OIDC

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 12, 2026

GEThttps://{apiHost}/oauth2/authorize

Authorization endpoint. Exact redirect_uri match, PKCE for public clients; authenticates via the hosted session and returns a single-use code.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X GET "https://{apiHost}/oauth2/authorize"

POSThttps://{apiHost}/oauth2/authorize

Authorization endpoint (form post). Exact redirect_uri match, PKCE for public clients; returns a single-use code.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/authorize"

POSThttps://{apiHost}/oauth2/authorize/consent

Consent screen submit. Re-derives client, redirect_uri and scope from the signed token and the stored client (never the POST); approve records consent and mints a code, deny redirects access_denied.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/authorize/consent"

POSThttps://{apiHost}/oauth2/token

Token endpoint. authorization_code (single-use, PKCE-verified), refresh_token (rotated, theft-detected), client_credentials and device_code grants; mints access, id and refresh tokens.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/token"

POSThttps://{apiHost}/oauth2/par

Pushed Authorization Request (RFC 9126). Client-authenticated; lodges a validated authorization request and returns a single-use, client-bound request_uri for /authorize.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/par"

POSThttps://{apiHost}/oauth2/backchannel_authentication

CIBA backchannel authentication (OpenID Client-Initiated Backchannel Auth). Confidential client requests out-of-band user approval; returns an auth_req_id to poll /token with.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/backchannel_authentication"

POSThttps://{apiHost}/oauth2/device_authorization

Device Authorization endpoint (RFC 8628). Client-authenticated; returns a device_code, a user_code and the verification URIs for the "log in on a TV" flow.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/device_authorization"

GEThttps://{apiHost}/oauth2/device

Device verification page (RFC 8628). Requires a hosted session; with a user_code it renders an approve/deny screen carrying a signed, session-bound token, else the code-entry form.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X GET "https://{apiHost}/oauth2/device"

POSThttps://{apiHost}/oauth2/device/verify

Device verification submit. Re-derives the device code from the signed session-bound token; approve binds the signed-in user and records consent, deny marks the code denied.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/device/verify"

POSThttps://{apiHost}/oauth2/register

Dynamic Client Registration (RFC 7591). Gated by the per-instance oauthProvider.dynamicRegistration flag (403 when off); validates https/localhost redirect_uris and returns the new client_id and, for confidential clients, a secret.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/register"

GEThttps://{apiHost}/oauth2/register/{clientId}

Read a dynamically-registered client’s configuration (RFC 7592). Authenticated by the registration_access_token issued at registration.

Parameters

Name	In	Type	Required	Description
`clientId`	path	string	yes

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X GET "https://{apiHost}/oauth2/register/{clientId}"

PUThttps://{apiHost}/oauth2/register/{clientId}

Update a dynamically-registered client’s configuration (RFC 7592), authenticated by its registration_access_token.

Parameters

Name	In	Type	Required	Description
`clientId`	path	string	yes

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X PUT "https://{apiHost}/oauth2/register/{clientId}"

DELETEhttps://{apiHost}/oauth2/register/{clientId}

Delete a dynamically-registered client (RFC 7592), authenticated by its registration_access_token.

Parameters

Name	In	Type	Required	Description
`clientId`	path	string	yes

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X DELETE "https://{apiHost}/oauth2/register/{clientId}"

GEThttps://{apiHost}/oauth2/logout

RP-Initiated Logout end_session_endpoint (OIDC). Verifies the id_token_hint signature, revokes the end-user hosted session, fires Back-Channel and Front-Channel Logout to other RPs, and redirects only to an exact-match registered post_logout_redirect_uri.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X GET "https://{apiHost}/oauth2/logout"

POSThttps://{apiHost}/oauth2/logout

RP-Initiated Logout end_session_endpoint (form post). Verifies the id_token_hint, revokes the hosted session, notifies other RPs (Back-/Front-Channel Logout), and redirects only to an exact-match registered post_logout_redirect_uri.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/logout"

GEThttps://{apiHost}/oauth2/userinfo

UserInfo endpoint. Returns sub plus profile and email claims filtered by the granted scope, for a Bearer access token; refuses a token whose grant has been revoked.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X GET "https://{apiHost}/oauth2/userinfo"

POSThttps://{apiHost}/oauth2/revoke

Token revocation (RFC 7009). Client-authenticated; revokes the grant behind a refresh or access token. Always 200 for a well-formed request; only the owning client revokes anything.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/revoke"

POSThttps://{apiHost}/oauth2/introspect

Token introspection (RFC 7662). Client-authenticated; returns active:true with the token metadata for a live, non-revoked token owned by the caller, else {active:false}.

Responses

200 Success

400 Validation failed

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

401 Unauthenticated

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

403 Forbidden or missing scope

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

404 Not found

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

409 Conflict

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

429 Rate limited

{
  "errors": [
    {
      "code": "VALIDATION_FAILED",
      "message": "string",
      "param": "string",
      "meta": {}
    }
  ]
}

Example request

curl -X POST "https://{apiHost}/oauth2/introspect"

Was this page helpful?