openapi: 3.0.3
info:
  title: Infisical Admin OIDC Auth API
  description: List of all available APIs that can be consumed
  version: 0.0.1
servers:
- url: https://us.infisical.com
  description: Production server (US)
- url: https://eu.infisical.com
  description: Production server (EU)
- url: http://localhost:8080
  description: Local server
tags:
- name: OIDC Auth
paths:
  /api/v1/auth/oidc-auth/login:
    post:
      operationId: loginWithOidcAuth
      tags:
      - OIDC Auth
      description: Login with OIDC Auth for machine identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                identityId:
                  type: string
                  description: The ID of the machine identity to login.
                jwt:
                  type: string
                organizationSlug:
                  type: string
                  minLength: 1
                  maxLength: 64
                  description: When set, this will scope the login session to the specified organization the machine identity has access to. If omitted, the session defaults to the organization where the machine identity was created in.
              required:
              - identityId
              - jwt
              additionalProperties: false
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  accessToken:
                    type: string
                  expiresIn:
                    type: number
                  accessTokenMaxTTL:
                    type: number
                  tokenType:
                    type: string
                    enum:
                    - Bearer
                required:
                - accessToken
                - expiresIn
                - accessTokenMaxTTL
                - tokenType
                additionalProperties: false
        '400':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 400
                  message:
                    type: string
                  error:
                    type: string
                  details: {}
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '401':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 401
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '403':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 403
                  message:
                    type: string
                  details: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '404':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 404
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '422':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 422
                  message: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - error
                additionalProperties: false
        '500':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 500
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
  /api/v1/auth/oidc-auth/identities/{identityId}:
    post:
      operationId: attachOidcAuth
      tags:
      - OIDC Auth
      description: Attach OIDC Auth configuration onto machine identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                oidcDiscoveryUrl:
                  type: string
                  format: uri
                  minLength: 1
                  description: The URL used to retrieve the OpenID Connect configuration from the identity provider.
                caCert:
                  type: string
                  default: ''
                  description: The PEM-encoded CA cert for establishing secure communication with the Identity Provider endpoints.
                boundIssuer:
                  type: string
                  minLength: 1
                  description: The unique identifier of the identity provider issuing the JWT.
                boundAudiences:
                  type: string
                  default: ''
                  description: The list of intended recipients.
                boundClaims:
                  type: object
                  additionalProperties:
                    type: string
                  description: The attributes that should be present in the JWT for it to be valid.
                claimMetadataMapping:
                  type: object
                  additionalProperties:
                    type: string
                  description: The attributes that should be present in the permission metadata from the JWT.
                boundSubject:
                  type: string
                  default: ''
                  description: The expected principal that is the subject of the JWT.
                accessTokenTrustedIps:
                  type: array
                  items:
                    type: object
                    properties:
                      ipAddress:
                        type: string
                    required:
                    - ipAddress
                    additionalProperties: false
                  minItems: 1
                  default:
                  - ipAddress: 0.0.0.0/0
                  - ipAddress: ::/0
                  description: The IPs or CIDR ranges that access tokens can be used from.
                accessTokenTTL:
                  type: integer
                  minimum: 0
                  maximum: 315360000
                  default: 2592000
                  description: The lifetime for an access token in seconds.
                accessTokenMaxTTL:
                  type: integer
                  minimum: 0
                  maximum: 315360000
                  default: 2592000
                  description: The maximum lifetime for an access token in seconds.
                accessTokenNumUsesLimit:
                  type: integer
                  minimum: 0
                  default: 0
                  description: The maximum number of times that an access token can be used.
              required:
              - oidcDiscoveryUrl
              - boundIssuer
              - boundClaims
              additionalProperties: false
      parameters:
      - schema:
          type: string
        in: path
        name: identityId
        required: true
        description: The ID of the machine identity to attach the configuration onto.
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  identityOidcAuth:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
                      accessTokenTTL:
                        type: number
                        default: 7200
                      accessTokenMaxTTL:
                        type: number
                        default: 7200
                      accessTokenNumUsesLimit:
                        type: number
                        default: 0
                      accessTokenTrustedIps: {}
                      identityId:
                        type: string
                        format: uuid
                      oidcDiscoveryUrl:
                        type: string
                      boundIssuer:
                        type: string
                      boundAudiences:
                        type: string
                      boundClaims: {}
                      claimMetadataMapping:
                        nullable: true
                      boundSubject:
                        type: string
                        nullable: true
                      createdAt:
                        type: string
                        format: date-time
                      updatedAt:
                        type: string
                        format: date-time
                      caCert:
                        type: string
                    required:
                    - id
                    - identityId
                    - oidcDiscoveryUrl
                    - boundIssuer
                    - boundAudiences
                    - createdAt
                    - updatedAt
                    - caCert
                    additionalProperties: false
                required:
                - identityOidcAuth
                additionalProperties: false
        '400':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 400
                  message:
                    type: string
                  error:
                    type: string
                  details: {}
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '401':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 401
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '403':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 403
                  message:
                    type: string
                  details: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '404':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 404
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '422':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 422
                  message: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - error
                additionalProperties: false
        '500':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 500
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
    patch:
      operationId: updateOidcAuth
      tags:
      - OIDC Auth
      description: Update OIDC Auth configuration on machine identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                oidcDiscoveryUrl:
                  type: string
                  format: uri
                  minLength: 1
                  description: The new URL used to retrieve the OpenID Connect configuration from the identity provider.
                caCert:
                  type: string
                  default: ''
                  description: The new PEM-encoded CA cert for establishing secure communication with the Identity Provider endpoints.
                boundIssuer:
                  type: string
                  minLength: 1
                  description: The new unique identifier of the identity provider issuing the JWT.
                boundAudiences:
                  type: string
                  default: ''
                  description: The new list of intended recipients.
                boundClaims:
                  type: object
                  additionalProperties:
                    type: string
                  description: The new attributes that should be present in the JWT for it to be valid.
                claimMetadataMapping:
                  type: object
                  additionalProperties:
                    type: string
                  description: The new attributes that should be present in the permission metadata from the JWT.
                boundSubject:
                  type: string
                  default: ''
                  description: The new expected principal that is the subject of the JWT.
                accessTokenTrustedIps:
                  type: array
                  items:
                    type: object
                    properties:
                      ipAddress:
                        type: string
                    required:
                    - ipAddress
                    additionalProperties: false
                  minItems: 1
                  default:
                  - ipAddress: 0.0.0.0/0
                  - ipAddress: ::/0
                  description: The new IPs or CIDR ranges that access tokens can be used from.
                accessTokenTTL:
                  type: integer
                  minimum: 0
                  maximum: 315360000
                  default: 2592000
                  description: The new lifetime for an access token in seconds.
                accessTokenMaxTTL:
                  type: integer
                  minimum: 0
                  maximum: 315360000
                  default: 2592000
                  description: The new maximum lifetime for an access token in seconds.
                accessTokenNumUsesLimit:
                  type: integer
                  minimum: 0
                  default: 0
                  description: The new maximum number of times that an access token can be used.
              additionalProperties: false
      parameters:
      - schema:
          type: string
        in: path
        name: identityId
        required: true
        description: The ID of the machine identity to update the auth method for.
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  identityOidcAuth:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
                      accessTokenTTL:
                        type: number
                        default: 7200
                      accessTokenMaxTTL:
                        type: number
                        default: 7200
                      accessTokenNumUsesLimit:
                        type: number
                        default: 0
                      accessTokenTrustedIps: {}
                      identityId:
                        type: string
                        format: uuid
                      oidcDiscoveryUrl:
                        type: string
                      boundIssuer:
                        type: string
                      boundAudiences:
                        type: string
                      boundClaims: {}
                      claimMetadataMapping:
                        nullable: true
                      boundSubject:
                        type: string
                        nullable: true
                      createdAt:
                        type: string
                        format: date-time
                      updatedAt:
                        type: string
                        format: date-time
                      caCert:
                        type: string
                    required:
                    - id
                    - identityId
                    - oidcDiscoveryUrl
                    - boundIssuer
                    - boundAudiences
                    - createdAt
                    - updatedAt
                    - caCert
                    additionalProperties: false
                required:
                - identityOidcAuth
                additionalProperties: false
        '400':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 400
                  message:
                    type: string
                  error:
                    type: string
                  details: {}
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '401':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 401
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '403':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 403
                  message:
                    type: string
                  details: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '404':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 404
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '422':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 422
                  message: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - error
                additionalProperties: false
        '500':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 500
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
    get:
      operationId: getOidcAuth
      tags:
      - OIDC Auth
      description: Retrieve OIDC Auth configuration on machine identity
      parameters:
      - schema:
          type: string
        in: path
        name: identityId
        required: true
        description: The ID of the machine identity to retrieve the auth method for.
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  identityOidcAuth:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
                      accessTokenTTL:
                        type: number
                        default: 7200
                      accessTokenMaxTTL:
                        type: number
                        default: 7200
                      accessTokenNumUsesLimit:
                        type: number
                        default: 0
                      accessTokenTrustedIps: {}
                      identityId:
                        type: string
                        format: uuid
                      oidcDiscoveryUrl:
                        type: string
                      boundIssuer:
                        type: string
                      boundAudiences:
                        type: string
                      boundClaims: {}
                      claimMetadataMapping:
                        nullable: true
                      boundSubject:
                        type: string
                        nullable: true
                      createdAt:
                        type: string
                        format: date-time
                      updatedAt:
                        type: string
                        format: date-time
                      caCert:
                        type: string
                    required:
                    - id
                    - identityId
                    - oidcDiscoveryUrl
                    - boundIssuer
                    - boundAudiences
                    - createdAt
                    - updatedAt
                    - caCert
                    additionalProperties: false
                required:
                - identityOidcAuth
                additionalProperties: false
        '400':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 400
                  message:
                    type: string
                  error:
                    type: string
                  details: {}
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '401':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 401
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '403':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 403
                  message:
                    type: string
                  details: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '404':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 404
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '422':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 422
                  message: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - error
                additionalProperties: false
        '500':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 500
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
    delete:
      operationId: deleteOidcAuth
      tags:
      - OIDC Auth
      description: Delete OIDC Auth configuration on machine identity
      parameters:
      - schema:
          type: string
        in: path
        name: identityId
        required: true
        description: The ID of the machine identity to revoke the auth method for.
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  identityOidcAuth:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
                      accessTokenTTL:
                        type: number
                        default: 7200
                      accessTokenMaxTTL:
                        type: number
                        default: 7200
                      accessTokenNumUsesLimit:
                        type: number
                        default: 0
                      accessTokenTrustedIps: {}
                      identityId:
                        type: string
                        format: uuid
                      oidcDiscoveryUrl:
                        type: string
                      boundIssuer:
                        type: string
                      boundAudiences:
                        type: string
                      boundClaims: {}
                      claimMetadataMapping:
                        nullable: true
                      boundSubject:
                        type: string
                        nullable: true
                      createdAt:
                        type: string
                        format: date-time
                      updatedAt:
                        type: string
                        format: date-time
                    required:
                    - id
                    - identityId
                    - oidcDiscoveryUrl
                    - boundIssuer
                    - boundAudiences
                    - createdAt
                    - updatedAt
                    additionalProperties: false
                required:
                - identityOidcAuth
                additionalProperties: false
        '400':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 400
                  message:
                    type: string
                  error:
                    type: string
                  details: {}
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '401':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 401
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '403':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 403
                  message:
                    type: string
                  details: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '404':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 404
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
        '422':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 422
                  message: {}
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - error
                additionalProperties: false
        '500':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  reqId:
                    type: string
                  statusCode:
                    type: number
                    enum:
                    - 500
                  message:
                    type: string
                  error:
                    type: string
                required:
                - reqId
                - statusCode
                - message
                - error
                additionalProperties: false
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: An access token in Infisical