generated: '2026-07-25'
method: searched
source: https://auth.cyberresilience.com/.well-known/openid-configuration
docs: https://auth.cyberresilience.com/.well-known/openid-configuration
local_copy: well-known/resilience-cyber-openid-configuration.json
note: >-
  Resilience publishes no OpenAPI, so this profile is not derived from a spec —
  it is read verbatim from the Auth0 tenant metadata that guards
  portal.cyberresilience.com, plus the live /authorize redirect the portal
  issues. This is the only publicly documented machine-readable surface on the
  estate. Anyone integrating still needs an appointed-broker relationship and a
  client_id issued by Resilience; there is no self-serve registration.
summary:
  types:
  - oauth2
  - openIdConnect
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - deviceCode
  - refreshToken
  - tokenExchange
  bearer_format: JWT
  self_serve_signup: false
  audience_gated: true
schemes:
- name: Auth0OIDC
  type: openIdConnect
  openIdConnectUrl: https://auth.cyberresilience.com/.well-known/openid-configuration
  issuer: https://auth.cyberresilience.com/
  sources:
  - well-known/resilience-cyber-openid-configuration.json
- name: Auth0OAuth2
  type: oauth2
  sources:
  - well-known/resilience-cyber-oauth-authorization-server.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.cyberresilience.com/authorize
    tokenUrl: https://auth.cyberresilience.com/oauth/token
    refreshUrl: https://auth.cyberresilience.com/oauth/token
    pkce: required-in-practice
    code_challenge_methods:
    - S256
    - plain
  - flow: clientCredentials
    tokenUrl: https://auth.cyberresilience.com/oauth/token
    note: >-
      Advertised in tenant metadata. No partner client-credentials onboarding is
      documented publicly anywhere on cyberresilience.com.
  - flow: deviceCode
    deviceAuthorizationUrl: https://auth.cyberresilience.com/oauth/device/code
    grant: urn:ietf:params:oauth:grant-type:device_code
endpoints:
  issuer: https://auth.cyberresilience.com/
  authorization: https://auth.cyberresilience.com/authorize
  token: https://auth.cyberresilience.com/oauth/token
  userinfo: https://auth.cyberresilience.com/userinfo
  jwks: https://auth.cyberresilience.com/.well-known/jwks.json
  registration: https://auth.cyberresilience.com/oidc/register
  revocation: https://auth.cyberresilience.com/oauth/revoke
  device_authorization: https://auth.cyberresilience.com/oauth/device/code
  backchannel_authentication: https://auth.cyberresilience.com/bc-authorize
  mfa_challenge: https://auth.cyberresilience.com/mfa/challenge
  global_token_revocation: https://auth.cyberresilience.com/oauth/global-token-revocation/connection/{connectionName}
grant_types_supported:
- client_credentials
- authorization_code
- refresh_token
- password
- implicit
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:token-exchange
- urn:ietf:params:oauth:grant-type:jwt-bearer
- http://auth0.com/oauth/grant-type/password-realm
- http://auth0.com/oauth/grant-type/passwordless/otp
- http://auth0.com/oauth/grant-type/mfa-oob
- http://auth0.com/oauth/grant-type/mfa-otp
- http://auth0.com/oauth/grant-type/mfa-recovery-code
token_endpoint_auth_methods_supported:
- client_secret_basic
- client_secret_post
- private_key_jwt
- none
id_token_signing_alg_values_supported:
- HS256
- RS256
- PS256
sender_constraining:
  dpop: true
  dpop_signing_alg_values_supported:
  - ES256
  mutual_tls: false
  note: >-
    DPoP (RFC 9449) proof-of-possession is advertised by the tenant; whether the
    private product API enforces it cannot be observed anonymously.
observed_client:
  source: >-
    live 302 chain https://portal.cyberresilience.com/ ->
    /v2/api/auth/login -> https://auth.cyberresilience.com/authorize (probed
    2026-07-25)
  response_type: code
  code_challenge_method: S256
  scope: openid profile email offline_access
  audience: https://api.prod.resilienceinsurance.app
  redirect_uri: https://portal.cyberresilience.com/v2/api/auth/callback
  prompt: login
  note: client_id is deliberately not recorded here.
resource_server:
  audience: https://api.prod.resilienceinsurance.app
  published: false
  oauth_protected_resource_metadata: false
  note: >-
    The private product API exists and is named as an OAuth audience, but it
    returns 404 anonymously for /, /openapi.json, /openapi.yaml, /swagger.json,
    /v1/openapi.json, /api-docs, /docs, /redoc, /graphql and /mcp, and serves no
    RFC 9728 protected-resource metadata.