openapi: 3.0.3
info:
  title: Spring Server Authorization OpenID Connect API
  description: Spring Authorization Server is a framework providing implementations of OAuth 2.1 and OpenID Connect 1.0 specifications. It exposes standard protocol endpoints for token issuance, token introspection, JWKS publication, device authorization, and OpenID Connect session management.
  version: 1.3.0
  contact:
    name: Spring Security Team
    url: https://spring.io/projects/spring-authorization-server
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: http://localhost:9000
  description: Default authorization server port
tags:
- name: OpenID Connect
paths:
  /userinfo:
    get:
      operationId: getUserInfo
      summary: OpenID Connect UserInfo
      description: Returns claims about the authenticated end-user
      tags:
      - OpenID Connect
      security:
      - bearerAuth: []
      responses:
        '200':
          description: UserInfo claims
          content:
            application/json:
              schema:
                type: object
    post:
      operationId: getUserInfoPost
      summary: OpenID Connect UserInfo Endpoint (POST)
      description: Returns claims about the authenticated end-user via POST method
      tags:
      - OpenID Connect
      security:
      - bearerAuth: []
      responses:
        '200':
          description: UserInfo claims
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfo'
  /connect/logout:
    get:
      operationId: oidcLogout
      summary: OpenID Connect Session Logout
      description: Initiates OIDC RP-initiated logout
      tags:
      - OpenID Connect
      parameters:
      - name: id_token_hint
        in: query
        schema:
          type: string
      - name: post_logout_redirect_uri
        in: query
        schema:
          type: string
      - name: state
        in: query
        schema:
          type: string
      responses:
        '302':
          description: Redirect after logout
components:
  schemas:
    UserInfo:
      type: object
      properties:
        sub:
          type: string
          description: Subject identifier
        name:
          type: string
        given_name:
          type: string
        family_name:
          type: string
        email:
          type: string
          format: email
        email_verified:
          type: boolean
        picture:
          type: string
          format: uri
        locale:
          type: string
        updated_at:
          type: integer
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT