Authelia OIDC API

openapi: 3.2.0
info:
  title: Authelia OpenID Connect 1.0 / OAuth 2.0 Endpoints
  description: OpenID Connect 1.0 Provider and OAuth 2.0 authorization server endpoints exposed by an Authelia deployment.
    Extracted verbatim from the first-party Authelia OpenAPI 3.2.0 contract at https://github.com/authelia/authelia/blob/master/api/openapi.yml.
  version: 1.0.0
  contact:
    name: Support
    url: https://www.authelia.com/contact/
    email: team@authelia.com
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://{authelia_host}
  description: 'Authelia deployment root URL. Authelia is self-hosted: substitute the host of your own deployment.'
  variables:
    authelia_host:
      default: auth.example.com
      description: Hostname of your Authelia instance. auth.example.com is the default used by Authelia's own published contract
        template.
tags:
- name: OAuth 2.0
  description: OAuth 2.0 Endpoints
  externalDocs:
    url: https://www.authelia.com/integration/openid-connect/introduction/
- name: OpenID Connect 1.0
  description: OpenID Connect 1.0 Endpoints
  externalDocs:
    url: https://www.authelia.com/integration/openid-connect/introduction/
paths:
  /api/oidc/authorization:
    get:
      operationId: getOpenIDConnectAuthorization
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: OpenID Connect 1.0 Authorization Endpoint
      description: 'This endpoint performs OpenID Connect 1.0 Authorization.

        '
      parameters:
      - in: query
        name: consent_id
        required: false
        description: The OpenID Connect 1.0 consent workflow ID.
        schema:
          type: string
          format: uuid
          pattern: ^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$
          examples:
          - 713ef767-81bc-4a27-9b83-5fe2e101b2b4
      - in: query
        name: scope
        description: The requested scope.
        required: true
        schema:
          type: string
          examples:
          - openid profile groups
      - in: query
        name: response_type
        description: The OAuth 2.0 response type.
        required: true
        schema:
          $ref: '#/components/schemas/openid.spec.ResponseType'
      - in: query
        name: client_id
        description: The OAuth 2.0 client identifier.
        required: true
        schema:
          type: string
          examples:
          - app
      - in: query
        name: redirect_uri
        description: 'Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection
          URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section
          6.2.1 of [RFC3986] (Simple String Comparison). When using this flow, the Redirection URI SHOULD use the https scheme;
          however, it MAY use the http scheme, provided that the Client Type is confidential, as defined in Section 2.1 of
          OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. The Redirection URI MAY use
          an alternate scheme, such as one that is intended to identify a callback into a native application.

          '
        required: true
        schema:
          type: string
          format: uri
          examples:
          - https://app.example.com
      - in: query
        name: state
        description: 'Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request
          Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser
          cookie.

          '
        required: false
        schema:
          type: string
          examples:
          - oV84Vsy7wyCgRk2h4aZBmXZq4q3g2f
      - in: query
        name: response_mode
        description: 'Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization
          Endpoint. This use of this parameter is NOT RECOMMENDED when the Response Mode that would be requested is the default
          mode specified for the Response Type.

          '
        required: false
        schema:
          $ref: '#/components/schemas/openid.spec.ResponseMode'
      - in: query
        name: nonce
        description: 'String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The
          value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present
          in the nonce values used to prevent attackers from guessing values. For implementation notes, see Section 15.5.2.

          '
        required: false
        schema:
          type: string
          examples:
          - TRMLqchoKGQNcooXvBvUy9PtmLdJGf
      - in: query
        name: display
        description: 'Not Supported: ASCII string value that specifies how the Authorization Server displays the authentication
          and consent user interface pages to the End-User.

          '
        required: false
        schema:
          $ref: '#/components/schemas/openid.spec.DisplayType'
      - in: query
        name: prompt
        description: 'Not Supported: Space delimited, case sensitive list of ASCII string values that specifies whether the
          Authorization Server prompts the End-User for reauthentication and consent.

          '
        required: false
        schema:
          $ref: '#/components/schemas/openid.spec.Prompt'
      - in: query
        name: max_age
        description: 'Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the
          End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt
          to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE [OpenID.PAPE]
          max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value.

          '
        required: false
        schema:
          type: integer
          examples:
          - 3600
      - in: query
        name: ui_locales
        description: 'Not Supported: End-User''s preferred languages and scripts for the user interface, represented as a
          space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value "fr-CA
          fr en" represents a preference for French as spoken in Canada, then French (without a region designation), followed
          by English (without a region designation). An error SHOULD NOT result if some or all of the requested locales are
          not supported by the OpenID Provider.

          '
        required: false
        schema:
          type: string
          examples:
          - en-US
      - in: query
        name: claims_locales
        description: 'Not Supported: End-User''s preferred languages and scripts for Claims being returned, represented as
          a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. An error SHOULD NOT result
          if some or all of the requested locales are not supported by the OpenID Provider.

          '
        required: false
        schema:
          type: string
          examples:
          - en-US
      - in: query
        name: id_token_hint
        required: false
        description: 'Not Supported: ID Token previously issued by the Authorization Server being passed as a hint about the
          End-User''s current or past authenticated session with the Client. If the End-User identified by the ID Token is
          logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise,
          it SHOULD return an error, such as login_required. When possible, an id_token_hint SHOULD be present when prompt=none
          is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully
          when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token
          when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it
          as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client
          MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the
          ID Token, and use the re-encrypted ID token as the id_token_hint value.

          '
        schema:
          type: string
      - in: query
        name: login_hint
        description: 'Not Supported: Hint to the Authorization Server about the login identifier the End-User might use to
          log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or
          other identifier) and then wants to pass that value as a hint to the discovered authorization service. It is RECOMMENDED
          that the hint value match the value used for discovery. This value MAY also be a phone number in the format specified
          for the phone_number Claim. The use of this parameter is left to the OP''s discretion.

          '
        required: false
        schema:
          type: string
      - in: query
        name: acr_values
        description: 'Not Supported: Requested Authentication Context Class Reference values. Space-separated string that
          specifies the acr values that the Authorization Server is being requested to use for processing this Authentication
          Request, with the values appearing in order of preference. The Authentication Context Class satisfied by the authentication
          performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a Voluntary
          Claim by this parameter.

          '
        required: false
        schema:
          type: string
      - in: query
        name: claims
        description: 'Not Supported: The claims parameter value, as specified in Section 5.5.

          '
        required: false
        schema:
          type: string
      - in: query
        name: registration
        description: 'Not Supported: This parameter is used by the Client to provide information about itself to a Self-Issued
          OP that would normally be provided to an OP during Dynamic Client Registration, as specified in Section 7.2.1.

          '
        required: false
        schema:
          type: string
      - in: query
        name: request
        description: 'Not Supported: Request Object value, as specified in Section 6.1. The Request Object MAY be encrypted
          to the Self-Issued OP by the Client. In this case, the sub (subject) of a previously issued ID Token for this Client
          MUST be sent as the kid (Key ID) of the JWE. Encrypting content to Self-Issued OPs is currently only supported when
          the OP''s JWK key type is RSA and the encryption algorithm used is RSA1_5.

          '
        required: false
        schema:
          type: string
      - in: query
        name: code_challenge
        description: 'RFC7636 Code Challenge.

          '
        required: false
        schema:
          type: string
      - in: query
        name: code_challenge_method
        required: false
        description: 'RFC7636 Code Challenge Method. defaults to "plain" if not present in the request. Code verifier transformation
          method is "S256" or "plain".

          '
        schema:
          $ref: '#/components/schemas/openid.spec.CodeChallengeMethod'
      responses:
        '200':
          description: 'OK Response. It should be noted that it is not possible to properly describe responses for this endpoint.

            '
          content:
            text/html:
              schema:
                type: string
                description: The Form Post Response Mode content.
        '303':
          description: 'See Other. It should be noted that it is not possible to properly describe responses for this endpoint.

            '
          headers:
            Location:
              schema:
                type: string
              description: 'Redirection location for the consent flow, or the authorization response callback location when
                using the Query or Fragment Response Modes.

                '
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
      security:
      - authelia_auth: []
    post:
      operationId: postOpenIDConnectAuthorization
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: OpenID Connect 1.0 Authorization Endpoint
      description: 'This endpoint performs OpenID Connect 1.0 Authorization.

        '
      requestBody:
        description: Authorize Request Parameters.
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/openid.spec.AuthorizeRequest'
      responses:
        '200':
          description: OK
          content:
            text/html:
              schema:
                type: string
                description: The Form Post Response Mode content.
        '303':
          description: See Other
          headers:
            Location:
              schema:
                type: string
              description: 'Redirection location for the consent flow, or the authorization response callback location when
                using the Query or Fragment Response Modes.

                '
        '400':
          description: Bad Request
        '500':
          description: Internal Server Error
      security:
      - authelia_auth: []
  /api/oidc/device-authorization:
    post:
      operationId: postOAuth2DeviceAuthorization
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: RFC8628 OAuth 2.0 Device Authorization Grant Endpoint
      description: 'This endpoint performs the client interaction for the Device Authorization Flow.

        '
      requestBody:
        description: Device Authorize Request (Device Code Flow) Parameters.
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/openid.spec.DeviceAuthorizeRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  device_code:
                    type: string
                    examples:
                    - authelia_dc_oqLXXUv2pvCDgBJLBav63ZduL4CxKP7JpYZ6ldHp39Y.u3XxwV3O-uYOA5TSv44iQyB27YjUGawJLlwOMuC770E
                  user_code:
                    type: string
                    examples:
                    - XGQWWFMM
                  verification_uri:
                    type: string
                    format: uri
                    examples:
                    - https://auth.example.com/consent/openid/device-authorization
                  verification_uri_complete:
                    type: string
                    format: uri
                    examples:
                    - https://auth.example.com/consent/openid/device-authorization?user_code=XGQWWFMM
                  expires_in:
                    type: integer
                    examples:
                    - 600
                  interval:
                    type: integer
                    examples:
                    - 10
        '400':
          description: Bad Request
        '500':
          description: Internal Server Error
      security:
      - authelia_auth: []
    put:
      operationId: putOAuth2DeviceAuthorization
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: RFC8628 OAuth 2.0 Device Authorization Grant Endpoint
      description: 'This endpoint performs the user interaction for the Device Authorization Flow.

        '
      requestBody:
        description: Device Authorize Request (User Code Flow) Parameters.
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                flow_id:
                  type: string
                  description: This is the field of the same name returned by the consent endpoint.
                user_code:
                  type: string
                  description: This is the user code submitted by the user during the Device Authorization Flow.
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
        '500':
          description: Internal Server Error
      security:
      - authelia_auth: []
  /api/oidc/pushed-authorization-request:
    post:
      operationId: postOAuth2PushedAuthorizationRequest
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: OAuth 2.0 Pushed Authorization Endpoint
      description: 'This endpoint performs OAuth 2.0 Pushed Authorization.

        '
      requestBody:
        description: Pushed Authorize Request Parameters.
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - $ref: '#/components/schemas/openid.spec.AuthorizeRequest'
              - $ref: '#/components/schemas/openid.spec.AccessRequest.ClientAuth'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                description: The Pushed Authorize Request Successful Response.
                properties:
                  request_uri:
                    type: string
                    format: uri
                    description: 'The request URI corresponding to the authorization request posted. This URI is a single-use
                      reference to the respective request data in the subsequent authorization request. The way the authorization
                      process obtains the authorization request data is at the discretion of the authorization server and
                      is out of scope of this specification. There is no need to make the authorization request data available
                      to other parties via this URI.

                      '
                    examples:
                    - urn:ietf:params:oauth:request_uri:lXtUUGsLrMxI5cogDk6Zk1pc5-Zw95lT4fzY0eAbdiU
                  expires_in:
                    type: integer
                    description: 'A JSON number that represents the lifetime of the request URI in seconds as a positive integer.
                      The request URI lifetime is at the discretion of the authorization server but will typically be relatively
                      short (e.g., between 5 and 600 seconds).

                      '
                    examples:
                    - 300
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
        '413':
          description: Content Too Large
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
          headers:
            Retry-After:
              schema:
                type: string
                format: http-date
              description: The date time that the request can be retried.
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
      security:
      - openid: []
  /api/oidc/token:
    post:
      operationId: postOpenIDConnectToken
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: OpenID Connect 1.0 Token Endpoint
      description: 'This endpoint performs OpenID Connect 1.0 Token Access Requests.

        '
      requestBody:
        description: Access Request Parameters.
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              oneOf:
              - $ref: '#/components/schemas/openid.spec.AccessRequest.AuthorizationCodeFlow'
              - $ref: '#/components/schemas/openid.spec.AccessRequest.RefreshTokenFlow'
              - $ref: '#/components/schemas/openid.spec.AccessRequest.ClientCredentialsFlow'
              - $ref: '#/components/schemas/openid.spec.AccessRequest.DeviceCodeFlow'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/openid.spec.AccessResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
      security:
      - openid: []
  /api/oidc/revocation:
    post:
      operationId: postOAuth2Revocation
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: OAuth 2.0 Token Revocation Endpoint
      description: 'This endpoint performs OAuth 2.0 Token Revocation Requests.

        '
      requestBody:
        description: Required OAuth 2.0 revocation parameters.
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - $ref: '#/components/schemas/openid.spec.AccessServerTokenAssertionRequest'
              - $ref: '#/components/schemas/openid.spec.AccessRequest.ClientAuth'
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
      security:
      - openid: []
  /api/oidc/introspection:
    post:
      operationId: postOAuth2Introspection
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: OAuth 2.0 Token Introspection Endpoint
      description: 'This endpoint performs OAuth 2.0 Token Introspection Requests.

        '
      requestBody:
        description: Required OAuth 2.0 introspection parameters.
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - $ref: '#/components/schemas/openid.spec.AccessServerTokenAssertionRequest'
              - $ref: '#/components/schemas/openid.spec.AccessRequest.ClientAuth'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.IntrospectionResponse'
            application/token-introspection+jwt:
              schema:
                description: 'The RFC7519 encoded JWT with the nested ''token_introspection'' claim which contains the same
                  structure

                  as the openid.spec.IntrospectionResponse described in this OpenAPI 3.0 specification.

                  '
                type: string
                examples:
                - eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20vIiwiYXVkIjoiaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20vcmVzb3VyY2UiLCJpYXQiOjE1MTQ3OTc4OTIsInRva2VuX2ludHJvc3BlY3Rpb24iOnsiYWN0aXZlIjp0cnVlLCJleHAiOjE1MTQ3OTc5NDIsImNsaWVudF9pZCI6ImV4YW1wbGUiLCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIiwiaWF0IjoxNTE0Nzk3ODIyLCJzdWIiOiI5Y2JhMzJhMC02M2EyLTQyZDUtODNlYi1kZmM3NTc4OGEyMjIiLCJhdWQiOiJodHRwczovL2FwcC5leGFtcGxlLmNvbS9yZXNvdXJjZSIsInVzZXJuYW1lIjoiam9obiJ9fQ.9rN-G3uaj28Geiktfvknl-G6EnZxOGJjpXcemvsllYA
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.spec.ErrorResponseGeneric'
      security:
      - openid: []
  /api/oidc/userinfo:
    get:
      operationId: getOpenIDConnectUserInfo
      tags:
      - OpenID Connect 1.0
      summary: OpenID Connect 1.0 UserInfo Endpoint
      description: 'This endpoint performs OpenID Connect 1.0 UserInfo Access Requests.

        '
      parameters:
      - in: query
        name: access_token
        description: The OAuth 2.0 Access Token issued by this OpenID Connect 1.0 Provider.
        schema:
          type: string
          examples:
          - authelia_at_6-8jeA8y9Y744pAHCRwGtJrsD9ABOVWyzL3uWB1ntbI.foaDPNLT0T7VVQ9on5F1rOfHs0Lbc09FGO2xF_pzmNY
      responses:
        '200':
          description: OK
          content:
            application/jwt: {}
            application/json:
              schema:
                $ref: '#/components/schemas/openid.implementation.Claims.Object'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      security:
      - openid: []
    post:
      operationId: postOpenIDConnectUserInfo
      tags:
      - OpenID Connect 1.0
      summary: OpenID Connect 1.0 UserInfo Endpoint
      description: 'This endpoint performs OpenID Connect 1.0 UserInfo Access Requests.

        '
      parameters:
      - in: query
        name: access_token
        description: The OAuth 2.0 Access Token issued by this OpenID Connect 1.0 Provider.
        schema:
          type: string
          examples:
          - authelia_at_6-8jeA8y9Y744pAHCRwGtJrsD9ABOVWyzL3uWB1ntbI.foaDPNLT0T7VVQ9on5F1rOfHs0Lbc09FGO2xF_pzmNY
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                access_token:
                  description: The OAuth 2.0 Access Token issued by this OpenID Connect 1.0 Provider.
                  type: string
                  examples:
                  - authelia_at_6-8jeA8y9Y744pAHCRwGtJrsD9ABOVWyzL3uWB1ntbI.foaDPNLT0T7VVQ9on5F1rOfHs0Lbc09FGO2xF_pzmNY
      responses:
        '200':
          description: OK
          content:
            application/jwt: {}
            application/json:
              schema:
                $ref: '#/components/schemas/openid.implementation.Claims.Object'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      security:
      - openid: []
  /api/oidc/consent:
    get:
      operationId: getOpenIDConnectConsent
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: OpenID Connect 1.0 Consent Information
      description: 'This endpoint retrieves the consent information about a specific consent ID during the consent workflow.


        Either the flow_id or user_code parameter must be provided. The user_code parameter is used by the RFC8628 OAuth 2.0
        Device Authorization Grant sub-flow.

        '
      parameters:
      - $ref: '#/components/parameters/flowIDParam'
      - $ref: '#/components/parameters/userCodeParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.request.consent'
        '403':
          description: Forbidden
      security:
      - authelia_auth: []
    post:
      operationId: postOpenIDConnectConsent
      tags:
      - OAuth 2.0
      - OpenID Connect 1.0
      summary: OpenID Connect 1.0 Consent Response
      description: 'This endpoint retrieves the consent response for a specific consent ID during the consent workflow.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/openid.request.consent.body'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/openid.response.consent'
        '403':
          description: Forbidden
      security:
      - authelia_auth: []
components:
  schemas:
    openid.spec.AccessResponse:
      type: object
      required:
      - access_token
      - token_type
      - expires_in
      properties:
        access_token:
          description: The access token issued by the authorization server.
          examples:
          - authelia_at_6-8jeA8y9Y744pAHCRwGtJrsD9ABOVWyzL3uWB1ntbI.foaDPNLT0T7VVQ9on5F1rOfHs0Lbc09FGO2xF_pzmNY
          type: string
        id_token:
          description: The id token issued by the authorization server.
          examples:
          - eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
          type: string
        refresh_token:
          description: 'The refresh token, which can be used to obtain new access tokens using the same authorization grant
            as described in Section 6.

            '
          examples:
          - authelia_rt_MgALbONdFPIwo3o2QukHry7W451xrO6jza31IS8Vh4M.IArqzOzLwY6HWqom1vmp9DUWBuOQel_fGnRw5MyT-jo
          type: string
        token_type:
          description: 'The access token type provides the client with the information required to successfully utilize the
            access token to make a protected resource request (along with type-specific attributes). The client MUST NOT use
            an access token if it does not understand the token type.

            '
          enum:
          - bearer
          examples:
          - bearer
          type: string
        expires_in:
          description: 'The lifetime in seconds of the access token. For example, the value "3600" denotes that the access
            token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD
            provide the expiration time via other means or document the default value.

            '
          examples:
          - 3600
          type: integer
        state:
          description: Exactly the state value passed in the authorization request if present.
          examples:
          - 5dVZhNfri5XZS6wadskuzUk4MHYCvEcUgidjMeBjsktAhY7EKB
          type: string
        scope:
          description: 'The scope of the access token as described by Section 3.3 if it differs from the requested scope.

            '
          examples:
          - openid profile groups
          type: string
    openid.response.consent:
      type: object
      properties:
        s

# --- truncated at 32 KB (64 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/authelia/refs/heads/main/openapi/authelia-oidc-api-openapi.yml