openapi: 3.2.0 info: title: Janssen Server Authorization API description: Janssen Authorization Server - OAuth 2.0 server; OpenID Connect Provider (OP) & UMA Authorization Server (AS) contact: name: Contact url: https://github.com/JanssenProject/jans/discussions license: name: License url: https://github.com/JanssenProject/jans/blob/main/LICENSE version: OAS Version servers: - url: https://jans.local.io/jans-auth tags: - name: Authorization paths: /restv1/authorize: get: tags: - Authorization summary: The Authorization Endpoint performs Authentication of the End-User description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect. operationId: get_authorize parameters: - name: scope in: query required: true description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present. schema: type: string - name: response_type in: query required: true description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used. schema: type: string - name: client_id in: query required: true description: OAuth 2.0 Client Identifier valid at the Authorization Server. schema: type: string - name: redirect_uri in: query required: true description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider. schema: type: string - name: state in: query required: false description: Opaque value used to maintain state between the request and the callback. schema: type: string - name: response_mode in: query required: false description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. schema: type: string - name: nonce in: query required: false description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. schema: type: string - name: display in: query required: false description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. schema: type: string - name: prompt in: query required: false description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are - none, login, consent, select_account. schema: type: string - name: max_age in: query required: false description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. schema: type: integer - name: ui_locales in: query required: false description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. schema: type: string - name: id_token_hint in: query required: false description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response. schema: type: string - name: login_hint in: query required: false description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary). schema: type: string - name: acr_values in: query required: false description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. schema: type: string - name: amr_values in: query required: false description: AMR Values. schema: type: string - name: request in: query required: false description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters. schema: type: string - name: request_uri in: query required: false description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters. schema: type: string - name: request_session_id in: query required: false description: Request session id. schema: type: string - name: session_id in: query required: false description: Session id of this call. schema: type: string - name: origin_headers in: query required: false description: Origin headers. Used in custom workflows. schema: type: string - name: code_challenge in: query required: false description: PKCE code challenge. schema: type: string - name: code_challenge_method in: query required: false description: PKCE code challenge method. schema: type: string - name: custom_response_headers in: query required: false description: Custom Response Headers. schema: type: string - name: claims in: query required: false description: Requested Claims. schema: type: string - name: auth_req_id in: query required: false description: CIBA authentication request Id. schema: type: string - name: dpop_jkt in: query required: false description: The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function schema: type: string - name: logout_status_jwt in: query required: false description: Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful. schema: type: string - name: authorization_details in: query required: false description: The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field. schema: type: string responses: 200: description: OK content: {} 302: description: Error codes for authorization endpoint. content: application/json: schema: title: AuthorizeError type: object required: - error - error_description properties: error: type: string format: enum example: - invalid_request - unauthorized_client - disabled_client - access_denied - retry - unsupported_response_type - invalid_scope - server_error - temporarily_unavailable - invalid_request_redirect_uri - invalid_authorization_details - login_required - session_selection_required - consent_required - user_mismatched - request_not_supported - request_uri_not_supported - invalid_request_uri - invalid_request_object - authentication_session_invalid - invalid_authentication_method error_description: type: string details: type: string 400: $ref: '#/components/responses/InvalidRequest' 401: $ref: '#/components/responses/Unauthorized' 500: $ref: '#/components/responses/InternalServerError' post: tags: - Authorization summary: The Authorization Endpoint performs Authentication of the End-User description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect. operationId: post_authorize requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object required: - scope - response_type - client_id - redirect_uri properties: scope: type: string description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present. response_type: type: string description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used. client_id: type: string description: OAuth 2.0 Client Identifier valid at the Authorization Server. redirect_uri: type: string description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider. state: type: string description: Opaque value used to maintain state between the request and the callback. response_mode: type: string description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. nonce: type: string description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. display: type: string description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. prompt: type: string description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. max_age: type: integer description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. ui_locales: type: string description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). id_token_hint: type: string description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response. login_hint: type: string description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary). acr_values: type: string description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. amr_values: type: string description: AMR Values. request: type: string description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters. request_uri: type: string description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters. request_session_id: type: string description: Request session id. session_id: type: string description: Session id of this call. origin_headers: type: string description: Origin headers. Used in custom workflows. code_challenge: type: string description: PKCE code challenge. code_challenge_method: type: string description: PKCE code challenge method. custom_response_headers: type: string description: Custom Response Headers. claims: type: string description: Requested Claims. auth_req_id: type: string description: CIBA authentication request Id. dpop_jkt: type: string description: The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function logout_status_jwt: type: string description: Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful. authorization_details: type: string description: The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field. responses: 200: description: OK content: {} 302: description: Error codes for authorization endpoint. content: application/json: schema: title: AuthorizeError type: object required: - error - error_description properties: error: type: string format: enum example: - invalid_request - unauthorized_client - disabled_client - access_denied - retry - unsupported_response_type - invalid_scope - server_error - temporarily_unavailable - invalid_request_redirect_uri - invalid_authorization_details - login_required - session_selection_required - consent_required - user_mismatched - request_not_supported - request_uri_not_supported - invalid_request_uri - invalid_request_object - authentication_session_invalid - invalid_authentication_method error_description: type: string details: type: string 400: $ref: '#/components/responses/InvalidRequest' 401: $ref: '#/components/responses/Unauthorized' 500: $ref: '#/components/responses/InternalServerError' /restv1/par: post: tags: - Authorization summary: The Pushed Authorization Endpoint performs Authentication Request registration description: Registers Pushed Authorization Request at Pushed Authorization Endpoint using request parameters defined by https://datatracker.ietf.org/doc/html/draft-ietf-oauth-par-08. operationId: post_par requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object required: - scope - response_type - client_id - redirect_uri properties: scope: type: string description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present. response_type: type: string description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used. client_id: type: string description: OAuth 2.0 Client Identifier valid at the Authorization Server. redirect_uri: type: string description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider. state: type: string description: Opaque value used to maintain state between the request and the callback. response_mode: type: string description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. nonce: type: string description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. display: type: string description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. prompt: type: string description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. max_age: type: integer description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. ui_locales: type: string description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). id_token_hint: type: string description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response. login_hint: type: string description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary). acr_values: type: string description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. amr_values: type: string description: AMR Values. request: type: string description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters. request_session_id: type: string description: Request session id. session_id: type: string description: Session id of this call. origin_headers: type: string description: Origin headers. Used in custom workflows. code_challenge: type: string description: PKCE code challenge. code_challenge_method: type: string description: PKCE code challenge method. custom_response_headers: type: string description: Custom Response Headers. claims: type: string description: Requested Claims. responses: 201: description: Created content: application/json: schema: title: ParResponse type: object required: - request_uri - expires_in properties: request_uri: type: string description: The request URI corresponding to the authorization request posted. This URI is used as reference to the respective request data in the subsequent authorization request only. The way the authorization process obtains the authorization request data is at the discretion of the authorization server and out of scope of this specification. There is no need to make the authorization request data available to other parties via this URI. expires_in: type: string description: A JSON number that represents the lifetime of the request URI in seconds as a positive integer. The request URI lifetime is at the discretion of the authorization server but will typically be relatively short (e.g., between 5 and 600 seconds). 302: description: Error codes for pushed authorization endpoint. content: application/json: schema: title: AuthorizeError type: object required: - error - error_description properties: error: type: string format: enum example: - invalid_request - unauthorized_client - disabled_client - access_denied - retry - unsupported_response_type - invalid_scope - server_error - temporarily_unavailable - invalid_request_object - invalid_authentication_method error_description: type: string details: type: string 400: $ref: '#/components/responses/InvalidRequest' 401: $ref: '#/components/responses/Unauthorized' 403: $ref: '#/components/responses/AccessDenied' 500: $ref: '#/components/responses/InternalServerError' /restv1/bc-authorize: post: tags: - Authorization summary: Performs backchannel authorization of the end-user description: The Backchannel Authentication Endpoint is used to initiate an out-of-band authentication of the end-user. operationId: bc-authorize requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object required: - client_id - scope - client_notification_token properties: client_id: type: string description: OAuth 2.0 Client Identifier valid at the Authorization Server. scope: type: string description: CIBA authentication requests must contain the openid scope value. client_notification_token: type: string description: It is a bearer token provided by the Client that will be used by the OpenID Provider to authenticate the callback request to the Client. It is required if the Client is registered to use Ping or Push modes. acr_values: type: string description: Requested Authentication Context Class Reference values. login_hint_token: type: string description: A token containing information identifying the end-user for whom authentication is being requested. id_token_hint: type: string description: An ID Token previously issued to the Client by the OpenID Provider being passed back as a hint to identify the end-user for whom authentication is being requested. login_hint: type: string description: A hint to the OpenID Provider regarding the end-user for whom authentication is being requested. binding_message: type: string description: A human readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user. user_code: type: string description: A secret code, such as password or pin, known only to the user but verifiable by the OP. requested_expiry: type: integer description: A positive integer allowing the client to request the expires_in value for the auth_req_id the server will return. responses: 200: description: OK content: application/json: schema: title: Backchannel Authorization required: - AUTH_REQ_ID - EXPIRES_IN - INTERVAL type: object properties: AUTH_REQ_ID: type: string EXPIRES_IN: type: integer INTERVAL: type: integer 400: $ref: '#/components/responses/InvalidRequest' 401: description: Unauthorized CIBA (Client Initiated Backchannel Authentication) access. content: application/json: schema: type: object required: - error - error_description properties: error: type: string format: enum example: - invalid_request - invalid_scope - expired_login_hint_token - unknown_user_id - unauthorized_client - missing_user_code - invalid_user_code - invalid_binding_message - invalid_client - unauthorized_end_user_device - access_denied error_description: type: string details: type: string 403: $ref: '#/components/responses/AccessDenied' components: schemas: ErrorResponse: required: - error - error_description type: object properties: error: type: string error_description: type: string details: type: string responses: InvalidRequest: description: Invalid parameters are provided to endpoint. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalServerError: description: Internal error occured. Please check log file for details. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Unauthorized access request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' AccessDenied: description: Invalid details provided hence access denied. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearer: type: http scheme: bearer