GET/api/oidc/openid-configurationPublic

OpenID Provider metadata (discovery)

OIDC Discovery 1.0 §4 provider-configuration document. Relying parties normally fetch it at the spec-fixed paths /.well-known/openid-configuration and, for plain OAuth 2.0 clients (RFC 8414), /.well-known/oauth-authorization-server; both are rewritten to this route (OpenID Provider Metadata is a superset of RFC 8414 metadata, so one document serves both). registration_endpoint is advertised only while dynamic client registration is enabled by the allow_dynamic_client_registration server setting; a failure to read that setting degrades to not advertising it. Cached for an hour (Cache-Control: public, max-age=3600) and served with Access-Control-Allow-Origin: *.

operationId get_api_oidc_openid_configurationOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials
None required
Notes
Unauthenticated by design: the document is public.

Responses

application/json
OidcProviderMetadata
PropertyTypeDescription
issuer*string

Issuer identifier; byte-identical to the iss claim of issued id_tokens (no trailing slash).

authorization_endpoint*string

The authorization endpoint

token_endpoint*string

The token endpoint

userinfo_endpoint*string

The userinfo endpoint

introspection_endpoint*string

RFC 7662 token introspection endpoint

revocation_endpoint*string

RFC 7009 token revocation endpoint

jwks_uri*string

Public RS256 id_token verification keys

registration_endpointstring

RFC 7591 dynamic client registration endpoint. Present only while the allow_dynamic_client_registration server setting is on.

response_types_supported*string[]
response_modes_supported*string[]
grant_types_supported*string[]
subject_types_supported*string[]
id_token_signing_alg_values_supported*string[]
scopes_supported*string[]
token_endpoint_auth_methods_supported*string[]
introspection_endpoint_auth_methods_supported*string[]

Client secrets for confidential client apps; private_key_jwt (a JWKS access assertion) for API servers introspecting the access tokens minted for them.

introspection_endpoint_auth_signing_alg_values_supported*string[]
revocation_endpoint_auth_methods_supported*string[]

As at the token endpoint: none (a public client identifies itself with client_id) or the client secret of a confidential client.

code_challenge_methods_supported*string[]
claims_supported*string[]
authorization_response_iss_parameter_supported*boolean

RFC 9207: every authorization response carries iss.

request_parameter_supported*boolean
request_uri_parameter_supported*boolean
JSONExample
"issuer""https://auth.example.com"
"authorization_endpoint""https://auth.example.com/api/oidc/authorize"
"token_endpoint""https://auth.example.com/api/oidc/token"
"userinfo_endpoint""https://auth.example.com/api/oidc/userinfo"
"introspection_endpoint""https://auth.example.com/api/oidc/introspect"
"revocation_endpoint""https://auth.example.com/api/oidc/revoke"
"jwks_uri""https://auth.example.com/api/oidc/jwks"
"registration_endpoint""https://auth.example.com/api/oidc/register"
"response_types_supported"
"code"
"response_modes_supported"
"query"
"grant_types_supported"
"authorization_code"
"refresh_token"
"client_credentials"
"urn:ietf:params:oauth:grant-type:token-exchange"
"subject_types_supported"
"public"
"id_token_signing_alg_values_supported"
"RS256"
"scopes_supported"
"openid"
"email"
"profile"
"token_endpoint_auth_methods_supported"
"none"
"client_secret_basic"
"client_secret_post"
"introspection_endpoint_auth_methods_supported"
"client_secret_basic"
"client_secret_post"
"private_key_jwt"
"introspection_endpoint_auth_signing_alg_values_supported"
"RS256"
"revocation_endpoint_auth_methods_supported"
"none"
"client_secret_basic"
"client_secret_post"
"code_challenge_methods_supported"
"S256"
"claims_supported"
"string"
"authorization_response_iss_parameter_supported"true
"request_parameter_supported"false
"request_uri_parameter_supported"false

Example request

bashcurl
curl -X GET 'https://auth.schemavaults.com/api/oidc/openid-configuration'
GET /api/oidc/openid-configuration | SchemaVaults Auth API