openapi: 3.1.0
info:
  title: ForgeRock Access Management Access Requests OpenID Connect API
  description: REST API for ForgeRock Access Management (AM) providing authentication, authorization, session management, and policy evaluation. Supports OAuth 2.0 and OpenID Connect flows, authentication trees/journeys, policy-based authorization decisions, and realm management.
  version: 7.3.0
  contact:
    name: ForgeRock
    url: https://www.forgerock.com
  license:
    name: Proprietary
    url: https://www.forgerock.com/terms
  x-provider: forgerock
  x-api: access-management
servers:
- url: https://{deployment}/am
  description: ForgeRock Access Management server
  variables:
    deployment:
      default: am.example.com
      description: The AM deployment hostname
security:
- ssoToken: []
- bearerAuth: []
tags:
- name: OpenID Connect
  description: OpenID Connect discovery and userinfo
paths:
  /oauth2/realms/root/realms/{realm}/userinfo:
    get:
      operationId: oidcUserInfo
      summary: ForgeRock OpenID Connect UserInfo endpoint
      description: Returns claims about the authenticated end-user. Requires a valid access token with the openid scope.
      tags:
      - OpenID Connect
      parameters:
      - $ref: '#/components/parameters/RealmPath'
      security:
      - bearerAuth: []
      responses:
        '200':
          description: User info claims
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfo'
        '401':
          description: Invalid or missing access token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
  /.well-known/openid-configuration:
    get:
      operationId: oidcDiscovery
      summary: ForgeRock OpenID Connect discovery
      description: Returns the OpenID Connect Provider configuration metadata, including supported endpoints, scopes, claims, and signing algorithms.
      tags:
      - OpenID Connect
      responses:
        '200':
          description: OpenID Connect configuration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OIDCConfiguration'
components:
  parameters:
    RealmPath:
      name: realm
      in: path
      required: true
      description: The realm name
      schema:
        type: string
        default: root
  schemas:
    UserInfo:
      type: object
      description: OpenID Connect UserInfo claims
      properties:
        sub:
          type: string
          description: Subject identifier
        name:
          type: string
        given_name:
          type: string
        family_name:
          type: string
        email:
          type: string
          format: email
        email_verified:
          type: boolean
        phone_number:
          type: string
        address:
          type: object
          properties:
            formatted:
              type: string
    OAuthError:
      type: object
      description: OAuth 2.0 error response
      properties:
        error:
          type: string
        error_description:
          type: string
    OIDCConfiguration:
      type: object
      description: OpenID Connect discovery metadata
      properties:
        issuer:
          type: string
          format: uri
        authorization_endpoint:
          type: string
          format: uri
        token_endpoint:
          type: string
          format: uri
        userinfo_endpoint:
          type: string
          format: uri
        jwks_uri:
          type: string
          format: uri
        registration_endpoint:
          type: string
          format: uri
        scopes_supported:
          type: array
          items:
            type: string
        response_types_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        subject_types_supported:
          type: array
          items:
            type: string
        id_token_signing_alg_values_supported:
          type: array
          items:
            type: string
        token_endpoint_auth_methods_supported:
          type: array
          items:
            type: string
        claims_supported:
          type: array
          items:
            type: string
  securitySchemes:
    ssoToken:
      type: apiKey
      in: header
      name: iPlanetDirectoryPro
      description: AM SSO token obtained from authentication
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 access token