openapi: 3.2.0
info:
  title: Login.gov OpenID Connect User Info API
  version: 2026-01
  description: Login.gov is the U.S.
  contact:
    name: Login.gov Partner Support
    url: https://developers.login.gov
    email: partners@login.gov
  license:
    name: Public Domain (U.S. Government Work)
    url: https://www.usa.gov/government-works
servers:
- url: https://idp.int.identitysandbox.gov
  description: Sandbox (integration) environment
- url: https://secure.login.gov
  description: Production environment
tags:
- name: User Info
  description: User attribute retrieval with a bearer access token.
paths:
  /api/openid_connect/userinfo:
    get:
      tags:
      - User Info
      summary: Get Authenticated User Attributes
      operationId: getUserInfo
      description: Returns user attributes consented to during authorization. Requires a bearer `access_token`.
      security:
      - bearerAuth: []
      responses:
        '200':
          description: User attributes.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfo'
        '401':
          description: Invalid or expired access token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Address:
      type: object
      properties:
        formatted:
          type: string
        street_address:
          type: string
        locality:
          type: string
        region:
          type: string
        postal_code:
          type: string
        country:
          type: string
    UserInfo:
      type: object
      properties:
        sub:
          type: string
          description: Stable per-RP user UUID v4.
        iss:
          type: string
          format: uri
        email:
          type: string
          format: email
        email_verified:
          type: boolean
        all_emails:
          type: array
          items:
            type: string
            format: email
        locale:
          type: string
        ial:
          type: string
          description: Identity assurance level granted (e.g. `http://idmanagement.gov/ns/assurance/ial/1`).
        aal:
          type: string
          description: Authenticator assurance level granted.
        given_name:
          type: string
          description: Available at IAL2.
        family_name:
          type: string
          description: Available at IAL2.
        address:
          $ref: '#/components/schemas/Address'
        phone:
          type: string
          description: E.164 phone number. Available at IAL2.
        phone_verified:
          type: boolean
        birthdate:
          type: string
          format: date
          description: Available at IAL2.
        social_security_number:
          type: string
          description: Available at IAL2 with the `social_security_number` scope; SSN may be unmasked or last-4 depending on configuration.
        verified_at:
          type: integer
          description: Unix timestamp when the user's identity was verified. Null if never verified.
        x509_subject:
          type: string
        x509_issuer:
          type: string
        x509_presented:
          type: boolean
    Error:
      type: object
      properties:
        error:
          type: string
        error_description:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: opaque