Discovery & JWKS

Atlas publishes standard discovery documents so clients configure themselves rather than hard-coding hosts and keys.

OpenID Provider discovery

GET /.well-known/openid-configuration

Returns the OpenID Provider metadata for your instance: the host-based issuer, the authorization/token/userinfo/jwks endpoints, S256 PKCE support, and RS256 signing. Point any standards-compliant OIDC client at this URL.

JWKS (public signing keys)

GET /.well-known/jwks.json
GET /instances/:instanceId/.well-known/jwks.json

The public keys for verifying session JWTs and OIDC tokens. Cacheable with stale-if-error. Always fetch and cache rather than pinning a key — keys rotate.

import { AtlasBackend } from '@atlas/backend';

const atlas = new AtlasBackend({
  jwksUrl: 'https://accounts.yourapp.com/.well-known/jwks.json',
  issuer: 'https://accounts.yourapp.com',
});

SCIM discovery

GET /scim/v2/ServiceProviderConfig   → features + authentication scheme
GET /scim/v2/ResourceTypes           → the User and Group resource types
GET /scim/v2/Schemas                 → core User and Group schema definitions

SAML metadata

GET /v1/saml/idp/metadata                     → Atlas-as-IdP metadata (entityId, signing cert, SSO bindings)
GET /v1/sso/saml/:connectionId/metadata       → SP metadata for a specific connection (entityID + ACS URL)

Operational endpoints

GET /v1/health           → liveness (does not touch the database)
GET /v1/health/ready      → readiness (includes a database check)
GET /metrics             → Prometheus exposition (guarded by METRICS_TOKEN; 404 when unset)