---
title: "Use this endpoint to retrieve authorization server metadata"
method: GET
path: "/.well-known/openid-configuration"
tags: ["Well-known Metadata Endpoint"]
---

# Use this endpoint to retrieve authorization server metadata

`GET /.well-known/openid-configuration`

Retrieve metadata for the authorization server as a JSON document, which declares its
endpoint locations and authorization server capabilities.

## Response `200`

Metadata associated with the given token.

- MetadataResponse
  - `issuer` string, required — URL using the https scheme with no query or fragment component that the OIDC Provider asserts as its Issuer Identifier
  - `authorization_endpoint` string, required — URL of the OIDC Provider Authorization Endpoint
  - `token_endpoint` string — URL of the OIDC Provider Token Endpoint
  - `userinfo_endpoint` string — URL of the OIDC Provider User Info Endpoint
  - `introspection_endpoint` string — URL of the OIDC Provider Introspection Endpoint
  - `revocation_endpoint` string — URL of the OIDC Provider Revocation Endpoint
  - `pushed_authorization_request_endpoint` string — URL of the OIDC Provider Pushed Authorization Request Endpoint
  - `registration_endpoint` string — URL of the OIDC Provider Dynamic Registration Endpoint
  - `jwks_uri` string — URL of the OIDC Provider JSON Web Keys (JWKS) Endpoint
  - `backchannel_authentication_endpoint` string — URL of the OIDC Provider Backchannel Authentication Endpoint
  - `backchannel_token_delivery_modes_supported` string[]
  - `backchannel_authentication_request_signing_alg_values_supported` string[]
  - `backchannel_user_code_parameter_supported` boolean — Whether the OIDC Provider supports the use of the user_code parameter
  - `acr_values_supported` string[]
  - `response_types_supported` string[]
  - `response_modes_supported` string[]
  - `grant_types_supported` string[]
  - `token_endpoint_auth_methods_supported` string[]
  - `id_token_signing_alg_values_supported` string[]
  - `id_token_encryption_alg_values_supported` string[]
  - `id_token_encryption_enc_values_supported` string[]
  - `userinfo_signing_alg_values_supported` string[]
  - `userinfo_encryption_alg_values_supported` string[]
  - `userinfo_encryption_enc_values_supported` string[]
  - `request_object_signing_alg_values_supported` string[]
  - `request_object_encryption_alg_values_supported` string[]
  - `request_object_encryption_enc_values_supported` string[]
  - `subject_types_supported` string[]
  - `scopes_supported` string[]
  - `claims_supported` string[]
  - `claim_types_supported` string[]
  - `claims_locales_supported` string[]
  - `ui_locales_supported` string[]
  - `claims_parameter_supported` boolean — Whether the OIDC Provider supports use of the claims parameter
  - `request_parameter_supported` boolean — Whether the OIDC Provider supports use of the request parameter
  - `request_uri_parameter_supported` boolean — Whether the OIDC Provider supports use of the request_uri parameter
  - `require_request_uri_registration` boolean — Whether the OIDC Provider requires any request_uri values used to be pre-registered using the request_uris registration parameter.
  - `require_pushed_authorization_requests` boolean — Whether the OIDC Provider accepts authorization request data only via pushed authorization requests
  - `tls_client_certificate_bound_access_tokens` boolean — Whether the OIDC Provider supports for mutual-TLS client certificate-bound access tokens
  - `mtls_endpoint_aliases` object — Alternative authorization server endpoints that, when present, an OAuth client intending to do mutual TLS uses in preference to the conventional endpoints.
    - `token_endpoint` string — URL of the OIDC Provider Token Endpoint which require MTLS
    - `introspection_endpoint` string — URL of the OIDC Provider Introspection Endpoint which require MTLS
    - `revocation_endpoint` string — URL of the OIDC Provider Revocation Endpoint which require MTLS
    - `pushed_authorization_request_endpoint` string — URL of the OIDC Provider Pushed Authorization Request Endpoint which require MTLS
    - `registration_endpoint` string — URL of the OIDC Provider Dynamic Registration Endpoint which require MTLS
    - `backchannel_authentication_endpoint` string — URL of the OIDC Provider Backchannel Authentication Endpoint which require MTLS

---

[API](https://skmtc.net/ibm/apis/ibm-security-verify-access-oidc-provider.md) · [All operations](https://skmtc.net/ibm/apis/ibm-security-verify-access-oidc-provider/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ibm/ibm-security-verify-access-oidc-provider/revisions/68cfc4d21b73/schema)