openapi: 3.0.3 info: contact: email: hi@ory.sh description: 'Documentation for all of Ory Hydra''s APIs. ' license: name: Apache 2.0 title: Ory Hydra api oAuth2 API version: '' tags: - description: OAuth 2.0 name: oAuth2 paths: /admin/clients: get: description: 'This endpoint lists all clients in the database, and never returns client secrets. As a default it lists the first 100 clients.' operationId: listOAuth2Clients parameters: - description: 'Items per Page This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).' in: query name: page_size schema: default: 250 format: int64 maximum: 1000 minimum: 1 type: integer - description: 'Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).' in: query name: page_token schema: type: string - description: The name of the clients to filter by. in: query name: client_name schema: type: string - description: The owner of the clients to filter by. in: query name: owner schema: type: string responses: '200': $ref: '#/components/responses/listOAuth2Clients' default: $ref: '#/components/responses/errorOAuth2Default' summary: List OAuth 2.0 Clients tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-medium post: description: 'Create a new OAuth 2.0 client. If you pass `client_secret` the secret is used, otherwise a random secret is generated. The secret is echoed in the response. It is not possible to retrieve it later on.' operationId: createOAuth2Client requestBody: content: application/json: schema: $ref: '#/components/schemas/oAuth2Client' description: OAuth 2.0 Client Request Body required: true x-originalParamName: Body responses: '201': content: application/json: schema: $ref: '#/components/schemas/oAuth2Client' description: oAuth2Client '400': $ref: '#/components/responses/errorOAuth2BadRequest' default: $ref: '#/components/responses/errorOAuth2Default' summary: Create OAuth 2.0 Client tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low /admin/clients/{id}: delete: description: 'Delete an existing OAuth 2.0 Client by its ID. OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. Make sure that this endpoint is well protected and only callable by first-party components.' operationId: deleteOAuth2Client parameters: - description: The id of the OAuth 2.0 Client. in: path name: id required: true schema: type: string responses: '204': $ref: '#/components/responses/emptyResponse' default: content: application/json: schema: $ref: '#/components/schemas/genericError' description: genericError summary: Delete OAuth 2.0 Client tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low get: description: 'Get an OAuth 2.0 client by its ID. This endpoint never returns the client secret. OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.' operationId: getOAuth2Client parameters: - description: The id of the OAuth 2.0 Client. in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2Client' description: oAuth2Client default: $ref: '#/components/responses/errorOAuth2Default' summary: Get an OAuth 2.0 Client tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high patch: description: 'Patch an existing OAuth 2.0 Client using JSON Patch. If you pass `client_secret` the secret will be updated and returned via the API. This is the only time you will be able to retrieve the client secret, so write it down and keep it safe. OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.' operationId: patchOAuth2Client parameters: - description: The id of the OAuth 2.0 Client. in: path name: id required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/jsonPatchDocument' description: OAuth 2.0 Client JSON Patch Body required: true x-originalParamName: Body responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2Client' description: oAuth2Client '404': $ref: '#/components/responses/errorOAuth2NotFound' default: $ref: '#/components/responses/errorOAuth2Default' summary: Patch OAuth 2.0 Client tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low put: description: 'Replaces an existing OAuth 2.0 Client with the payload you send. If you pass `client_secret` the secret is used, otherwise the existing secret is used. If set, the secret is echoed in the response. It is not possible to retrieve it later on. OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.' operationId: setOAuth2Client parameters: - description: OAuth 2.0 Client ID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/oAuth2Client' description: OAuth 2.0 Client Request Body required: true x-originalParamName: Body responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2Client' description: oAuth2Client '400': $ref: '#/components/responses/errorOAuth2BadRequest' '404': $ref: '#/components/responses/errorOAuth2NotFound' default: $ref: '#/components/responses/errorOAuth2Default' summary: Set OAuth 2.0 Client tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low /admin/clients/{id}/lifespans: put: description: Set lifespans of different token types issued for this OAuth 2.0 client. Does not modify other fields. operationId: setOAuth2ClientLifespans parameters: - description: OAuth 2.0 Client ID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/oAuth2ClientTokenLifespans' x-originalParamName: Body responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2Client' description: oAuth2Client default: content: application/json: schema: $ref: '#/components/schemas/genericError' description: genericError summary: Set OAuth2 Client Token Lifespans tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low /admin/oauth2/auth/requests/consent: get: description: 'When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell Ory now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject''s behalf. The consent challenge is appended to the consent provider''s URL to which the subject''s user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells Ory if the subject accepted or rejected the request. The default consent provider is available via the Ory Managed Account Experience. To customize the consent provider, please head over to the OAuth 2.0 documentation.' operationId: getOAuth2ConsentRequest parameters: - description: OAuth 2.0 Consent Request Challenge in: query name: consent_challenge required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2ConsentRequest' description: oAuth2ConsentRequest '410': content: application/json: schema: $ref: '#/components/schemas/oAuth2RedirectTo' description: oAuth2RedirectTo default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Get OAuth 2.0 Consent Request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/requests/consent/accept: put: description: 'When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell Ory now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject''s behalf. The consent challenge is appended to the consent provider''s URL to which the subject''s user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells Ory if the subject accepted or rejected the request. This endpoint tells Ory that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider includes additional information, such as session data for access and ID tokens, and if the consent request should be used as basis for future requests. The response contains a redirect URL which the consent provider should redirect the user-agent to. The default consent provider is available via the Ory Managed Account Experience. To customize the consent provider, please head over to the OAuth 2.0 documentation.' operationId: acceptOAuth2ConsentRequest parameters: - description: OAuth 2.0 Consent Request Challenge in: query name: consent_challenge required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/acceptOAuth2ConsentRequest' x-originalParamName: Body responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2RedirectTo' description: oAuth2RedirectTo default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Accept OAuth 2.0 Consent Request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/requests/consent/reject: put: description: 'When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell Ory now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject''s behalf. The consent challenge is appended to the consent provider''s URL to which the subject''s user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells Ory if the subject accepted or rejected the request. This endpoint tells Ory that the subject has not authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider must include a reason why the consent was not granted. The response contains a redirect URL which the consent provider should redirect the user-agent to. The default consent provider is available via the Ory Managed Account Experience. To customize the consent provider, please head over to the OAuth 2.0 documentation.' operationId: rejectOAuth2ConsentRequest parameters: - description: OAuth 2.0 Consent Request Challenge in: query name: consent_challenge required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/rejectOAuth2Request' x-originalParamName: Body responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2RedirectTo' description: oAuth2RedirectTo default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Reject OAuth 2.0 Consent Request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/requests/device/accept: put: description: Accepts a device grant user_code request operationId: acceptUserCodeRequest parameters: - in: query name: device_challenge required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/acceptDeviceUserCodeRequest' x-originalParamName: Body responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2RedirectTo' description: oAuth2RedirectTo default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Accepts a device grant user_code request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/requests/login: get: description: 'When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service about it. Per default, the login provider is Ory itself. You may use a different login provider which needs to be a web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner"). The authentication challenge is appended to the login provider URL to which the subject''s user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.' operationId: getOAuth2LoginRequest parameters: - description: OAuth 2.0 Login Request Challenge in: query name: login_challenge required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2LoginRequest' description: oAuth2LoginRequest '410': content: application/json: schema: $ref: '#/components/schemas/oAuth2RedirectTo' description: oAuth2RedirectTo default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Get OAuth 2.0 Login Request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/requests/login/accept: put: description: 'When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service about it. The authentication challenge is appended to the login provider URL to which the subject''s user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process. This endpoint tells Ory that the subject has successfully authenticated and includes additional information such as the subject''s ID and if Ory should remember the subject''s subject agent for future authentication attempts by setting a cookie. The response contains a redirect URL which the login provider should redirect the user-agent to.' operationId: acceptOAuth2LoginRequest parameters: - description: OAuth 2.0 Login Request Challenge in: query name: login_challenge required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/acceptOAuth2LoginRequest' x-originalParamName: Body responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2RedirectTo' description: oAuth2RedirectTo default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Accept OAuth 2.0 Login Request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/requests/login/reject: put: description: 'When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service about it. The authentication challenge is appended to the login provider URL to which the subject''s user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process. This endpoint tells Ory that the subject has not authenticated and includes a reason why the authentication was denied. The response contains a redirect URL which the login provider should redirect the user-agent to.' operationId: rejectOAuth2LoginRequest parameters: - description: OAuth 2.0 Login Request Challenge in: query name: login_challenge required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/rejectOAuth2Request' x-originalParamName: Body responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2RedirectTo' description: oAuth2RedirectTo default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Reject OAuth 2.0 Login Request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/requests/logout: get: description: Use this endpoint to fetch an Ory OAuth 2.0 logout request. operationId: getOAuth2LogoutRequest parameters: - in: query name: logout_challenge required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2LogoutRequest' description: oAuth2LogoutRequest '410': content: application/json: schema: $ref: '#/components/schemas/oAuth2RedirectTo' description: oAuth2RedirectTo default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Get OAuth 2.0 Session Logout Request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/requests/logout/accept: put: description: 'When a user or an application requests Ory OAuth 2.0 to remove the session state of a subject, this endpoint is used to confirm that logout request. The response contains a redirect URL which the consent provider should redirect the user-agent to.' operationId: acceptOAuth2LogoutRequest parameters: - description: OAuth 2.0 Logout Request Challenge in: query name: logout_challenge required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2RedirectTo' description: oAuth2RedirectTo default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Accept OAuth 2.0 Session Logout Request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/requests/logout/reject: put: description: 'When a user or an application requests Ory OAuth 2.0 to remove the session state of a subject, this endpoint is used to deny that logout request. No HTTP request body is required. The response is empty as the logout provider has to chose what action to perform next.' operationId: rejectOAuth2LogoutRequest parameters: - in: query name: logout_challenge required: true schema: type: string responses: '204': $ref: '#/components/responses/emptyResponse' default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Reject OAuth 2.0 Session Logout Request tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/sessions/consent: delete: description: 'This endpoint revokes a subject''s granted consent sessions and invalidates all associated OAuth 2.0 Access Tokens. You may also only revoke sessions for a specific OAuth 2.0 Client ID.' operationId: revokeOAuth2ConsentSessions parameters: - description: 'OAuth 2.0 Consent Subject The subject whose consent sessions should be deleted.' in: query name: subject schema: type: string - description: 'OAuth 2.0 Client ID If set, deletes only those consent sessions that have been granted to the specified OAuth 2.0 Client ID.' in: query name: client schema: type: string - description: 'Consent Request ID If set, revoke all token chains derived from this particular consent request ID.' in: query name: consent_request_id schema: type: string - description: 'Revoke All Consent Sessions If set to `true` deletes all consent sessions by the Subject that have been granted.' in: query name: all schema: type: boolean responses: '204': $ref: '#/components/responses/emptyResponse' default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Revoke OAuth 2.0 Consent Sessions of a Subject tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low get: description: 'This endpoint lists all subject''s granted consent sessions, including client and granted scope. If the subject is unknown or has not granted any consent sessions yet, the endpoint returns an empty JSON array with status code 200 OK.' operationId: listOAuth2ConsentSessions parameters: - description: 'Items per Page This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).' in: query name: page_size schema: default: 250 format: int64 maximum: 500 minimum: 1 type: integer - description: 'Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).' in: query name: page_token schema: type: string - description: The subject to list the consent sessions for. in: query name: subject required: true schema: type: string - description: The login session id to list the consent sessions for. in: query name: login_session_id schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2ConsentSessions' description: oAuth2ConsentSessions default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: List OAuth 2.0 Consent Sessions of a Subject tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/auth/sessions/login: delete: description: 'This endpoint invalidates authentication sessions. After revoking the authentication session(s), the subject has to re-authenticate at the Ory OAuth2 Provider. This endpoint does not invalidate any tokens. If you send the subject in a query param, all authentication sessions that belong to that subject are revoked. No OpenID Connect Front- or Back-channel logout is performed in this case. Alternatively, you can send a SessionID via `sid` query param, in which case, only the session that is connected to that SessionID is revoked. OpenID Connect Back-channel logout is performed in this case. When using Ory for the identity provider, the login provider will also invalidate the session cookie.' operationId: revokeOAuth2LoginSessions parameters: - description: 'OAuth 2.0 Subject The subject to revoke authentication sessions for.' in: query name: subject schema: type: string - description: 'Login Session ID The login session to revoke.' in: query name: sid schema: type: string responses: '204': $ref: '#/components/responses/emptyResponse' default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Revokes OAuth 2.0 Login Sessions by either a Subject or a SessionID tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low /admin/oauth2/introspect: post: description: 'The introspection endpoint allows to check if a token (both refresh and access) is active or not. An active token is neither expired nor revoked. If a token is active, additional information on the token will be included. You can set additional data for a token by setting `session.access_token` during the consent flow.' operationId: introspectOAuth2Token requestBody: content: application/x-www-form-urlencoded: schema: properties: scope: description: 'An optional, space separated list of required scopes. If the access token was not granted one of the scopes, the result of active will be false.' type: string x-formData-name: scope token: description: 'The string value of the token. For access tokens, this is the "access_token" value returned from the token endpoint defined in OAuth 2.0. For refresh tokens, this is the "refresh_token" value returned.' required: - token type: string x-formData-name: token required: - token type: object responses: '200': content: application/json: schema: $ref: '#/components/schemas/introspectedOAuth2Token' description: introspectedOAuth2Token default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Introspect OAuth2 Access and Refresh Tokens tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /admin/oauth2/tokens: delete: description: This endpoint deletes OAuth2 access tokens issued to an OAuth 2.0 Client from the database. operationId: deleteOAuth2Token parameters: - description: OAuth 2.0 Client ID in: query name: client_id required: true schema: type: string responses: '204': $ref: '#/components/responses/emptyResponse' default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: Delete OAuth 2.0 Access Tokens from specific OAuth 2.0 Client tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low /admin/trust/grants/jwt-bearer/issuers: get: description: Use this endpoint to list all trusted JWT Bearer Grant Type Issuers. operationId: listTrustedOAuth2JwtGrantIssuers parameters: - description: 'Items per Page This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).' in: query name: page_size schema: default: 250 format: int64 maximum: 1000 minimum: 1 type: integer - description: 'Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).' in: query name: page_token schema: type: string - description: If optional "issuer" is supplied, only jwt-bearer grants with this issuer will be returned. in: query name: issuer schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/trustedOAuth2JwtGrantIssuers' description: trustedOAuth2JwtGrantIssuers default: content: application/json: schema: $ref: '#/components/schemas/genericError' description: genericError summary: List Trusted OAuth2 JWT Bearer Grant Type Issuers tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-medium post: description: 'Use this endpoint to establish a trust relationship for a JWT issuer to perform JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants [RFC7523](https://datatracker.ietf.org/doc/html/rfc7523).' operationId: trustOAuth2JwtGrantIssuer requestBody: content: application/json: schema: $ref: '#/components/schemas/trustOAuth2JwtGrantIssuer' x-originalParamName: Body responses: '201': content: application/json: schema: $ref: '#/components/schemas/trustedOAuth2JwtGrantIssuer' description: trustedOAuth2JwtGrantIssuer default: content: application/json: schema: $ref: '#/components/schemas/genericError' description: genericError summary: Trust OAuth2 JWT Bearer Grant Type Issuer tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low /admin/trust/grants/jwt-bearer/issuers/{id}: delete: description: 'Use this endpoint to delete trusted JWT Bearer Grant Type Issuer. The ID is the one returned when you created the trust relationship. Once deleted, the associated issuer will no longer be able to perform the JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grant.' operationId: deleteTrustedOAuth2JwtGrantIssuer parameters: - description: The id of the desired grant in: path name: id required: true schema: type: string responses: '204': $ref: '#/components/responses/emptyResponse' default: content: application/json: schema: $ref: '#/components/schemas/genericError' description: genericError summary: Delete Trusted OAuth2 JWT Bearer Grant Type Issuer tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-low get: description: 'Use this endpoint to get a trusted JWT Bearer Grant Type Issuer. The ID is the one returned when you created the trust relationship.' operationId: getTrustedOAuth2JwtGrantIssuer parameters: - description: The id of the desired grant in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/trustedOAuth2JwtGrantIssuer' description: trustedOAuth2JwtGrantIssuer default: content: application/json: schema: $ref: '#/components/schemas/genericError' description: genericError summary: Get Trusted OAuth2 JWT Bearer Grant Type Issuer tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-medium /oauth2/auth: get: description: 'Use open source libraries to perform OAuth 2.0 and OpenID Connect available for any programming language. You can find a list of libraries at https://oauth.net/code/ This endpoint should not be used via the Ory SDK and is only included for technical reasons. Instead, use one of the libraries linked above.' operationId: oAuth2Authorize responses: '302': $ref: '#/components/responses/emptyResponse' default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: OAuth 2.0 Authorize Endpoint tags: - oAuth2 x-ory-ratelimit-bucket: hydra-public-medium /oauth2/device/auth: post: description: 'This endpoint is not documented here because you should never use your own implementation to perform OAuth2 flows. OAuth2 is a very popular protocol and a library for your programming language will exist. To learn more about this flow please refer to the specification: https://tools.ietf.org/html/rfc8628' operationId: oAuth2DeviceFlow responses: '200': content: application/json: schema: $ref: '#/components/schemas/deviceAuthorization' description: deviceAuthorization default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: The OAuth 2.0 Device Authorize Endpoint tags: - oAuth2 x-ory-ratelimit-bucket: hydra-public-high /oauth2/device/verify: get: description: This is the device user verification endpoint. The user is redirected here when trying to log in using the device flow. operationId: performOAuth2DeviceVerificationFlow responses: '302': $ref: '#/components/responses/emptyResponse' default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 summary: OAuth 2.0 Device Verification Endpoint tags: - oAuth2 x-ory-ratelimit-bucket: hydra-admin-high /oauth2/revoke: post: description: 'Revoking a token (both access and refresh) means that the tokens will be invalid. A revoked access token can no longer be used to make access requests, and a revoked refresh token can no longer be used to refresh an access token. Revoking a refresh token also invalidates the access token that was created with it. A token may only be revoked by the client the token was generated for.' operationId: revokeOAuth2Token requestBody: content: application/x-www-form-urlencoded: schema: properties: client_id: type: string x-formData-name: client_id client_secret: type: string x-formData-name: client_secret token: required: - token type: string x-formData-name: token required: - token type: object responses: '200': $ref: '#/components/responses/emptyResponse' default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 security: - basic: [] - oauth2: [] summary: Revoke OAuth 2.0 Access or Refresh Token tags: - oAuth2 x-ory-ratelimit-bucket: hydra-public-medium /oauth2/token: post: description: 'Use open source libraries to perform OAuth 2.0 and OpenID Connect available for any programming language. You can find a list of libraries here https://oauth.net/code/ This endpoint should not be used via the Ory SDK and is only included for technical reasons. Instead, use one of the libraries linked above.' operationId: oauth2TokenExchange requestBody: content: application/x-www-form-urlencoded: schema: properties: client_id: type: string x-formData-name: client_id code: type: string x-formData-name: code grant_type: required: - grant_type type: string x-formData-name: grant_type redirect_uri: type: string x-formData-name: redirect_uri refresh_token: type: string x-formData-name: refresh_token required: - grant_type type: object responses: '200': content: application/json: schema: $ref: '#/components/schemas/oAuth2TokenExchange' description: oAuth2TokenExchange default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: errorOAuth2 security: - basic: [] - oauth2: [] summary: The OAuth 2.0 Token Endpoint tags: - oAuth2 x-ory-ratelimit-bucket: hydra-public-medium components: schemas: oAuth2Client: description: 'OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.' properties: access_token_strategy: description: 'OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see https://www.ory.com/docs/oauth2-oidc/jwt-access-token Setting the strategy here overrides the global setting in `strategies.access_token`.' type: string allowed_cors_origins: description: 'OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server''s CORS origin configuration (`CORS_ALLOWED_ORIGINS`) will be used instead. If this array is set, the allowed origins are appended to the server''s CORS origin configuration. Be aware that environment variable `CORS_ENABLED` MUST be set to `true` for this to work.' items: type: string type: array audience: description: 'OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain API endpoints. The value is a list of URLs. URLs MUST NOT contain whitespaces.' example: https://mydomain.com/api/users, https://mydomain.com/api/posts items: type: string type: array authorization_code_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' authorization_code_grant_id_token_lifespan: $ref: '#/components/schemas/NullDuration' authorization_code_grant_refresh_token_lifespan: $ref: '#/components/schemas/NullDuration' backchannel_logout_session_required: description: 'OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.' type: boolean backchannel_logout_uri: description: 'OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.' type: string client_credentials_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' client_id: description: 'OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated.' type: string client_name: description: 'OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization.' type: string client_secret: description: 'OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost.' type: string client_secret_expires_at: description: 'OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0.' format: int64 type: integer client_uri: description: 'OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion.' type: string contacts: description: 'OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses.' example: help@example.org items: type: string type: array created_at: description: 'OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client''s creation.' format: date-time type: string device_authorization_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' device_authorization_grant_id_token_lifespan: $ref: '#/components/schemas/NullDuration' device_authorization_grant_refresh_token_lifespan: $ref: '#/components/schemas/NullDuration' frontchannel_logout_session_required: description: 'OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session with the OP when the frontchannel_logout_uri is used. If omitted, the default value is false.' type: boolean frontchannel_logout_uri: description: 'OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the request and to determine which of the potentially multiple sessions is to be logged out; if either is included, both MUST be.' type: string grant_types: description: 'OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant: `authorization_code` OpenID Connect Implicit Grant (deprecated!): `implicit` Refresh Token Grant: `refresh_token` OAuth 2.0 Token Exchange: `urn:ietf:params:oauth:grant-type:jwt-bearer` OAuth 2.0 Device Code Grant: `urn:ietf:params:oauth:grant-type:device_code`' items: type: string type: array implicit_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' implicit_grant_id_token_lifespan: $ref: '#/components/schemas/NullDuration' jwks: $ref: '#/components/schemas/jsonWebKeySet' jwks_uri: description: 'OAuth 2.0 Client JSON Web Key Set URL URL for the Client''s JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the Client''s encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key''s intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.' type: string jwt_bearer_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' logo_uri: description: 'OAuth 2.0 Client Logo URI A URL string referencing the client''s logo.' type: string metadata: $ref: '#/components/schemas/JSONRawMessage' owner: description: 'OAuth 2.0 Client Owner Owner is a string identifying the owner of the OAuth 2.0 Client.' type: string policy_uri: description: 'OAuth 2.0 Client Policy URI PolicyURI is a URL string that points to a human-readable privacy policy document that describes how the deployment organization collects, uses, retains, and discloses personal data.' type: string post_logout_redirect_uris: description: 'Allowed Post-Redirect Logout URIs Array of URLs supplied by the RP to which it MAY request that the End-User''s User Agent be redirected using the post_logout_redirect_uri parameter after a logout has been performed.' items: type: string type: array redirect_uris: description: 'OAuth 2.0 Client Redirect URIs RedirectURIs is an array of allowed redirect urls for the client.' example: http://mydomain/oauth/callback items: type: string type: array refresh_token_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' refresh_token_grant_id_token_lifespan: $ref: '#/components/schemas/NullDuration' refresh_token_grant_refresh_token_lifespan: $ref: '#/components/schemas/NullDuration' registration_access_token: description: 'OpenID Connect Dynamic Client Registration Access Token RegistrationAccessToken can be used to update, get, or delete the OAuth2 Client. It is sent when creating a client using Dynamic Client Registration.' type: string registration_client_uri: description: 'OpenID Connect Dynamic Client Registration URL RegistrationClientURI is the URL used to update, get, or delete the OAuth2 Client.' type: string request_object_signing_alg: description: 'OpenID Connect Request Object Signing Algorithm JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects from this Client MUST be rejected, if not signed with this algorithm.' type: string request_uris: description: 'OpenID Connect Request URIs Array of request_uri values that are pre-registered by the RP for use at the OP. Servers MAY cache the contents of the files referenced by these URIs and not retrieve them at the time they are used in a request. OPs can require that request_uri values used be pre-registered with the require_request_uri_registration discovery parameter.' items: type: string type: array response_types: description: 'OAuth 2.0 Client Response Types An array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint. Can be one of: Needed for OpenID Connect Implicit Grant: Returns ID Token to redirect URI: `id_token` Returns Access token redirect URI: `token` Needed for Authorization Code Grant: `code`' items: type: string type: array scope: description: 'OAuth 2.0 Client Scope Scope is a string containing a space-separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens.' example: scope1 scope-2 scope.3 scope:4 type: string sector_identifier_uri: description: 'OpenID Connect Sector Identifier URI URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.' type: string skip_consent: description: 'SkipConsent skips the consent screen for this client. This field can only be set from the admin API.' type: boolean skip_logout_consent: description: 'SkipLogoutConsent skips the logout consent screen for this client. This field can only be set from the admin API.' type: boolean subject_type: description: 'OpenID Connect Subject Type The `subject_types_supported` Discovery parameter contains a list of the supported subject_type values for this server. Valid types include `pairwise` and `public`.' type: string token_endpoint_auth_method: default: client_secret_basic description: 'OAuth 2.0 Token Endpoint Authentication Method Requested Client Authentication method for the Token Endpoint. The options are: `client_secret_basic`: (default) Send `client_id` and `client_secret` as `application/x-www-form-urlencoded` encoded in the HTTP Authorization header. `client_secret_post`: Send `client_id` and `client_secret` as `application/x-www-form-urlencoded` in the HTTP body. `private_key_jwt`: Use JSON Web Tokens to authenticate the client. `none`: Used for public clients (native apps, mobile apps) which can not have secrets.' type: string token_endpoint_auth_signing_alg: description: 'OAuth 2.0 Token Endpoint Signing Algorithm Requested Client Authentication signing algorithm for the Token Endpoint.' type: string tos_uri: description: 'OAuth 2.0 Client Terms of Service URI A URL string pointing to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client.' type: string updated_at: description: 'OAuth 2.0 Client Last Update Date UpdatedAt returns the timestamp of the last update.' format: date-time type: string userinfo_signed_response_alg: description: 'OpenID Connect Request Userinfo Signed Response Algorithm JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT [JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims as a UTF-8 encoded JSON object using the application/json content-type.' type: string title: OAuth 2.0 Client type: object trustOAuth2JwtGrantIssuer: description: Trust OAuth2 JWT Bearer Grant Type Issuer Request Body properties: allow_any_subject: description: The "allow_any_subject" indicates that the issuer is allowed to have any principal as the subject of the JWT. type: boolean expires_at: description: The "expires_at" indicates, when grant will expire, so we will reject assertion from "issuer" targeting "subject". format: date-time type: string issuer: description: The "issuer" identifies the principal that issued the JWT assertion (same as "iss" claim in JWT). example: https://jwt-idp.example.com type: string jwk: $ref: '#/components/schemas/jsonWebKey' scope: description: The "scope" contains list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) example: - openid - offline items: type: string type: array subject: description: The "subject" identifies the principal that is the subject of the JWT. example: mike@example.com type: string required: - issuer - scope - jwk - expires_at type: object oAuth2ConsentRequestOpenIDConnectContext: properties: acr_values: description: 'ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request. It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required. OpenID Connect defines it as follows: > Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a Voluntary Claim by this parameter.' items: type: string type: array display: description: 'Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. The defined values are: page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode. popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over. touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface. wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display. The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display.' type: string id_token_hint_claims: additionalProperties: {} description: 'IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the End-User''s current or past authenticated session with the Client.' type: object login_hint: description: 'LoginHint hints about the login identifier the End-User might use to log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier) and then wants to pass that value as a hint to the discovered authorization service. This value MAY also be a phone number in the format specified for the phone_number Claim. The use of this parameter is optional.' type: string ui_locales: description: 'UILocales is the End-User''id preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested locales are not supported by the OpenID Provider.' items: type: string type: array title: Contains optional information about the OpenID Connect request. type: object jsonPatchDocument: description: A JSONPatchDocument request items: $ref: '#/components/schemas/jsonPatch' type: array genericError: properties: code: description: The status code example: 404 format: int64 type: integer debug: description: 'Debug information This field is often not exposed to protect against leaking sensitive information.' example: SQL field "foo" is not a bool. type: string details: description: Further error details id: description: 'The error ID Useful when trying to identify various errors in application logic.' type: string message: description: 'Error message The error''s message.' example: The resource could not be found type: string reason: description: A human-readable reason for the error example: User with ID 1234 does not exist. type: string request: description: 'The request ID The request ID is often exposed internally in order to trace errors across service architectures. This is often a UUID.' example: d7ef54b1-ec15-46e6-bccb-524b82c035e6 type: string status: description: The status description example: Not Found type: string required: - message type: object acceptOAuth2ConsentRequestSession: properties: access_token: description: 'AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0 Challenge Introspection. If only your services can perform OAuth 2.0 Challenge Introspection, this is usually fine. But if third parties can access that endpoint as well, sensitive data from the session might be exposed to them. Use with care!' id_token: description: 'IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session''id payloads are readable by anyone that has access to the ID Challenge. Use with care!' title: Pass session data to a consent request. type: object oAuth2ConsentSession: description: A completed OAuth 2.0 Consent Session. properties: consent_request: $ref: '#/components/schemas/oAuth2ConsentRequest' consent_request_id: description: ConsentRequestID is the identifier of the consent request that initiated this consent session. type: string context: $ref: '#/components/schemas/JSONRawMessage' grant_access_token_audience: description: 'Audience Granted GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`.' items: type: string type: array grant_scope: description: 'Scope Granted GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`.' items: type: string type: array handled_at: $ref: '#/components/schemas/nullTime' remember: description: 'Remember Consent Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope.' type: boolean remember_for: description: 'Remember Consent For RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the authorization will be remembered indefinitely.' format: int64 type: integer session: $ref: '#/components/schemas/acceptOAuth2ConsentRequestSession' title: OAuth 2.0 Consent Session type: object rejectOAuth2Request: properties: error: description: 'The error should follow the OAuth2 error format (e.g. `invalid_request`, `login_required`). Defaults to `request_denied`.' type: string error_debug: description: 'Debug contains information to help resolve the problem as a developer. Usually not exposed to the public but only in the server logs.' type: string error_description: description: Description of the error in a human readable format. type: string error_hint: description: Hint to help resolve the error. type: string status_code: description: 'Represents the HTTP status code of the error (e.g. 401 or 403) Defaults to 400' format: int64 type: integer title: The request payload used to accept a login or consent request. type: object oAuth2RedirectTo: description: Contains a redirect URL used to complete a login, consent, or logout request. properties: redirect_to: description: RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed. type: string required: - redirect_to title: OAuth 2.0 Redirect Browser To type: object errorOAuth2: description: Error properties: error: description: Error type: string error_debug: description: 'Error Debug Information Only available in dev mode.' type: string error_description: description: Error Description type: string error_hint: description: 'Error Hint Helps the user identify the error cause.' example: The redirect URL is not allowed. type: string status_code: description: HTTP Status Code example: 401 format: int64 type: integer type: object acceptDeviceUserCodeRequest: description: Contains information on an device verification properties: user_code: type: string type: object jsonWebKeySet: description: JSON Web Key Set properties: keys: description: 'List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among them, although applications of JWK Sets can choose to assign a meaning to the order for their purposes, if desired.' items: $ref: '#/components/schemas/jsonWebKey' type: array type: object oAuth2ConsentRequest: properties: acr: description: 'ACR represents the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it to express that, for example, a user authenticated using two factor authentication.' type: string amr: description: 'AMR is the Authentication Methods References value for this authentication session. You can use it to specify the method a user used to authenticate. For example, if the acr indicates a user used two factor authentication, the amr can express they used a software-secured key.' items: type: string type: array challenge: description: Challenge is used to retrieve/accept/deny the consent request. type: string client: $ref: '#/components/schemas/oAuth2Client' consent_request_id: description: ConsentRequestID is the ID of the consent request. type: string context: $ref: '#/components/schemas/JSONRawMessage' login_challenge: description: 'LoginChallenge is the login challenge this consent challenge belongs to. It can be used to associate a login and consent request in the login & consent app.' type: string login_session_id: description: 'LoginSessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false) this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back- channel logout. It''s value can generally be used to associate consecutive login requests by a certain user.' type: string oidc_context: $ref: '#/components/schemas/oAuth2ConsentRequestOpenIDConnectContext' request_url: description: 'RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters.' type: string requested_access_token_audience: description: RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client. items: type: string type: array requested_scope: description: RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client. items: type: string type: array skip: description: 'Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the consent request using the usual API call.' type: boolean subject: description: 'Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client.' type: string required: - challenge title: Contains information on an ongoing consent request. type: object acceptOAuth2ConsentRequest: properties: context: $ref: '#/components/schemas/JSONRawMessage' grant_access_token_audience: description: GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`. items: type: string type: array grant_scope: description: GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`. items: type: string type: array remember: description: 'Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope.' type: boolean remember_for: description: 'RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the authorization will be remembered indefinitely.' format: int64 type: integer session: $ref: '#/components/schemas/acceptOAuth2ConsentRequestSession' title: The request payload used to accept a consent request. type: object oAuth2LoginRequest: properties: challenge: description: ID is the identifier of the login request. type: string client: $ref: '#/components/schemas/oAuth2Client' oidc_context: $ref: '#/components/schemas/oAuth2ConsentRequestOpenIDConnectContext' request_url: description: 'RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters.' type: string requested_access_token_audience: description: RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client. items: type: string type: array requested_scope: description: RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client. items: type: string type: array session_id: description: 'SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false) this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back- channel logout. It''s value can generally be used to associate consecutive login requests by a certain user.' type: string skip: description: 'Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL. This feature allows you to update / set session information.' type: boolean subject: description: 'Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST include this subject type when accepting the login request, or the request will fail.' type: string required: - challenge - skip - subject - client - request_url title: Contains information on an ongoing login request. type: object deviceAuthorization: description: '# Ory''s OAuth 2.0 Device Authorization API' properties: device_code: description: The device verification code. example: ory_dc_smldfksmdfkl.mslkmlkmlk type: string expires_in: description: The lifetime in seconds of the "device_code" and "user_code". example: 16830 format: int64 type: integer interval: description: 'The minimum amount of time in seconds that the client SHOULD wait between polling requests to the token endpoint. If no value is provided, clients MUST use 5 as the default.' example: 5 format: int64 type: integer user_code: description: The end-user verification code. example: AAAAAA type: string verification_uri: description: 'The end-user verification URI on the authorization server. The URI should be short and easy to remember as end users will be asked to manually type it into their user agent.' example: https://auth.ory.sh/tv type: string verification_uri_complete: description: 'A verification URI that includes the "user_code" (or other information with the same function as the "user_code"), which is designed for non-textual transmission.' example: https://auth.ory.sh/tv?user_code=AAAAAA type: string title: OAuth2 Device Flow type: object oAuth2ClientTokenLifespans: description: Lifespans of different token types issued for this OAuth 2.0 Client. properties: authorization_code_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' authorization_code_grant_id_token_lifespan: $ref: '#/components/schemas/NullDuration' authorization_code_grant_refresh_token_lifespan: $ref: '#/components/schemas/NullDuration' client_credentials_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' device_authorization_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' device_authorization_grant_id_token_lifespan: $ref: '#/components/schemas/NullDuration' device_authorization_grant_refresh_token_lifespan: $ref: '#/components/schemas/NullDuration' implicit_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' implicit_grant_id_token_lifespan: $ref: '#/components/schemas/NullDuration' jwt_bearer_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' refresh_token_grant_access_token_lifespan: $ref: '#/components/schemas/NullDuration' refresh_token_grant_id_token_lifespan: $ref: '#/components/schemas/NullDuration' refresh_token_grant_refresh_token_lifespan: $ref: '#/components/schemas/NullDuration' title: OAuth 2.0 Client Token Lifespans type: object trustedOAuth2JwtGrantIssuers: description: OAuth2 JWT Bearer Grant Type Issuer Trust Relationships items: $ref: '#/components/schemas/trustedOAuth2JwtGrantIssuer' type: array oAuth2LogoutRequest: properties: challenge: description: Challenge is the identifier of the logout authentication request. type: string client: $ref: '#/components/schemas/oAuth2Client' expires_at: $ref: '#/components/schemas/nullTime' request_url: description: RequestURL is the original Logout URL requested. type: string requested_at: $ref: '#/components/schemas/nullTime' rp_initiated: description: RPInitiated is set to true if the request was initiated by a Relying Party (RP), also known as an OAuth 2.0 Client. type: boolean sid: description: SessionID is the login session ID that was requested to log out. type: string subject: description: Subject is the user for whom the logout was request. type: string title: Contains information about an ongoing logout request. type: object trustedOAuth2JwtGrantJsonWebKey: description: OAuth2 JWT Bearer Grant Type Issuer Trusted JSON Web Key properties: kid: description: The "key_id" is key unique identifier (same as kid header in jws/jwt). example: 123e4567-e89b-12d3-a456-426655440000 type: string set: description: The "set" is basically a name for a group(set) of keys. Will be the same as "issuer" in grant. example: https://jwt-idp.example.com type: string type: object NullDuration: description: Specify a time duration in milliseconds, seconds, minutes, hours. pattern: ^([0-9]+(ns|us|ms|s|m|h))*$ title: Time duration type: string nullTime: format: date-time title: NullTime implements sql.NullTime functionality. type: string oAuth2TokenExchange: description: OAuth2 Token Exchange Result properties: access_token: description: The access token issued by the authorization server. type: string expires_in: description: 'The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated.' format: int64 type: integer id_token: description: To retrieve a refresh token request the id_token scope. type: string refresh_token: description: 'The refresh token, which can be used to obtain new access tokens. To retrieve it add the scope "offline" to your access token request.' type: string scope: description: The scope of the access token type: string token_type: description: The type of the token issued type: string type: object trustedOAuth2JwtGrantIssuer: description: OAuth2 JWT Bearer Grant Type Issuer Trust Relationship properties: allow_any_subject: description: The "allow_any_subject" indicates that the issuer is allowed to have any principal as the subject of the JWT. type: boolean created_at: description: The "created_at" indicates, when grant was created. format: date-time type: string expires_at: description: The "expires_at" indicates, when grant will expire, so we will reject assertion from "issuer" targeting "subject". format: date-time type: string id: example: 9edc811f-4e28-453c-9b46-4de65f00217f type: string issuer: description: The "issuer" identifies the principal that issued the JWT assertion (same as "iss" claim in JWT). example: https://jwt-idp.example.com type: string public_key: $ref: '#/components/schemas/trustedOAuth2JwtGrantJsonWebKey' scope: description: The "scope" contains list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) example: - openid - offline items: type: string type: array subject: description: The "subject" identifies the principal that is the subject of the JWT. example: mike@example.com type: string type: object introspectedOAuth2Token: description: 'Introspection contains an access token''s session data as specified by [IETF RFC 7662](https://tools.ietf.org/html/rfc7662)' properties: active: description: 'Active is a boolean indicator of whether or not the presented token is currently active. The specifics of a token''s "active" state will vary depending on the implementation of the authorization server and the information it keeps about its tokens, but a "true" value return for the "active" property will generally indicate that a given token has been issued by this authorization server, has not been revoked by the resource owner, and is within its given time window of validity (e.g., after its issuance time and before its expiration time).' type: boolean aud: description: Audience contains a list of the token's intended audiences. items: type: string type: array client_id: description: 'ID is a client identifier for the OAuth 2.0 client that requested this token.' type: string exp: description: 'Expires at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token will expire.' format: int64 type: integer ext: additionalProperties: {} description: Extra is arbitrary data set by the session. type: object iat: description: 'Issued at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token was originally issued.' format: int64 type: integer iss: description: IssuerURL is a string representing the issuer of this token type: string nbf: description: 'NotBefore is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token is not to be used before.' format: int64 type: integer obfuscated_subject: description: 'ObfuscatedSubject is set when the subject identifier algorithm was set to "pairwise" during authorization. It is the `sub` value of the ID Token that was issued.' type: string scope: description: 'Scope is a JSON string containing a space-separated list of scopes associated with this token.' type: string sub: description: 'Subject of the token, as defined in JWT [RFC7519]. Usually a machine-readable identifier of the resource owner who authorized this token.' type: string token_type: description: TokenType is the introspected token's type, typically `Bearer`. type: string token_use: description: TokenUse is the introspected token's use, for example `access_token` or `refresh_token`. type: string username: description: 'Username is a human-readable identifier for the resource owner who authorized this token.' type: string required: - active type: object jsonWebKey: properties: alg: description: 'The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry established by [JWA] or be a value that contains a Collision- Resistant Name.' example: RS256 type: string crv: example: P-256 type: string d: example: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE type: string dp: example: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0 type: string dq: example: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk type: string e: example: AQAB type: string k: example: GawgguFyGrWKav7AX4VKUg type: string kid: description: 'The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is unspecified. When "kid" values are used within a JWK Set, different keys within the JWK Set SHOULD use distinct "kid" values. (One example in which different keys might use the same "kid" value is if they have different "kty" (key type) values but are considered to be equivalent alternatives by the application using them.) The "kid" value is a case-sensitive string.' example: 1603dfe0af8f4596 type: string kty: description: 'The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types" registry established by [JWA] or be a value that contains a Collision- Resistant Name. The "kty" value is a case-sensitive string.' example: RSA type: string n: example: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0 type: string p: example: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ type: string q: example: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ type: string qi: example: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU type: string use: description: 'Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data. Values are commonly "sig" (signature) or "enc" (encryption).' example: sig type: string x: example: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU type: string x5c: description: 'The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each string in the array is a base64-encoded (Section 4 of [RFC4648] -- not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value. The PKIX certificate containing the key value MUST be the first certificate.' items: type: string type: array y: example: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0 type: string required: - use - kty - kid - alg type: object jsonPatch: description: A JSONPatch document as defined by RFC 6902 properties: from: description: 'This field is used together with operation "move" and uses JSON Pointer notation. Learn more [about JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901#section-5).' example: /name type: string op: description: The operation to be performed. One of "add", "remove", "replace", "move", "copy", or "test". example: replace type: string path: description: 'The path to the target path. Uses JSON pointer notation. Learn more [about JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901#section-5).' example: /name type: string value: description: 'The value to be used within the operations. Learn more [about JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901#section-5).' example: foobar required: - op - path type: object acceptOAuth2LoginRequest: properties: acr: description: 'ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it to express that, for example, a user authenticated using two-factor authentication.' type: string amr: description: 'AMR sets the Authentication Methods References value for this authentication session. You can use it to specify the method a user used to authenticate. For example, if the acr indicates a user used two-factor authentication, the amr can express they used a software-secured key.' items: type: string type: array context: $ref: '#/components/schemas/JSONRawMessage' extend_session_lifespan: description: 'Extend OAuth2 authentication session lifespan If set to `true`, the OAuth2 authentication cookie lifespan is extended. This is for example useful if you want the user to be able to use `prompt=none` continuously. This value can only be set to `true` if the user has an authentication, which is the case if the `skip` value is `true`.' type: boolean force_subject_identifier: description: 'ForceSubjectIdentifier forces the "pairwise" user ID of the end-user that authenticated. The "pairwise" user ID refers to the (Pairwise Identifier Algorithm)[http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg] of the OpenID Connect specification. It allows you to set an obfuscated subject ("user") identifier that is unique to the client. Please note that this changes the user ID on endpoint /userinfo and sub claim of the ID Token. It does not change the sub claim in the OAuth 2.0 Introspection. Per default, ORY Hydra handles this value with its own algorithm. In case you want to set this yourself you can use this field. Please note that setting this field has no effect if `pairwise` is not configured in ORY Hydra or the OAuth 2.0 Client does not expect a pairwise identifier (set via `subject_type` key in the client''s configuration). Please also be aware that ORY Hydra is unable to properly compute this value during authentication. This implies that you have to compute this value on every authentication process (probably depending on the client ID or some other unique value). If you fail to compute the proper value, then authentication processes which have id_token_hint set might fail.' type: string identity_provider_session_id: description: 'IdentityProviderSessionID is the session ID of the end-user that authenticated. If specified, we will use this value to propagate the logout.' type: string remember: description: 'Remember, if set to true, tells Ory Hydra to remember this user by telling the user agent (browser) to store a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, they will not be asked to log in again.' type: boolean remember_for: description: 'RememberFor sets how long the authentication should be remembered for in seconds. If set to `0`, the authorization will be remembered for the duration of the browser session (using a session cookie).' format: int64 type: integer subject: description: Subject is the user ID of the end-user that authenticated. type: string required: - subject title: HandledLoginRequest is the request payload used to accept a login request. type: object JSONRawMessage: title: JSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger. oAuth2ConsentSessions: description: List of OAuth 2.0 Consent Sessions items: $ref: '#/components/schemas/oAuth2ConsentSession' type: array responses: errorOAuth2Default: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: Default Error Response listOAuth2Clients: content: application/json: schema: items: $ref: '#/components/schemas/oAuth2Client' type: array description: Paginated OAuth2 Client List Response emptyResponse: description: 'Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 204.' errorOAuth2BadRequest: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: Bad Request Error Response errorOAuth2NotFound: content: application/json: schema: $ref: '#/components/schemas/errorOAuth2' description: Not Found Error Response securitySchemes: basic: scheme: basic type: http bearer: scheme: bearer type: http oauth2: flows: authorizationCode: authorizationUrl: https://hydra.demo.ory.sh/oauth2/auth scopes: offline: A scope required when requesting refresh tokens (alias for `offline_access`) offline_access: A scope required when requesting refresh tokens openid: Request an OpenID Connect ID Token tokenUrl: https://hydra.demo.ory.sh/oauth2/token type: oauth2 x-forwarded-proto: string x-request-id: string