{ "openapi": "3.0.3", "info": { "title": "user_oidc", "version": "0.0.1", "description": "Use an OpenID Connect backend to login to your Nextcloud", "license": { "name": "agpl" } }, "components": { "securitySchemes": { "basic_auth": { "type": "http", "scheme": "basic" }, "bearer_auth": { "type": "http", "scheme": "bearer" } }, "schemas": { "OCSMeta": { "type": "object", "required": [ "status", "statuscode" ], "properties": { "status": { "type": "string" }, "statuscode": { "type": "integer" }, "message": { "type": "string" }, "totalitems": { "type": "string" }, "itemsperpage": { "type": "string" } } }, "Provider": { "type": "object", "required": [ "id", "identifier", "clientId", "discoveryEndpoint", "endSessionEndpoint", "postLogoutUri", "scope", "settings" ], "properties": { "id": { "type": "integer", "format": "int64" }, "identifier": { "type": "string" }, "clientId": { "type": "string" }, "discoveryEndpoint": { "type": "string", "nullable": true }, "endSessionEndpoint": { "type": "string", "nullable": true }, "postLogoutUri": { "type": "string", "nullable": true }, "scope": { "type": "string" }, "settings": { "$ref": "#/components/schemas/ProviderSettings" } } }, "ProviderSettings": { "type": "object", "required": [ "mappingDisplayName", "mappingEmail", "mappingQuota", "mappingUid", "mappingGroups", "mappingLanguage", "mappingLocale", "mappingAddress", "mappingStreetaddress", "mappingPostalcode", "mappingLocality", "mappingRegion", "mappingCountry", "mappingWebsite", "mappingAvatar", "mappingTwitter", "mappingFediverse", "mappingOrganisation", "mappingRole", "mappingHeadline", "mappingBiography", "mappingPhonenumber", "mappingGender", "mappingPronouns", "mappingBirthdate", "uniqueUid", "checkBearer", "sendIdTokenHint", "bearerProvisioning", "extraClaims", "providerBasedId", "groupProvisioning", "groupWhitelistRegex", "restrictLoginToGroups", "forbidLoginWithoutGroup", "nestedAndFallbackClaims", "enrichLoginIdTokenWithUserinfo" ], "properties": { "mappingDisplayName": { "type": "string" }, "mappingEmail": { "type": "string" }, "mappingQuota": { "type": "string" }, "mappingUid": { "type": "string" }, "mappingGroups": { "type": "string" }, "mappingLanguage": { "type": "string" }, "mappingLocale": { "type": "string" }, "mappingAddress": { "type": "string" }, "mappingStreetaddress": { "type": "string" }, "mappingPostalcode": { "type": "string" }, "mappingLocality": { "type": "string" }, "mappingRegion": { "type": "string" }, "mappingCountry": { "type": "string" }, "mappingWebsite": { "type": "string" }, "mappingAvatar": { "type": "string" }, "mappingTwitter": { "type": "string" }, "mappingFediverse": { "type": "string" }, "mappingOrganisation": { "type": "string" }, "mappingRole": { "type": "string" }, "mappingHeadline": { "type": "string" }, "mappingBiography": { "type": "string" }, "mappingPhonenumber": { "type": "string" }, "mappingGender": { "type": "string" }, "mappingPronouns": { "type": "string" }, "mappingBirthdate": { "type": "string" }, "uniqueUid": { "type": "boolean" }, "checkBearer": { "type": "boolean" }, "sendIdTokenHint": { "type": "boolean" }, "bearerProvisioning": { "type": "boolean" }, "extraClaims": { "type": "string" }, "providerBasedId": { "type": "boolean" }, "groupProvisioning": { "type": "boolean" }, "groupWhitelistRegex": { "type": "string" }, "restrictLoginToGroups": { "type": "boolean" }, "forbidLoginWithoutGroup": { "type": "boolean" }, "nestedAndFallbackClaims": { "type": "boolean" }, "enrichLoginIdTokenWithUserinfo": { "type": "boolean" } } } } }, "paths": { "/ocs/v2.php/apps/user_oidc/api/{apiVersion}/provider": { "get": { "operationId": "settings-get-providers", "summary": "Get all registered providers with their settings", "description": "This endpoint requires admin access", "tags": [ "user_oidc_settings" ], "security": [ { "bearer_auth": [] }, { "basic_auth": [] } ], "parameters": [ { "name": "apiVersion", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "v1" ], "default": "v1" } }, { "name": "OCS-APIRequest", "in": "header", "description": "Required to be true for the API request to pass", "required": true, "schema": { "type": "boolean", "default": true } } ], "responses": { "200": { "description": "The list of providers with their settings", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/Provider" } } } } } } } } }, "401": { "description": "Current user is not logged in", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } }, "403": { "description": "Logged in account must be an admin", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } } } }, "post": { "operationId": "settings-create-provider", "summary": "Create a new provider", "description": "This endpoint requires admin access\nThis endpoint requires password confirmation", "tags": [ "user_oidc_settings" ], "security": [ { "bearer_auth": [] }, { "basic_auth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "identifier", "clientId", "clientSecret", "discoveryEndpoint" ], "properties": { "identifier": { "type": "string", "description": "The unique identifier for the provider" }, "clientId": { "type": "string", "description": "The client ID for the provider" }, "clientSecret": { "type": "string", "description": "The client secret for the provider" }, "discoveryEndpoint": { "type": "string", "description": "The discovery endpoint URL" }, "settings": { "type": "object", "default": {}, "description": "Optional provider settings", "additionalProperties": { "type": "object" } }, "scope": { "type": "string", "default": "openid email profile", "description": "The scope to request" }, "endSessionEndpoint": { "type": "string", "nullable": true, "default": null, "description": "Optional end session endpoint URL" }, "postLogoutUri": { "type": "string", "nullable": true, "default": null, "description": "Optional post-logout redirect URI" } } } } } }, "parameters": [ { "name": "apiVersion", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "v1" ], "default": "v1" } }, { "name": "OCS-APIRequest", "in": "header", "description": "Required to be true for the API request to pass", "required": true, "schema": { "type": "boolean", "default": true } } ], "responses": { "200": { "description": "The provider was successfully created", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "$ref": "#/components/schemas/Provider" } } } } } } } }, "409": { "description": "A provider with the given identifier already exists", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object", "required": [ "message" ], "properties": { "message": { "type": "string" } } } } } } } } } }, "400": { "description": "The discovery endpoint is not reachable or is invalid", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object", "required": [ "message" ], "properties": { "message": { "type": "string" } } } } } } } } } }, "401": { "description": "Current user is not logged in", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } }, "403": { "description": "Logged in account must be an admin", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } } } } }, "/ocs/v2.php/apps/user_oidc/api/{apiVersion}/provider/{providerId}": { "put": { "operationId": "settings-update-provider", "summary": "Update an existing provider", "description": "This endpoint requires admin access\nThis endpoint requires password confirmation", "tags": [ "user_oidc_settings" ], "security": [ { "bearer_auth": [] }, { "basic_auth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "identifier", "clientId", "discoveryEndpoint" ], "properties": { "identifier": { "type": "string", "description": "The unique identifier for the provider" }, "clientId": { "type": "string", "description": "The client ID for the provider" }, "discoveryEndpoint": { "type": "string", "description": "The discovery endpoint URL" }, "clientSecret": { "type": "string", "nullable": true, "default": null, "description": "Optional new client secret" }, "settings": { "type": "object", "default": {}, "description": "Optional provider settings", "additionalProperties": { "type": "object" } }, "scope": { "type": "string", "default": "openid email profile", "description": "The scope to request" }, "endSessionEndpoint": { "type": "string", "nullable": true, "default": null, "description": "Optional end session endpoint URL" }, "postLogoutUri": { "type": "string", "nullable": true, "default": null, "description": "Optional post-logout redirect URI" } } } } } }, "parameters": [ { "name": "apiVersion", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "v1" ], "default": "v1" } }, { "name": "providerId", "in": "path", "description": "The numeric ID of the provider to update", "required": true, "schema": { "type": "integer", "format": "int64" } }, { "name": "OCS-APIRequest", "in": "header", "description": "Required to be true for the API request to pass", "required": true, "schema": { "type": "boolean", "default": true } } ], "responses": { "200": { "description": "The provider was successfully updated", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "$ref": "#/components/schemas/Provider" } } } } } } } }, "404": { "description": "The provider does not exist", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object", "required": [ "message" ], "properties": { "message": { "type": "string" } } } } } } } } } }, "400": { "description": "The discovery endpoint is not reachable or is invalid", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object", "required": [ "message" ], "properties": { "message": { "type": "string" } } } } } } } } } }, "401": { "description": "Current user is not logged in", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } }, "403": { "description": "Logged in account must be an admin", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } } } }, "delete": { "operationId": "settings-delete-provider", "summary": "Delete a provider", "description": "This endpoint requires admin access\nThis endpoint requires password confirmation", "tags": [ "user_oidc_settings" ], "security": [ { "bearer_auth": [] }, { "basic_auth": [] } ], "parameters": [ { "name": "apiVersion", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "v1" ], "default": "v1" } }, { "name": "providerId", "in": "path", "description": "The numeric ID of the provider to delete", "required": true, "schema": { "type": "integer", "format": "int64" } }, { "name": "OCS-APIRequest", "in": "header", "description": "Required to be true for the API request to pass", "required": true, "schema": { "type": "boolean", "default": true } } ], "responses": { "200": { "description": "The provider was successfully deleted", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object" } } } } } } } }, "404": { "description": "The provider does not exist", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object" } } } } } } } }, "500": { "description": "", "content": { "text/plain": { "schema": { "type": "string" } } } }, "401": { "description": "Current user is not logged in", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } }, "403": { "description": "Logged in account must be an admin", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } } } } }, "/ocs/v2.php/apps/user_oidc/api/{apiVersion}/provider/id4me": { "post": { "operationId": "settings-seti-d4me", "summary": "Set the ID4me state", "description": "This endpoint requires admin access\nThis endpoint requires password confirmation", "tags": [ "user_oidc_settings" ], "security": [ { "bearer_auth": [] }, { "basic_auth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "enabled" ], "properties": { "enabled": { "type": "boolean", "description": "Whether ID4me should be enabled" } } } } } }, "parameters": [ { "name": "apiVersion", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "v1" ], "default": "v1" } }, { "name": "OCS-APIRequest", "in": "header", "description": "Required to be true for the API request to pass", "required": true, "schema": { "type": "boolean", "default": true } } ], "responses": { "200": { "description": "The ID4me state was successfully updated", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object", "required": [ "enabled" ], "properties": { "enabled": { "type": "boolean" } } } } } } } } } }, "401": { "description": "Current user is not logged in", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } }, "403": { "description": "Logged in account must be an admin", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } } } } }, "/ocs/v2.php/apps/user_oidc/api/{apiVersion}/supported-settings": { "get": { "operationId": "settings-get-supported-settings", "summary": "Get the list of supported provider settings", "description": "This endpoint requires admin access", "tags": [ "user_oidc_settings" ], "security": [ { "bearer_auth": [] }, { "basic_auth": [] } ], "parameters": [ { "name": "apiVersion", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "v1" ], "default": "v1" } }, { "name": "OCS-APIRequest", "in": "header", "description": "Required to be true for the API request to pass", "required": true, "schema": { "type": "boolean", "default": true } } ], "responses": { "200": { "description": "The list of supported settings", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "array", "items": { "type": "string" } } } } } } } } }, "401": { "description": "Current user is not logged in", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } }, "403": { "description": "Logged in account must be an admin", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } } } } }, "/ocs/v2.php/apps/user_oidc/api/{apiVersion}/admin-config": { "post": { "operationId": "settings-set-admin-config", "summary": "Set admin configuration values", "description": "This endpoint requires admin access\nThis endpoint requires password confirmation", "tags": [ "user_oidc_settings" ], "security": [ { "bearer_auth": [] }, { "basic_auth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "values" ], "properties": { "values": { "type": "object", "description": "Key-value pairs of configuration options to set", "additionalProperties": { "type": "object" } } } } } } }, "parameters": [ { "name": "apiVersion", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "v1" ], "default": "v1" } }, { "name": "OCS-APIRequest", "in": "header", "description": "Required to be true for the API request to pass", "required": true, "schema": { "type": "boolean", "default": true } } ], "responses": { "200": { "description": "The admin configuration was successfully updated", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object" } } } } } } } }, "401": { "description": "Current user is not logged in", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } }, "403": { "description": "Logged in account must be an admin", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } } } } }, "/ocs/v2.php/apps/user_oidc/api/{apiVersion}/user": { "post": { "operationId": "ocs_api-create-user", "summary": "Create or update a user for a backend provider.", "description": "This endpoint requires admin access", "tags": [ "user_oidc_provisioning" ], "security": [ { "bearer_auth": [] }, { "basic_auth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "providerId", "userId" ], "properties": { "providerId": { "type": "integer", "format": "int64", "description": "Numeric ID of the provider backend" }, "userId": { "type": "string", "description": "Provider-specific user identifier", "minLength": 1 }, "displayName": { "type": "string", "nullable": true, "default": null, "description": "Optional display name to set for the user" }, "email": { "type": "string", "nullable": true, "default": null, "description": "Optional email address to set for the user" }, "quota": { "type": "string", "nullable": true, "default": null, "description": "Optional quota value to set for the user" } } } } } }, "parameters": [ { "name": "apiVersion", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "v1" ], "default": "v1" } }, { "name": "OCS-APIRequest", "in": "header", "description": "Required to be true for the API request to pass", "required": true, "schema": { "type": "boolean", "default": true } } ], "responses": { "200": { "description": "The user was created or updated successfully", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object", "required": [ "user_id" ], "properties": { "user_id": { "type": "string" } } } } } } } } } }, "401": { "description": "Current user is not logged in", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } }, "403": { "description": "Logged in account must be an admin", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } } } } }, "/ocs/v2.php/apps/user_oidc/api/{apiVersion}/user/{userId}": { "delete": { "operationId": "ocs_api-delete-user", "summary": "Delete a user created by the provider backend.", "description": "This endpoint requires admin access", "tags": [ "user_oidc_provisioning" ], "security": [ { "bearer_auth": [] }, { "basic_auth": [] } ], "parameters": [ { "name": "apiVersion", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "v1" ], "default": "v1" } }, { "name": "userId", "in": "path", "description": "The internal user id to delete", "required": true, "schema": { "type": "string" } }, { "name": "OCS-APIRequest", "in": "header", "description": "Required to be true for the API request to pass", "required": true, "schema": { "type": "boolean", "default": true } } ], "responses": { "200": { "description": "The provider user was deleted successfully", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object", "required": [ "user_id" ], "properties": { "user_id": { "type": "string" } } } } } } } } } }, "404": { "description": "The user was not found or is not managed by this backend", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": { "type": "object", "required": [ "message" ], "properties": { "message": { "type": "string" } } } } } } } } } }, "401": { "description": "Current user is not logged in", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } }, "403": { "description": "Logged in account must be an admin", "content": { "application/json": { "schema": { "type": "object", "required": [ "ocs" ], "properties": { "ocs": { "type": "object", "required": [ "meta", "data" ], "properties": { "meta": { "$ref": "#/components/schemas/OCSMeta" }, "data": {} } } } } } } } } } } }, "tags": [] }