openapi: 3.0.0
info:
  title: Auth0 Authentication actions Authorize User API
  description: Auth0 Authentication API. Endpoints for authentication and authorization using OpenID Connect, OAuth 2.0, SAML, WS-Federation, and Passwordless flows.
  version: 1.0.0
servers:
- url: '{auth0_domain}'
  description: The Authentication API is served over HTTPS.
  variables:
    auth0_domain:
      description: Auth0 domain
      default: https://demo.us.auth0.com
tags:
- name: Authorize User
paths:
  /authorize:
    get:
      operationId: authorize
      tags:
      - Authorize User
      summary: Auth0 Authenticate a User with a Social Provider, Database/AD/LDAP (Passive), SAML/Windows Azure AD (Passive), Authorization Code Flow, Authorization Code Grant (PKCE) Flow, or Implicit Flow
      description: "Use this endpoint to authenticate a user. The following flows are supported:\n  - Social Provider Authentication\n  - Database/AD/LDAP (Passive) Authentication\n  - SAML/Windows Azure AD (Passive) Authentication\n  - Authorization Code Flow\n  - Authorization Code Grant (PKCE) Flow\n  - Implicit Flow\n"
      parameters:
      - name: audience
        in: query
        description: The unique identifier of the target API you want to access
        schema:
          type: string
      - name: scope
        in: query
        description: The scopes which you want to request authorization for. These must be separated by a space. You can request any of the standard OpenID Connect (OIDC) scopes about users, such as profile and email, custom claims that must conform to a namespaced format, or any scopes supported by the target API (for example, read:contacts). Include offline_access to get a Refresh Token.
        schema:
          type: string
      - name: response_type
        in: query
        description: Indicates to Auth0 which OAuth 2.0 flow you want to perform. Use code for Authorization Code Grant Flow, token for Implicit Flow, or id_token token for both an ID Token and an Access Token.
        required: true
        schema:
          type: string
          enum:
          - code
          - token
          - id_token token
      - name: client_id
        in: query
        description: Your application's ID.
        required: true
        schema:
          type: string
      - name: redirect_uri
        in: query
        description: The URL to which Auth0 will redirect the browser after authorization has been granted by the user.
        schema:
          type: string
          format: uri
      - name: state
        in: query
        description: An opaque value the applications adds to the initial request that the authorization server includes when redirecting the back to the application. This value must be used by the application to prevent CSRF attacks.
        schema:
          type: string
      - name: nonce
        in: query
        description: A string value which will be included in the ID Token response from Auth0, used to prevent token replay attacks. It is required for response_type=id_token token.
        schema:
          type: string
      - name: code_challenge_method
        in: query
        description: Method used to generate the challenge. The PKCE spec defines two methods, S256 and plain, however, Auth0 supports only S256 since the latter is discouraged.
        schema:
          type: string
          enum:
          - S256
      - name: code_challenge
        in: query
        description: Generated challenge from the code_verifier.
        schema:
          type: string
      - name: connection
        in: query
        description: The name of the connection configured to your application.
        schema:
          type: string
      - name: prompt
        in: query
        description: To initiate a silent authentication request, use prompt=none.
        schema:
          type: string
      - name: organization
        in: query
        description: ID of the organization to use when authenticating a user. When not provided, if your application is configured to Display Organization Prompt, the user will be able to enter the organization name when authenticating.
        schema:
          type: string
      - name: invitation
        in: query
        description: Ticket ID of the organization invitation. When inviting a member to an Organization, your application should handle invitation acceptance by forwarding the invitation and organization key-value pairs when the user accepts the invitation.
        schema:
          type: string
      responses:
        '302':
          description: Redirect to the social provider specified in connection
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          $ref: '#/components/responses/MethodNotAllowed'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
components:
  responses:
    NotImplemented:
      description: Not Implemented
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
              error_description:
                type: string
    ServiceUnavailable:
      description: Service Unavailable
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
              error_description:
                type: string
    InternalServerError:
      description: Internal Server Error
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
              error_description:
                type: string
    TooManyRequests:
      description: Too Many Requests
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
              error_description:
                type: string
    BadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
              error_description:
                type: string
    NotFound:
      description: Not Found
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
              error_description:
                type: string
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
              error_description:
                type: string
    MethodNotAllowed:
      description: Method Not Allowed
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
              error_description:
                type: string