Gluu Authorization API
The Authorization API from Gluu — 3 operation(s) for authorization.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/gluu:gluu-authorization-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Janssen Server Authorization API
description: Janssen Authorization Server - OAuth 2.0 server; OpenID Connect Provider (OP) & UMA Authorization Server (AS)
contact:
name: Contact
url: https://github.com/JanssenProject/jans/discussions
license:
name: License
url: https://github.com/JanssenProject/jans/blob/main/LICENSE
version: OAS Version
servers:
- url: https://jans.local.io/jans-auth
tags:
- name: Authorization
paths:
/restv1/authorize:
get:
tags:
- Authorization
summary: The Authorization Endpoint performs Authentication of the End-User
description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
operationId: get_authorize
parameters:
- name: scope
in: query
required: true
description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
schema:
type: string
- name: response_type
in: query
required: true
description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
schema:
type: string
- name: client_id
in: query
required: true
description: OAuth 2.0 Client Identifier valid at the Authorization Server.
schema:
type: string
- name: redirect_uri
in: query
required: true
description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
schema:
type: string
- name: state
in: query
required: false
description: Opaque value used to maintain state between the request and the callback.
schema:
type: string
- name: response_mode
in: query
required: false
description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
schema:
type: string
- name: nonce
in: query
required: false
description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
schema:
type: string
- name: display
in: query
required: false
description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
schema:
type: string
- name: prompt
in: query
required: false
description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are - none, login, consent, select_account.
schema:
type: string
- name: max_age
in: query
required: false
description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
schema:
type: integer
- name: ui_locales
in: query
required: false
description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
schema:
type: string
- name: id_token_hint
in: query
required: false
description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
schema:
type: string
- name: login_hint
in: query
required: false
description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
schema:
type: string
- name: acr_values
in: query
required: false
description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
schema:
type: string
- name: amr_values
in: query
required: false
description: AMR Values.
schema:
type: string
- name: request
in: query
required: false
description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
schema:
type: string
- name: request_uri
in: query
required: false
description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
schema:
type: string
- name: request_session_id
in: query
required: false
description: Request session id.
schema:
type: string
- name: session_id
in: query
required: false
description: Session id of this call.
schema:
type: string
- name: origin_headers
in: query
required: false
description: Origin headers. Used in custom workflows.
schema:
type: string
- name: code_challenge
in: query
required: false
description: PKCE code challenge.
schema:
type: string
- name: code_challenge_method
in: query
required: false
description: PKCE code challenge method.
schema:
type: string
- name: custom_response_headers
in: query
required: false
description: Custom Response Headers.
schema:
type: string
- name: claims
in: query
required: false
description: Requested Claims.
schema:
type: string
- name: auth_req_id
in: query
required: false
description: CIBA authentication request Id.
schema:
type: string
- name: dpop_jkt
in: query
required: false
description: The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function
schema:
type: string
- name: logout_status_jwt
in: query
required: false
description: Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful.
schema:
type: string
- name: authorization_details
in: query
required: false
description: The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field.
schema:
type: string
responses:
200:
description: OK
content: {}
302:
description: Error codes for authorization endpoint.
content:
application/json:
schema:
title: AuthorizeError
type: object
required:
- error
- error_description
properties:
error:
type: string
format: enum
example:
- invalid_request
- unauthorized_client
- disabled_client
- access_denied
- retry
- unsupported_response_type
- invalid_scope
- server_error
- temporarily_unavailable
- invalid_request_redirect_uri
- invalid_authorization_details
- login_required
- session_selection_required
- consent_required
- user_mismatched
- request_not_supported
- request_uri_not_supported
- invalid_request_uri
- invalid_request_object
- authentication_session_invalid
- invalid_authentication_method
error_description:
type: string
details:
type: string
400:
$ref: '#/components/responses/InvalidRequest'
401:
$ref: '#/components/responses/Unauthorized'
500:
$ref: '#/components/responses/InternalServerError'
post:
tags:
- Authorization
summary: The Authorization Endpoint performs Authentication of the End-User
description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
operationId: post_authorize
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- scope
- response_type
- client_id
- redirect_uri
properties:
scope:
type: string
description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
response_type:
type: string
description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
client_id:
type: string
description: OAuth 2.0 Client Identifier valid at the Authorization Server.
redirect_uri:
type: string
description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
state:
type: string
description: Opaque value used to maintain state between the request and the callback.
response_mode:
type: string
description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
nonce:
type: string
description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
display:
type: string
description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
prompt:
type: string
description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
max_age:
type: integer
description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
ui_locales:
type: string
description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
id_token_hint:
type: string
description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
login_hint:
type: string
description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
acr_values:
type: string
description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
amr_values:
type: string
description: AMR Values.
request:
type: string
description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
request_uri:
type: string
description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
request_session_id:
type: string
description: Request session id.
session_id:
type: string
description: Session id of this call.
origin_headers:
type: string
description: Origin headers. Used in custom workflows.
code_challenge:
type: string
description: PKCE code challenge.
code_challenge_method:
type: string
description: PKCE code challenge method.
custom_response_headers:
type: string
description: Custom Response Headers.
claims:
type: string
description: Requested Claims.
auth_req_id:
type: string
description: CIBA authentication request Id.
dpop_jkt:
type: string
description: The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function
logout_status_jwt:
type: string
description: Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful.
authorization_details:
type: string
description: The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field.
responses:
200:
description: OK
content: {}
302:
description: Error codes for authorization endpoint.
content:
application/json:
schema:
title: AuthorizeError
type: object
required:
- error
- error_description
properties:
error:
type: string
format: enum
example:
- invalid_request
- unauthorized_client
- disabled_client
- access_denied
- retry
- unsupported_response_type
- invalid_scope
- server_error
- temporarily_unavailable
- invalid_request_redirect_uri
- invalid_authorization_details
- login_required
- session_selection_required
- consent_required
- user_mismatched
- request_not_supported
- request_uri_not_supported
- invalid_request_uri
- invalid_request_object
- authentication_session_invalid
- invalid_authentication_method
error_description:
type: string
details:
type: string
400:
$ref: '#/components/responses/InvalidRequest'
401:
$ref: '#/components/responses/Unauthorized'
500:
$ref: '#/components/responses/InternalServerError'
/restv1/par:
post:
tags:
- Authorization
summary: The Pushed Authorization Endpoint performs Authentication Request registration
description: Registers Pushed Authorization Request at Pushed Authorization Endpoint using request parameters defined by https://datatracker.ietf.org/doc/html/draft-ietf-oauth-par-08.
operationId: post_par
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- scope
- response_type
- client_id
- redirect_uri
properties:
scope:
type: string
description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
response_type:
type: string
description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
client_id:
type: string
description: OAuth 2.0 Client Identifier valid at the Authorization Server.
redirect_uri:
type: string
description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
state:
type: string
description: Opaque value used to maintain state between the request and the callback.
response_mode:
type: string
description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
nonce:
type: string
description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
display:
type: string
description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
prompt:
type: string
description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
max_age:
type: integer
description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
ui_locales:
type: string
description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
id_token_hint:
type: string
description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
login_hint:
type: string
description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
acr_values:
type: string
description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
amr_values:
type: string
description: AMR Values.
request:
type: string
description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
request_session_id:
type: string
description: Request session id.
session_id:
type: string
description: Session id of this call.
origin_headers:
type: string
description: Origin headers. Used in custom workflows.
code_challenge:
type: string
description: PKCE code challenge.
code_challenge_method:
type: string
description: PKCE code challenge method.
custom_response_headers:
type: string
description: Custom Response Headers.
claims:
type: string
description: Requested Claims.
responses:
201:
description: Created
content:
application/json:
schema:
title: ParResponse
type: object
required:
- request_uri
- expires_in
properties:
request_uri:
type: string
description: The request URI corresponding to the authorization request posted. This URI is used as reference to the respective request data in the subsequent authorization request only. The way the authorization process obtains the authorization request data is at the discretion of the authorization server and out of scope of this specification. There is no need to make the authorization request data available to other parties via this URI.
expires_in:
type: string
description: A JSON number that represents the lifetime of the request URI in seconds as a positive integer. The request URI lifetime is at the discretion of the authorization server but will typically be relatively short (e.g., between 5 and 600 seconds).
302:
description: Error codes for pushed authorization endpoint.
content:
application/json:
schema:
title: AuthorizeError
type: object
required:
- error
- error_description
properties:
error:
type: string
format: enum
example:
- invalid_request
- unauthorized_client
- disabled_client
- access_denied
- retry
- unsupported_response_type
- invalid_scope
- server_error
- temporarily_unavailable
- invalid_request_object
- invalid_authentication_method
error_description:
type: string
details:
type: string
400:
$ref: '#/components/responses/InvalidRequest'
401:
$ref: '#/components/responses/Unauthorized'
403:
$ref: '#/components/responses/AccessDenied'
500:
$ref: '#/components/responses/InternalServerError'
/restv1/bc-authorize:
post:
tags:
- Authorization
summary: Performs backchannel authorization of the end-user
description: The Backchannel Authentication Endpoint is used to initiate an out-of-band authentication of the end-user.
operationId: bc-authorize
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- client_id
- scope
- client_notification_token
properties:
client_id:
type: string
description: OAuth 2.0 Client Identifier valid at the Authorization Server.
scope:
type: string
description: CIBA authentication requests must contain the openid scope value.
client_notification_token:
type: string
description: It is a bearer token provided by the Client that will be used by the OpenID Provider to authenticate the callback request to the Client. It is required if the Client is registered to use Ping or Push modes.
acr_values:
type: string
description: Requested Authentication Context Class Reference values.
login_hint_token:
type: string
description: A token containing information identifying the end-user for whom authentication is being requested.
id_token_hint:
type: string
description: An ID Token previously issued to the Client by the OpenID Provider being passed back as a hint to identify the end-user for whom authentication is being requested.
login_hint:
type: string
description: A hint to the OpenID Provider regarding the end-user for whom authentication is being requested.
binding_message:
type: string
description: A human readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user.
user_code:
type: string
description: A secret code, such as password or pin, known only to the user but verifiable by the OP.
requested_expiry:
type: integer
description: A positive integer allowing the client to request the expires_in value for the auth_req_id the server will return.
responses:
200:
description: OK
content:
application/json:
schema:
title: Backchannel Authorization
required:
- AUTH_REQ_ID
- EXPIRES_IN
- INTERVAL
type: object
properties:
AUTH_REQ_ID:
type: string
EXPIRES_IN:
type: integer
INTERVAL:
type: integer
400:
$ref: '#/components/responses/InvalidRequest'
401:
description: Unauthorized CIBA (Client Initiated Backchannel Authentication) access.
content:
application/json:
schema:
type: object
required:
- error
- error_description
properties:
error:
type: string
format: enum
example:
- invalid_request
- invalid_scope
- expired_login_hint_token
- unknown_user_id
- unauthorized_client
- missing_user_code
- invalid_user_code
- invalid_binding_message
- invalid_client
- unauthorized_end_user_device
- access_denied
error_description:
type: string
details:
type: string
403:
$ref: '#/components/responses/AccessDenied'
components:
responses:
InvalidRequest:
description: Invalid parameters are provided to endpoint.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
AccessDenied:
description: Invalid details provided hence access denied.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
InternalServerError:
description: Internal error occured. Please check log file for details.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Unauthorized:
description: Unauthorized access request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
schemas:
ErrorResponse:
required:
- error
- error_description
type: object
properties:
error:
type: string
error_description:
type: string
details:
type: string
securitySchemes:
bearer:
type: http
scheme: bearer