v5

latestOpenAPI 3.0.0raw.githubusercontent.com2025-09-30102742.8 KB

Integrated Authorization Server

Get authorization server metadata, if the integrated authorization server is enabled. Conforms to OAuth2

get/.well-known/oauth-authorization-server

Response

Successful response

issuerstring required

Authorization server's identifier URL

authorization_endpointstring

URL of the authorization endpoint

token_endpointstring

URL of the token endpoint

jwks_uristring

URL of the JSON Web Key Set document

registration_endpointstring

URL of the dynamic client registration endpoint

scopes_supportedstring[]

List of OAuth 2.0 scope values supported

response_types_supportedstring[] required

List of OAuth 2.0 response_type values supported

response_modes_supportedstring[]

List of OAuth 2.0 response_mode values supported

grant_types_supportedstring[]

List of OAuth 2.0 grant type values supported

token_endpoint_auth_methods_supportedstring[]

List of client authentication methods supported by token endpoint

token_endpoint_auth_signing_alg_values_supportedstring[]

List of JWS signing algorithms supported for client authentication

service_documentationstring

URL of human-readable service documentation

ui_locales_supportedstring[]

List of UI locales supported

op_policy_uristring

URL of the authorization server's policy document

op_tos_uristring

URL of the authorization server's terms of service

revocation_endpointstring

URL of the token revocation endpoint

revocation_endpoint_auth_methods_supportedstring[]

List of client authentication methods supported by revocation endpoint

revocation_endpoint_auth_signing_alg_values_supportedstring[]

List of JWS signing algorithms for revocation endpoint authentication

introspection_endpointstring

URL of the token introspection endpoint

introspection_endpoint_auth_methods_supportedstring[]

List of client authentication methods supported by introspection endpoint

introspection_endpoint_auth_signing_alg_values_supportedstring[]

List of JWS signing algorithms for introspection endpoint authentication

code_challenge_methods_supportedstring[]

List of PKCE code challenge methods supported

pushed_authorization_request_endpointstring

URL of the pushed authorization request endpoint

require_pushed_authorization_requestsboolean

Whether PAR is required for authorization requests

dpop_signing_alg_values_supportedstring[]

List of JWS algorithms supported for DPoP proof JWTs

userinfo_endpointstring

URL of the UserInfo endpoint

check_session_iframestring

URL of an OP iframe for session management

end_session_endpointstring

URL of the end session endpoint

acr_values_supportedstring[]

List of Authentication Context Class References supported

subject_types_supportedstring[]

List of Subject Identifier types supported

id_token_signing_alg_values_supportedstring[]

List of JWS algorithms supported for ID Token signing

id_token_encryption_alg_values_supportedstring[]

List of JWE algorithms supported for ID Token encryption

id_token_encryption_enc_values_supportedstring[]

List of JWE encryption methods supported for ID Token

request_object_signing_alg_values_supportedstring[]

List of JWS algorithms supported for request objects

request_object_encryption_alg_values_supportedstring[]

List of JWE algorithms supported for request object encryption

request_object_encryption_enc_values_supportedstring[]

List of JWE encryption methods supported for request objects

display_values_supportedstring[]

List of display parameter values supported

claim_types_supportedstring[]

List of claim types supported

claims_supportedstring[]

List of claim names supported

claims_parameter_supportedboolean

Whether the claims parameter is supported

request_parameter_supportedboolean

Whether the request parameter is supported

request_uri_parameter_supportedboolean

Whether the request_uri parameter is supported

require_request_uri_registrationboolean

Whether request_uri values must be pre-registered

frontchannel_logout_supportedboolean

Whether front-channel logout is supported

frontchannel_logout_session_supportedboolean

Whether front-channel logout can include session information

backchannel_logout_supportedboolean

Whether back-channel logout is supported

backchannel_logout_session_supportedboolean

Whether back-channel logout can include session information

pre-authorized_grant_anonymous_access_supportedboolean

OPTIONAL. Boolean indicating whether the Credential Issuer accepts a Token Request with a Pre-Authorized Code but without a client_id. The default is false.

authorization_challenge_endpointstring

URL of the authorization challenge endpoint (first-party apps)

credential_endpointstring

URL of the credential endpoint (if AS also acts as credential issuer)

deferred_credential_endpointstring

URL of the deferred credential endpoint

nonce_endpointstring

URL of the nonce endpoint (OID4VCI v1.0.15)

Example response

{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token",
  "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
  "registration_endpoint": "https://auth.example.com/register",
  "scopes_supported": [
    "openid",
    "profile",
    "email"
  ],
  "response_types_supported": [
    "code"
  ],
  "response_modes_supported": [
    "query",
    "fragment"
  ],
  "grant_types_supported": [
    "authorization_code",
    "urn:ietf:params:oauth:grant-type:pre-authorized_code",
    "refresh_token"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "private_key_jwt"
  ],
  "token_endpoint_auth_signing_alg_values_supported": [
    "RS256",
    "ES256",
    "PS256"
  ],
  "service_documentation": "https://auth.example.com/docs",
  "ui_locales_supported": [
    "en-US",
    "fr-FR",
    "de-DE"
  ],
  "op_policy_uri": "https://auth.example.com/policy",
  "op_tos_uri": "https://auth.example.com/tos",
  "revocation_endpoint": "https://auth.example.com/revoke",
  "revocation_endpoint_auth_signing_alg_values_supported": [
    "RS256",
    "ES256"
  ],
  "introspection_endpoint": "https://auth.example.com/introspect",
  "introspection_endpoint_auth_signing_alg_values_supported": [
    "RS256",
    "ES256"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "pushed_authorization_request_endpoint": "https://auth.example.com/par",
  "dpop_signing_alg_values_supported": [
    "ES256",
    "ES384",
    "ES512",
    "EdDSA"
  ],
  "userinfo_endpoint": "https://auth.example.com/userinfo",
  "check_session_iframe": "https://auth.example.com/check_session",
  "end_session_endpoint": "https://auth.example.com/logout",
  "acr_values_supported": [
    "urn:mace:incommon:iap:silver",
    "urn:mace:incommon:iap:bronze"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256",
    "ES256",
    "EdDSA"
  ],
  "id_token_encryption_alg_values_supported": [
    "RSA-OAEP",
    "ECDH-ES"
  ],
  "id_token_encryption_enc_values_supported": [
    "A256GCM",
    "A128GCM"
  ],
  "request_object_signing_alg_values_supported": [
    "RS256",
    "ES256",
    "none"
  ],
  "request_object_encryption_alg_values_supported": [
    "RSA-OAEP",
    "ECDH-ES"
  ],
  "request_object_encryption_enc_values_supported": [
    "A256GCM",
    "A128GCM"
  ],
  "display_values_supported": [
    "page",
    "popup"
  ],
  "claims_supported": [
    "sub",
    "iss",
    "name",
    "email",
    "email_verified"
  ],
  "pre-authorized_grant_anonymous_access_supported": true,
  "authorization_challenge_endpoint": "https://auth.example.com/authorization-challenge",
  "credential_endpoint": "https://auth.example.com/credentials",
  "deferred_credential_endpoint": "https://auth.example.com/deferred-credentials",
  "nonce_endpoint": "https://auth.example.com/nonce"
}