API docs by Redocly

Autentico OIDC (1.0)

Download OpenAPI specification:

Authentication Service

Well-Known

Get JWKS

Returns the JSON Web Key Set for verifying JWTs

Responses

Response samples

Content type
application/json
{
  • "keys": [
    ]
}

Get Well-Known Configuration

Returns the OpenID Connect Well-Known Configuration

Responses

Response samples

Content type
application/json
{
  • "authorization_endpoint": "string",
  • "claims_supported": [
    ],
  • "end_session_endpoint": "string",
  • "id_token_signing_alg_values_supported": [
    ],
  • "issuer": "string",
  • "jwks_uri": "string",
  • "registration_endpoint": "string",
  • "response_types_supported": [
    ],
  • "scopes_supported": [
    ],
  • "subject_types_supported": [
    ],
  • "token_endpoint": "string",
  • "token_endpoint_auth_methods_supported": [
    ],
  • "userinfo_endpoint": "string"
}

client

List all clients

Lists all registered clients (admin only)

Authorizations:
BearerAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Register a new OAuth2 client

Registers a new OAuth2/OIDC client (admin only)

Authorizations:
BearerAuth
Request Body schema: application/json
required

Client registration request

access_token_expiration
string

Per-client overrides

allow_self_signup
boolean
allowed_audiences
Array of strings
authorization_code_expiration
string
client_id
string
client_name
string
client_type
string
grant_types
Array of strings
post_logout_redirect_uris
Array of strings
redirect_uris
Array of strings
refresh_token_expiration
string
response_types
Array of strings
scopes
string
sso_session_idle_timeout
string
token_endpoint_auth_method
string
trust_device_enabled
boolean
trust_device_expiration
string

Responses

Request samples

Content type
application/json
{
  • "access_token_expiration": "string",
  • "allow_self_signup": true,
  • "allowed_audiences": [
    ],
  • "authorization_code_expiration": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_type": "string",
  • "grant_types": [
    ],
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_expiration": "string",
  • "response_types": [
    ],
  • "scopes": "string",
  • "sso_session_idle_timeout": "string",
  • "token_endpoint_auth_method": "string",
  • "trust_device_enabled": true,
  • "trust_device_expiration": "string"
}

Response samples

Content type
application/json
{
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_type": "string",
  • "grant_types": [
    ],
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "response_types": [
    ],
  • "scopes": "string",
  • "token_endpoint_auth_method": "string"
}

Deactivate a client

Deactivates (soft deletes) a registered client (admin only)

Authorizations:
BearerAuth
path Parameters
client_id
required
string

Client ID

Responses

Get client information

Retrieves information about a registered client (admin only)

Authorizations:
BearerAuth
path Parameters
client_id
required
string

Client ID

Responses

Response samples

Content type
application/json
{
  • "access_token_expiration": "string",
  • "allow_self_signup": true,
  • "allowed_audiences": [
    ],
  • "authorization_code_expiration": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_type": "string",
  • "grant_types": [
    ],
  • "is_active": true,
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_expiration": "string",
  • "response_types": [
    ],
  • "scopes": "string",
  • "sso_session_idle_timeout": "string",
  • "token_endpoint_auth_method": "string",
  • "trust_device_enabled": true,
  • "trust_device_expiration": "string"
}

Update client information

Updates a registered client (admin only)

Authorizations:
BearerAuth
path Parameters
client_id
required
string

Client ID

Request Body schema: application/json
required

Client update request

access_token_expiration
string

Per-client overrides

allow_self_signup
boolean
allowed_audiences
Array of strings
authorization_code_expiration
string
client_name
string
grant_types
Array of strings
is_active
boolean
post_logout_redirect_uris
Array of strings
redirect_uris
Array of strings
refresh_token_expiration
string
response_types
Array of strings
scopes
string
sso_session_idle_timeout
string
token_endpoint_auth_method
string
trust_device_enabled
boolean
trust_device_expiration
string

Responses

Request samples

Content type
application/json
{
  • "access_token_expiration": "string",
  • "allow_self_signup": true,
  • "allowed_audiences": [
    ],
  • "authorization_code_expiration": "string",
  • "client_name": "string",
  • "grant_types": [
    ],
  • "is_active": true,
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_expiration": "string",
  • "response_types": [
    ],
  • "scopes": "string",
  • "sso_session_idle_timeout": "string",
  • "token_endpoint_auth_method": "string",
  • "trust_device_enabled": true,
  • "trust_device_expiration": "string"
}

Response samples

Content type
application/json
{
  • "access_token_expiration": "string",
  • "allow_self_signup": true,
  • "allowed_audiences": [
    ],
  • "authorization_code_expiration": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_type": "string",
  • "grant_types": [
    ],
  • "is_active": true,
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_expiration": "string",
  • "response_types": [
    ],
  • "scopes": "string",
  • "sso_session_idle_timeout": "string",
  • "token_endpoint_auth_method": "string",
  • "trust_device_enabled": true,
  • "trust_device_expiration": "string"
}

List all clients

Lists all registered clients (admin only)

Authorizations:
BearerAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Register a new OAuth2 client

Registers a new OAuth2/OIDC client (admin only)

Authorizations:
BearerAuth
Request Body schema: application/json
required

Client registration request

access_token_expiration
string

Per-client overrides

allow_self_signup
boolean
allowed_audiences
Array of strings
authorization_code_expiration
string
client_id
string
client_name
string
client_type
string
grant_types
Array of strings
post_logout_redirect_uris
Array of strings
redirect_uris
Array of strings
refresh_token_expiration
string
response_types
Array of strings
scopes
string
sso_session_idle_timeout
string
token_endpoint_auth_method
string
trust_device_enabled
boolean
trust_device_expiration
string

Responses

Request samples

Content type
application/json
{
  • "access_token_expiration": "string",
  • "allow_self_signup": true,
  • "allowed_audiences": [
    ],
  • "authorization_code_expiration": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_type": "string",
  • "grant_types": [
    ],
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_expiration": "string",
  • "response_types": [
    ],
  • "scopes": "string",
  • "sso_session_idle_timeout": "string",
  • "token_endpoint_auth_method": "string",
  • "trust_device_enabled": true,
  • "trust_device_expiration": "string"
}

Response samples

Content type
application/json
{
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_type": "string",
  • "grant_types": [
    ],
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "response_types": [
    ],
  • "scopes": "string",
  • "token_endpoint_auth_method": "string"
}

Deactivate a client

Deactivates (soft deletes) a registered client (admin only)

Authorizations:
BearerAuth
path Parameters
client_id
required
string

Client ID

Responses

Get client information

Retrieves information about a registered client (admin only)

Authorizations:
BearerAuth
path Parameters
client_id
required
string

Client ID

Responses

Response samples

Content type
application/json
{
  • "access_token_expiration": "string",
  • "allow_self_signup": true,
  • "allowed_audiences": [
    ],
  • "authorization_code_expiration": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_type": "string",
  • "grant_types": [
    ],
  • "is_active": true,
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_expiration": "string",
  • "response_types": [
    ],
  • "scopes": "string",
  • "sso_session_idle_timeout": "string",
  • "token_endpoint_auth_method": "string",
  • "trust_device_enabled": true,
  • "trust_device_expiration": "string"
}

Update client information

Updates a registered client (admin only)

Authorizations:
BearerAuth
path Parameters
client_id
required
string

Client ID

Request Body schema: application/json
required

Client update request

access_token_expiration
string

Per-client overrides

allow_self_signup
boolean
allowed_audiences
Array of strings
authorization_code_expiration
string
client_name
string
grant_types
Array of strings
is_active
boolean
post_logout_redirect_uris
Array of strings
redirect_uris
Array of strings
refresh_token_expiration
string
response_types
Array of strings
scopes
string
sso_session_idle_timeout
string
token_endpoint_auth_method
string
trust_device_enabled
boolean
trust_device_expiration
string

Responses

Request samples

Content type
application/json
{
  • "access_token_expiration": "string",
  • "allow_self_signup": true,
  • "allowed_audiences": [
    ],
  • "authorization_code_expiration": "string",
  • "client_name": "string",
  • "grant_types": [
    ],
  • "is_active": true,
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_expiration": "string",
  • "response_types": [
    ],
  • "scopes": "string",
  • "sso_session_idle_timeout": "string",
  • "token_endpoint_auth_method": "string",
  • "trust_device_enabled": true,
  • "trust_device_expiration": "string"
}

Response samples

Content type
application/json
{
  • "access_token_expiration": "string",
  • "allow_self_signup": true,
  • "allowed_audiences": [
    ],
  • "authorization_code_expiration": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_type": "string",
  • "grant_types": [
    ],
  • "is_active": true,
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_expiration": "string",
  • "response_types": [
    ],
  • "scopes": "string",
  • "sso_session_idle_timeout": "string",
  • "token_endpoint_auth_method": "string",
  • "trust_device_enabled": true,
  • "trust_device_expiration": "string"
}

federation-admin

List federation providers

Authorizations:
BearerAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a federation provider

Authorizations:
BearerAuth
Request Body schema: application/json
required

Provider request

client_id
string
client_secret
string
enabled
boolean
icon_svg
string
id
string
issuer
string
name
string
sort_order
integer

Responses

Request samples

Content type
application/json
{
  • "client_id": "string",
  • "client_secret": "string",
  • "enabled": true,
  • "icon_svg": "string",
  • "id": "string",
  • "issuer": "string",
  • "name": "string",
  • "sort_order": 0
}

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

Delete a federation provider

Authorizations:
BearerAuth
path Parameters
id
required
string

Provider ID

Responses

Get a federation provider

Authorizations:
BearerAuth
path Parameters
id
required
string

Provider ID

Responses

Response samples

Content type
application/json
{
  • "client_id": "string",
  • "enabled": true,
  • "icon_svg": "string",
  • "id": "string",
  • "issuer": "string",
  • "name": "string",
  • "sort_order": 0
}

Update a federation provider

Authorizations:
BearerAuth
path Parameters
id
required
string

Provider ID

Request Body schema: application/json
required

Provider request

client_id
string
client_secret
string
enabled
boolean
icon_svg
string
id
string
issuer
string
name
string
sort_order
integer

Responses

Request samples

Content type
application/json
{
  • "client_id": "string",
  • "client_secret": "string",
  • "enabled": true,
  • "icon_svg": "string",
  • "id": "string",
  • "issuer": "string",
  • "name": "string",
  • "sort_order": 0
}

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

sessions-admin

List sessions

Lists all active sessions, optionally filtered by user ID.

Authorizations:
BearerAuth
query Parameters
user_id
string

Filter by User ID

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Deactivate a session

Authorizations:
BearerAuth
path Parameters
id
required
string

Session ID

Responses

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

admin

Get system settings

Retrieve all system settings (except sensitive values).

Authorizations:
BearerAuth

Responses

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

Update system settings

Update multiple settings by key-value pairs.

Authorizations:
BearerAuth

Responses

System statistics

Returns a summary of users, clients, and active sessions.

Authorizations:
BearerAuth

Responses

Response samples

Content type
application/json
{
  • "active_clients": 0,
  • "active_sessions": 0,
  • "recent_logins": 0,
  • "total_sessions": 0,
  • "total_users": 0
}

users-admin

List all users

Authorizations:
BearerAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a new user

Registers a new user in the system (admin only)

Authorizations:
BearerAuth
Request Body schema: application/json
required

User creation payload

email
string
password
string
role
string

optional role assignment

username
string

Responses

Request samples

Content type
application/json
{
  • "email": "string",
  • "password": "string",
  • "role": "string",
  • "username": "string"
}

Response samples

Content type
application/json
{
  • "address_country": "string",
  • "address_locality": "string",
  • "address_postal_code": "string",
  • "address_region": "string",
  • "address_street": "string",
  • "created_at": "string",
  • "email": "string",
  • "failed_login_attempts": 0,
  • "family_name": "string",
  • "given_name": "string",
  • "id": "string",
  • "is_email_verified": true,
  • "locale": "string",
  • "locked_until": "string",
  • "phone_number": "string",
  • "picture": "string",
  • "role": "string",
  • "totp_verified": true,
  • "username": "string",
  • "zoneinfo": "string"
}

Delete a user

Authorizations:
BearerAuth
path Parameters
id
required
string

User ID

Responses

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

Get a user by ID

Authorizations:
BearerAuth
path Parameters
id
required
string

User ID

Responses

Response samples

Content type
application/json
{
  • "address_country": "string",
  • "address_locality": "string",
  • "address_postal_code": "string",
  • "address_region": "string",
  • "address_street": "string",
  • "created_at": "string",
  • "email": "string",
  • "failed_login_attempts": 0,
  • "family_name": "string",
  • "given_name": "string",
  • "id": "string",
  • "is_email_verified": true,
  • "locale": "string",
  • "locked_until": "string",
  • "phone_number": "string",
  • "picture": "string",
  • "role": "string",
  • "totp_verified": true,
  • "username": "string",
  • "zoneinfo": "string"
}

Update a user

Authorizations:
BearerAuth
path Parameters
id
required
string

User ID

Request Body schema: application/json
required

User update payload

address_country
string
address_locality
string
address_postal_code
string
address_region
string
address_street
string
email
string
family_name
string
given_name
string

OIDC standard profile claims

is_email_verified
boolean
locale
string
password
string
phone_number
string
picture
string
role
string
totp_verified
boolean
username
string
zoneinfo
string

Responses

Request samples

Content type
application/json
{
  • "address_country": "string",
  • "address_locality": "string",
  • "address_postal_code": "string",
  • "address_region": "string",
  • "address_street": "string",
  • "email": "string",
  • "family_name": "string",
  • "given_name": "string",
  • "is_email_verified": true,
  • "locale": "string",
  • "password": "string",
  • "phone_number": "string",
  • "picture": "string",
  • "role": "string",
  • "totp_verified": true,
  • "username": "string",
  • "zoneinfo": "string"
}

Response samples

Content type
application/json
{
  • "address_country": "string",
  • "address_locality": "string",
  • "address_postal_code": "string",
  • "address_region": "string",
  • "address_street": "string",
  • "created_at": "string",
  • "email": "string",
  • "failed_login_attempts": 0,
  • "family_name": "string",
  • "given_name": "string",
  • "id": "string",
  • "is_email_verified": true,
  • "locale": "string",
  • "locked_until": "string",
  • "phone_number": "string",
  • "picture": "string",
  • "role": "string",
  • "totp_verified": true,
  • "username": "string",
  • "zoneinfo": "string"
}

Unlock user account

Resets the failed login attempts and clears the lockout time for a user.

Authorizations:
BearerAuth
path Parameters
id
required
string

User ID

Responses

Response samples

Content type
application/json
{
  • "address_country": "string",
  • "address_locality": "string",
  • "address_postal_code": "string",
  • "address_region": "string",
  • "address_street": "string",
  • "created_at": "string",
  • "email": "string",
  • "failed_login_attempts": 0,
  • "family_name": "string",
  • "given_name": "string",
  • "id": "string",
  • "is_email_verified": true,
  • "locale": "string",
  • "locked_until": "string",
  • "phone_number": "string",
  • "picture": "string",
  • "role": "string",
  • "totp_verified": true,
  • "username": "string",
  • "zoneinfo": "string"
}

Health

Health check

Returns the health status of the server and its dependencies. Returns 200 when healthy, 503 when the database is unreachable.

Responses

Response samples

Content type
application/json
{
  • "database": "string",
  • "status": "string"
}

authorize

Authorize a client

Handles the authorization request and displays the login page

query Parameters
response_type
required
string

Response type

client_id
required
string

Client ID

redirect_uri
required
string

Redirect URI

scope
string

Scope

state
required
string

State

Responses

introspect

Introspect a token

Validates and retrieves metadata about a token

Request Body schema: application/json
required

Token introspection payload

token
string

Responses

Request samples

Content type
application/json
{
  • "token": "string"
}

Response samples

Content type
application/json
{
  • "active": true,
  • "aud": "string",
  • "client_id": "string",
  • "error": "string",
  • "error_description": "string",
  • "exp": 0,
  • "iat": 0,
  • "jti": "string",
  • "nbf": 0,
  • "scope": "string",
  • "sub": "string",
  • "token_type": "string",
  • "username": "string"
}

auth

Log in a user

Authenticates a user and generates an authorization code

Request Body schema: application/x-www-form-urlencoded
required
username
required
string

Username

password
required
string

Password

redirect
required
string

Redirect URI

state
required
string

State

Responses

Response samples

Content type
application/json
"string"

session

Log out a user

Terminates the user's session

header Parameters
Authorization
required
string

Bearer access token

Responses

Response samples

Content type
application/json
"string"

mfa

Multi-factor authentication

Renders the MFA verification or enrollment page (GET) or processes the MFA code (POST).

query Parameters
challenge_id
string

MFA challenge ID (GET)

Request Body schema: application/x-www-form-urlencoded
challenge_id
string

MFA challenge ID (POST)

code
string

Verification code (POST)

totp_secret
string

TOTP secret for enrollment (POST)

trust_device
string

Whether to trust the device (POST)

Responses

Multi-factor authentication

Renders the MFA verification or enrollment page (GET) or processes the MFA code (POST).

query Parameters
challenge_id
string

MFA challenge ID (GET)

Request Body schema: application/x-www-form-urlencoded
challenge_id
string

MFA challenge ID (POST)

code
string

Verification code (POST)

totp_secret
string

TOTP secret for enrollment (POST)

trust_device
string

Whether to trust the device (POST)

Responses

passkey

Begin passkey login

Initiates a WebAuthn authentication ceremony. The user must already have a registered passkey. Returns the options for the navigator.credentials.get call.

query Parameters
username
required
string

User's username

redirect_uri
string

Redirect URI

state
string

OAuth2 state

client_id
string

OAuth2 client ID

Responses

Response samples

Content type
application/json
{ }

Complete passkey login

Processes the WebAuthn assertion from the client and issues an authorization code.

query Parameters
challenge_id
required
string

Challenge ID from BeginLogin

Request Body schema: application/json
required

WebAuthn assertion response

property name*
additional property
any

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

Begin passkey registration

Creates a user account (if not already present) and initiates a WebAuthn registration ceremony.

query Parameters
username
required
string

Desired username

email
string

Email address

redirect_uri
string

Redirect URI

state
string

OAuth2 state

client_id
string

OAuth2 client ID

Responses

Response samples

Content type
application/json
{ }

Complete passkey registration

Processes the WebAuthn attestation from the client and registers the passkey.

query Parameters
challenge_id
required
string

Challenge ID from BeginRegistration

Request Body schema: application/json
required

WebAuthn attestation response

property name*
additional property
any

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

token

Revoke a token

Revokes an access or refresh token

Request Body schema: application/x-www-form-urlencoded
required
token
required
string

Token to revoke

Responses

Response samples

Content type
application/json
"string"

Token endpoint

Exchanges authorization code or credentials for tokens

Request Body schema: application/x-www-form-urlencoded
required
grant_type
required
string

Grant type

code
string

Authorization code

redirect_uri
string

Redirect URI

client_id
string

Client ID

username
string

Username

password
string

Password

Responses

Response samples

Content type
application/json
{
  • "access_token": "string",
  • "expires_in": 0,
  • "id_token": "string",
  • "refresh_token": "string",
  • "scope": "string",
  • "token_type": "string"
}

signup

User signup

Renders the signup page (GET) or processes a new user registration (POST).

Request Body schema: application/x-www-form-urlencoded
username
string

Desired username

password
string

Password

confirm_password
string

Confirm password

email
string

Email address

redirect_uri
string

Redirect URI

state
string

OAuth2 state

Responses

User signup

Renders the signup page (GET) or processes a new user registration (POST).

Request Body schema: application/x-www-form-urlencoded
username
string

Desired username

password
string

Password

confirm_password
string

Confirm password

email
string

Email address

redirect_uri
string

Redirect URI

state
string

OAuth2 state

Responses

userinfo

Get user information

Retrieves user information based on the access token

header Parameters
Authorization
required
string

Bearer access token

Responses

Response samples

Content type
application/json
{ }

onboarding

Initial admin setup

Renders the onboarding page (GET) or creates the initial administrator (POST).

Request Body schema: application/x-www-form-urlencoded
username
string

Admin username

password
string

Admin password

confirm_password
string

Confirm password

email
string

Admin email

Responses

Initial admin setup

Renders the onboarding page (GET) or creates the initial administrator (POST).

Request Body schema: application/x-www-form-urlencoded
username
string

Admin username

password
string

Admin password

confirm_password
string

Confirm password

email
string

Admin email

Responses