{ "openapi": "3.0.1", "info": { "title": "Janssen Authorization Server", "description": "Janssen Authorization Server is an OAuth 2.0 Authorization Server and OpenID Connect Provider (OP).", "contact": { "name": "Contact", "url": "https://github.com/JanssenProject/jans/discussions" }, "license": { "name": "License", "url": "https://github.com/JanssenProject/jans/blob/main/LICENSE" }, "version": "Janssen 2.5.0" }, "servers": [ { "url": "HOST" } ], "tags": [ { "name": "About", "description": "Janssen Authorization Server is an open source OpenID Connect Provider (OP). The project also includes OpenID Connect Client code which can be used by websites to validate tokens. Server currently implements all required aspects of the OpenID Connect stack." } ], "paths": { "/.well-known/authzen-configuration": { "get": { "tags": [ "AuthZEN Access Evaluation Discovery" ], "summary": "Gets Access Evaluation configuration data.", "description": "Gets Access Evaluation configuration data.", "operationId": "authzen-configuration", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "description": "AuthZEN Access Evaluation Discovery", "required": [ "access_evaluation_v1_endpoint" ], "properties": { "access_evaluation_v1_endpoint": { "type": "string", "description": "URL of the Access Evaluation endpoint.", "example": "https://sample.com/jans-auth/restv1/evaluate" } } } } } }, "500": { "description": "Error during request processing endpoint.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "server_error" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } } } } }, "/.well-known/oauth-authorization-server": { "get": { "tags": [ "OAuth Authorization Server Metadata" ], "summary": "Gets OAuth 2.0 Authorization Server Metadata.", "description": "Gets OAuth 2.0 Authorization Server Metadata as defined by RFC 8414. Response content is the same document served at /.well-known/openid-configuration (OpenID Connect Discovery is a superset of RFC 8414 metadata), including additional non-standard members.", "operationId": "oauth-authorization-server", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "description": "OAuth 2.0 Authorization Server Metadata", "required": [ "issuer", "response_types_supported" ], "properties": { "issuer": { "type": "string", "description": "URL using the https scheme that uniquely identifies the authorization server." }, "authorization_endpoint": { "type": "string", "description": "URL of the authorization server's authorization endpoint." }, "token_endpoint": { "type": "string", "description": "URL of the authorization server's token endpoint." }, "jwks_uri": { "type": "string", "description": "URL of the authorization server's JWK Set document." }, "registration_endpoint": { "type": "string", "description": "URL of the authorization server's dynamic client registration endpoint." }, "scopes_supported": { "type": "array", "description": "Array of scope values supported by this authorization server.", "items": { "type": "string" } }, "response_types_supported": { "type": "array", "description": "Array of response_type values supported by this authorization server.", "items": { "type": "string" } }, "response_modes_supported": { "type": "array", "description": "Array of response_mode values supported by this authorization server.", "items": { "type": "string" } }, "grant_types_supported": { "type": "array", "description": "Array of grant_type values supported by this authorization server.", "items": { "type": "string" } }, "token_endpoint_auth_methods_supported": { "type": "array", "description": "Array of client authentication methods supported by the token endpoint.", "items": { "type": "string" } }, "service_documentation": { "type": "string", "description": "URL of a page containing human-readable information for developers." }, "ui_locales_supported": { "type": "array", "description": "Array of languages and scripts supported for the user interface.", "items": { "type": "string" } }, "op_policy_uri": { "type": "string", "description": "URL of a page with policy information about data usage." }, "op_tos_uri": { "type": "string", "description": "URL of a page with terms of service." }, "revocation_endpoint": { "type": "string", "description": "URL of the authorization server's token revocation endpoint." }, "introspection_endpoint": { "type": "string", "description": "URL of the authorization server's token introspection endpoint." }, "code_challenge_methods_supported": { "type": "array", "description": "Array of PKCE code_challenge_method values supported by this authorization server.", "items": { "type": "string" } } } } } } }, "500": { "description": "Error during request processing endpoint.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "server_error" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } } } } }, "/jans-auth/restv1/authorize": { "get": { "tags": [ "Authorization" ], "summary": "The Authorization Endpoint performs Authentication of the End-User.", "description": "End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.", "operationId": "get_authorize", "parameters": [ { "name": "scope", "in": "query", "required": true, "description": "OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.", "schema": { "type": "string" } }, { "name": "response_type", "in": "query", "required": true, "description": "OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.", "schema": { "type": "string" } }, { "name": "client_id", "in": "query", "required": true, "description": "OAuth 2.0 Client Identifier valid at the Authorization Server.", "schema": { "type": "string" } }, { "name": "redirect_uri", "in": "query", "required": true, "description": "Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.", "schema": { "type": "string" } }, { "name": "state", "in": "query", "required": false, "description": "Opaque value used to maintain state between the request and the callback.", "schema": { "type": "string" } }, { "name": "response_mode", "in": "query", "required": false, "description": "Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.", "schema": { "type": "string" } }, { "name": "nonce", "in": "query", "required": false, "description": "String value used to associate a Client session with an ID Token, and to mitigate replay attacks.", "schema": { "type": "string" } }, { "name": "display", "in": "query", "required": false, "description": "ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.", "schema": { "type": "string" } }, { "name": "prompt", "in": "query", "required": false, "description": "Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are - none, login, consent, select_account.", "schema": { "type": "string" } }, { "name": "max_age", "in": "query", "required": false, "description": "Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.", "schema": { "type": "integer" } }, { "name": "ui_locales", "in": "query", "required": false, "description": "End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.", "schema": { "type": "string" } }, { "name": "id_token_hint", "in": "query", "required": false, "description": "ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.", "schema": { "type": "string" } }, { "name": "login_hint", "in": "query", "required": false, "description": "Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).", "schema": { "type": "string" } }, { "name": "acr_values", "in": "query", "required": false, "description": "Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.", "schema": { "type": "string" } }, { "name": "amr_values", "in": "query", "required": false, "description": "AMR Values.", "schema": { "type": "string" } }, { "name": "request", "in": "query", "required": false, "description": "This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.", "schema": { "type": "string" } }, { "name": "request_uri", "in": "query", "required": false, "description": "This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.", "schema": { "type": "string" } }, { "name": "request_session_id", "in": "query", "required": false, "description": "Request session id.", "schema": { "type": "string" } }, { "name": "session_id", "in": "query", "required": false, "description": "Session id of this call.", "schema": { "type": "string" } }, { "name": "origin_headers", "in": "query", "required": false, "description": "Origin headers. Used in custom workflows.", "schema": { "type": "string" } }, { "name": "code_challenge", "in": "query", "required": false, "description": "PKCE code challenge.", "schema": { "type": "string" } }, { "name": "code_challenge_method", "in": "query", "required": false, "description": "PKCE code challenge method.", "schema": { "type": "string" } }, { "name": "custom_response_headers", "in": "query", "required": false, "description": "Custom Response Headers.", "schema": { "type": "string" } }, { "name": "claims", "in": "query", "required": false, "description": "Requested Claims.", "schema": { "type": "string" } }, { "name": "auth_req_id", "in": "query", "required": false, "description": "CIBA authentication request Id.", "schema": { "type": "string" } }, { "name": "dpop_jkt", "in": "query", "required": false, "description": "The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function", "schema": { "type": "string" } }, { "name": "logout_status_jwt", "in": "query", "required": false, "description": "Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful.", "schema": { "type": "string" } }, { "name": "authorization_details", "in": "query", "required": false, "description": "The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field.", "schema": { "type": "string" } }, { "name": "rp_name", "in": "query", "required": false, "description": "Relying Party name (to be displayed during login and in the app)", "schema": { "type": "string" } }, { "name": "rp_client_logo_url", "in": "query", "required": false, "description": "Relying Party custom logo in svg format (to be displayed during login and in the app)", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": {} }, "302": { "description": "Error codes for authorization endpoint.", "content": { "application/json": { "schema": { "title": "AuthorizeError", "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_request", "unauthorized_client", "disabled_client", "access_denied", "retry", "unsupported_response_type", "invalid_scope", "server_error", "temporarily_unavailable", "invalid_request_redirect_uri", "invalid_authorization_details", "login_required", "session_selection_required", "consent_required", "user_mismatched", "request_not_supported", "request_uri_not_supported", "invalid_request_uri", "invalid_request_object", "authentication_session_invalid", "invalid_authentication_method" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/InvalidRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "post": { "tags": [ "Authorization" ], "summary": "The Authorization Endpoint performs Authentication of the End-User.", "description": "End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.", "operationId": "post_authorize", "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "required": [ "scope", "response_type", "client_id", "redirect_uri" ], "properties": { "scope": { "type": "string", "description": "OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present." }, "response_type": { "type": "string", "description": "OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used." }, "client_id": { "type": "string", "description": "OAuth 2.0 Client Identifier valid at the Authorization Server." }, "redirect_uri": { "type": "string", "description": "Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider." }, "state": { "type": "string", "description": "Opaque value used to maintain state between the request and the callback." }, "response_mode": { "type": "string", "description": "Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint." }, "nonce": { "type": "string", "description": "String value used to associate a Client session with an ID Token, and to mitigate replay attacks." }, "display": { "type": "string", "description": "ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User." }, "prompt": { "type": "string", "description": "Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent." }, "max_age": { "type": "integer", "description": "Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP." }, "ui_locales": { "type": "string", "description": "End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.", "example": "\\\"fr-CA fr en\\\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation)." }, "id_token_hint": { "type": "string", "description": "ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response." }, "login_hint": { "type": "string", "description": "Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary)." }, "acr_values": { "type": "string", "description": "Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference." }, "amr_values": { "type": "string", "description": "AMR Values." }, "request": { "type": "string", "description": "This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters." }, "request_uri": { "type": "string", "description": "This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters." }, "request_session_id": { "type": "string", "description": "Request session id." }, "session_id": { "type": "string", "description": "Session id of this call." }, "origin_headers": { "type": "string", "description": "Origin headers. Used in custom workflows." }, "code_challenge": { "type": "string", "description": "PKCE code challenge." }, "code_challenge_method": { "type": "string", "description": "PKCE code challenge method." }, "custom_response_headers": { "type": "string", "description": "Custom Response Headers." }, "claims": { "type": "string", "description": "Requested Claims." }, "auth_req_id": { "type": "string", "description": "CIBA authentication request Id." }, "dpop_jkt": { "type": "string", "description": "The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function" }, "logout_status_jwt": { "type": "string", "description": "Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful." }, "authorization_details": { "type": "string", "description": "The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field." }, "rp_name": { "type": "string", "description": "Relying Party name (to be displayed during login)" }, "rp_client_logo_url": { "type": "string", "description": "Relying Party custom logo in svg format (to be displayed during login and in the app)" } } } } } }, "responses": { "200": { "description": "OK", "content": {} }, "302": { "description": "Error codes for authorization endpoint.", "content": { "application/json": { "schema": { "title": "AuthorizeError", "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_request", "unauthorized_client", "disabled_client", "access_denied", "retry", "unsupported_response_type", "invalid_scope", "server_error", "temporarily_unavailable", "invalid_request_redirect_uri", "invalid_authorization_details", "login_required", "session_selection_required", "consent_required", "user_mismatched", "request_not_supported", "request_uri_not_supported", "invalid_request_uri", "invalid_request_object", "authentication_session_invalid", "invalid_authentication_method" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "400": { "$ref": "#/components/responses/InvalidRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/jans-auth/restv1/bc-authorize": { "post": { "tags": [ "Authorization" ], "summary": "Performs backchannel authorization of the end-user.", "description": "The Backchannel Authentication Endpoint is used to initiate an out-of-band authentication of the end-user.", "operationId": "bc-authorize", "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "required": [ "client_id", "scope", "client_notification_token" ], "properties": { "client_id": { "type": "string", "description": "OAuth 2.0 Client Identifier valid at the Authorization Server." }, "scope": { "type": "string", "description": "CIBA authentication requests must contain the openid scope value." }, "client_notification_token": { "type": "string", "description": "It is a bearer token provided by the Client that will be used by the OpenID Provider to authenticate the callback request to the Client. It is required if the Client is registered to use Ping or Push modes." }, "acr_values": { "type": "string", "description": "Requested Authentication Context Class Reference values." }, "login_hint_token": { "type": "string", "description": "A token containing information identifying the end-user for whom authentication is being requested." }, "id_token_hint": { "type": "string", "description": "An ID Token previously issued to the Client by the OpenID Provider being passed back as a hint to identify the end-user for whom authentication is being requested." }, "login_hint": { "type": "string", "description": "A hint to the OpenID Provider regarding the end-user for whom authentication is being requested." }, "binding_message": { "type": "string", "description": "A human readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user." }, "user_code": { "type": "string", "description": "A secret code, such as password or pin, known only to the user but verifiable by the OP." }, "requested_expiry": { "type": "integer", "description": "A positive integer allowing the client to request the expires_in value for the auth_req_id the server will return." } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "title": "Backchannel Authorization", "required": [ "AUTH_REQ_ID", "EXPIRES_IN", "INTERVAL" ], "type": "object", "properties": { "AUTH_REQ_ID": { "type": "string" }, "EXPIRES_IN": { "type": "integer" }, "INTERVAL": { "type": "integer" } } } } } }, "400": { "$ref": "#/components/responses/InvalidRequest" }, "401": { "description": "Unauthorized CIBA (Client Initiated Backchannel Authentication) access.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_request", "invalid_scope", "expired_login_hint_token", "unknown_user_id", "unauthorized_client", "missing_user_code", "invalid_user_code", "invalid_binding_message", "invalid_client", "unauthorized_end_user_device", "access_denied" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "403": { "$ref": "#/components/responses/AccessDenied" } } } }, "/.well-known/openid-configuration": { "get": { "tags": [ "Server Configuration" ], "summary": "Gets Janssen Server configuration data that contains non-standard OpenID Connect discovery metadata.", "description": "Gets Janssen Server configuration data that contains non-standard OpenID Connect discovery metadata.", "operationId": "well-known-gluu-configuration", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "title": "GluuConfigurationResponse", "description": "Client GluuAttribute by Dn(Distinguished Name) based on Authorization Scope.", "required": [ "introspection_endpoint" ], "type": "object", "properties": { "id_generation_endpoint": { "type": "string" }, "introspection_endpoint": { "type": "string", "description": "URL of the Introspection endpoint." }, "access_evaluation_v1_endpoint": { "type": "string", "description": "URL of the Access Evaluation endpoint.", "example": "https://sample.com/jans-auth/restv1/evaluate" }, "auth_level_mapping": { "type": "object", "additionalProperties": { "type": "string", "description": "Additional Custom Acr's map object" } }, "scope_to_claims_mapping": { "type": "object", "additionalProperties": { "type": "string", "description": "Scope map object" } }, "authorization_details_types_supported": { "type": "array", "description": "Array of string. Each string represents supported type of authorization details.", "items": { "type": "string" } }, "identity_chaining_requested_token_types_supported": { "type": "array", "description": "Array of token type URIs that the AS supports as requested_token_type in a token exchange request when the IDENTITY_ASSERTION_AUTHZ_GRANT feature is enabled. Contains urn:ietf:params:oauth:token-type:id-jag when ID-JAG is enabled.", "items": { "type": "string" }, "example": [ "urn:ietf:params:oauth:token-type:id-jag" ] }, "authorization_grant_profiles_supported": { "type": "array", "description": "Array of grant profile URIs supported by this AS as Resource AS. Contains urn:ietf:params:oauth:grant-profile:id-jag when ID-JAG is enabled.", "items": { "type": "string" }, "example": [ "urn:ietf:params:oauth:grant-profile:id-jag" ] } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/jans-auth/restv1/introspection": { "get": { "tags": [ "Token" ], "summary": "The Introspection OAuth 2 Endpoint.", "description": "The Introspection OAuth 2 Endpoint.", "operationId": "get-introspection", "parameters": [ { "name": "Authorization", "in": "header", "required": true, "description": "Client Authorization details that contains the access token along with other details.", "schema": { "type": "string" }, "example": "Bearer 23410913-abewfq.123483" }, { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "example": "token=2YotnFZFEjr1zCsicMWpAA" }, { "name": "token_type_hint", "in": "query", "description": "ID Token previously issued by the Authorization Server being passed as a hint about the End-User.", "schema": { "type": "string" } }, { "name": "response_as_jwt", "in": "query", "description": "OPTIONAL. Boolean value with default value false. If true, returns introspection response as JWT (signed based on client configuration used for authentication to Introspection Endpoint).", "schema": { "type": "boolean" }, "example": "response_as_jwt=false" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "title": "IntrospectionResponse", "description": "meta-information about token", "required": [ "active" ], "type": "object", "properties": { "active": { "type": "boolean", "description": "Boolean indicator of whether or not the presented token is currently active.", "example": true }, "scope": { "type": "array", "description": "Provide list of scopes to which access was granted for this resource.", "example": [ "read write dolphin" ], "items": { "type": "string" } }, "client_id": { "type": "string", "description": "Client identifier for the OAuth 2.0 client that requested this token.", "example": "1238j323ds-23ij4" }, "username": { "type": "string", "description": "Human-readable identifier for the resource owner who authorized this token.", "example": "jdoe" }, "token_type": { "type": "string", "description": "Type of the token as defined in Section 5.1 of OAuth 2.0 [RFC6749].", "example": "bearer, mac" }, "exp": { "type": "integer", "description": "Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission will expire." }, "iat": { "type": "integer", "example": "Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued." }, "sub": { "type": "string", "description": "Subject of the token, as defined in JWT [RFC7519].", "example": "Z5O3upPC88QrAjx00dis" }, "aud": { "type": "string", "description": "Service-specific string identifier or list of string identifiers representing the intended audience for this token, as defined in JWT [RFC7519].", "example": "https://protected.example.net/resource" }, "iss": { "type": "string", "description": "String representing the issuer of this token, as defined in JWT [RFC7519].", "example": "https://server.example.com/" }, "acr_values": { "type": "string", "description": "Authentication Context Class Reference values." }, "jti": { "type": "string", "description": "String identifier for the token, as defined in JWT." } } } } } }, "400": { "description": "Error codes for introspection endpoint.", "content": { "application/json": { "schema": { "title": "AuthorizeError", "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_request", "unauthorized_client", "disabled_client", "access_denied", "retry", "unsupported_response_type", "invalid_scope", "server_error", "temporarily_unavailable", "invalid_request_redirect_uri", "invalid_authorization_details", "login_required", "session_selection_required", "consent_required", "user_mismatched", "invalid_request_uri", "invalid_request_object", "authentication_session_invalid", "invalid_authentication_method" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "post": { "tags": [ "Token" ], "summary": "The Introspection OAuth 2 Endpoint.", "description": "The Introspection OAuth 2 Endpoint.", "operationId": "post-introspection", "parameters": [ { "name": "Authorization", "in": "header", "required": true, "description": "Client Authorization details that contains the access token along with other details.", "schema": { "type": "string" }, "example": "Bearer 23410913-abewfq.123483" } ], "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "required": [ "token" ], "properties": { "token": { "type": "string", "description": "Client access token.", "example": "token=2YotnFZFEjr1zCsicMWpAA" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "title": "IntrospectionResponse", "description": "meta-information about token", "required": [ "active" ], "type": "object", "properties": { "active": { "type": "boolean", "description": "Boolean indicator of whether or not the presented token is currently active.", "example": true }, "scope": { "type": "array", "description": "Provide list of scopes to which access was granted for this resource.", "example": [ "read write dolphin" ], "items": { "type": "string" } }, "client_id": { "type": "string", "description": "Client identifier for the OAuth 2.0 client that requested this token.", "example": "1238j323ds-23ij4" }, "username": { "type": "string", "description": "Human-readable identifier for the resource owner who authorized this token.", "example": "jdoe" }, "token_type": { "type": "string", "description": "Type of the token as defined in Section 5.1 of OAuth 2.0 [RFC6749].", "example": "bearer, mac" }, "exp": { "type": "integer", "description": "Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission will expire." }, "iat": { "type": "integer", "example": "Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued." }, "sub": { "type": "string", "description": "Subject of the token, as defined in JWT [RFC7519].", "example": "Z5O3upPC88QrAjx00dis" }, "aud": { "type": "string", "description": "Service-specific string identifier or list of string identifiers representing the intended audience for this token, as defined in JWT [RFC7519].", "example": "https://protected.example.net/resource" }, "iss": { "type": "string", "description": "String representing the issuer of this token, as defined in JWT [RFC7519].", "example": "https://server.example.com/" }, "acr_values": { "type": "string", "description": "Authentication Context Class Reference values." }, "jti": { "type": "string", "description": "String identifier for the token, as defined in JWT." } } } } } }, "400": { "description": "Error codes for introspection endpoint.", "content": { "application/json": { "schema": { "title": "AuthorizeError", "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_request", "unauthorized_client", "disabled_client", "access_denied", "retry", "unsupported_response_type", "invalid_scope", "server_error", "temporarily_unavailable", "invalid_request_redirect_uri", "invalid_authorization_details", "login_required", "session_selection_required", "consent_required", "user_mismatched", "invalid_request_uri", "invalid_request_object", "authentication_session_invalid", "invalid_authentication_method" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/jans-auth/restv1/end_session": { "get": { "tags": [ "Session Management" ], "summary": "End current session.", "description": "End current session.", "operationId": "end_session", "parameters": [ { "name": "id_token_hint", "in": "query", "description": "Previously issued ID Token (id_token) passed to the logout endpoint as a hint about the End-User's current authenticated session with the Client. This is used as an indication of the identity of the End-User that the RP is requesting be logged out by the OP. The OP need not be listed as an audience of the ID Token when it is used as an id_token_hint value.", "schema": { "type": "string" } }, { "name": "post_logout_redirect_uri", "in": "query", "description": "URL to which the RP is requesting that the End-User's User Agent be redirected after a logout has been performed. The value MUST have been previously registered with the OP, either using the post_logout_redirect_uris Registration parameter or via another mechanism. If supplied, the OP SHOULD honor this request following the logout.", "schema": { "type": "string" } }, { "name": "state", "in": "query", "description": "Opaque value used by the RP to maintain state between the logout request and the callback to the endpoint specified by the post_logout_redirect_uri parameter. If included in the logout request, the OP passes this value back to the RP using the state query parameter when redirecting the User Agent back to the RP.", "schema": { "type": "string" } }, { "name": "session_id", "in": "query", "description": "Session Id", "schema": { "type": "string" } }, { "name": "client_id", "in": "query", "description": "Client Id. It can be useful to specify client id explicitly in case id_token and session are expired so AS can still validate post_logout_redirect_uri", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK - User redirected to logout page", "content": {} }, "302": { "$ref": "#/components/responses/Found" }, "400": { "description": "Error codes for end session endpoint.", "content": { "application/json": { "schema": { "title": "EndSessionError", "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_grant", "invalid_request", "invalid_grant_and_session", "session_not_passed", "post_logout_uri_not_passed", "post_logout_uri_not_associated_with_client" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/jans-auth/restv1/token": { "post": { "tags": [ "Token" ], "summary": "To obtain an Access Token, an ID Token, and optionally a Refresh Token, the RP (Client).", "description": "To obtain an Access Token, an ID Token, and optionally a Refresh Token, the RP (Client).", "operationId": "post-token", "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "required": [ "grant_type" ], "properties": { "grant_type": { "type": "array", "description": "Provide a list of the OAuth 2.0 grant types that the Client is declaring that it will restrict itself to using.", "example": [ "authorization_code", "client_credentials" ], "items": { "type": "string" } }, "code": { "type": "string", "description": "Code which is returned by authorization endpoint. (For grant_type=authorization_code)" }, "redirect_uri": { "type": "string", "description": "Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider." }, "username": { "type": "string", "description": "End-User username." }, "password": { "type": "string", "description": "End-User password." }, "scope": { "type": "array", "description": "OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present. Scope values used that are not understood by an implementation SHOULD be ignored.", "items": { "type": "string" } }, "assertion": { "type": "string", "description": "Assertion JWT. Used with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer (e.g. ID-JAG bearer grant)." }, "refresh_token": { "type": "string", "description": "Refresh token." }, "client_id": { "type": "string", "description": "OAuth 2.0 Client Identifier valid at the Authorization Server." }, "client_secret": { "type": "string", "description": "The client secret. The client MAY omit the parameter if the client secret is an empty string." }, "code_verifier": { "type": "string", "description": "The client's PKCE code verifier." }, "ticket": { "type": "string" }, "claim_token": { "type": "string" }, "claim_token_format": { "type": "string" }, "pct": { "type": "string" }, "rpt": { "type": "string" }, "subject_token": { "type": "string", "description": "Security token representing the identity of the party on behalf of whom the request is being made. Used with grant_type=urn:ietf:params:oauth:grant-type:token-exchange." }, "subject_token_type": { "type": "string", "description": "Identifier for the type of subject_token. For example urn:ietf:params:oauth:token-type:id_token, urn:ietf:params:oauth:token-type:saml2, or urn:ietf:params:oauth:token-type:refresh_token.", "example": "urn:ietf:params:oauth:token-type:id_token" }, "requested_token_type": { "type": "string", "description": "Identifier for the type of the requested security token. For example urn:ietf:params:oauth:token-type:id-jag or urn:ietf:params:oauth:token-type:txn-token.", "example": "urn:ietf:params:oauth:token-type:id-jag" }, "audience": { "type": "string", "description": "The logical name of the target service or resource where the client intends to use the requested security token. Used with grant_type=urn:ietf:params:oauth:grant-type:token-exchange." }, "actor_token": { "type": "string", "description": "Security token representing the actor. Used in delegation scenarios with grant_type=urn:ietf:params:oauth:grant-type:token-exchange." }, "actor_token_type": { "type": "string", "description": "Identifier for the type of actor_token.", "example": "urn:x-oath:params:oauth:token-type:device-secret" } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "description": "AccessTokenResponse.", "required": [ "access_token", "token_type" ], "properties": { "access_token": { "type": "string", "description": "The access token issued by the authorization server." }, "token_type": { "type": "string", "description": "The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes)." }, "expires_in": { "type": "integer", "description": "The lifetime in seconds of the access token. For example, the value \\\"3600\\\" denotes that the access token will expire in one hour from the time the response was generated." }, "refresh_token": { "type": "string", "description": "The refresh token, which can be used to obtain new access tokens using the same authorization grant" }, "scope": { "type": "array", "example": [ "openid", "oxd" ], "items": { "type": "string" } }, "id_token": { "type": "string" }, "issued_token_type": { "type": "string", "description": "Identifier for the type of the issued token. Present in token exchange responses. For example urn:ietf:params:oauth:token-type:id-jag or urn:ietf:params:oauth:token-type:txn-token.", "example": "urn:ietf:params:oauth:token-type:id-jag" } } } } } }, "400": { "description": "Invalid parameters provided to endpoint.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_client_metadata", "invalid_token" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/AccessDenied" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/jans-auth/restv1/userinfo": { "get": { "tags": [ "User Info" ], "summary": "Returns Claims about the authenticated End-User.", "description": "Returns Claims about the authenticated End-User.", "operationId": "get-userinfo", "parameters": [ { "name": "Authorization", "in": "header", "required": true, "description": "Bearer access token, e.g. \"Authorization: Bearer \". Sending the access token as a query parameter is not supported.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/jwt": { "schema": { "title": "User Claims details", "properties": { "sub": { "type": "integer", "example": 248289761001 }, "name": { "type": "string", "example": "Jane Doe" }, "given_name": { "type": "string", "example": "Jane" }, "family_name": { "type": "string", "example": "Doe" }, "preferred_username": { "type": "string", "example": "j.doe" }, "email": { "type": "string", "example": "janedoe@example.com" }, "picture": { "type": "string", "example": "http://example.com/janedoe/me.jpg" } } } } } }, "400": { "description": "Invalid parameters provided to endpoint.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_request" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "401": { "description": "Invalid parameters provided to endpoint.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_token" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "403": { "description": "Invalid parameters provided to endpoint.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "insufficient_scope" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "post": { "tags": [ "User Info" ], "summary": "Returns Claims about the authenticated End-User.", "description": "Returns Claims about the authenticated End-User.", "operationId": "post-userinfo", "parameters": [ { "name": "Authorization", "in": "header", "description": "Client Authorization details that contains the access token along with other details.", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "required": [ "access_token" ], "properties": { "access_token": { "type": "string", "description": "OAuth 2.0 Access Token." } } } } } }, "responses": { "200": { "description": "OK", "content": { "application/jwt": { "schema": { "title": "User Claims details", "properties": { "sub": { "type": "integer", "example": 248289761001 }, "name": { "type": "string", "example": "Jane Doe" }, "given_name": { "type": "string", "example": "Jane" }, "family_name": { "type": "string", "example": "Doe" }, "preferred_username": { "type": "string", "example": "j.doe" }, "email": { "type": "string", "example": "janedoe@example.com" }, "picture": { "type": "string", "example": "http://example.com/janedoe/me.jpg" } } } } } }, "400": { "description": "Invalid parameters provided to endpoint.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_request" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "401": { "description": "Invalid parameters provided to endpoint.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "invalid_token" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "403": { "description": "Invalid parameters provided to endpoint.", "content": { "application/json": { "schema": { "type": "object", "required": [ "error", "error_description" ], "properties": { "error": { "type": "string", "format": "enum", "example": [ "insufficient_scope" ] }, "error_description": { "type": "string" }, "details": { "type": "string" } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" } } } } }, "components": { "responses": { "Found": { "description": "Resource Found.", "content": {} }, "InvalidRequest": { "description": "Invalid parameters are provided to endpoint.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "Unauthorized": { "description": "Unauthorized access request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "AccessDenied": { "description": "Invalid details provided hence access denied.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "NotFound": { "description": "Resource Not Found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "NotAcceptable": { "description": "Request Not Acceptable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "InternalServerError": { "description": "Internal error occured. Please check log file for details.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } } }, "schemas": { "ErrorResponse": { "required": [ "error", "error_description" ], "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" }, "details": { "type": "string" } } }, "Resource": { "type": "object", "properties": { "type": { "type": "string", "description": "Type of the resource (e.g., document, database)" }, "id": { "type": "string", "description": "Unique identifier of the resource" }, "properties": { "type": "object", "additionalProperties": true, "description": "Additional attributes of the resource" } }, "required": [ "type", "id" ] }, "Context": { "type": "object", "additionalProperties": true, "description": "Environmental or contextual attributes for the request" }, "EvaluationResponse": { "type": "object", "properties": { "decision": { "type": "boolean", "description": "Result of the access evaluation (true for allow, false for deny)" }, "context": { "$ref": "#/components/schemas/Context" } }, "required": [ "decision" ] } }, "securitySchemes": { "bearer": { "type": "http", "scheme": "bearer" } } } }