71d396c2af63/schema)