openapi: 3.2.0 info: title: NUS Identity Provider API (vafs.nus.edu.sg) Discovery API version: '2026-08-19' description: "The National University of Singapore operates its own federated identity service at\n`vafs.nus.edu.sg` (\"NUS VAFS\" — the university's Active Directory Federation Services\ndeployment). It is the one substantial machine-readable, institution-operated API surface\nNUS publishes to the open internet, and it is the front door to essentially every gated\nNUS system.\n\nThe host is unambiguously NUS's own engineering, not a vendor's:\n\n * `vafs.nus.edu.sg` resolves inside NUS's own address space (137.132.21.18).\n * Its TLS certificate is an Extended Validation certificate issued to\n `jurisdictionC=SG, businessCategory=Private Organization, serialNumber=200604346E,\n O=National University of Singapore, CN=vafs.nus.edu.sg` — NUS is the validated\n organization, not a hosting provider.\n * The SAML entityID it asserts is `https://vafs.nus.edu.sg/adfs/services/trust`.\n\nThis document is DERIVED — every path, parameter, scope and response below was read out of\nthe institution's own live OpenID Connect discovery document at\n`https://vafs.nus.edu.sg/adfs/.well-known/openid-configuration` and its JWKS at\n`https://vafs.nus.edu.sg/adfs/discovery/keys`, both fetched 2026-08-19. NUS does not itself\npublish an OpenAPI description; nothing here is invented, but the OpenAPI packaging is\nAPI Evangelist's, not the university's.\n\nThe service speaks OpenID Connect 1.0 / OAuth 2.0, SAML 2.0, WS-Federation and WS-Trust\nfrom the same endpoint family. The SAML half is described in\n`identity-federation/nus-identity-federation.yml`.\n" contact: name: NUS Information Technology url: https://nusit.nus.edu.sg/ termsOfService: https://nus.edu.sg/ormc/personal-data-protection/nus-privacy-notice x-operator: institution x-operator-evidence: - TLS certificate subject O=National University of Singapore (DigiCert EV RSA CA G2) - A record 137.132.21.18 within NUS-assigned address space - SAML entityID https://vafs.nus.edu.sg/adfs/services/trust x-method: derived x-source: https://vafs.nus.edu.sg/adfs/.well-known/openid-configuration x-generated: '2026-08-19' servers: - url: https://vafs.nus.edu.sg description: NUS federated identity service (production) tags: - name: Discovery description: Machine-readable metadata describing the identity service and its signing keys. paths: /adfs/.well-known/openid-configuration: get: tags: - Discovery operationId: getOpenIdConfiguration summary: OpenID Connect discovery document description: Returns the OpenID Provider metadata for the NUS identity service, per OpenID Connect Discovery 1.0. Publicly readable, no authentication. security: [] responses: '200': description: OpenID Provider metadata. content: application/json: schema: $ref: '#/components/schemas/OpenIdConfiguration' /adfs/discovery/keys: get: tags: - Discovery operationId: getJwks summary: JSON Web Key Set description: Returns the RSA public keys used to verify ID tokens and access tokens issued by this provider (RFC 7517). Publicly readable, no authentication. security: [] responses: '200': description: JWKS document. content: application/json: schema: $ref: '#/components/schemas/Jwks' /FederationMetadata/2007-06/FederationMetadata.xml: get: tags: - Discovery operationId: getFederationMetadata summary: SAML 2.0 / WS-Federation metadata description: Returns the signed SAML 2.0 metadata document for entityID `https://vafs.nus.edu.sg/adfs/services/trust`, carrying both an IDPSSODescriptor and an SPSSODescriptor, four SingleLogoutService bindings, and 76 declared claim types. Publicly readable, no authentication. security: [] responses: '200': description: Signed SAML 2.0 EntityDescriptor. content: application/samlmetadata+xml: schema: type: string format: xml components: schemas: Jwks: type: object required: - keys properties: keys: type: array items: type: object required: - kty - use - alg - kid - n - e properties: kty: type: string example: RSA use: type: string example: sig alg: type: string example: RS256 kid: type: string x5t: type: string n: type: string description: RSA modulus base64url.: null e: type: string example: AQAB x5c: type: array items: type: string OpenIdConfiguration: type: object description: OpenID Provider metadata as returned by the live NUS discovery endpoint. required: - issuer - authorization_endpoint - token_endpoint - jwks_uri properties: issuer: type: string example: https://vafs.nus.edu.sg/adfs authorization_endpoint: type: string example: https://vafs.nus.edu.sg/adfs/oauth2/authorize/ token_endpoint: type: string example: https://vafs.nus.edu.sg/adfs/oauth2/token/ jwks_uri: type: string example: https://vafs.nus.edu.sg/adfs/discovery/keys userinfo_endpoint: type: string example: https://vafs.nus.edu.sg/adfs/userinfo end_session_endpoint: type: string example: https://vafs.nus.edu.sg/adfs/oauth2/logout device_authorization_endpoint: type: string example: https://vafs.nus.edu.sg/adfs/oauth2/devicecode access_token_issuer: type: string example: https://vafs.nus.edu.sg/adfs/services/trust scopes_supported: type: array items: type: string response_types_supported: type: array items: type: string grant_types_supported: type: array items: type: string subject_types_supported: type: array items: type: string enum: - pairwise id_token_signing_alg_values_supported: type: array items: type: string token_endpoint_auth_methods_supported: type: array items: type: string claims_supported: type: array items: type: string frontchannel_logout_supported: type: boolean frontchannel_logout_session_supported: type: boolean securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT clientSecretBasic: type: http scheme: basic description: client_secret_basic client authentication. clientSecretPost: type: apiKey in: header name: Authorization description: Placeholder for client_secret_post; the provider also advertises private_key_jwt and windows_client_authentication. oidc: type: openIdConnect openIdConnectUrl: https://vafs.nus.edu.sg/adfs/.well-known/openid-configuration