openapi: 3.0.3
info:
  contact:
    email: hi@ory.sh
  description: 'Documentation for all of Ory Hydra''s APIs.

    '
  license:
    name: Apache 2.0
  title: Ory Hydra api jwk API
  version: ''
tags:
- description: JSON Web Keys
  name: jwk
paths:
  /admin/keys/{set}:
    delete:
      description: 'Use this endpoint to delete a complete JSON Web Key Set and all the keys in that set.


        A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
      operationId: deleteJsonWebKeySet
      parameters:
      - description: The JSON Web Key Set
        in: path
        name: set
        required: true
        schema:
          type: string
      responses:
        '204':
          $ref: '#/components/responses/emptyResponse'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errorOAuth2'
          description: errorOAuth2
      summary: Delete JSON Web Key Set
      tags:
      - jwk
      x-ory-ratelimit-bucket: hydra-admin-low
    get:
      description: 'This endpoint can be used to retrieve JWK Sets stored in ORY Hydra.


        A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
      operationId: getJsonWebKeySet
      parameters:
      - description: JSON Web Key Set ID
        in: path
        name: set
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonWebKeySet'
          description: jsonWebKeySet
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errorOAuth2'
          description: errorOAuth2
      summary: Retrieve a JSON Web Key Set
      tags:
      - jwk
      x-ory-ratelimit-bucket: hydra-admin-medium
    post:
      description: 'This endpoint is capable of generating JSON Web Key Sets for you. There are different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymmetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.


        A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
      operationId: createJsonWebKeySet
      parameters:
      - description: The JSON Web Key Set ID
        in: path
        name: set
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/createJsonWebKeySet'
        required: true
        x-originalParamName: Body
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonWebKeySet'
          description: jsonWebKeySet
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errorOAuth2'
          description: errorOAuth2
      summary: Create JSON Web Key
      tags:
      - jwk
      x-ory-ratelimit-bucket: hydra-admin-low
    put:
      description: 'Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.


        A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
      operationId: setJsonWebKeySet
      parameters:
      - description: The JSON Web Key Set ID
        in: path
        name: set
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonWebKeySet'
        x-originalParamName: Body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonWebKeySet'
          description: jsonWebKeySet
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errorOAuth2'
          description: errorOAuth2
      summary: Update a JSON Web Key Set
      tags:
      - jwk
      x-ory-ratelimit-bucket: hydra-admin-low
  /admin/keys/{set}/{kid}:
    delete:
      description: 'Use this endpoint to delete a single JSON Web Key.


        A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A

        JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses

        this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens),

        and allows storing user-defined keys as well.'
      operationId: deleteJsonWebKey
      parameters:
      - description: The JSON Web Key Set
        in: path
        name: set
        required: true
        schema:
          type: string
      - description: The JSON Web Key ID (kid)
        in: path
        name: kid
        required: true
        schema:
          type: string
      responses:
        '204':
          $ref: '#/components/responses/emptyResponse'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errorOAuth2'
          description: errorOAuth2
      summary: Delete JSON Web Key
      tags:
      - jwk
      x-ory-ratelimit-bucket: hydra-admin-low
    get:
      description: This endpoint returns a singular JSON Web Key contained in a set. It is identified by the set and the specific key ID (kid).
      operationId: getJsonWebKey
      parameters:
      - description: JSON Web Key Set ID
        in: path
        name: set
        required: true
        schema:
          type: string
      - description: JSON Web Key ID
        in: path
        name: kid
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonWebKeySet'
          description: jsonWebKeySet
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errorOAuth2'
          description: errorOAuth2
      summary: Get JSON Web Key
      tags:
      - jwk
      x-ory-ratelimit-bucket: hydra-admin-medium
    put:
      description: 'Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.


        A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
      operationId: setJsonWebKey
      parameters:
      - description: The JSON Web Key Set ID
        in: path
        name: set
        required: true
        schema:
          type: string
      - description: JSON Web Key ID
        in: path
        name: kid
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/jsonWebKey'
        x-originalParamName: Body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jsonWebKey'
          description: jsonWebKey
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/errorOAuth2'
          description: errorOAuth2
      summary: Set JSON Web Key
      tags:
      - jwk
      x-ory-ratelimit-bucket: hydra-admin-low
components:
  schemas:
    jsonWebKeySet:
      description: JSON Web Key Set
      properties:
        keys:
          description: 'List of JSON Web Keys


            The value of the "keys" parameter is an array of JSON Web Key (JWK)

            values. By default, the order of the JWK values within the array does

            not imply an order of preference among them, although applications

            of JWK Sets can choose to assign a meaning to the order for their

            purposes, if desired.'
          items:
            $ref: '#/components/schemas/jsonWebKey'
          type: array
      type: object
    jsonWebKey:
      properties:
        alg:
          description: 'The "alg" (algorithm) parameter identifies the algorithm intended for

            use with the key.  The values used should either be registered in the

            IANA "JSON Web Signature and Encryption Algorithms" registry

            established by [JWA] or be a value that contains a Collision-

            Resistant Name.'
          example: RS256
          type: string
        crv:
          example: P-256
          type: string
        d:
          example: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE
          type: string
        dp:
          example: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0
          type: string
        dq:
          example: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk
          type: string
        e:
          example: AQAB
          type: string
        k:
          example: GawgguFyGrWKav7AX4VKUg
          type: string
        kid:
          description: 'The "kid" (key ID) parameter is used to match a specific key.  This

            is used, for instance, to choose among a set of keys within a JWK Set

            during key rollover.  The structure of the "kid" value is

            unspecified.  When "kid" values are used within a JWK Set, different

            keys within the JWK Set SHOULD use distinct "kid" values.  (One

            example in which different keys might use the same "kid" value is if

            they have different "kty" (key type) values but are considered to be

            equivalent alternatives by the application using them.)  The "kid"

            value is a case-sensitive string.'
          example: 1603dfe0af8f4596
          type: string
        kty:
          description: 'The "kty" (key type) parameter identifies the cryptographic algorithm

            family used with the key, such as "RSA" or "EC". "kty" values should

            either be registered in the IANA "JSON Web Key Types" registry

            established by [JWA] or be a value that contains a Collision-

            Resistant Name.  The "kty" value is a case-sensitive string.'
          example: RSA
          type: string
        n:
          example: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0
          type: string
        p:
          example: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ
          type: string
        q:
          example: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ
          type: string
        qi:
          example: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU
          type: string
        use:
          description: 'Use ("public key use") identifies the intended use of

            the public key. The "use" parameter is employed to indicate whether

            a public key is used for encrypting data or verifying the signature

            on data. Values are commonly "sig" (signature) or "enc" (encryption).'
          example: sig
          type: string
        x:
          example: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU
          type: string
        x5c:
          description: 'The "x5c" (X.509 certificate chain) parameter contains a chain of one

            or more PKIX certificates [RFC5280].  The certificate chain is

            represented as a JSON array of certificate value strings.  Each

            string in the array is a base64-encoded (Section 4 of [RFC4648] --

            not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value.

            The PKIX certificate containing the key value MUST be the first

            certificate.'
          items:
            type: string
          type: array
        y:
          example: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0
          type: string
      required:
      - use
      - kty
      - kid
      - alg
      type: object
    createJsonWebKeySet:
      description: Create JSON Web Key Set Request Body
      properties:
        alg:
          description: 'JSON Web Key Algorithm


            The algorithm to be used for creating the key. Supports `RS256`, `ES256`, `ES512`, `HS512`, and `HS256`.'
          type: string
        kid:
          description: 'JSON Web Key ID


            The Key ID of the key to be created.'
          type: string
        use:
          description: 'JSON Web Key Use


            The "use" (public key use) parameter identifies the intended use of

            the public key. The "use" parameter is employed to indicate whether

            a public key is used for encrypting data or verifying the signature

            on data. Valid values are "enc" and "sig".'
          type: string
      required:
      - alg
      - use
      - kid
      type: object
    errorOAuth2:
      description: Error
      properties:
        error:
          description: Error
          type: string
        error_debug:
          description: 'Error Debug Information


            Only available in dev mode.'
          type: string
        error_description:
          description: Error Description
          type: string
        error_hint:
          description: 'Error Hint


            Helps the user identify the error cause.'
          example: The redirect URL is not allowed.
          type: string
        status_code:
          description: HTTP Status Code
          example: 401
          format: int64
          type: integer
      type: object
  responses:
    emptyResponse:
      description: 'Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is

        typically 204.'
  securitySchemes:
    basic:
      scheme: basic
      type: http
    bearer:
      scheme: bearer
      type: http
    oauth2:
      flows:
        authorizationCode:
          authorizationUrl: https://hydra.demo.ory.sh/oauth2/auth
          scopes:
            offline: A scope required when requesting refresh tokens (alias for `offline_access`)
            offline_access: A scope required when requesting refresh tokens
            openid: Request an OpenID Connect ID Token
          tokenUrl: https://hydra.demo.ory.sh/oauth2/token
      type: oauth2
x-forwarded-proto: string
x-request-id: string