Auth0 resource-servers API

openapi: 3.0.0
info:
  title: Auth0 Authentication actions resource-servers API
  description: Auth0 Authentication API. Endpoints for authentication and authorization using OpenID Connect, OAuth 2.0, SAML, WS-Federation, and Passwordless flows.
  version: 1.0.0
servers:
- url: '{auth0_domain}'
  description: The Authentication API is served over HTTPS.
  variables:
    auth0_domain:
      description: Auth0 domain
      default: https://demo.us.auth0.com
tags:
- name: resource-servers
paths:
  /resource-servers:
    get:
      summary: Get Resource Servers
      description: Retrieve details of all APIs associated with your tenant.
      tags:
      - resource-servers
      parameters:
      - name: identifiers
        in: query
        description: An optional filter on the resource server identifier. Must be URL encoded and may be specified multiple times (max 10).<br /><b>e.g.</b> <i>../resource-servers?identifiers=id1&identifiers=id2</i>
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            minLength: 1
      - name: page
        in: query
        description: Page index of the results to return. First page is 0.
        schema:
          type: integer
          minimum: 0
      - name: per_page
        in: query
        description: Number of results per page.
        schema:
          type: integer
          minimum: 1
          maximum: 100
      - name: include_totals
        in: query
        description: Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
        schema:
          type: boolean
      - name: include_fields
        in: query
        description: Whether specified fields are to be included (true) or excluded (false).
        schema:
          type: boolean
      responses:
        '200':
          description: Resource servers successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResourceServerResponseContent'
        '400':
          description: Invalid request query string. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope, expected any of: read:resource_servers.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: get_resource-servers
      x-release-lifecycle: GA
      x-operation-name: list
      x-operation-request-parameters-name: ListResourceServerRequestParameters
      x-operation-group: resourceServers
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:resource_servers
    post:
      summary: Create a Resource Server
      description: Create a new API associated with your tenant. Note that all new APIs must be registered with Auth0. For more information, read <a href="https://www.auth0.com/docs/get-started/apis"> APIs</a>.
      tags:
      - resource-servers
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateResourceServerRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/CreateResourceServerRequestContent'
      responses:
        '201':
          description: Resource server successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateResourceServerResponseContent'
        '400':
          description: Invalid request body. The message will vary depending on the cause.
          x-description-1: The selected identifier is reserved.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: create:resource_servers.'
          x-description-1: You reached the limit of entities of this type for this tenant.
        '409':
          description: A resource server with the same identifier already exists.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: post_resource-servers
      x-release-lifecycle: GA
      x-operation-name: create
      x-operation-group: resourceServers
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - create:resource_servers
  /resource-servers/{id}:
    get:
      summary: Get a Resource Server
      description: Retrieve <a href="https://auth0.com/docs/apis">API</a> details with the given ID.
      tags:
      - resource-servers
      parameters:
      - name: id
        in: path
        description: ID or audience of the resource server to retrieve.
        required: true
        schema:
          type: string
      - name: include_fields
        in: query
        description: Whether specified fields are to be included (true) or excluded (false).
        schema:
          type: boolean
      responses:
        '200':
          description: Resource server successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetResourceServerResponseContent'
        '400':
          description: Invalid request URI. The message will vary depending on the cause.
          x-description-1: Invalid request query string. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: read:resource_servers.'
          x-description-1: Some fields cannot be read with the permissions granted by the bearer token scopes. The message will vary depending on the fields and the scopes.
        '404':
          description: Resource server not found.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: get_resource-servers_by_id
      x-release-lifecycle: GA
      x-operation-name: get
      x-operation-request-parameters-name: GetResourceServerRequestParameters
      x-operation-group: resourceServers
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:resource_servers
    delete:
      summary: Delete a Resource Server
      description: Delete an existing API by ID. For more information, read <a href="https://www.auth0.com/docs/get-started/apis/api-settings">API Settings</a>.
      tags:
      - resource-servers
      parameters:
      - name: id
        in: path
        description: ID or the audience of the resource server to delete.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Resource server successfully deleted.
        '400':
          description: Invalid request URI. The message will vary depending on the cause.
          x-description-1: System resource servers cannot be deleted.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: delete:resource_servers.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: delete_resource-servers_by_id
      x-release-lifecycle: GA
      x-operation-name: delete
      x-operation-group: resourceServers
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - delete:resource_servers
    patch:
      summary: Update a Resource Server
      description: Change an existing API setting by resource server ID. For more information, read <a href="https://www.auth0.com/docs/get-started/apis/api-settings">API Settings</a>.
      tags:
      - resource-servers
      parameters:
      - name: id
        in: path
        description: ID or audience of the resource server to update.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateResourceServerRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/UpdateResourceServerRequestContent'
      responses:
        '201':
          description: Resource server successfully updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateResourceServerResponseContent'
        '400':
          description: Invalid request body. The message will vary depending on the cause.
          x-description-1: System resource servers cannot be patched.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: update:resource_servers.'
        '409':
          description: A resource server with the same identifier already exists.
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: patch_resource-servers_by_id
      x-release-lifecycle: GA
      x-operation-name: update
      x-operation-group: resourceServers
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - update:resource_servers
components:
  schemas:
    ResourceServerConsentPolicyEnum:
      type:
      - string
      - 'null'
      enum:
      - transactional-authorization-with-mfa
      - null
    ResourceServerProofOfPossession:
      type:
      - object
      - 'null'
      description: Proof-of-Possession configuration for access tokens
      additionalProperties: false
      required:
      - mechanism
      - required
      properties:
        mechanism:
          $ref: '#/components/schemas/ResourceServerProofOfPossessionMechanismEnum'
        required:
          type: boolean
          description: Whether the use of Proof-of-Possession is required for the resource server
        required_for:
          $ref: '#/components/schemas/ResourceServerProofOfPossessionRequiredForEnum'
    ResourceServer:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          description: ID of the API (resource server).
        name:
          type: string
          description: Friendly name for this resource server. Can not contain `<` or `>` characters.
        is_system:
          type: boolean
          description: Whether this is an Auth0 system API (true) or a custom API (false).
        identifier:
          type: string
          description: Unique identifier for the API used as the audience parameter on authorization calls. Can not be changed once set.
        scopes:
          type: array
          description: List of permissions (scopes) that this API uses.
          items:
            $ref: '#/components/schemas/ResourceServerScope'
        signing_alg:
          $ref: '#/components/schemas/SigningAlgorithmEnum'
        signing_secret:
          type: string
          description: Secret used to sign tokens when using symmetric algorithms (HS256).
          minLength: 16
        allow_offline_access:
          type: boolean
          description: Whether refresh tokens can be issued for this API (true) or not (false).
        allow_online_access:
          type: boolean
          description: Whether Online Refresh Tokens can be issued for this API (true) or not (false).
        skip_consent_for_verifiable_first_party_clients:
          type: boolean
          description: Whether to skip user consent for applications flagged as first party (true) or not (false).
        token_lifetime:
          type: integer
          description: Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
        token_lifetime_for_web:
          type: integer
          description: Expiration value (in seconds) for access tokens issued for this API via Implicit or Hybrid Flows. Cannot be greater than the `token_lifetime` value.
        enforce_policies:
          type: boolean
          description: Whether authorization polices are enforced (true) or unenforced (false).
        token_dialect:
          $ref: '#/components/schemas/ResourceServerTokenDialectResponseEnum'
        token_encryption:
          $ref: '#/components/schemas/ResourceServerTokenEncryption'
        consent_policy:
          $ref: '#/components/schemas/ResourceServerConsentPolicyEnum'
        authorization_details:
          type:
          - array
          - 'null'
          items: {}
        proof_of_possession:
          $ref: '#/components/schemas/ResourceServerProofOfPossession'
        subject_type_authorization:
          $ref: '#/components/schemas/ResourceServerSubjectTypeAuthorization'
        authorization_policy:
          $ref: '#/components/schemas/ResourceServerAuthorizationPolicy'
          x-release-lifecycle: EA
        client_id:
          type: string
          description: The client ID of the client that this resource server is linked to
          format: client-id
    ResourceServerSubjectTypeAuthorization:
      type: object
      description: Defines application access permission for a resource server
      additionalProperties: false
      properties:
        user:
          $ref: '#/components/schemas/ResourceServerSubjectTypeAuthorizationUser'
        client:
          $ref: '#/components/schemas/ResourceServerSubjectTypeAuthorizationClient'
    ResourceServerSubjectTypeAuthorizationClient:
      type: object
      description: Access Permissions for client flows
      additionalProperties: true
      properties:
        policy:
          $ref: '#/components/schemas/ResourceServerSubjectTypeAuthorizationClientPolicyEnum'
    ResourceServerTokenEncryptionAlgorithmEnum:
      type: string
      description: Algorithm used to encrypt the token.
      enum:
      - RSA-OAEP-256
      - RSA-OAEP-384
      - RSA-OAEP-512
    ListResourceServerResponseContent:
      oneOf:
      - type: array
        items:
          $ref: '#/components/schemas/ResourceServer'
      - $ref: '#/components/schemas/ListResourceServerOffsetPaginatedResponseContent'
    SigningAlgorithmEnum:
      type: string
      description: Algorithm used to sign JWTs. Can be `HS256` (default) or `RS256`. `PS256` available via addon.
      default: HS256
      enum:
      - HS256
      - RS256
      - RS512
      - PS256
    ResourceServerTokenEncryptionFormatEnum:
      description: Format of the encrypted JWT payload.
      enum:
      - compact-nested-jwe
    ResourceServerTokenDialectSchemaEnum:
      type: string
      description: Dialect of issued access token. `access_token` is a JWT containing standard Auth0 claims; `rfc9068_profile` is a JWT conforming to the IETF JWT Access Token Profile. `access_token_authz` and `rfc9068_profile_authz` additionally include RBAC permissions claims.
      enum:
      - access_token
      - access_token_authz
      - rfc9068_profile
      - rfc9068_profile_authz
    ResourceServerTokenDialectResponseEnum:
      type: string
      description: Dialect of access tokens that should be issued. `access_token` is a JWT containing standard Auth0 claims; `rfc9068_profile` is a JWT conforming to the IETF JWT Access Token Profile. `access_token_authz` and `rfc9068_profile_authz` additionally include RBAC permissions claims.
      enum:
      - access_token
      - access_token_authz
      - rfc9068_profile
      - rfc9068_profile_authz
    ResourceServerProofOfPossessionMechanismEnum:
      type: string
      description: Intended mechanism for Proof-of-Possession
      enum:
      - mtls
      - dpop
    ListResourceServerOffsetPaginatedResponseContent:
      type: object
      additionalProperties: false
      properties:
        start:
          type: number
        limit:
          type: number
        total:
          type: number
        resource_servers:
          type: array
          items:
            $ref: '#/components/schemas/ResourceServer'
    ResourceServerSubjectTypeAuthorizationClientPolicyEnum:
      type: string
      description: Defines the client flows policy for the resource server
      enum:
      - deny_all
      - require_client_grant
    ResourceServerTokenEncryption:
      type:
      - object
      - 'null'
      additionalProperties: false
      required:
      - format
      - encryption_key
      properties:
        format:
          $ref: '#/components/schemas/ResourceServerTokenEncryptionFormatEnum'
        encryption_key:
          $ref: '#/components/schemas/ResourceServerTokenEncryptionKey'
    UpdateResourceServerResponseContent:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          description: ID of the API (resource server).
        name:
          type: string
          description: Friendly name for this resource server. Can not contain `<` or `>` characters.
        is_system:
          type: boolean
          description: Whether this is an Auth0 system API (true) or a custom API (false).
        identifier:
          type: string
          description: Unique identifier for the API used as the audience parameter on authorization calls. Can not be changed once set.
        scopes:
          type: array
          description: List of permissions (scopes) that this API uses.
          items:
            $ref: '#/components/schemas/ResourceServerScope'
        signing_alg:
          $ref: '#/components/schemas/SigningAlgorithmEnum'
        signing_secret:
          type: string
          description: Secret used to sign tokens when using symmetric algorithms (HS256).
          minLength: 16
        allow_offline_access:
          type: boolean
          description: Whether refresh tokens can be issued for this API (true) or not (false).
        allow_online_access:
          type: boolean
          description: Whether Online Refresh Tokens can be issued for this API (true) or not (false).
        skip_consent_for_verifiable_first_party_clients:
          type: boolean
          description: Whether to skip user consent for applications flagged as first party (true) or not (false).
        token_lifetime:
          type: integer
          description: Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
        token_lifetime_for_web:
          type: integer
          description: Expiration value (in seconds) for access tokens issued for this API via Implicit or Hybrid Flows. Cannot be greater than the `token_lifetime` value.
        enforce_policies:
          type: boolean
          description: Whether authorization polices are enforced (true) or unenforced (false).
        token_dialect:
          $ref: '#/components/schemas/ResourceServerTokenDialectResponseEnum'
        token_encryption:
          $ref: '#/components/schemas/ResourceServerTokenEncryption'
        consent_policy:
          $ref: '#/components/schemas/ResourceServerConsentPolicyEnum'
        authorization_details:
          type:
          - array
          - 'null'
          items: {}
        proof_of_possession:
          $ref: '#/components/schemas/ResourceServerProofOfPossession'
        subject_type_authorization:
          $ref: '#/components/schemas/ResourceServerSubjectTypeAuthorization'
        authorization_policy:
          $ref: '#/components/schemas/ResourceServerAuthorizationPolicy'
          x-release-lifecycle: EA
        client_id:
          type: string
          description: The client ID of the client that this resource server is linked to
          format: client-id
    GetResourceServerResponseContent:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          description: ID of the API (resource server).
        name:
          type: string
          description: Friendly name for this resource server. Can not contain `<` or `>` characters.
        is_system:
          type: boolean
          description: Whether this is an Auth0 system API (true) or a custom API (false).
        identifier:
          type: string
          description: Unique identifier for the API used as the audience parameter on authorization calls. Can not be changed once set.
        scopes:
          type: array
          description: List of permissions (scopes) that this API uses.
          items:
            $ref: '#/components/schemas/ResourceServerScope'
        signing_alg:
          $ref: '#/components/schemas/SigningAlgorithmEnum'
        signing_secret:
          type: string
          description: Secret used to sign tokens when using symmetric algorithms (HS256).
          minLength: 16
        allow_offline_access:
          type: boolean
          description: Whether refresh tokens can be issued for this API (true) or not (false).
        allow_online_access:
          type: boolean
          description: Whether Online Refresh Tokens can be issued for this API (true) or not (false).
        skip_consent_for_verifiable_first_party_clients:
          type: boolean
          description: Whether to skip user consent for applications flagged as first party (true) or not (false).
        token_lifetime:
          type: integer
          description: Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
        token_lifetime_for_web:
          type: integer
          description: Expiration value (in seconds) for access tokens issued for this API via Implicit or Hybrid Flows. Cannot be greater than the `token_lifetime` value.
        enforce_policies:
          type: boolean
          description: Whether authorization polices are enforced (true) or unenforced (false).
        token_dialect:
          $ref: '#/components/schemas/ResourceServerTokenDialectResponseEnum'
        token_encryption:
          $ref: '#/components/schemas/ResourceServerTokenEncryption'
        consent_policy:
          $ref: '#/components/schemas/ResourceServerConsentPolicyEnum'
        authorization_details:
          type:
          - array
          - 'null'
          items: {}
        proof_of_possession:
          $ref: '#/components/schemas/ResourceServerProofOfPossession'
        subject_type_authorization:
          $ref: '#/components/schemas/ResourceServerSubjectTypeAuthorization'
        authorization_policy:
          $ref: '#/components/schemas/ResourceServerAuthorizationPolicy'
          x-release-lifecycle: EA
        client_id:
          type: string
          description: The client ID of the client that this resource server is linked to
          format: client-id
    ResourceServerSubjectTypeAuthorizationUser:
      type: object
      description: Access Permissions for user flows
      additionalProperties: true
      properties:
        policy:
          $ref: '#/components/schemas/ResourceServerSubjectTypeAuthorizationUserPolicyEnum'
    ResourceServerAuthorizationPolicy:
      type:
      - object
      - 'null'
      description: Authorization policy for the resource server.
      additionalProperties: false
      required:
      - policy_id
      x-release-lifecycle: EA
      properties:
        policy_id:
          type: string
          description: The ID of the authorization policy to apply.
          minLength: 1
          maxLength: 1024
    ResourceServerSubjectTypeAuthorizationUserPolicyEnum:
      type: string
      description: Defines the user flows policy for the resource server
      enum:
      - allow_all
      - deny_all
      - require_client_grant
    CreateResourceServerResponseContent:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          description: ID of the API (resource server).
        name:
          type: string
          description: Friendly name for this resource server. Can not contain `<` or `>` characters.
        is_system:
          type: boolean
          description: Whether this is an Auth0 system API (true) or a custom API (false).
        identifier:
          type: string
          description: Unique identifier for the API used as the audience parameter on authorization calls. Can not be changed once set.
        scopes:
          type: array
          description: List of permissions (scopes) that this API uses.
          items:
            $ref: '#/components/schemas/ResourceServerScope'
        signing_alg:
          $ref: '#/components/schemas/SigningAlgorithmEnum'
        signing_secret:
          type: string
          description: Secret used to sign tokens when using symmetric algorithms (HS256).
          minLength: 16
        allow_offline_access:
          type: boolean
          description: Whether refresh tokens can be issued for this API (true) or not (false).
        allow_online_access:
          type: boolean
          description: Whether Online Refresh Tokens can be issued for this API (true) or not (false).
        skip_consent_for_verifiable_first_party_clients:
          type: boolean
          description: Whether to skip user consent for applications flagged as first party (true) or not (false).
        token_lifetime:
          type: integer
          description: Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
        token_lifetime_for_web:
          type: integer
          description: Expiration value (in seconds) for access tokens issued for this API via Implicit or Hybrid Flows. Cannot be greater than the `token_lifetime` value.
        enforce_policies:
          type: boolean
          description: Whether authorization polices are enforced (true) or unenforced (false).
        token_dialect:
          $ref: '#/components/schemas/ResourceServerTokenDialectResponseEnum'
        token_encryption:
          $ref: '#/components/schemas/ResourceServerTokenEncryption'
        consent_policy:
          $ref: '#/components/schemas/ResourceServerConsentPolicyEnum'
        authorization_details:
          type:
          - array
          - 'null'
          items: {}
        proof_of_possession:
          $ref: '#/components/schemas/ResourceServerProofOfPossession'
        subject_type_authorization:
          $ref: '#/components/schemas/ResourceServerSubjectTypeAuthorization'
        authorization_policy:
          $ref: '#/components/schemas/ResourceServerAuthorizationPolicy'
          x-release-lifecycle: EA
        client_id:
          type: string
          description: The client ID of the client that this resource server is linked to
          format: client-id
    ResourceServerProofOfPossessionRequiredForEnum:
      type: string
      description: Specifies which client types require Proof-of-Possession
      enum:
      - public_clients
      - all_clients
    ResourceServerScope:
      type: object
      additionalProperties: false
      required:
      - value
      properties:
        value:
          type: string
          description: Value of this scope.
          minLength: 1
          maxLength: 280
        description:
          type: string
          description: User-friendly description of this scope.
          maxLength: 500
    CreateResourceServerRequestContent:
      type: object
      additionalProperties: false
      required:
      - identifier
      properties:
        name:
          type: string
          description: Friendly name for this resource server. Can not contain `<` or `>` characters.
          maxLength: 200
          pattern: ^[^<>]+$
        identifier:
          type: string
          description: Unique identifier for the API used as the audience parameter on authorization calls. Can not be changed once set.
          minLength: 1
          maxLength: 600
        scopes:
          type: array
          description: List of permissions (scopes) that this API uses.
          items:
            $ref: '#/components/schemas/ResourceServerScope'
        signing_alg:
          $ref: '#/components/schemas/SigningAlgorithmEnum'
        signing_secret:
          type: string
          description: Secret used to sign tokens when using symmetric algorithms (HS256).
          minLength: 16
        allow_offline_access:
          type: boolean
          description: Whether refresh tokens can be issued for this API (true) or not (false).
        allow_online_access:
          type: boolean
          description: Whether Online Refresh Tokens can be issued for this API (true) or not (false).
        token_lifetime:
          type: integer
          description: Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
          minimum: 0
          maximum: 2592000
        token_dialect:
          $ref: '#/components/schemas/ResourceServerTokenDialectSchemaEnum'
        skip_consent_for_verifiable_first_party_clients:
          type: boolean
          description: Whether to skip user consent for applications flagged as first party (true) or not (false).
        enforce_policies:
          type: boolean
          description: Whether to enforce authorization policies (true) or to ignore them (false).
        token_encryption:
          $ref: '#/components/schemas/ResourceServerTokenEncryption'
        consent_policy:
          $ref: '#/components/schemas/ResourceServerConsentPolicyEnum'
        authorization_details:
          type:
          - array
          - 'null'
          items: {}
        proof_of_possession:
          $ref: '#/components/schemas/ResourceServerProofOfPossession'
        subject_type_authorization:
          $ref: '#/components/schemas/ResourceServerSubjectTypeAuthorization'
        authorization_policy:
          $ref: '#/components/schemas/ResourceServerAuthorizationPolicy'
          x-release-lifecycle: EA
    ResourceServerTokenEncryptionKey:
      type: object
      additionalProperties: false
      required:
      - alg
      - pem
      properties:
        name:
          type: string
          description: Name of the encryption key.
          minLength: 1
          maxLength: 128
        alg:
          $ref: '#/components/schemas/ResourceServerTokenEncryptionAlgorithmEnum'
        kid:
          type: string
          description: Key ID.
          minLength: 1
          maxLength: 128
        pem:
          type: string
          description: PEM-formatted public key. Must be JSON escaped.
          default: "-----BEGIN PUBLIC KEY-----\r\nMIIBIjANBg...\r\n-----END PUBLIC KEY-----\r\n"
          minLength: 1
          maxLength: 4096
    UpdateResourceServerRequestContent:
      type: object
      additionalProperties: false
      properties:
        name:
          type: string
          description: Friendly name for this resource server. Can not contain `<` or `>` characters.
          maxLength: 200
          pattern: ^[^<>]+$
        scopes:
          type: array
          description: List of permissions (scopes) that this API uses.
          items:
            $ref: '#/components/schemas/ResourceServerScope'
        signing_alg:
          $ref: '#/components/schemas/SigningAlgorithmEnum'
        signing_secret:
          type: string
          description: Secret used to sign tokens when using symmetric algorithms (HS256).
          minLength: 16
        skip_consent_for_verifiable_first_party_clients:
          type: boolean
          description: Whether to skip user consent for applications flagged as first party (true) or not (false).
        allow_offline_access:
          type: boolean
          description: Whether refresh tokens can be issued for this API (true) or not (false).
        allow_online_access:
          type: boolean
          description: Whether Online Refresh Tokens can be issued for this API (true) or not (false).
        token_lif

# --- truncated at 32 KB (33 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/openapi/auth0-resource-servers-api-openapi.yml