UGM ID — OAuth 2.0 / OpenID Connect Authorization Server
Universitas Gadjah Mada's own identity API, operated by the Directorate of Information Technology (DTI) at oauth.simaster.ugm.ac.id, in front of SIMASTER, the university's integrated academic information system. UGM publishes an OpenAPI 3.1.0 document for it at /openapi.json (retrieved 2026-09-01, 200, 19677 bytes) and serves Swagger UI from /docs. Twenty operations across five tags: the OAuth2 core (authorize, token, introspect, revoke, logout, userinfo), Discovery (OIDC configuration, RFC 8414 metadata, JWKS), three read-only resource endpoints (/api/me, /user/me, /user/username/{username}), social login initiation for Google, Microsoft 365, Facebook, LinkedIn and Apple, and a public /health check that reports the status of its database, Redis and SIMASTER dependencies. Six grant types including PKCE-protected authorization_code and RFC 8693 token exchange. Five scopes, all read-only. The specification is written by UGM in Indonesian. Two real defects are recorded rather than smoothed over: both discovery documents emit scheme-less URLs, breaking OIDC Discovery and RFC 8414 conformance, and the JWKS endpoint returns an empty key set while advertising RS256 id_tokens.