Eliq .well Known API

openapi: 3.2.0
info:
  title: Eliq auth .well Known API
  version: 2.0.0
  description: '# Eliq auth API


    Used to obtain access tokens for Eliq APIs, most commonly the Eliq data management API and Eliq insights API.


    ## Getting started


    OAuth clients are set up in collaboration with Eliq. Your account manager will provide you with a `client_id`.

    Client secrets are generated via the **Client Admin API** or by your account manager.


    Each client is configured with access to one or more APIs, along with the allowed access types and scopes for each.

    You can review and manage your client''s API access, secrets, and scope configuration in the **Client Admin Portal**.


    **Multiple secrets** are supported per client to allow for smooth secret rotation without downtime.


    ## Requesting tokens


    Tokens are requested via `POST /oauth/token` using OAuth 2.0 client credentials. The endpoint supports three flows:


    - **App token** — machine-to-machine token scoped to a specific API

    - **Delegated token** — token issued on behalf of a subject (e.g. a user or location)

    - **Token refresh** — exchange a refresh token for a new access token


    ## Token verification


    Tokens are signed with asymmetric keys. The public key is available at `GET /.well-known/jwks.json`.

    The full OpenID configuration is available at `GET /.well-known/openid-configuration`.


    ## Token claims


    | Claim | Description | Example |

    |---|---|---|

    | `iss` | Token issuer | `https://auth-api.eliq.com` |

    | `aud` | Target API the token is scoped to | `data-management-api` |

    | `client_id` | OAuth application the token belongs to | `utility-acme-backend` |

    | `org` | Organization ID | `1234567890` |

    | `org_type` | Type of organization | `utility` |

    | `sub` | Identity the token represents | `12345` (user) or `utility-acme-backend` (app) |

    | `sub_type` | Type of subject | `user`, `client` |

    | `scope` | Scopes granted | `data.read data.write` |

    | `access_type` | How access was granted | `application`, `delegated` |


    > **Legacy (v1) clients:** If your `client_id` is a numeric Utility ID, your existing integration continues to work without any changes. See the Legacy v1 section at the bottom of this page.'
servers:
- url: https://auth-api.eliq.com
  description: Production
- url: https://auth-api-uat.eliq.com
  description: UAT
tags:
- name: .well Known
paths:
  /.well-known/jwks.json:
    get:
      summary: JSON Web Key Set
      operationId: get-jwks
      description: Returns the public keys used to verify token signatures. Use this endpoint to validate JWTs issued by the auth API.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                description: JWKS document containing the public signing keys.
      tags:
      - .well Known
  /.well-known/openid-configuration:
    get:
      summary: OpenID configuration
      operationId: get-openid-configuration
      description: Returns the OpenID Connect discovery document, including supported endpoints, signing algorithms, and claim types.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                description: OpenID Connect discovery document.
      tags:
      - .well Known
x-provenance:
  method: harvested
  publisher: Eliq
  source: https://eliqdeveloperportalst.blob.core.windows.net/api-docs/eliq-auth-api.yaml
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)