Authelia Discovery API

openapi: 3.2.0
info:
  title: Authelia Discovery Endpoints
  description: Well-known discovery documents and JSON Web Key Set published by an Authelia deployment. Extracted verbatim
    from the first-party Authelia OpenAPI 3.2.0 contract at https://github.com/authelia/authelia/blob/master/api/openapi.yml.
  version: 1.0.0
  contact:
    name: Support
    url: https://www.authelia.com/contact/
    email: team@authelia.com
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://{authelia_host}
  description: 'Authelia deployment root URL. Authelia is self-hosted: substitute the host of your own deployment.'
  variables:
    authelia_host:
      default: auth.example.com
      description: Hostname of your Authelia instance. auth.example.com is the default used by Authelia's own published contract
        template.
tags:
- name: OAuth 2.0
  description: OAuth 2.0 Endpoints
  externalDocs:
    url: https://www.authelia.com/integration/openid-connect/introduction/
- name: OpenID Connect 1.0
  description: OpenID Connect 1.0 Endpoints
  externalDocs:
    url: https://www.authelia.com/integration/openid-connect/introduction/
paths:
  /.well-known/openid-configuration:
    get:
      operationId: getOpenIDConnectConfiguration
      tags:
      - OpenID Connect 1.0
      summary: OpenID Connect Discovery 1.0 Document
      description: 'This endpoint retrieves the OpenID Connect Discovery 1.0 document used by clients to perform discovery
        for an OpenID Connect 1.0 Provider. See https://openid.net/specs/openid-connect-discovery-1_0.html.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.Metadata.OpenIDConfiguration'
        '400':
          description: Bad Request
        '500':
          description: Internal Server Error
  /.well-known/oauth-authorization-server:
    get:
      operationId: getOAuth2AuthorizationServerMetadata
      tags:
      - OAuth 2.0
      summary: OAuth 2.0 Authorization Server Metadata
      description: 'This endpoint retrieves the OAuth 2.0 Authorization Server Metadata document (RFC8414) used by clients
        to perform discovery for an OAuth 2.0 Authorization Server. See https://datatracker.ietf.org/doc/html/rfc8414.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.Metadata.OAuth2AuthorizationServer'
        '400':
          description: Bad Request
        '500':
          description: Internal Server Error
  /jwks.json:
    get:
      operationId: getOpenIDConnectJSONWebKeySet
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: OpenID Connect 1.0 JSON Web Key Set Document
      description: 'This endpoint retrieves the OpenID Connect 1.0 JSON Web Key Set Document (JWKS) used by clients to validate
        information from this OpenID Connect 1.0 Provider.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jose.spec.JWKs'
components:
  schemas:
    jose.spec.JWS.None:
      description: The JSON Web Signature Algorithm
      oneOf:
      - $ref: '#/components/schemas/jose.spec.None'
      - $ref: '#/components/schemas/jose.spec.JWS'
      type: string
    jose.spec.JWK.Symmetric:
      description: Symmetric Key in JSON Web Key format as defined by RFC7517 and RFC7518.
      allOf:
      - $ref: '#/components/schemas/jose.spec.JWK.base'
      - type: object
        required:
        - k
        properties:
          kty:
            description: 'The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key.

              '
            type: string
            examples:
            - oct
            enum:
            - oct
          k:
            description: 'The "k" (key value) parameter contains the value of the symmetric (or other single-valued) key.
              It is represented as the base64url encoding of the octet sequence containing the key value.

              '
            type: string
            contentEncoding: base64url
    openid.spec.ResponseType:
      description: The OAuth 2.0 / OpenID Connect 1.0 Response Type.
      enum:
      - code
      - id_token
      - token
      - code token
      - code id_token
      - id_token token
      - code id_token token
      - none
      examples:
      - code
      type: string
    jose.spec.JWS:
      description: The JSON Web Signature Algorithm
      enum:
      - HS256
      - HS384
      - HS512
      - RS256
      - RS384
      - RS512
      - ES256
      - ES384
      - ES512
      - PS256
      - PS384
      - PS512
      type: string
    jose.spec.JWK.EC:
      description: Elliptic Curve Public Key in JSON Web Key format as defined by RFC7517 and RFC7518.
      allOf:
      - $ref: '#/components/schemas/jose.spec.JWK.base'
      - type: object
        required:
        - kty
        - crv
        - x
        properties:
          kty:
            description: 'The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key.

              '
            type: string
            examples:
            - EC
            enum:
            - EC
          alg:
            description: The JSON Web Signature Algorithm
            type: string
            examples:
            - ES256
            enum:
            - ES256
            - ES384
            - ES512
          x:
            description: 'EC Public Key: The x coordinate parameter contains the x coordinate for the Elliptic Curve point.
              It is represented as the base64url encoding of the octet string representation of the coordinate, as defined
              in Section 2.3.5 of SEC1 [SEC1].

              '
            type: string
            contentEncoding: base64url
          y:
            description: 'EC Public Key: The y coordinate parameter contains the y coordinate for the Elliptic Curve point.
              It is represented as the base64url encoding of the octet string representation of the coordinate, as defined
              in Section 2.3.5 of SEC1 [SEC1].

              '
            type: string
            contentEncoding: base64url
          crv:
            description: 'The curve parameter identifies the cryptographic curve used with the key. Curve values from [DSS]
              used by this specification.

              '
            type: string
            examples:
            - P-521
            enum:
            - P-256
            - P-384
            - P-521
            - Ed25519
            - Ed448
            - X25519
            - X448
            - secp256k1
    openid.spec.Metadata.OAuth2AuthorizationServer:
      type: object
      required:
      - issuer
      - authorization_endpoint
      - subject_types_supported
      - response_types_supported
      - require_pushed_authorization_requests
      properties:
        authorization_endpoint:
          description: 'URL of the OP''s OAuth 2.0 Authorization Endpoint [OpenID.Core]. See Also: OpenID.Core: https://openid.net/specs/openid-connect-core-1_0.html

            '
          type: string
          format: uri
          examples:
          - https://auth.example.com/api/oidc/authorization
        claims_supported:
          description: 'JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able
            to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.

            '
          type: array
          examples:
          - - amr
            - aud
            - azp
            - client_id
            - exp
            - iat
            - iss
            - jti
            - rat
            - auth_time
            - nonce
            - groups
            - sub
            - name
            - given_name
            - family_name
            - middle_name
            - nickname
            - preferred_username
            - profile
            - picture
            - website
            - email
            - email_verified
            - alt_emails
            - gender
            - birthdate
            - zoneinfo
            - locale
            - phone_number
            - phone_number_verified
            - address
            - updated_at
          items:
            $ref: '#/components/schemas/openid.implementation.Claims.Name'
        code_challenge_methods_supported:
          description: 'JSON array containing a list of PKCE [RFC7636] code challenge methods supported by this authorization
            server. Code challenge method values are used in the "code_challenge_method" parameter defined in Section 4.3
            of [RFC7636]. The valid code challenge method values are those registered in the IANA "PKCE Code Challenge Methods"
            registry [IANA.OAuth.Parameters]. If omitted, the authorization server does not support PKCE. See Also: PKCE:
            https://datatracker.ietf.org/doc/html/rfc7636 IANA.OAuth.Parameters: https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml

            '
          type: array
          examples:
          - - S256
            - plain
          items:
            $ref: '#/components/schemas/openid.spec.CodeChallengeMethod'
        grant_types_supported:
          type: array
          description: 'JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID
            Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types.
            If omitted, the default value is ["authorization_code", "implicit"].

            '
          examples:
          - - authorization_code
            - implicit
            - client_credentials
            - refresh_token
            - urn:ietf:params:oauth:grant-type:device_code
          items:
            $ref: '#/components/schemas/openid.spec.GrantType'
        device_authorization_endpoint:
          description: 'URL of the authorization server''s device authorization endpoint, as defined in Section 3.1.

            '
          type: string
          format: uri
          examples:
          - https://auth.example.com/api/oidc/device-authorization
        introspection_endpoint:
          description: 'URL of the authorization server''s OAuth 2.0 introspection endpoint [RFC7662]. See Also: OAuth 2.0
            Token Introspection: https://datatracker.ietf.org/doc/html/rfc7662

            '
          type: string
          format: uri
          examples:
          - https://auth.example.com/api/oidc/introspection
        introspection_endpoint_auth_methods_supported:
          description: 'JSON array containing a list of client authentication methods supported by this introspection endpoint.
            The valid client authentication method values are those registered in the IANA "OAuth Token Endpoint Authentication
            Methods" registry [IANA.OAuth.Parameters] or those registered in the IANA "OAuth Access Token Types" registry
            [IANA.OAuth.Parameters]. (These values are and will remain distinct, due to Section 7.2.) If omitted, the set
            of supported authentication methods MUST be determined by other means. See Also: IANA.OAuth.Parameters: https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml
            OAuth 2.0 Authorization Server Metadata - Updated Registration Instructions: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-discovery-10#section-7.2

            '
          type: array
          examples:
          - - client_secret_post
            - client_secret_basic
            - client_secret_jwt
            - private_key_jwt
          items:
            $ref: '#/components/schemas/openid.spec.ClientAuthMethod'
        introspection_endpoint_auth_signing_alg_values_supported:
          description: 'JSON array containing a list of the JWS signing algorithms ("alg" values) supported by the introspection
            endpoint for the signature on the JWT [JWT] used to authenticate the client at the introspection endpoint for
            the "private_key_jwt" and "client_secret_jwt" authentication methods. This metadata entry MUST be present if either
            of these authentication methods are specified in the "introspection_endpoint_auth_methods_supported" entry. No
            default algorithms are implied if this entry is omitted. The value "none" MUST NOT be used. See Also: JWT: https://datatracker.ietf.org/doc/html/rfc7519

            '
          type: array
          examples:
          - - HS256
            - HS384
            - HS512
            - RS256
            - RS384
            - RS512
            - PS256
            - PS384
            - PS512
            - ES256
            - ES384
            - ES512
          items:
            $ref: '#/components/schemas/jose.spec.JWS'
        issuer:
          description: URL using the https scheme with no query or fragment component that the OP asserts as its Issuer Identifier.
            If Issuer discovery is supported (see Section 2), this value MUST be identical to the issuer value returned by
            WebFinger. This also MUST be identical to the iss Claim value in ID Tokens issued from this Issuer.
          type: string
          examples:
          - https://auth.example.com/
        jwks_uri:
          description: 'URL of the OP''s JSON Web Key Set [JWK] document. This contains the signing key(s) the RP uses to
            validate signatures from the OP. The JWK Set MAY also contain the Server''s encryption key(s), which are used
            by RPs to encrypt requests to the Server. When both signing and encryption keys are made available, a use (Key
            Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key''s intended usage.
            Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED,
            as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When
            used, the bare key values MUST still be present and MUST match those in the certificate.

            '
          type: string
          format: uri
          examples:
          - https://auth.example.com/jwks.json
        op_policy_uri:
          description: URL that the OpenID Provider provides to the person registering the Client to read about the OP's requirements
            on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL
            to the person registering the Client if it is given.
          type: string
          format: uri
        op_tos_uri:
          description: 'URL that the OpenID Provider provides to the person registering the Client to read about OpenID Provider''s
            terms of service. The registration process SHOULD display this URL to the person registering the Client if it
            is given.

            '
          type: string
          format: uri
        pushed_authorization_request_endpoint:
          description: 'The URL of the pushed authorization request endpoint at which a client can post an authorization request
            to exchange for a "request_uri" value usable at the authorization server.

            '
          type: string
          format: uri
          examples:
          - https://auth.example.com/api/oidc/pushed-authorization-request
        require_pushed_authorization_requests:
          description: 'Boolean parameter indicating whether the authorization server accepts authorization request data only
            via PAR. If omitted, the default value is "false".

            '
          type: boolean
          examples:
          - false
        response_modes_supported:
          description: 'JSON array containing a list of the OAuth 2.0 response_mode values that this OP supports, as specified
            in OAuth 2.0 Multiple Response Type Encoding Practices [OAuth.Responses]. If omitted, the default for Dynamic
            OpenID Providers is ["query", "fragment"].

            '
          type: array
          examples:
          - - form_post
            - query
            - fragment
            - jwt
            - form_post.jwt
            - query.jwt
            - fragment.jwt
          items:
            $ref: '#/components/schemas/openid.spec.ResponseMode'
        response_types_supported:
          description: 'JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic
            OpenID Providers MUST support the code, id_token, and the token id_token Response Type values.

            '
          type: array
          examples:
          - - code
            - id_token
            - token
            - id_token token
            - code id_token
            - code token
            - code id_token token
          items:
            $ref: '#/components/schemas/openid.spec.ResponseType'
        revocation_endpoint:
          description: 'URL of the authorization server''s OAuth 2.0 revocation endpoint [RFC7009]. See Also: OAuth 2.0 Token
            Revocation: https://datatracker.ietf.org/doc/html/rfc7009

            '
          type: string
          format: uri
          examples:
          - https://auth.example.com/api/oidc/revocation
        revocation_endpoint_auth_methods_supported:
          description: 'JSON array containing a list of client authentication methods supported by this revocation endpoint.
            The valid client authentication method values are those registered in the IANA "OAuth Token Endpoint Authentication
            Methods" registry [IANA.OAuth.Parameters]. If omitted, the default is "client_secret_basic" -- the HTTP Basic
            Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]. See Also: IANA.OAuth.Parameters: https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml
            OAuth 2.0 - Client Password: https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1

            '
          type: array
          examples:
          - - none
            - client_secret_post
            - client_secret_basic
            - client_secret_jwt
            - private_key_jwt
          items:
            $ref: '#/components/schemas/openid.spec.ClientAuthMethod'
        revocation_endpoint_auth_signing_alg_values_supported:
          description: 'JSON array containing a list of the JWS signing algorithms ("alg" values) supported by the revocation
            endpoint for the signature on the JWT [JWT] used to authenticate the client at the revocation endpoint for the
            "private_key_jwt" and "client_secret_jwt" authentication methods. This metadata entry MUST be present if either
            of these authentication methods are specified in the "revocation_endpoint_auth_methods_supported" entry. No default
            algorithms are implied if this entry is omitted. The value "none" MUST NOT be used. See Also: JWT: https://datatracker.ietf.org/doc/html/rfc7519

            '
          type: array
          examples:
          - - HS256
            - HS384
            - HS512
            - RS256
            - RS384
            - RS512
            - PS256
            - PS384
            - PS512
            - ES256
            - ES384
            - ES512
          items:
            $ref: '#/components/schemas/jose.spec.JWS'
        scopes_supported:
          description: 'JSON array containing a list of the OAuth 2.0 [RFC6749] scope values that this server supports. The
            server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even
            when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. See Also:
            OAuth 2.0: https://datatracker.ietf.org/doc/html/rfc6749 OpenID.Core: https://openid.net/specs/openid-connect-core-1_0.html

            '
          type: array
          examples:
          - - openid
            - offline_access
            - profile
            - email
            - address
            - phone
            - groups
          items:
            $ref: '#/components/schemas/openid.implementation.Scopes.Object'
        service_documentation:
          description: 'URL of a page containing human-readable information that developers might want or need to know when
            using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration,
            then information on how to register Clients needs to be provided in this documentation.

            '
          type: string
          examples:
          - https://authelia.com
        subject_types_supported:
          description: 'JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include
            pairwise and public.

            '
          type: array
          examples:
          - - public
            - pairwise
          items:
            $ref: '#/components/schemas/openid.spec.SubjectIdentifier'
        token_endpoint:
          description: 'URL of the OP''s OAuth 2.0 Token Endpoint [OpenID.Core]. This is REQUIRED unless only the Implicit
            Flow is used. See Also: OpenID.Core: https://openid.net/specs/openid-connect-core-1_0.html

            '
          type: string
          format: uri
          examples:
          - https://auth.example.com/api/oidc/token
        token_endpoint_auth_methods_supported:
          description: 'JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The
            options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section
            9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted,
            the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth
            2.0 [RFC6749]. See Also: OAuth 2.0: https://datatracker.ietf.org/doc/html/rfc6749 OpenID.Core Section 9: https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

            '
          type: array
          examples:
          - - none
            - client_secret_post
            - client_secret_basic
            - client_secret_jwt
            - private_key_jwt
          items:
            $ref: '#/components/schemas/openid.spec.ClientAuthMethod'
        token_endpoint_auth_signing_alg_values_supported:
          description: 'JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint
            for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt
            and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. See
            Also: JWT: https://datatracker.ietf.org/doc/html/rfc7519

            '
          type: array
          examples:
          - - HS256
            - HS384
            - HS512
            - RS256
            - RS384
            - RS512
            - PS256
            - PS384
            - PS512
            - ES256
            - ES384
            - ES512
          items:
            $ref: '#/components/schemas/jose.spec.JWS'
        ui_locales_supported:
          type: array
          description: 'Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646]
            language tag values. See Also: BCP47: https://datatracker.ietf.org/doc/html/rfc5646

            '
          examples:
          - - en-US
          items:
            type: string
        authorization_response_iss_parameter_supported:
          description: 'Boolean parameter indicating whether the authorization server provides the iss parameter in the authorization
            response as defined in Section 2. If omitted, the default value is false.

            '
          type: boolean
          examples:
          - true
    jose.spec.JWE.alg:
      description: The JSON Web Encryption Algorithm (CEK)
      enum:
      - RSA1_5
      - RSA-OAEP
      - RSA-OAEP-256
      - A128KW
      - A192KW
      - A256KW
      - dir
      - ECDH-ES
      - ECDH-ES+A128KW
      - ECDH-ES+A192KW
      - ECDH-ES+A256KW
      - A128GCMKW
      - A192GCMKW
      - A256GCMKW
      - PBES2-HS256+A128KW
      - PBES2-HS384+A192KW
      - PBES2-HS512+A256KW
      type: string
    openid.spec.ClaimType:
      description: The representation of claims.
      enum:
      - normal
      - aggregated
      - distributed
      examples:
      - normal
      type: string
    jose.spec.None:
      description: The JSON Web Signature Algorithm
      type: string
      enum:
      - none
    openid.spec.Metadata.OpenIDConfiguration:
      type: object
      required:
      - issuer
      - authorization_endpoint
      - subject_types_supported
      - response_types_supported
      - require_pushed_authorization_requests
      - request_uri_parameter_supported
      - require_request_uri_registration
      - claims_parameter_supported
      - frontchannel_logout_supported
      - frontchannel_logout_session_supported
      - backchannel_logout_supported
      - backchannel_logout_session_supported
      properties:
        acr_values_supported:
          description: JSON array containing a list of the Authentication Context Class References that this OP supports.
          type: array
          items:
            type: string
        authorization_endpoint:
          description: 'URL of the OP''s OAuth 2.0 Authorization Endpoint [OpenID.Core]. See Also: OpenID.Core: https://openid.net/specs/openid-connect-core-1_0.html

            '
          type: string
          format: uri
          examples:
          - https://auth.example.com/api/oidc/authorization
        backchannel_logout_session_supported:
          description: 'Boolean value specifying whether the OP can pass a sid (session ID) Claim in the Logout Token to identify
            the RP session with the OP. If supported, the sid Claim is also included in ID Tokens issued by the OP. If omitted,
            the default value is false.

            '
          type: boolean
          examples:
          - false
        backchannel_logout_supported:
          description: 'Boolean value specifying whether the OP supports back-channel logout, with true indicating support.
            If omitted, the default value is false.

            '
          type: boolean
          examples:
          - false
        claims_parameter_supported:
          description: 'Boolean value specifying whether the OP supports use of the claims parameter, with true indicating
            support. If omitted, the default value is false.

            '
          type: boolean
          examples:
          - false
        claim_types_supported:
          description: 'JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types
            are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. Values defined by this specification are
            normal, aggregated, and distributed. If omitted, the implementation supports only normal Claims. See Also: OpenID.Core
            Section 5.6: https://openid.net/specs/openid-connect-core-1_0.html#ClaimTypes

            '
          type: array
          examples:
          - - normal
          items:
            $ref: '#/components/schemas/openid.spec.ClaimType'
        claims_locales_supported:
          description: 'Languages and scripts supported for values in Claims being returned, represented as a JSON array of
            BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.
            See Also: BCP47: https://datatracker.ietf.org/doc/html/rfc5646

            '
          type: array
          examples:
          - - en-US
          items:
            type: string
        claims_supported:
          description: 'JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able
            to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.

            '
          type: array
          examples:
          - - amr
            - aud
            - azp
            - client_id
            - exp
            - iat
            - iss
            - jti
            - rat
            - auth_time
            - nonce
            - groups
            - sub
            - name
            - given_name
            - family_name
            - middle_name
            - nickname
            - preferred_username
            - profile
            - picture
            - website
            - email
            - email_verified
            - alt_emails
            - gender
            - birthdate
            - zoneinfo
            - locale
            - phone_number
            - phone_number_verified
            - address
            - updated_at
          items:
            $ref: '#/components/schemas/openid.implementation.Claims.Name'
        prompt_values_supported:
          description: 'OPTIONAL. JSON array containing the list of prompt values that this OP supports.

            '
          type: array
          items:
            $ref: '#/components/schemas/openid.spec.Prompt'
        code_challenge_methods_supported:
          description: 'JSON array containing a list of PKCE [RFC7636] code challenge methods supported by this authorization
            server. Code challenge method values are used in the "code_challenge_method" parameter defined in Section 4.3
            of [RFC7636]. The valid code challenge method values are those registered in the IANA "PKCE Code Challenge Methods"
            registry [IANA.OAuth.Parameters]. If omitted, the authorization server does not support PKCE. See Also: PKCE:
            https://datatracker.ietf.org/doc/html/rfc7636 IANA.OAuth.Parameters: https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml

            '
          type: array
          examples:
          - - S256
            - plain
          items:
            $ref: '#/components/schemas/openid.spec.CodeChallengeMethod'
        display_values_supported:
          description: 'JSON array containing a list of the display parameter values that the OpenID Provider supports. These
            values are described in Section 3.1.2.1 of OpenID Connect Core 1.0 [OpenID.Core]. See Also: OpenID.Core Section
            3.1.2.1: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

            '
          type: array
          examples:
          - - page
          items:
            $ref: '#/components/schemas/openid.spec.DisplayType'
        frontchannel_logout_session_supported:
          description: 'Boolean value specifying whether the OP can pass iss (issuer) and sid (session ID) query parameters
            to identify the RP session with the OP when the frontchannel_logout_uri is used. If supported, the sid Claim is
            also included in ID Tokens issued by the OP. If omitted, the default value is false.

            '
          type: boolean
          examples:
          - false
        frontchannel_logout_supported:
          description: 'Boolean value specifying whether the OP supports HTTP-based logout, with true indicating support.
            If omitted, the default value is false.

            '
          type: boolean
          examples:
          - false
        grant_types_supported:
          description: 'JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID
            Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types.
            If omitted, the default value is ["authorization_code", "implicit"].

            '
          type: array
          examples:
          - - authorization_code
            - implicit
            - client_credentials
            - refresh_token
            - urn:ietf:params:oauth:grant-type:device_code
          items:
            $ref: '#/components/schemas/openid.spec.Gra

# --- truncated at 32 KB (73 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/authelia/refs/heads/main/openapi/authelia-discovery-api-openapi.yml