openapi: 3.0.1
info:
description: Welcome to the ORY Hydra HTTP API documentation. You will find documentation
for all HTTP APIs here.
title: ORY Hydra
version: latest
servers:
- url: /
paths:
/.well-known/jwks.json:
get:
description: |-
This endpoint returns JSON Web Keys to be used as public keys for verifying OpenID Connect ID Tokens and,
if enabled, OAuth 2.0 JWT Access Tokens. This endpoint can be used with client libraries like
[node-jwks-rsa](https://github.com/auth0/node-jwks-rsa) among others.
operationId: wellKnown
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/JSONWebKeySet'
description: JSONWebKeySet
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: JSON Web Keys Discovery
tags:
- public
/.well-known/openid-configuration:
get:
description: |-
The well known endpoint an be used to retrieve information for OpenID Connect clients. We encourage you to not roll
your own OpenID Connect client but to use an OpenID Connect client library instead. You can learn more on this
flow at https://openid.net/specs/openid-connect-discovery-1_0.html .
Popular libraries for OpenID Connect clients include oidc-client-js (JavaScript), go-oidc (Golang), and others.
For a full list of clients go here: https://openid.net/developers/certified/
operationId: discoverOpenIDConfiguration
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/wellKnown'
description: wellKnown
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: OpenID Connect Discovery
tags:
- public
/clients:
get:
description: |-
This endpoint lists all clients in the database, and never returns client secrets. As a default it lists the first 100 clients. The `limit` parameter can be used to retrieve more clients, but it has an upper bound at 500 objects. Pagination should be used to retrieve more than 500 objects.
OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.
The "Link" header is also included in successful responses, which contains one or more links for pagination, formatted like so: '<https://hydra-url/admin/clients?limit={limit}&offset={offset}>; rel="{page}"', where page is one of the following applicable pages: 'first', 'next', 'last', and 'previous'.
Multiple links can be included in this header, and will be separated by a comma.
operationId: listOAuth2Clients
parameters:
- description: The maximum amount of policies returned, upper bound is 500 policies
in: query
name: limit
schema:
format: int64
type: integer
- description: The offset from where to start looking.
in: query
name: offset
schema:
format: int64
type: integer
responses:
"200":
content:
application/json:
schema:
items:
$ref: '#/components/schemas/oAuth2Client'
type: array
description: A list of clients.
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: List OAuth 2.0 Clients
tags:
- admin
post:
description: |-
Create a new OAuth 2.0 client If you pass `client_secret` the secret will be used, otherwise a random secret will be generated. The secret will be returned in the response and you will not be able to retrieve it later on. Write the secret down and keep it somwhere safe.
OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.
operationId: createOAuth2Client
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
required: true
responses:
"201":
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
description: oAuth2Client
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"409":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Create an OAuth 2.0 Client
tags:
- admin
x-codegen-request-body-name: Body
/clients/{id}:
delete:
description: |-
Delete an existing OAuth 2.0 Client by its ID.
OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.
operationId: deleteOAuth2Client
parameters:
- description: The id of the OAuth 2.0 Client.
in: path
name: id
required: true
schema:
type: string
responses:
"204":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Deletes an OAuth 2.0 Client
tags:
- admin
get:
description: |-
Get an OAUth 2.0 client by its ID. This endpoint never returns passwords.
OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.
operationId: getOAuth2Client
parameters:
- description: The id of the OAuth 2.0 Client.
in: path
name: id
required: true
schema:
type: string
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
description: oAuth2Client
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Get an OAuth 2.0 Client.
tags:
- admin
put:
description: |-
Update an existing OAuth 2.0 Client. If you pass `client_secret` the secret will be updated and returned via the API. This is the only time you will be able to retrieve the client secret, so write it down and keep it safe.
OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.
operationId: updateOAuth2Client
parameters:
- in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
description: oAuth2Client
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Update an OAuth 2.0 Client
tags:
- admin
x-codegen-request-body-name: Body
/health/alive:
get:
description: |-
This endpoint returns a 200 status code when the HTTP server is up running.
This status does currently not include checks whether the database connection is working.
If the service supports TLS Edge Termination, this endpoint does not require the
`X-Forwarded-Proto` header to be set.
Be aware that if you are running multiple nodes of this service, the health status will never
refer to the cluster state, only to a single instance.
operationId: isInstanceAlive
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/healthStatus'
description: healthStatus
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Check Alive Status
tags:
- admin
/health/ready:
get:
description: |-
This endpoint returns a 200 status code when the HTTP server is up running and the environment dependencies (e.g.
the database) are responsive as well.
If the service supports TLS Edge Termination, this endpoint does not require the
`X-Forwarded-Proto` header to be set.
Be aware that if you are running multiple nodes of this service, the health status will never
refer to the cluster state, only to a single instance.
operationId: isInstanceReady
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/healthStatus'
description: healthStatus
"503":
content:
application/json:
schema:
$ref: '#/components/schemas/healthNotReadyStatus'
description: healthNotReadyStatus
summary: Check Readiness Status
tags:
- public
/keys/{set}:
delete:
description: |-
Use this endpoint to delete a complete JSON Web Key Set and all the keys in that set.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
operationId: deleteJsonWebKeySet
parameters:
- description: The set
in: path
name: set
required: true
schema:
type: string
responses:
"204":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Delete a JSON Web Key Set
tags:
- admin
get:
description: |-
This endpoint can be used to retrieve JWK Sets stored in ORY Hydra.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
operationId: getJsonWebKeySet
parameters:
- description: The set
in: path
name: set
required: true
schema:
type: string
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/JSONWebKeySet'
description: JSONWebKeySet
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Retrieve a JSON Web Key Set
tags:
- admin
post:
description: |-
This endpoint is capable of generating JSON Web Key Sets for you. There a different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
operationId: createJsonWebKeySet
parameters:
- description: The set
in: path
name: set
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/jsonWebKeySetGeneratorRequest'
required: false
responses:
"201":
content:
application/json:
schema:
$ref: '#/components/schemas/JSONWebKeySet'
description: JSONWebKeySet
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Generate a New JSON Web Key
tags:
- admin
x-codegen-request-body-name: Body
put:
description: |-
Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
operationId: updateJsonWebKeySet
parameters:
- description: The set
in: path
name: set
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/JSONWebKeySet'
required: false
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/JSONWebKeySet'
description: JSONWebKeySet
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Update a JSON Web Key Set
tags:
- admin
x-codegen-request-body-name: Body
/keys/{set}/{kid}:
delete:
description: |-
Use this endpoint to delete a single JSON Web Key.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
operationId: deleteJsonWebKey
parameters:
- description: The kid of the desired key
in: path
name: kid
required: true
schema:
type: string
- description: The set
in: path
name: set
required: true
schema:
type: string
responses:
"204":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Delete a JSON Web Key
tags:
- admin
get:
description: This endpoint returns a singular JSON Web Key, identified by the
set and the specific key ID (kid).
operationId: getJsonWebKey
parameters:
- description: The kid of the desired key
in: path
name: kid
required: true
schema:
type: string
- description: The set
in: path
name: set
required: true
schema:
type: string
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/JSONWebKeySet'
description: JSONWebKeySet
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Fetch a JSON Web Key
tags:
- admin
put:
description: |-
Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
operationId: updateJsonWebKey
parameters:
- description: The kid of the desired key
in: path
name: kid
required: true
schema:
type: string
- description: The set
in: path
name: set
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/JSONWebKey'
required: false
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/JSONWebKey'
description: JSONWebKey
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Update a JSON Web Key
tags:
- admin
x-codegen-request-body-name: Body
/metrics/prometheus:
get:
description: |-
If you're using k8s, you can then add annotations to your deployment like so:
```
metadata:
annotations:
prometheus.io/port: "4445"
prometheus.io/path: "/metrics/prometheus"
```
If the service supports TLS Edge Termination, this endpoint does not require the
`X-Forwarded-Proto` header to be set.
operationId: prometheus
responses:
"200":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
summary: Get Snapshot Metrics from the Hydra Service.
tags:
- admin
/oauth2/auth:
get:
description: |-
This endpoint is not documented here because you should never use your own implementation to perform OAuth2 flows.
OAuth2 is a very popular protocol and a library for your programming language will exists.
To learn more about this flow please refer to the specification: https://tools.ietf.org/html/rfc6749
operationId: oauthAuth
responses:
"302":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: The OAuth 2.0 Authorize Endpoint
tags:
- public
/oauth2/auth/requests/consent:
get:
description: |-
When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider
to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if
the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.
The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to
grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").
The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent
provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted
or rejected the request.
operationId: getConsentRequest
parameters:
- in: query
name: consent_challenge
required: true
schema:
type: string
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/consentRequest'
description: consentRequest
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"409":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Get Consent Request Information
tags:
- admin
/oauth2/auth/requests/consent/accept:
put:
description: |-
When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider
to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if
the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.
The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to
grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").
The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent
provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted
or rejected the request.
This endpoint tells ORY Hydra that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf.
The consent provider includes additional information, such as session data for access and ID tokens, and if the
consent request should be used as basis for future requests.
The response contains a redirect URL which the consent provider should redirect the user-agent to.
operationId: acceptConsentRequest
parameters:
- in: query
name: consent_challenge
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/acceptConsentRequest'
required: false
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/completedRequest'
description: completedRequest
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Accept a Consent Request
tags:
- admin
x-codegen-request-body-name: Body
/oauth2/auth/requests/consent/reject:
put:
description: |-
When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider
to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if
the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.
The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to
grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").
The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent
provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted
or rejected the request.
This endpoint tells ORY Hydra that the subject has not authorized the OAuth 2.0 client to access resources on his/her behalf.
The consent provider must include a reason why the consent was not granted.
The response contains a redirect URL which the consent provider should redirect the user-agent to.
operationId: rejectConsentRequest
parameters:
- in: query
name: consent_challenge
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/rejectRequest'
required: false
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/completedRequest'
description: completedRequest
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Reject a Consent Request
tags:
- admin
x-codegen-request-body-name: Body
/oauth2/auth/requests/login:
get:
description: |-
When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider
(sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login
provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen")
a subject (in OAuth2 the proper name for subject is "resource owner").
The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login
provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.
operationId: getLoginRequest
parameters:
- in: query
name: login_challenge
required: true
schema:
type: string
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/loginRequest'
description: loginRequest
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"409":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Get a Login Request
tags:
- admin
/oauth2/auth/requests/login/accept:
put:
description: |-
When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider
(sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login
provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen")
a subject (in OAuth2 the proper name for subject is "resource owner").
The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login
provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.
This endpoint tells ORY Hydra that the subject has successfully authenticated and includes additional information such as
the subject's ID and if ORY Hydra should remember the subject's subject agent for future authentication attempts by setting
a cookie.
The response contains a redirect URL which the login provider should redirect the user-agent to.
operationId: acceptLoginRequest
parameters:
- in: query
name: login_challenge
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/acceptLoginRequest'
required: false
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/completedRequest'
description: completedRequest
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Accept a Login Request
tags:
- admin
x-codegen-request-body-name: Body
/oauth2/auth/requests/login/reject:
put:
description: |-
When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider
(sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login
provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen")
a subject (in OAuth2 the proper name for subject is "resource owner").
The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login
provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.
This endpoint tells ORY Hydra that the subject has not authenticated and includes a reason why the authentication
was be denied.
The response contains a redirect URL which the login provider should redirect the user-agent to.
operationId: rejectLoginRequest
parameters:
- in: query
name: login_challenge
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/rejectRequest'
required: false
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/completedRequest'
description: completedRequest
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Reject a Login Request
tags:
- admin
x-codegen-request-body-name: Body
/oauth2/auth/requests/logout:
get:
description: Use this endpoint to fetch a logout request.
operationId: getLogoutRequest
parameters:
- in: query
name: logout_challenge
required: true
schema:
type: string
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/logoutRequest'
description: logoutRequest
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Get a Logout Request
tags:
- admin
/oauth2/auth/requests/logout/accept:
put:
description: |-
When a user or an application requests ORY Hydra to log out a user, this endpoint is used to confirm that logout request.
No body is required.
The response contains a redirect URL which the consent provider should redirect the user-agent to.
operationId: acceptLogoutRequest
parameters:
- in: query
name: logout_challenge
required: true
schema:
type: string
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/completedRequest'
description: completedRequest
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Accept a Logout Request
tags:
- admin
/oauth2/auth/requests/logout/reject:
put:
description: |-
When a user or an application requests ORY Hydra to log out a user, this endpoint is used to deny that logout request.
No body is required.
The response is empty as the logout provider has to chose what action to perform next.
operationId: rejectLogoutRequest
parameters:
- in: query
name: logout_challenge
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/rejectRequest'
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/rejectRequest'
required: false
responses:
"204":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Reject a Logout Request
tags:
- admin
x-codegen-request-body-name: Body
/oauth2/auth/sessions/consent:
delete:
description: |-
This endpoint revokes a subject's granted consent sessions for a specific OAuth 2.0 Client and invalidates all
associated OAuth 2.0 Access Tokens.
operationId: revokeConsentSessions
parameters:
- description: The subject (Subject) who's consent sessions should be deleted.
in: query
name: subject
required: true
schema:
type: string
- description: If set, deletes only those consent sessions by the Subject that
have been granted to the specified OAuth 2.0 Client ID
in: query
name: client
schema:
type: string
- description: If set to `?all=true`, deletes all consent sessions by the Subject
that have been granted.
in: query
name: all
schema:
type: boolean
responses:
"204":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Revokes Consent Sessions of a Subject for a Specific OAuth 2.0 Client
tags:
- admin
get:
description: |-
This endpoint lists all subject's granted consent sessions, including client and granted scope.
If the subject is unknown or has not granted any consent sessions yet, the endpoint returns an
empty JSON array with status code 200 OK.
The "Link" header is also included in successful responses, which contains one or more links for pagination, formatted like so: '<https://hydra-url/admin/oauth2/auth/sessions/consent?subject={user}&limit={limit}&offset={offset}>; rel="{page}"', where page is one of the following applicable pages: 'first', 'next', 'last', and 'previous'.
Multiple links can be included in this header, and will be separated by a comma.
operationId: listSubjectConsentSessions
parameters:
- in: query
name: subject
required: true
schema:
type: string
responses:
"200":
content:
application/json:
schema:
items:
$ref: '#/components/schemas/PreviousConsentSession'
type: array
description: A list of used consent requests.
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Lists All Consent Sessions of a Subject
tags:
- admin
/oauth2/auth/sessions/login:
delete:
description: |-
This endpoint invalidates a subject's authentication session. After revoking the authentication session, the subject
has to re-authenticate at ORY Hydra. This endpoint does not invalidate any tokens and does not work with OpenID Connect
Front- or Back-channel logout.
operationId: revokeAuthenticationSession
parameters:
- in: query
name: subject
required: true
schema:
type: string
responses:
"204":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: |-
Invalidates All Login Sessions of a Certain User
Invalidates a Subject's Authentication Session
tags:
- admin
/oauth2/flush:
post:
description: |-
This endpoint flushes expired OAuth2 access tokens from the database. You can set a time after which no tokens will be
not be touched, in case you want to keep recent tokens for auditing. Refresh tokens can not be flushed as they are deleted
automatically when performing the refresh flow.
operationId: flushInactiveOAuth2Tokens
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/flushInactiveOAuth2TokensRequest'
required: false
responses:
"204":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Flush Expired OAuth2 Access Tokens
tags:
- admin
x-codegen-request-body-name: Body
/oauth2/introspect:
post:
description: |-
The introspection endpoint allows to check if a token (both refresh and access) is active or not. An active token
is neither expired nor revoked. If a token is active, additional information on the token will be included. You can
set additional data for a token by setting `accessTokenExtra` during the consent flow.
For more information [read this blog post](https://www.oauth.com/oauth2-servers/token-introspection-endpoint/).
operationId: introspectOAuth2Token
requestBody:
content:
application/x-www-form-urlencoded:
schema:
properties:
token:
description: |-
The string value of the token. For access tokens, this
is the "access_token" value returned from the token endpoint
defined in OAuth 2.0. For refresh tokens, this is the "refresh_token"
value returned.
type: string
scope:
description: |-
An optional, space separated list of required scopes. If the access token was not granted one of the
scopes, the result of active will be false.
type: string
required:
- token
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2TokenIntrospection'
description: oAuth2TokenIntrospection
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Introspect OAuth2 Tokens
tags:
- admin
/oauth2/revoke:
post:
description: |-
Revoking a token (both access and refresh) means that the tokens will be invalid. A revoked access token can no
longer be used to make access requests, and a revoked refresh token can no longer be used to refresh an access token.
Revoking a refresh token also invalidates the access token that was created with it. A token may only be revoked by
the client the token was generated for.
operationId: revokeOAuth2Token
requestBody:
content:
application/x-www-form-urlencoded:
schema:
properties:
token:
type: string
required:
- token
required: true
responses:
"200":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
security:
- basic: []
- oauth2: []
summary: Revoke OAuth2 Tokens
tags:
- public
/oauth2/sessions/logout:
get:
description: |-
This endpoint initiates and completes user logout at ORY Hydra and initiates OpenID Connect Front-/Back-channel logout:
https://openid.net/specs/openid-connect-frontchannel-1_0.html
https://openid.net/specs/openid-connect-backchannel-1_0.html
operationId: disconnectUser
responses:
"302":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
summary: OpenID Connect Front-Backchannel Enabled Logout
tags:
- public
/oauth2/token:
post:
description: |-
The client makes a request to the token endpoint by sending the
following parameters using the "application/x-www-form-urlencoded" HTTP
request entity-body.
> Do not implement a client for this endpoint yourself. Use a library. There are many libraries
> available for any programming language. You can find a list of libraries here: https://oauth.net/code/
>
> Do note that Hydra SDK does not implement this endpoint properly. Use one of the libraries listed above!
operationId: oauth2Token
requestBody:
content:
application/x-www-form-urlencoded:
schema:
properties:
grant_type:
type: string
code:
type: string
refresh_token:
type: string
redirect_uri:
type: string
client_id:
type: string
required:
- grant_type
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/oauth2TokenResponse'
description: oauth2TokenResponse
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
security:
- basic: []
- oauth2: []
summary: The OAuth 2.0 Token Endpoint
tags:
- public
/oauth2/tokens:
delete:
description: This endpoint deletes OAuth2 access tokens issued for a client
from the database
operationId: deleteOAuth2Token
parameters:
- in: query
name: client_id
required: true
schema:
type: string
responses:
"204":
content: {}
description: |-
Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 201.
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
summary: Delete OAuth2 Access Tokens from a Client
tags:
- admin
/userinfo:
get:
description: |-
This endpoint returns the payload of the ID Token, including the idTokenExtra values, of
the provided OAuth 2.0 Access Token.
For more information please [refer to the spec](http://openid.net/specs/openid-connect-core-1_0.html#UserInfo).
operationId: userinfo
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/userinfoResponse'
description: userinfoResponse
"401":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
"500":
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
security:
- oauth2: []
summary: OpenID Connect Userinfo
tags:
- public
/version:
get:
description: |-
This endpoint returns the service version typically notated using semantic versioning.
If the service supports TLS Edge Termination, this endpoint does not require the
`X-Forwarded-Proto` header to be set.
operationId: getVersion
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/version'
description: version
summary: Get Service Version
tags:
- admin
components:
schemas:
ContainerWaitOKBodyError:
description: ContainerWaitOKBodyError container waiting error, if any
properties:
Message:
description: Details of an error
type: string
type: object
JSONRawMessage:
title: JSONRawMessage represents a json.RawMessage that works well with JSON,
SQL, and Swagger.
type: object
JSONWebKey:
description: |-
It is important that this model object is named JSONWebKey for
"swagger generate spec" to generate only on definition of a
JSONWebKey.
example:
d: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE
e: AQAB
crv: P-256
use: sig
kid: 1603dfe0af8f4596
x5c:
- x5c
- x5c
k: GawgguFyGrWKav7AX4VKUg
dp: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0
dq: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk
n: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0
p: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ
kty: RSA
q: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ
qi: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU
x: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU
y: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0
alg: RS256
properties:
alg:
description: |-
The "alg" (algorithm) parameter identifies the algorithm intended for
use with the key. The values used should either be registered in the
IANA "JSON Web Signature and Encryption Algorithms" registry
established by [JWA] or be a value that contains a Collision-
Resistant Name.
example: RS256
type: string
crv:
example: P-256
type: string
d:
example: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE
type: string
dp:
example: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0
type: string
dq:
example: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk
type: string
e:
example: AQAB
type: string
k:
example: GawgguFyGrWKav7AX4VKUg
type: string
kid:
description: |-
The "kid" (key ID) parameter is used to match a specific key. This
is used, for instance, to choose among a set of keys within a JWK Set
during key rollover. The structure of the "kid" value is
unspecified. When "kid" values are used within a JWK Set, different
keys within the JWK Set SHOULD use distinct "kid" values. (One
example in which different keys might use the same "kid" value is if
they have different "kty" (key type) values but are considered to be
equivalent alternatives by the application using them.) The "kid"
value is a case-sensitive string.
example: 1603dfe0af8f4596
type: string
kty:
description: |-
The "kty" (key type) parameter identifies the cryptographic algorithm
family used with the key, such as "RSA" or "EC". "kty" values should
either be registered in the IANA "JSON Web Key Types" registry
established by [JWA] or be a value that contains a Collision-
Resistant Name. The "kty" value is a case-sensitive string.
example: RSA
type: string
n:
example: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0
type: string
p:
example: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ
type: string
q:
example: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ
type: string
qi:
example: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU
type: string
use:
description: |-
Use ("public key use") identifies the intended use of
the public key. The "use" parameter is employed to indicate whether
a public key is used for encrypting data or verifying the signature
on data. Values are commonly "sig" (signature) or "enc" (encryption).
example: sig
type: string
x:
example: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU
type: string
x5c:
description: |-
The "x5c" (X.509 certificate chain) parameter contains a chain of one
or more PKIX certificates [RFC5280]. The certificate chain is
represented as a JSON array of certificate value strings. Each
string in the array is a base64-encoded (Section 4 of [RFC4648] --
not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value.
The PKIX certificate containing the key value MUST be the first
certificate.
items:
type: string
type: array
y:
example: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0
type: string
required:
- alg
- kid
- kty
- use
type: object
JSONWebKeySet:
description: |-
It is important that this model object is named JSONWebKeySet for
"swagger generate spec" to generate only on definition of a
JSONWebKeySet. Since one with the same name is previously defined as
client.Client.JSONWebKeys and this one is last, this one will be
effectively written in the swagger spec.
example:
keys:
- d: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE
e: AQAB
crv: P-256
use: sig
kid: 1603dfe0af8f4596
x5c:
- x5c
- x5c
k: GawgguFyGrWKav7AX4VKUg
dp: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0
dq: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk
n: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0
p: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ
kty: RSA
q: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ
qi: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU
x: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU
y: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0
alg: RS256
- d: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE
e: AQAB
crv: P-256
use: sig
kid: 1603dfe0af8f4596
x5c:
- x5c
- x5c
k: GawgguFyGrWKav7AX4VKUg
dp: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0
dq: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk
n: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0
p: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ
kty: RSA
q: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ
qi: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU
x: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU
y: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0
alg: RS256
properties:
keys:
description: |-
The value of the "keys" parameter is an array of JWK values. By
default, the order of the JWK values within the array does not imply
an order of preference among them, although applications of JWK Sets
can choose to assign a meaning to the order for their purposes, if
desired.
items:
$ref: '#/components/schemas/JSONWebKey'
type: array
type: object
JoseJSONWebKeySet:
type: object
NullTime:
format: date-time
title: NullTime implements sql.NullTime functionality.
type: string
PluginConfig:
properties:
Args:
$ref: '#/components/schemas/PluginConfigArgs'
Description:
description: description
type: string
DockerVersion:
description: Docker Version used to create the plugin
type: string
Documentation:
description: documentation
type: string
Entrypoint:
description: entrypoint
items:
type: string
type: array
Env:
description: env
items:
$ref: '#/components/schemas/PluginEnv'
type: array
Interface:
$ref: '#/components/schemas/PluginConfigInterface'
IpcHost:
description: ipc host
type: boolean
Linux:
$ref: '#/components/schemas/PluginConfigLinux'
Mounts:
description: mounts
items:
$ref: '#/components/schemas/PluginMount'
type: array
Network:
$ref: '#/components/schemas/PluginConfigNetwork'
PidHost:
description: pid host
type: boolean
PropagatedMount:
description: propagated mount
type: string
User:
$ref: '#/components/schemas/PluginConfigUser'
WorkDir:
description: work dir
type: string
rootfs:
$ref: '#/components/schemas/PluginConfigRootfs'
required:
- Args
- Description
- Documentation
- Entrypoint
- Env
- Interface
- IpcHost
- Linux
- Mounts
- Network
- PidHost
- PropagatedMount
- WorkDir
title: PluginConfig The config of a plugin.
type: object
PluginConfigArgs:
description: PluginConfigArgs plugin config args
properties:
Description:
description: description
type: string
Name:
description: name
type: string
Settable:
description: settable
items:
type: string
type: array
Value:
description: value
items:
type: string
type: array
required:
- Description
- Name
- Settable
- Value
type: object
PluginConfigInterface:
description: PluginConfigInterface The interface between Docker and the plugin
properties:
Socket:
description: socket
type: string
Types:
description: types
items:
$ref: '#/components/schemas/PluginInterfaceType'
type: array
required:
- Socket
- Types
type: object
PluginConfigLinux:
description: PluginConfigLinux plugin config linux
properties:
AllowAllDevices:
description: allow all devices
type: boolean
Capabilities:
description: capabilities
items:
type: string
type: array
Devices:
description: devices
items:
$ref: '#/components/schemas/PluginDevice'
type: array
required:
- AllowAllDevices
- Capabilities
- Devices
type: object
PluginConfigNetwork:
description: PluginConfigNetwork plugin config network
properties:
Type:
description: type
type: string
required:
- Type
type: object
PluginConfigRootfs:
description: PluginConfigRootfs plugin config rootfs
properties:
diff_ids:
description: diff ids
items:
type: string
type: array
type:
description: type
type: string
type: object
PluginConfigUser:
description: PluginConfigUser plugin config user
properties:
GID:
description: g ID
format: uint32
type: integer
UID:
description: UID
format: uint32
type: integer
type: object
PluginDevice:
description: PluginDevice plugin device
properties:
Description:
description: description
type: string
Name:
description: name
type: string
Path:
description: path
type: string
Settable:
description: settable
items:
type: string
type: array
required:
- Description
- Name
- Path
- Settable
type: object
PluginEnv:
description: PluginEnv plugin env
properties:
Description:
description: description
type: string
Name:
description: name
type: string
Settable:
description: settable
items:
type: string
type: array
Value:
description: value
type: string
required:
- Description
- Name
- Settable
- Value
type: object
PluginInterfaceType:
description: PluginInterfaceType plugin interface type
properties:
Capability:
description: capability
type: string
Prefix:
description: prefix
type: string
Version:
description: version
type: string
required:
- Capability
- Prefix
- Version
type: object
PluginMount:
description: PluginMount plugin mount
properties:
Description:
description: description
type: string
Destination:
description: destination
type: string
Name:
description: name
type: string
Options:
description: options
items:
type: string
type: array
Settable:
description: settable
items:
type: string
type: array
Source:
description: source
type: string
Type:
description: type
type: string
required:
- Description
- Destination
- Name
- Options
- Settable
- Source
- Type
type: object
PluginSettings:
properties:
Args:
description: args
items:
type: string
type: array
Devices:
description: devices
items:
$ref: '#/components/schemas/PluginDevice'
type: array
Env:
description: env
items:
type: string
type: array
Mounts:
description: mounts
items:
$ref: '#/components/schemas/PluginMount'
type: array
required:
- Args
- Devices
- Env
- Mounts
title: PluginSettings Settings that can be modified by users.
type: object
PreviousConsentSession:
description: |-
The response used to return used consent requests
same as HandledLoginRequest, just with consent_request exposed as json
example:
remember: true
consent_request:
requested_access_token_audience:
- requested_access_token_audience
- requested_access_token_audience
acr: acr
login_challenge: login_challenge
subject: subject
context: '{}'
oidc_context:
login_hint: login_hint
ui_locales:
- ui_locales
- ui_locales
id_token_hint_claims: '{}'
acr_values:
- acr_values
- acr_values
display: display
challenge: challenge
client:
metadata: '{}'
token_endpoint_auth_signing_alg: token_endpoint_auth_signing_alg
client_uri: client_uri
jwks: '{}'
logo_uri: logo_uri
created_at: 2000-01-23T04:56:07.000+00:00
allowed_cors_origins:
- allowed_cors_origins
- allowed_cors_origins
client_id: client_id
token_endpoint_auth_method: token_endpoint_auth_method
userinfo_signed_response_alg: userinfo_signed_response_alg
updated_at: 2000-01-23T04:56:07.000+00:00
scope: scope
request_uris:
- request_uris
- request_uris
client_secret: client_secret
backchannel_logout_session_required: true
backchannel_logout_uri: backchannel_logout_uri
client_name: client_name
policy_uri: policy_uri
owner: owner
audience:
- audience
- audience
post_logout_redirect_uris:
- post_logout_redirect_uris
- post_logout_redirect_uris
grant_types:
- grant_types
- grant_types
subject_type: subject_type
redirect_uris:
- redirect_uris
- redirect_uris
sector_identifier_uri: sector_identifier_uri
frontchannel_logout_session_required: true
frontchannel_logout_uri: frontchannel_logout_uri
client_secret_expires_at: 0
jwks_uri: jwks_uri
request_object_signing_alg: request_object_signing_alg
tos_uri: tos_uri
contacts:
- contacts
- contacts
response_types:
- response_types
- response_types
skip: true
login_session_id: login_session_id
request_url: request_url
requested_scope:
- requested_scope
- requested_scope
session:
access_token: '{}'
id_token: '{}'
grant_access_token_audience:
- grant_access_token_audience
- grant_access_token_audience
handled_at: 2000-01-23T04:56:07.000+00:00
grant_scope:
- grant_scope
- grant_scope
remember_for: 0
properties:
consent_request:
$ref: '#/components/schemas/consentRequest'
grant_access_token_audience:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
grant_scope:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
handled_at:
format: date-time
title: NullTime implements sql.NullTime functionality.
type: string
remember:
description: |-
Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same
client asks the same user for the same, or a subset of, scope.
type: boolean
remember_for:
description: |-
RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the
authorization will be remembered indefinitely.
format: int64
type: integer
session:
$ref: '#/components/schemas/consentRequestSession'
type: object
StringSlicePipeDelimiter:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL string.
type: array
VolumeUsageData:
description: |-
VolumeUsageData Usage details about the volume. This information is used by the
`GET /system/df` endpoint, and omitted in other endpoints.
properties:
RefCount:
description: |-
The number of containers referencing this volume. This field
is set to `-1` if the reference-count is not available.
format: int64
type: integer
Size:
description: |-
Amount of disk space used by the volume (in bytes). This information
is only available for volumes created with the `"local"` volume
driver. For volumes created with other volume drivers, this field
is set to `-1` ("not available")
format: int64
type: integer
required:
- RefCount
- Size
type: object
acceptConsentRequest:
properties:
grant_access_token_audience:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
grant_scope:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
handled_at:
format: date-time
title: NullTime implements sql.NullTime functionality.
type: string
remember:
description: |-
Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same
client asks the same user for the same, or a subset of, scope.
type: boolean
remember_for:
description: |-
RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the
authorization will be remembered indefinitely.
format: int64
type: integer
session:
$ref: '#/components/schemas/consentRequestSession'
title: The request payload used to accept a consent request.
type: object
acceptLoginRequest:
properties:
acr:
description: |-
ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it
to express that, for example, a user authenticated using two factor authentication.
type: string
context:
title: JSONRawMessage represents a json.RawMessage that works well with
JSON, SQL, and Swagger.
type: object
force_subject_identifier:
description: |-
ForceSubjectIdentifier forces the "pairwise" user ID of the end-user that authenticated. The "pairwise" user ID refers to the
(Pairwise Identifier Algorithm)[http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg] of the OpenID
Connect specification. It allows you to set an obfuscated subject ("user") identifier that is unique to the client.
Please note that this changes the user ID on endpoint /userinfo and sub claim of the ID Token. It does not change the
sub claim in the OAuth 2.0 Introspection.
Per default, ORY Hydra handles this value with its own algorithm. In case you want to set this yourself
you can use this field. Please note that setting this field has no effect if `pairwise` is not configured in
ORY Hydra or the OAuth 2.0 Client does not expect a pairwise identifier (set via `subject_type` key in the client's
configuration).
Please also be aware that ORY Hydra is unable to properly compute this value during authentication. This implies
that you have to compute this value on every authentication process (probably depending on the client ID or some
other unique value).
If you fail to compute the proper value, then authentication processes which have id_token_hint set might fail.
type: string
remember:
description: |-
Remember, if set to true, tells ORY Hydra to remember this user by telling the user agent (browser) to store
a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, he/she
will not be asked to log in again.
type: boolean
remember_for:
description: |-
RememberFor sets how long the authentication should be remembered for in seconds. If set to `0`, the
authorization will be remembered for the duration of the browser session (using a session cookie).
format: int64
type: integer
subject:
description: Subject is the user ID of the end-user that authenticated.
type: string
required:
- subject
title: HandledLoginRequest is the request payload used to accept a login request.
type: object
completedRequest:
example:
redirect_to: redirect_to
properties:
redirect_to:
description: RedirectURL is the URL which you should redirect the user to
once the authentication process is completed.
type: string
required:
- redirect_to
title: The response payload sent when accepting or rejecting a login or consent
request.
type: object
consentRequest:
example:
requested_access_token_audience:
- requested_access_token_audience
- requested_access_token_audience
acr: acr
login_challenge: login_challenge
subject: subject
context: '{}'
oidc_context:
login_hint: login_hint
ui_locales:
- ui_locales
- ui_locales
id_token_hint_claims: '{}'
acr_values:
- acr_values
- acr_values
display: display
challenge: challenge
client:
metadata: '{}'
token_endpoint_auth_signing_alg: token_endpoint_auth_signing_alg
client_uri: client_uri
jwks: '{}'
logo_uri: logo_uri
created_at: 2000-01-23T04:56:07.000+00:00
allowed_cors_origins:
- allowed_cors_origins
- allowed_cors_origins
client_id: client_id
token_endpoint_auth_method: token_endpoint_auth_method
userinfo_signed_response_alg: userinfo_signed_response_alg
updated_at: 2000-01-23T04:56:07.000+00:00
scope: scope
request_uris:
- request_uris
- request_uris
client_secret: client_secret
backchannel_logout_session_required: true
backchannel_logout_uri: backchannel_logout_uri
client_name: client_name
policy_uri: policy_uri
owner: owner
audience:
- audience
- audience
post_logout_redirect_uris:
- post_logout_redirect_uris
- post_logout_redirect_uris
grant_types:
- grant_types
- grant_types
subject_type: subject_type
redirect_uris:
- redirect_uris
- redirect_uris
sector_identifier_uri: sector_identifier_uri
frontchannel_logout_session_required: true
frontchannel_logout_uri: frontchannel_logout_uri
client_secret_expires_at: 0
jwks_uri: jwks_uri
request_object_signing_alg: request_object_signing_alg
tos_uri: tos_uri
contacts:
- contacts
- contacts
response_types:
- response_types
- response_types
skip: true
login_session_id: login_session_id
request_url: request_url
requested_scope:
- requested_scope
- requested_scope
properties:
acr:
description: |-
ACR represents the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it
to express that, for example, a user authenticated using two factor authentication.
type: string
challenge:
description: |-
ID is the identifier ("authorization challenge") of the consent authorization request. It is used to
identify the session.
type: string
client:
$ref: '#/components/schemas/oAuth2Client'
context:
title: JSONRawMessage represents a json.RawMessage that works well with
JSON, SQL, and Swagger.
type: object
login_challenge:
description: |-
LoginChallenge is the login challenge this consent challenge belongs to. It can be used to associate
a login and consent request in the login & consent app.
type: string
login_session_id:
description: |-
LoginSessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)
this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)
this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-
channel logout. It's value can generally be used to associate consecutive login requests by a certain user.
type: string
oidc_context:
$ref: '#/components/schemas/openIDConnectContext'
request_url:
description: |-
RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
might come in handy if you want to deal with additional request parameters.
type: string
requested_access_token_audience:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
requested_scope:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
skip:
description: |-
Skip, if true, implies that the client has requested the same scopes from the same user previously.
If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the
consent request using the usual API call.
type: boolean
subject:
description: |-
Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
requested by the OAuth 2.0 client.
type: string
required:
- challenge
title: Contains information on an ongoing consent request.
type: object
consentRequestSession:
example:
access_token: '{}'
id_token: '{}'
properties:
access_token:
description: |-
AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the
refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0 Challenge Introspection.
If only your services can perform OAuth 2.0 Challenge Introspection, this is usually fine. But if third parties
can access that endpoint as well, sensitive data from the session might be exposed to them. Use with care!
properties: {}
type: object
id_token:
description: |-
IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session'id payloads are readable
by anyone that has access to the ID Challenge. Use with care!
properties: {}
type: object
title: Used to pass session data to a consent request.
type: object
flushInactiveOAuth2TokensRequest:
properties:
notAfter:
description: |-
NotAfter sets after which point tokens should not be flushed. This is useful when you want to keep a history
of recently issued tokens for auditing.
format: date-time
type: string
type: object
genericError:
description: Error responses are sent when an error (e.g. unauthorized, bad
request, ...) occurred.
properties:
debug:
description: Debug contains debug information. This is usually not available
and has to be enabled.
example: The database adapter was unable to find the element
type: string
error:
description: Name is the error name.
example: The requested resource could not be found
type: string
error_description:
description: Description contains further information on the nature of the
error.
example: Object with ID 12345 does not exist
type: string
status_code:
description: Code represents the error status code (404, 403, 401, ...).
example: 404
format: int64
type: integer
required:
- error
title: Error response
type: object
healthNotReadyStatus:
properties:
errors:
additionalProperties:
type: string
description: Errors contains a list of errors that caused the not ready
status.
type: object
type: object
healthStatus:
example:
status: status
properties:
status:
description: Status always contains "ok".
type: string
type: object
jsonWebKeySetGeneratorRequest:
properties:
alg:
description: The algorithm to be used for creating the key. Supports "RS256",
"ES512", "HS512", and "HS256"
type: string
kid:
description: The kid of the key to be created
type: string
use:
description: |-
The "use" (public key use) parameter identifies the intended use of
the public key. The "use" parameter is employed to indicate whether
a public key is used for encrypting data or verifying the signature
on data. Valid values are "enc" and "sig".
type: string
required:
- alg
- kid
- use
type: object
loginRequest:
example:
requested_access_token_audience:
- requested_access_token_audience
- requested_access_token_audience
subject: subject
oidc_context:
login_hint: login_hint
ui_locales:
- ui_locales
- ui_locales
id_token_hint_claims: '{}'
acr_values:
- acr_values
- acr_values
display: display
challenge: challenge
client:
metadata: '{}'
token_endpoint_auth_signing_alg: token_endpoint_auth_signing_alg
client_uri: client_uri
jwks: '{}'
logo_uri: logo_uri
created_at: 2000-01-23T04:56:07.000+00:00
allowed_cors_origins:
- allowed_cors_origins
- allowed_cors_origins
client_id: client_id
token_endpoint_auth_method: token_endpoint_auth_method
userinfo_signed_response_alg: userinfo_signed_response_alg
updated_at: 2000-01-23T04:56:07.000+00:00
scope: scope
request_uris:
- request_uris
- request_uris
client_secret: client_secret
backchannel_logout_session_required: true
backchannel_logout_uri: backchannel_logout_uri
client_name: client_name
policy_uri: policy_uri
owner: owner
audience:
- audience
- audience
post_logout_redirect_uris:
- post_logout_redirect_uris
- post_logout_redirect_uris
grant_types:
- grant_types
- grant_types
subject_type: subject_type
redirect_uris:
- redirect_uris
- redirect_uris
sector_identifier_uri: sector_identifier_uri
frontchannel_logout_session_required: true
frontchannel_logout_uri: frontchannel_logout_uri
client_secret_expires_at: 0
jwks_uri: jwks_uri
request_object_signing_alg: request_object_signing_alg
tos_uri: tos_uri
contacts:
- contacts
- contacts
response_types:
- response_types
- response_types
session_id: session_id
skip: true
request_url: request_url
requested_scope:
- requested_scope
- requested_scope
properties:
challenge:
description: |-
ID is the identifier ("login challenge") of the login request. It is used to
identify the session.
type: string
client:
$ref: '#/components/schemas/oAuth2Client'
oidc_context:
$ref: '#/components/schemas/openIDConnectContext'
request_url:
description: |-
RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which
initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but
might come in handy if you want to deal with additional request parameters.
type: string
requested_access_token_audience:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
requested_scope:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
session_id:
description: |-
SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)
this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)
this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-
channel logout. It's value can generally be used to associate consecutive login requests by a certain user.
type: string
skip:
description: |-
Skip, if true, implies that the client has requested the same scopes from the same user previously.
If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL.
This feature allows you to update / set session information.
type: boolean
subject:
description: |-
Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope
requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST include this subject type
when accepting the login request, or the request will fail.
type: string
required:
- challenge
- client
- request_url
- requested_access_token_audience
- requested_scope
- skip
- subject
title: Contains information on an ongoing login request.
type: object
logoutRequest:
example:
subject: subject
rp_initiated: true
request_url: request_url
sid: sid
properties:
request_url:
description: RequestURL is the original Logout URL requested.
type: string
rp_initiated:
description: RPInitiated is set to true if the request was initiated by
a Relying Party (RP), also known as an OAuth 2.0 Client.
type: boolean
sid:
description: SessionID is the login session ID that was requested to log
out.
type: string
subject:
description: Subject is the user for whom the logout was request.
type: string
title: Contains information about an ongoing logout request.
type: object
oAuth2Client:
example:
metadata: '{}'
token_endpoint_auth_signing_alg: token_endpoint_auth_signing_alg
client_uri: client_uri
jwks: '{}'
logo_uri: logo_uri
created_at: 2000-01-23T04:56:07.000+00:00
allowed_cors_origins:
- allowed_cors_origins
- allowed_cors_origins
client_id: client_id
token_endpoint_auth_method: token_endpoint_auth_method
userinfo_signed_response_alg: userinfo_signed_response_alg
updated_at: 2000-01-23T04:56:07.000+00:00
scope: scope
request_uris:
- request_uris
- request_uris
client_secret: client_secret
backchannel_logout_session_required: true
backchannel_logout_uri: backchannel_logout_uri
client_name: client_name
policy_uri: policy_uri
owner: owner
audience:
- audience
- audience
post_logout_redirect_uris:
- post_logout_redirect_uris
- post_logout_redirect_uris
grant_types:
- grant_types
- grant_types
subject_type: subject_type
redirect_uris:
- redirect_uris
- redirect_uris
sector_identifier_uri: sector_identifier_uri
frontchannel_logout_session_required: true
frontchannel_logout_uri: frontchannel_logout_uri
client_secret_expires_at: 0
jwks_uri: jwks_uri
request_object_signing_alg: request_object_signing_alg
tos_uri: tos_uri
contacts:
- contacts
- contacts
response_types:
- response_types
- response_types
properties:
allowed_cors_origins:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
audience:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
backchannel_logout_session_required:
description: |-
Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout
Token to identify the RP session with the OP when the backchannel_logout_uri is used.
If omitted, the default value is false.
type: boolean
backchannel_logout_uri:
description: RP URL that will cause the RP to log itself out when sent a
Logout Token by the OP.
type: string
client_id:
description: ID is the id for this client.
type: string
client_name:
description: |-
Name is the human-readable string name of the client to be presented to the
end-user during authorization.
type: string
client_secret:
description: |-
Secret is the client's secret. The secret will be included in the create request as cleartext, and then
never again. The secret is stored using BCrypt so it is impossible to recover it. Tell your users
that they need to write the secret down as it will not be made available again.
type: string
client_secret_expires_at:
description: |-
SecretExpiresAt is an integer holding the time at which the client
secret will expire or 0 if it will not expire. The time is
represented as the number of seconds from 1970-01-01T00:00:00Z as
measured in UTC until the date/time of expiration.
This feature is currently not supported and it's value will always
be set to 0.
format: int64
type: integer
client_uri:
description: |-
ClientURI is an URL string of a web page providing information about the client.
If present, the server SHOULD display this URL to the end-user in
a clickable fashion.
type: string
contacts:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
created_at:
description: CreatedAt returns the timestamp of the client's creation.
format: date-time
type: string
frontchannel_logout_session_required:
description: |-
Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be
included to identify the RP session with the OP when the frontchannel_logout_uri is used.
If omitted, the default value is false.
type: boolean
frontchannel_logout_uri:
description: |-
RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query
parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the
request and to determine which of the potentially multiple sessions is to be logged out; if either is
included, both MUST be.
type: string
grant_types:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
jwks:
type: object
jwks_uri:
description: |-
URL for the Client's JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains
the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the
Client's encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing
and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced
JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both
signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used
to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST
match those in the certificate.
type: string
logo_uri:
description: LogoURI is an URL string that references a logo for the client.
type: string
metadata:
title: JSONRawMessage represents a json.RawMessage that works well with
JSON, SQL, and Swagger.
type: object
owner:
description: Owner is a string identifying the owner of the OAuth 2.0 Client.
type: string
policy_uri:
description: |-
PolicyURI is a URL string that points to a human-readable privacy policy document
that describes how the deployment organization collects, uses,
retains, and discloses personal data.
type: string
post_logout_redirect_uris:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
redirect_uris:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
request_object_signing_alg:
description: |-
JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects
from this Client MUST be rejected, if not signed with this algorithm.
type: string
request_uris:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
response_types:
items:
type: string
title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL
string.
type: array
scope:
description: |-
Scope is a string containing a space-separated list of scope values (as
described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client
can use when requesting access tokens.
pattern: ([a-zA-Z0-9\.\*]+\s?)+
type: string
sector_identifier_uri:
description: |-
URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a
file with a single JSON array of redirect_uri values.
type: string
subject_type:
description: |-
SubjectType requested for responses to this Client. The subject_types_supported Discovery parameter contains a
list of the supported subject_type values for this server. Valid types include `pairwise` and `public`.
type: string
token_endpoint_auth_method:
description: |-
Requested Client Authentication method for the Token Endpoint. The options are client_secret_post,
client_secret_basic, private_key_jwt, and none.
type: string
token_endpoint_auth_signing_alg:
description: Requested Client Authentication signing algorithm for the Token
Endpoint.
type: string
tos_uri:
description: |-
TermsOfServiceURI is a URL string that points to a human-readable terms of service
document for the client that describes a contractual relationship
between the end-user and the client that the end-user accepts when
authorizing the client.
type: string
updated_at:
description: UpdatedAt returns the timestamp of the last update.
format: date-time
type: string
userinfo_signed_response_alg:
description: |-
JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT
[JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims
as a UTF-8 encoded JSON object using the application/json content-type.
type: string
title: Client represents an OAuth 2.0 Client.
type: object
oAuth2TokenIntrospection:
description: https://tools.ietf.org/html/rfc7662
example:
ext: '{}'
sub: sub
iss: iss
active: true
obfuscated_subject: obfuscated_subject
token_type: token_type
client_id: client_id
aud:
- aud
- aud
nbf: 1
token_use: token_use
scope: scope
exp: 0
iat: 6
username: username
properties:
active:
description: |-
Active is a boolean indicator of whether or not the presented token
is currently active. The specifics of a token's "active" state
will vary depending on the implementation of the authorization
server and the information it keeps about its tokens, but a "true"
value return for the "active" property will generally indicate
that a given token has been issued by this authorization server,
has not been revoked by the resource owner, and is within its
given time window of validity (e.g., after its issuance time and
before its expiration time).
type: boolean
aud:
description: Audience contains a list of the token's intended audiences.
items:
type: string
type: array
client_id:
description: |-
ID is aclient identifier for the OAuth 2.0 client that
requested this token.
type: string
exp:
description: |-
Expires at is an integer timestamp, measured in the number of seconds
since January 1 1970 UTC, indicating when this token will expire.
format: int64
type: integer
ext:
description: Extra is arbitrary data set by the session.
properties: {}
type: object
iat:
description: |-
Issued at is an integer timestamp, measured in the number of seconds
since January 1 1970 UTC, indicating when this token was
originally issued.
format: int64
type: integer
iss:
description: IssuerURL is a string representing the issuer of this token
type: string
nbf:
description: |-
NotBefore is an integer timestamp, measured in the number of seconds
since January 1 1970 UTC, indicating when this token is not to be
used before.
format: int64
type: integer
obfuscated_subject:
description: |-
ObfuscatedSubject is set when the subject identifier algorithm was set to "pairwise" during authorization.
It is the `sub` value of the ID Token that was issued.
type: string
scope:
description: |-
Scope is a JSON string containing a space-separated list of
scopes associated with this token.
type: string
sub:
description: |-
Subject of the token, as defined in JWT [RFC7519].
Usually a machine-readable identifier of the resource owner who
authorized this token.
type: string
token_type:
description: TokenType is the introspected token's type, typically `Bearer`.
type: string
token_use:
description: TokenUse is the introspected token's use, for example `access_token`
or `refresh_token`.
type: string
username:
description: |-
Username is a human-readable identifier for the resource owner who
authorized this token.
type: string
required:
- active
title: 'Introspection contains an access token''s session data as specified
by IETF RFC 7662, see:'
type: object
oauth2TokenResponse:
description: The Access Token Response
example:
access_token: access_token
refresh_token: refresh_token
scope: scope
id_token: id_token
token_type: token_type
expires_in: 0
properties:
access_token:
type: string
expires_in:
format: int64
type: integer
id_token:
type: string
refresh_token:
type: string
scope:
type: string
token_type:
type: string
type: object
openIDConnectContext:
example:
login_hint: login_hint
ui_locales:
- ui_locales
- ui_locales
id_token_hint_claims: '{}'
acr_values:
- acr_values
- acr_values
display: display
properties:
acr_values:
description: |-
ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request.
It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required.
OpenID Connect defines it as follows:
> Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values
that the Authorization Server is being requested to use for processing this Authentication Request, with the
values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication
performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a
Voluntary Claim by this parameter.
items:
type: string
type: array
display:
description: |-
Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
The defined values are:
page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode.
popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over.
touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface.
wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display.
The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display.
type: string
id_token_hint_claims:
description: |-
IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the
End-User's current or past authenticated session with the Client.
properties: {}
type: object
login_hint:
description: |-
LoginHint hints about the login identifier the End-User might use to log in (if necessary).
This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier)
and then wants to pass that value as a hint to the discovered authorization service. This value MAY also be a
phone number in the format specified for the phone_number Claim. The use of this parameter is optional.
type: string
ui_locales:
description: |-
UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a
space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value
"fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation),
followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested
locales are not supported by the OpenID Provider.
items:
type: string
type: array
title: Contains optional information about the OpenID Connect request.
type: object
rejectRequest:
properties:
error:
description: |-
The error should follow the OAuth2 error format (e.g. `invalid_request`, `login_required`).
Defaults to `request_denied`.
type: string
error_debug:
description: |-
Debug contains information to help resolve the problem as a developer. Usually not exposed
to the public but only in the server logs.
type: string
error_description:
description: Description of the error in a human readable format.
type: string
error_hint:
description: Hint to help resolve the error.
type: string
status_code:
description: |-
Represents the HTTP status code of the error (e.g. 401 or 403)
Defaults to 400
format: int64
type: integer
title: The request payload used to accept a login or consent request.
type: object
userinfoResponse:
description: The userinfo response
example:
sub: sub
website: website
zoneinfo: zoneinfo
birthdate: birthdate
email_verified: true
gender: gender
profile: profile
phone_number_verified: true
preferred_username: preferred_username
given_name: given_name
locale: locale
middle_name: middle_name
picture: picture
updated_at: 0
name: name
nickname: nickname
phone_number: phone_number
family_name: family_name
email: email
properties:
birthdate:
description: End-User's birthday, represented as an ISO 8601:2004 [ISO8601‑2004]
YYYY-MM-DD format. The year MAY be 0000, indicating that it is omitted.
To represent only the year, YYYY format is allowed. Note that depending
on the underlying platform's date related function, providing just year
can result in varying month and day, so the implementers need to take
this factor into account to correctly process the dates.
type: string
email:
description: End-User's preferred e-mail address. Its value MUST conform
to the RFC 5322 [RFC5322] addr-spec syntax. The RP MUST NOT rely upon
this value being unique, as discussed in Section 5.7.
type: string
email_verified:
description: True if the End-User's e-mail address has been verified; otherwise
false. When this Claim Value is true, this means that the OP took affirmative
steps to ensure that this e-mail address was controlled by the End-User
at the time the verification was performed. The means by which an e-mail
address is verified is context-specific, and dependent upon the trust
framework or contractual agreements within which the parties are operating.
type: boolean
family_name:
description: Surname(s) or last name(s) of the End-User. Note that in some
cultures, people can have multiple family names or no family name; all
can be present, with the names being separated by space characters.
type: string
gender:
description: End-User's gender. Values defined by this specification are
female and male. Other values MAY be used when neither of the defined
values are applicable.
type: string
given_name:
description: Given name(s) or first name(s) of the End-User. Note that in
some cultures, people can have multiple given names; all can be present,
with the names being separated by space characters.
type: string
locale:
description: End-User's locale, represented as a BCP47 [RFC5646] language
tag. This is typically an ISO 639-1 Alpha-2 [ISO639‑1] language code in
lowercase and an ISO 3166-1 Alpha-2 [ISO3166‑1] country code in uppercase,
separated by a dash. For example, en-US or fr-CA. As a compatibility note,
some implementations have used an underscore as the separator rather than
a dash, for example, en_US; Relying Parties MAY choose to accept this
locale syntax as well.
type: string
middle_name:
description: Middle name(s) of the End-User. Note that in some cultures,
people can have multiple middle names; all can be present, with the names
being separated by space characters. Also note that in some cultures,
middle names are not used.
type: string
name:
description: End-User's full name in displayable form including all name
parts, possibly including titles and suffixes, ordered according to the
End-User's locale and preferences.
type: string
nickname:
description: Casual name of the End-User that may or may not be the same
as the given_name. For instance, a nickname value of Mike might be returned
alongside a given_name value of Michael.
type: string
phone_number:
description: End-User's preferred telephone number. E.164 [E.164] is RECOMMENDED
as the format of this Claim, for example, +1 (425) 555-1212 or +56 (2)
687 2400. If the phone number contains an extension, it is RECOMMENDED
that the extension be represented using the RFC 3966 [RFC3966] extension
syntax, for example, +1 (604) 555-1234;ext=5678.
type: string
phone_number_verified:
description: True if the End-User's phone number has been verified; otherwise
false. When this Claim Value is true, this means that the OP took affirmative
steps to ensure that this phone number was controlled by the End-User
at the time the verification was performed. The means by which a phone
number is verified is context-specific, and dependent upon the trust framework
or contractual agreements within which the parties are operating. When
true, the phone_number Claim MUST be in E.164 format and any extensions
MUST be represented in RFC 3966 format.
type: boolean
picture:
description: URL of the End-User's profile picture. This URL MUST refer
to an image file (for example, a PNG, JPEG, or GIF image file), rather
than to a Web page containing an image. Note that this URL SHOULD specifically
reference a profile photo of the End-User suitable for displaying when
describing the End-User, rather than an arbitrary photo taken by the End-User.
type: string
preferred_username:
description: Non-unique shorthand name by which the End-User wishes to be
referred to at the RP, such as janedoe or j.doe. This value MAY be any
valid JSON string including special characters such as @, /, or whitespace.
type: string
profile:
description: URL of the End-User's profile page. The contents of this Web
page SHOULD be about the End-User.
type: string
sub:
description: Subject - Identifier for the End-User at the IssuerURL.
type: string
updated_at:
description: Time the End-User's information was last updated. Its value
is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z
as measured in UTC until the date/time.
format: int64
type: integer
website:
description: URL of the End-User's Web page or blog. This Web page SHOULD
contain information published by the End-User or an organization that
the End-User is affiliated with.
type: string
zoneinfo:
description: String from zoneinfo [zoneinfo] time zone database representing
the End-User's time zone. For example, Europe/Paris or America/Los_Angeles.
type: string
type: object
version:
example:
version: version
properties:
version:
description: Version is the service's version.
type: string
type: object
wellKnown:
description: |-
It includes links to several endpoints (e.g. /oauth2/token) and exposes information on supported signature algorithms
among others.
example:
request_parameter_supported: true
claims_parameter_supported: true
backchannel_logout_supported: true
scopes_supported:
- scopes_supported
- scopes_supported
issuer: https://playground.ory.sh/ory-hydra/public/
authorization_endpoint: https://playground.ory.sh/ory-hydra/public/oauth2/auth
claims_supported:
- claims_supported
- claims_supported
userinfo_signing_alg_values_supported:
- userinfo_signing_alg_values_supported
- userinfo_signing_alg_values_supported
token_endpoint_auth_methods_supported:
- token_endpoint_auth_methods_supported
- token_endpoint_auth_methods_supported
backchannel_logout_session_supported: true
response_modes_supported:
- response_modes_supported
- response_modes_supported
token_endpoint: https://playground.ory.sh/ory-hydra/public/oauth2/token
response_types_supported:
- response_types_supported
- response_types_supported
request_uri_parameter_supported: true
grant_types_supported:
- grant_types_supported
- grant_types_supported
end_session_endpoint: end_session_endpoint
revocation_endpoint: revocation_endpoint
userinfo_endpoint: userinfo_endpoint
frontchannel_logout_supported: true
require_request_uri_registration: true
frontchannel_logout_session_supported: true
jwks_uri: https://playground.ory.sh/ory-hydra/public/.well-known/jwks.json
subject_types_supported:
- subject_types_supported
- subject_types_supported
id_token_signing_alg_values_supported:
- id_token_signing_alg_values_supported
- id_token_signing_alg_values_supported
registration_endpoint: https://playground.ory.sh/ory-hydra/admin/client
request_object_signing_alg_values_supported:
- request_object_signing_alg_values_supported
- request_object_signing_alg_values_supported
properties:
authorization_endpoint:
description: URL of the OP's OAuth 2.0 Authorization Endpoint.
example: https://playground.ory.sh/ory-hydra/public/oauth2/auth
type: string
backchannel_logout_session_supported:
description: |-
Boolean value specifying whether the OP can pass a sid (session ID) Claim in the Logout Token to identify the RP
session with the OP. If supported, the sid Claim is also included in ID Tokens issued by the OP
type: boolean
backchannel_logout_supported:
description: Boolean value specifying whether the OP supports back-channel
logout, with true indicating support.
type: boolean
claims_parameter_supported:
description: Boolean value specifying whether the OP supports use of the
claims parameter, with true indicating support.
type: boolean
claims_supported:
description: |-
JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply
values for. Note that for privacy or other reasons, this might not be an exhaustive list.
items:
type: string
type: array
end_session_endpoint:
description: URL at the OP to which an RP can perform a redirect to request
that the End-User be logged out at the OP.
type: string
frontchannel_logout_session_supported:
description: |-
Boolean value specifying whether the OP can pass iss (issuer) and sid (session ID) query parameters to identify
the RP session with the OP when the frontchannel_logout_uri is used. If supported, the sid Claim is also
included in ID Tokens issued by the OP.
type: boolean
frontchannel_logout_supported:
description: Boolean value specifying whether the OP supports HTTP-based
logout, with true indicating support.
type: boolean
grant_types_supported:
description: JSON array containing a list of the OAuth 2.0 Grant Type values
that this OP supports.
items:
type: string
type: array
id_token_signing_alg_values_supported:
description: |-
JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token
to encode the Claims in a JWT.
items:
type: string
type: array
issuer:
description: |-
URL using the https scheme with no query or fragment component that the OP asserts as its IssuerURL Identifier.
If IssuerURL discovery is supported , this value MUST be identical to the issuer value returned
by WebFinger. This also MUST be identical to the iss Claim value in ID Tokens issued from this IssuerURL.
example: https://playground.ory.sh/ory-hydra/public/
type: string
jwks_uri:
description: |-
URL of the OP's JSON Web Key Set [JWK] document. This contains the signing key(s) the RP uses to validate
signatures from the OP. The JWK Set MAY also contain the Server's encryption key(s), which are used by RPs
to encrypt requests to the Server. When both signing and encryption keys are made available, a use (Key Use)
parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage.
Although some algorithms allow the same key to be used for both signatures and encryption, doing so is
NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of
keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.
example: https://playground.ory.sh/ory-hydra/public/.well-known/jwks.json
type: string
registration_endpoint:
description: URL of the OP's Dynamic Client Registration Endpoint.
example: https://playground.ory.sh/ory-hydra/admin/client
type: string
request_object_signing_alg_values_supported:
description: |-
JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects,
which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when
the Request Object is passed by value (using the request parameter) and when it is passed by reference
(using the request_uri parameter).
items:
type: string
type: array
request_parameter_supported:
description: Boolean value specifying whether the OP supports use of the
request parameter, with true indicating support.
type: boolean
request_uri_parameter_supported:
description: Boolean value specifying whether the OP supports use of the
request_uri parameter, with true indicating support.
type: boolean
require_request_uri_registration:
description: |-
Boolean value specifying whether the OP requires any request_uri values used to be pre-registered
using the request_uris registration parameter.
type: boolean
response_modes_supported:
description: JSON array containing a list of the OAuth 2.0 response_mode
values that this OP supports.
items:
type: string
type: array
response_types_supported:
description: |-
JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID
Providers MUST support the code, id_token, and the token id_token Response Type values.
items:
type: string
type: array
revocation_endpoint:
description: URL of the authorization server's OAuth 2.0 revocation endpoint.
type: string
scopes_supported:
description: |-
SON array containing a list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST
support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used
items:
type: string
type: array
subject_types_supported:
description: |-
JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include
pairwise and public.
items:
type: string
type: array
token_endpoint:
description: URL of the OP's OAuth 2.0 Token Endpoint
example: https://playground.ory.sh/ory-hydra/public/oauth2/token
type: string
token_endpoint_auth_methods_supported:
description: |-
JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are
client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0
items:
type: string
type: array
userinfo_endpoint:
description: URL of the OP's UserInfo Endpoint.
type: string
userinfo_signing_alg_values_supported:
description: JSON array containing a list of the JWS [JWS] signing algorithms
(alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims
in a JWT [JWT].
items:
type: string
type: array
required:
- authorization_endpoint
- id_token_signing_alg_values_supported
- issuer
- jwks_uri
- response_types_supported
- subject_types_supported
- token_endpoint
title: WellKnown represents important OpenID Connect discovery metadata
type: object
securitySchemes:
basic:
scheme: basic
type: http
oauth2:
flows:
authorizationCode:
authorizationUrl: https://hydra.demo.ory.sh/oauth2/auth
scopes:
offline: A scope required when requesting refresh tokens (alias for `offline_access`)
offline_access: A scope required when requesting refresh tokens
openid: Request an OpenID Connect ID Token
tokenUrl: https://hydra.demo.ory.sh/oauth2/token
type: oauth2
x-forwarded-proto: string
x-request-id: string
x-original-swagger-version: "2.0"