Discovery

Public metadata: OpenID configuration, RFC 8414 metadata and JWKS. 3 operations

Expand an endpoint for authentication, parameters, request fields and responses.

GET/realms/{realm}/.well-known/openid-configuration+

OpenID Provider metadata

Canonical issuer metadata for the realm. Cacheable for 300 seconds.

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-metadataPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/json

Field	Type	Required	Description
`issuer`	string	Yes
`authorization_endpoint`	string	Yes
`token_endpoint`	string	Yes
`jwks_uri`	string	Yes
`userinfo_endpoint`	string	—
`introspection_endpoint`	string	—
`revocation_endpoint`	string	—
`end_session_endpoint`	string	—
`device_authorization_endpoint`	string	—
`pushed_authorization_request_endpoint`	string	—
`registration_endpoint`	string	—
`check_session_iframe`	string	—	OpenID Connect Session Management 1.0 (OIDC-014); present only when the realm turned it on.
`response_types_supported`	array	Yes
`response_modes_supported`	array	—
`grant_types_supported`	array	—
`subject_types_supported`	array	Yes
`id_token_signing_alg_values_supported`	array	Yes
`userinfo_signing_alg_values_supported`	array	—
`token_endpoint_auth_methods_supported`	array	—
`token_endpoint_auth_signing_alg_values_supported`	array	—
`introspection_endpoint_auth_methods_supported`	array	—
`revocation_endpoint_auth_methods_supported`	array	—
`code_challenge_methods_supported`	array	—
`scopes_supported`	array	—
`claims_supported`	array	—
`claims_parameter_supported`	boolean	—
`request_parameter_supported`	boolean	—
`request_uri_parameter_supported`	boolean	—
`require_request_uri_registration`	boolean	—
`require_pushed_authorization_requests`	boolean	—
`prompt_values_supported`	array	—
`acr_values_supported`	array	—
`authorization_response_iss_parameter_supported`	boolean	—
`authorization_signing_alg_values_supported`	array	—	JARM (ADV-002): algorithms of the published signing keys.
`authorization_encryption_alg_values_supported`	array	—	JARM response encryption: RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW.
`authorization_encryption_enc_values_supported`	array	—	JARM content encryption: A128GCM, A256GCM.
`id_token_encryption_alg_values_supported`	array	—	TOK-020: RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW.
`id_token_encryption_enc_values_supported`	array	—	A128GCM, A256GCM.
`userinfo_encryption_alg_values_supported`	array	—	OIDC-013: RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW.
`userinfo_encryption_enc_values_supported`	array	—	A128GCM, A256GCM.
`tls_client_certificate_bound_access_tokens`	boolean	—	true when client certificates reach the server (server.mtls_listen or server.client_cert_header; RFC 8705, TOK-019); false otherwise.
`mtls_endpoint_aliases`	object	—	RFC 8705 §5: the mutual-TLS listener's endpoints, present only when server.mtls_origin is set. pushed_authorization_request_endpoint and device_authorization_endpoint appear with those capabilities.
`frontchannel_logout_supported`	boolean	—	OIDC Front-Channel Logout 1.0 (SES-018): true with the logout endpoint.
`frontchannel_logout_session_supported`	boolean	—	true with the logout endpoint: iss and sid are added to the front-channel logout URI when the client asks for them.
`backchannel_logout_supported`	boolean	—
`backchannel_logout_session_supported`	boolean	—
`dpop_signing_alg_values_supported`	array	—
`service_documentation`	string	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Cache-Control": {
    "schema": {
      "type": "string"
    },
    "description": "public, max-age=300"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation getOpenIDConfiguration · Schema definitions · OpenAPI contract

GET/.well-known/oauth-authorization-server/realms/{realm}+

OAuth 2.0 authorization server metadata (RFC 8414)

RFC 8414 location for the path-based issuer; same document as the OpenID configuration.

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-metadataPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/json

Field	Type	Required	Description
`issuer`	string	Yes
`authorization_endpoint`	string	Yes
`token_endpoint`	string	Yes
`jwks_uri`	string	Yes
`userinfo_endpoint`	string	—
`introspection_endpoint`	string	—
`revocation_endpoint`	string	—
`end_session_endpoint`	string	—
`device_authorization_endpoint`	string	—
`pushed_authorization_request_endpoint`	string	—
`registration_endpoint`	string	—
`check_session_iframe`	string	—	OpenID Connect Session Management 1.0 (OIDC-014); present only when the realm turned it on.
`response_types_supported`	array	Yes
`response_modes_supported`	array	—
`grant_types_supported`	array	—
`subject_types_supported`	array	Yes
`id_token_signing_alg_values_supported`	array	Yes
`userinfo_signing_alg_values_supported`	array	—
`token_endpoint_auth_methods_supported`	array	—
`token_endpoint_auth_signing_alg_values_supported`	array	—
`introspection_endpoint_auth_methods_supported`	array	—
`revocation_endpoint_auth_methods_supported`	array	—
`code_challenge_methods_supported`	array	—
`scopes_supported`	array	—
`claims_supported`	array	—
`claims_parameter_supported`	boolean	—
`request_parameter_supported`	boolean	—
`request_uri_parameter_supported`	boolean	—
`require_request_uri_registration`	boolean	—
`require_pushed_authorization_requests`	boolean	—
`prompt_values_supported`	array	—
`acr_values_supported`	array	—
`authorization_response_iss_parameter_supported`	boolean	—
`authorization_signing_alg_values_supported`	array	—	JARM (ADV-002): algorithms of the published signing keys.
`authorization_encryption_alg_values_supported`	array	—	JARM response encryption: RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW.
`authorization_encryption_enc_values_supported`	array	—	JARM content encryption: A128GCM, A256GCM.
`id_token_encryption_alg_values_supported`	array	—	TOK-020: RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW.
`id_token_encryption_enc_values_supported`	array	—	A128GCM, A256GCM.
`userinfo_encryption_alg_values_supported`	array	—	OIDC-013: RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW.
`userinfo_encryption_enc_values_supported`	array	—	A128GCM, A256GCM.
`tls_client_certificate_bound_access_tokens`	boolean	—	true when client certificates reach the server (server.mtls_listen or server.client_cert_header; RFC 8705, TOK-019); false otherwise.
`mtls_endpoint_aliases`	object	—	RFC 8705 §5: the mutual-TLS listener's endpoints, present only when server.mtls_origin is set. pushed_authorization_request_endpoint and device_authorization_endpoint appear with those capabilities.
`frontchannel_logout_supported`	boolean	—	OIDC Front-Channel Logout 1.0 (SES-018): true with the logout endpoint.
`frontchannel_logout_session_supported`	boolean	—	true with the logout endpoint: iss and sid are added to the front-channel logout URI when the client asks for them.
`backchannel_logout_supported`	boolean	—
`backchannel_logout_session_supported`	boolean	—
`dpop_signing_alg_values_supported`	array	—
`service_documentation`	string	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Cache-Control": {
    "schema": {
      "type": "string"
    },
    "description": "public, max-age=300"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation getOAuthServerMetadata · Schema definitions · OpenAPI contract

GET/realms/{realm}/jwks+

Public verification keys

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-metadataPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/jwk-set+json

Field	Type	Required	Description
`keys`	array	Yes

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Cache-Control": {
    "schema": {
      "type": "string"
    },
    "description": "public, max-age=300"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation getJWKS · Schema definitions · OpenAPI contract