GET/api/oidc/openid-configurationPublic

OpenID Provider metadata (discovery)

OIDC Discovery 1.0 §4 provider-configuration document. Relying parties normally fetch it at the spec-fixed paths /.well-known/openid-configuration and, for plain OAuth 2.0 clients (RFC 8414), /.well-known/oauth-authorization-server; both are rewritten to this route (OpenID Provider Metadata is a superset of RFC 8414 metadata, so one document serves both). registration_endpoint is advertised only while dynamic client registration is enabled by the allow_dynamic_client_registration server setting; a failure to read that setting degrades to not advertising it. Cached for an hour (Cache-Control: public, max-age=3600) and served with Access-Control-Allow-Origin: *.

operationId get_api_oidc_openid_configurationOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials
None required
Notes
Unauthenticated by design: the document is public.

Responses

application/json
OidcProviderMetadata
PropertyTypeDescription
issuer*string

Issuer identifier; byte-identical to the iss claim of issued id_tokens (no trailing slash).

authorization_endpoint*string

The authorization endpoint

token_endpoint*string

The token endpoint

userinfo_endpoint*string

The userinfo endpoint

introspection_endpoint*string

RFC 7662 token introspection endpoint

jwks_uri*string

Public RS256 id_token verification keys

registration_endpointstring

RFC 7591 dynamic client registration endpoint. Present only while the allow_dynamic_client_registration server setting is on.

response_types_supported*string[]
response_modes_supported*string[]
grant_types_supported*string[]
subject_types_supported*string[]
id_token_signing_alg_values_supported*string[]
scopes_supported*string[]
token_endpoint_auth_methods_supported*string[]
introspection_endpoint_auth_methods_supported*string[]
code_challenge_methods_supported*string[]
claims_supported*string[]
authorization_response_iss_parameter_supported*boolean

RFC 9207: every authorization response carries iss.

request_parameter_supported*boolean
request_uri_parameter_supported*boolean
JSONExample
"issuer""https://auth.example.com"
"authorization_endpoint""https://auth.example.com/api/oidc/authorize"
"token_endpoint""https://auth.example.com/api/oidc/token"
"userinfo_endpoint""https://auth.example.com/api/oidc/userinfo"
"introspection_endpoint""https://auth.example.com/api/oidc/introspect"
"jwks_uri""https://auth.example.com/api/oidc/jwks"
"registration_endpoint""https://auth.example.com/api/oidc/register"
"response_types_supported"
"code"
"response_modes_supported"
"query"
"grant_types_supported"
"authorization_code"
"refresh_token"
"client_credentials"
"subject_types_supported"
"public"
"id_token_signing_alg_values_supported"
"RS256"
"scopes_supported"
"openid"
"email"
"profile"
"token_endpoint_auth_methods_supported"
"none"
"client_secret_basic"
"client_secret_post"
"introspection_endpoint_auth_methods_supported"
"client_secret_basic"
"client_secret_post"
"code_challenge_methods_supported"
"S256"
"claims_supported"
"string"
"authorization_response_iss_parameter_supported"true
"request_parameter_supported"false
"request_uri_parameter_supported"false

Example request

bashcurl
curl -X GET 'https://auth.schemavaults.com/api/oidc/openid-configuration'