generated: '2026-08-06'
method: probed
source: https://auth.auditoria.ai/.well-known/openid-configuration
docs: https://docs.auditoria.ai/hc/en-us/categories/360003645754-Auditoria-AI-Integrations
scope: >-
  This profile describes how humans and connected systems authenticate TO Auditoria and how
  Auditoria authenticates OUT to a customer's ERP and mailbox. Auditoria publishes no public
  API, so there is no OpenAPI securityScheme to derive from - every scheme below was probed
  live or read from the published integration documentation.
summary:
  types: [openIdConnect, oauth2, saml2]
  api_key_in: []
  oauth2_flows: [authorizationCode, clientCredentials, deviceCode, refreshToken, tokenExchange, jwtBearer, implicit, password]
  public_api_auth: none
schemes:
  - name: Auth0OIDC
    type: openIdConnect
    openIdConnectUrl: https://auth.auditoria.ai/.well-known/openid-configuration
    issuer: https://auth.auditoria.ai/
    provider: Auth0
    purpose: End-user and machine sign-in to the Auditoria tenant application (app.auditoria.ai)
    endpoints:
      authorization: https://auth.auditoria.ai/authorize
      token: https://auth.auditoria.ai/oauth/token
      userinfo: https://auth.auditoria.ai/userinfo
      jwks: https://auth.auditoria.ai/.well-known/jwks.json
      registration: https://auth.auditoria.ai/oidc/register
      revocation: https://auth.auditoria.ai/oauth/revoke
      device_authorization: https://auth.auditoria.ai/oauth/device/code
      backchannel_authentication: https://auth.auditoria.ai/bc-authorize
      mfa_challenge: https://auth.auditoria.ai/mfa/challenge
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, private_key_jwt, none]
    id_token_signing_algs: [HS256, RS256, PS256]
    pkce: {supported: true, methods: [S256, plain]}
    dpop: {supported: true, algs: [ES256]}
    mfa: true
    backchannel_logout: true
    sources: [well-known/auditoria-openid-configuration.json]
  - name: SAML2SSO
    type: saml2
    purpose: Customer-tenant single sign-on into Auditoria
    identity_providers_documented: [Okta, Microsoft Entra ID (Azure AD), generic SAML 2.0]
    docs:
      - https://docs.auditoria.ai/hc/en-us/articles/52583635034905-Single-Sign-On-SSO-Integration-Generic-SAML-Guide
      - https://docs.auditoria.ai/hc/en-us/articles/29666250326169-SSO-Integration-Microsoft-Entra-ID-Azure-SSO
      - https://docs.auditoria.ai/hc/en-us/articles/7949613654681-Okta-SSO-for-an-Auditoria-Tenant
    sources: [docs.auditoria.ai]
  - name: MailboxOAuth
    type: oauth2
    purpose: >-
      Delegated OAuth 2.0 grant so Auditoria's SmartBots can read and send from the customer's
      shared AP/AR mailbox (Microsoft 365 / Google Workspace) rather than storing a password.
    docs:
      - https://docs.auditoria.ai/hc/en-us/articles/54689809797657-Auditoria-AI-Mailbox-Integration-OAuth-Overview
      - https://docs.auditoria.ai/hc/en-us/articles/4445097262361-Authenticate-Auditoria-in-Google-Workspace
      - https://docs.auditoria.ai/hc/en-us/articles/4414146361753-Configure-your-Auditoria-mailbox-for-Okta-SSO-support
    sources: [docs.auditoria.ai]
outbound_erp_credentials:
  note: >-
    Auditoria is an API CONSUMER on the ERP side. The documented pattern is a dedicated
    service account in the customer's ERP, not an Auditoria-issued credential.
  patterns:
    - system: Workday
      mechanism: Integration System User (ISU) / Automated Security User (ASU) with a web-services security group
      docs: https://docs.auditoria.ai/hc/en-us/articles/32034349717401-Setting-Up-a-Workday-ISU-for-SmartVendor-Products-AP-Invoices-and-AP-Helpdesk
    - system: Oracle NetSuite
      mechanism: NetSuite connection settings with a scoped business-user role
      docs: https://docs.auditoria.ai/hc/en-us/articles/4416849866649-Oracle-NetSuite-Connection-Settings
    - system: Sage Intacct
      mechanism: Sage Intacct web-services connection settings with a scoped business user
      docs: https://docs.auditoria.ai/hc/en-us/articles/4416842321305-Sage-Intacct-Connection-Settings
    - system: Coupa
      mechanism: Coupa connection settings
      docs: https://docs.auditoria.ai/hc/en-us/articles/5546330161049-Coupa-Connection-Settings
    - system: Oracle Fusion Cloud
      mechanism: Oracle Fusion Cloud service account
      docs: https://docs.auditoria.ai/hc/en-us/articles/60236686051481-Set-up-Oracle-Fusion-Cloud-for-Auditoria
    - system: Universal Connector (no native ERP connector)
      mechanism: SFTP credentials (host/port/username/password) or an AWS S3 bucket, exchanged out of band
      docs: https://docs.auditoria.ai/hc/en-us/articles/60112878955289-Auditoria-Universal-Connector
  tenant_token:
    name: Auditoria source token
    note: >-
      A per-tenant identifier the customer copies from Administration > System Settings and
      pastes into the ERP-side connection. It addresses an inbound Auditoria mail endpoint
      (<sourcetoken>@invoice-inbound.auditoria.ai); it is not an API key and grants no API access.
    docs: https://docs.auditoria.ai/hc/en-us/articles/4584712925721-Get-your-Auditoria-Source-Token
  byok:
    supported: true
    product: Auditoria Guardian
    docs: https://docs.auditoria.ai/hc/en-us/articles/49775469453593-Auditoria-Guardian-Bring-Your-Own-Key-BYOK-Configuration
x-evidence:
  fetched: '2026-08-06'
  url: https://auth.auditoria.ai/.well-known/openid-configuration
  http_status: 200
  content_type: application/json