Gluu Authorization API

openapi: 3.2.0
info:
  title: Janssen Server Authorization API
  description: Janssen Authorization Server - OAuth 2.0 server; OpenID Connect Provider (OP) & UMA Authorization Server (AS)
  contact:
    name: Contact
    url: https://github.com/JanssenProject/jans/discussions
  license:
    name: License
    url: https://github.com/JanssenProject/jans/blob/main/LICENSE
  version: OAS Version
servers:
- url: https://jans.local.io/jans-auth
tags:
- name: Authorization
paths:
  /restv1/authorize:
    get:
      tags:
      - Authorization
      summary: The Authorization Endpoint performs Authentication of the End-User
      description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
      operationId: get_authorize
      parameters:
      - name: scope
        in: query
        required: true
        description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
        schema:
          type: string
      - name: response_type
        in: query
        required: true
        description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
        schema:
          type: string
      - name: client_id
        in: query
        required: true
        description: OAuth 2.0 Client Identifier valid at the Authorization Server.
        schema:
          type: string
      - name: redirect_uri
        in: query
        required: true
        description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
        schema:
          type: string
      - name: state
        in: query
        required: false
        description: Opaque value used to maintain state between the request and the callback.
        schema:
          type: string
      - name: response_mode
        in: query
        required: false
        description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
        schema:
          type: string
      - name: nonce
        in: query
        required: false
        description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
        schema:
          type: string
      - name: display
        in: query
        required: false
        description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
        schema:
          type: string
      - name: prompt
        in: query
        required: false
        description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are - none, login, consent, select_account.
        schema:
          type: string
      - name: max_age
        in: query
        required: false
        description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
        schema:
          type: integer
      - name: ui_locales
        in: query
        required: false
        description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
        schema:
          type: string
      - name: id_token_hint
        in: query
        required: false
        description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
        schema:
          type: string
      - name: login_hint
        in: query
        required: false
        description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
        schema:
          type: string
      - name: acr_values
        in: query
        required: false
        description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
        schema:
          type: string
      - name: amr_values
        in: query
        required: false
        description: AMR Values.
        schema:
          type: string
      - name: request
        in: query
        required: false
        description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
        schema:
          type: string
      - name: request_uri
        in: query
        required: false
        description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
        schema:
          type: string
      - name: request_session_id
        in: query
        required: false
        description: Request session id.
        schema:
          type: string
      - name: session_id
        in: query
        required: false
        description: Session id of this call.
        schema:
          type: string
      - name: origin_headers
        in: query
        required: false
        description: Origin headers. Used in custom workflows.
        schema:
          type: string
      - name: code_challenge
        in: query
        required: false
        description: PKCE code challenge.
        schema:
          type: string
      - name: code_challenge_method
        in: query
        required: false
        description: PKCE code challenge method.
        schema:
          type: string
      - name: custom_response_headers
        in: query
        required: false
        description: Custom Response Headers.
        schema:
          type: string
      - name: claims
        in: query
        required: false
        description: Requested Claims.
        schema:
          type: string
      - name: auth_req_id
        in: query
        required: false
        description: CIBA authentication request Id.
        schema:
          type: string
      - name: dpop_jkt
        in: query
        required: false
        description: The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function
        schema:
          type: string
      - name: logout_status_jwt
        in: query
        required: false
        description: Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful.
        schema:
          type: string
      - name: authorization_details
        in: query
        required: false
        description: The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field.
        schema:
          type: string
      responses:
        200:
          description: OK
          content: {}
        302:
          description: Error codes for authorization endpoint.
          content:
            application/json:
              schema:
                title: AuthorizeError
                type: object
                required:
                - error
                - error_description
                properties:
                  error:
                    type: string
                    format: enum
                    example:
                    - invalid_request
                    - unauthorized_client
                    - disabled_client
                    - access_denied
                    - retry
                    - unsupported_response_type
                    - invalid_scope
                    - server_error
                    - temporarily_unavailable
                    - invalid_request_redirect_uri
                    - invalid_authorization_details
                    - login_required
                    - session_selection_required
                    - consent_required
                    - user_mismatched
                    - request_not_supported
                    - request_uri_not_supported
                    - invalid_request_uri
                    - invalid_request_object
                    - authentication_session_invalid
                    - invalid_authentication_method
                  error_description:
                    type: string
                  details:
                    type: string
        400:
          $ref: '#/components/responses/InvalidRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        500:
          $ref: '#/components/responses/InternalServerError'
    post:
      tags:
      - Authorization
      summary: The Authorization Endpoint performs Authentication of the End-User
      description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
      operationId: post_authorize
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - scope
              - response_type
              - client_id
              - redirect_uri
              properties:
                scope:
                  type: string
                  description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
                response_type:
                  type: string
                  description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
                client_id:
                  type: string
                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
                redirect_uri:
                  type: string
                  description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
                state:
                  type: string
                  description: Opaque value used to maintain state between the request and the callback.
                response_mode:
                  type: string
                  description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
                nonce:
                  type: string
                  description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
                display:
                  type: string
                  description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
                prompt:
                  type: string
                  description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
                max_age:
                  type: integer
                  description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
                ui_locales:
                  type: string
                  description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
                  example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
                id_token_hint:
                  type: string
                  description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
                login_hint:
                  type: string
                  description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
                acr_values:
                  type: string
                  description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
                amr_values:
                  type: string
                  description: AMR Values.
                request:
                  type: string
                  description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
                request_uri:
                  type: string
                  description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
                request_session_id:
                  type: string
                  description: Request session id.
                session_id:
                  type: string
                  description: Session id of this call.
                origin_headers:
                  type: string
                  description: Origin headers. Used in custom workflows.
                code_challenge:
                  type: string
                  description: PKCE code challenge.
                code_challenge_method:
                  type: string
                  description: PKCE code challenge method.
                custom_response_headers:
                  type: string
                  description: Custom Response Headers.
                claims:
                  type: string
                  description: Requested Claims.
                auth_req_id:
                  type: string
                  description: CIBA authentication request Id.
                dpop_jkt:
                  type: string
                  description: The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function
                logout_status_jwt:
                  type: string
                  description: Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful.
                authorization_details:
                  type: string
                  description: The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field.
      responses:
        200:
          description: OK
          content: {}
        302:
          description: Error codes for authorization endpoint.
          content:
            application/json:
              schema:
                title: AuthorizeError
                type: object
                required:
                - error
                - error_description
                properties:
                  error:
                    type: string
                    format: enum
                    example:
                    - invalid_request
                    - unauthorized_client
                    - disabled_client
                    - access_denied
                    - retry
                    - unsupported_response_type
                    - invalid_scope
                    - server_error
                    - temporarily_unavailable
                    - invalid_request_redirect_uri
                    - invalid_authorization_details
                    - login_required
                    - session_selection_required
                    - consent_required
                    - user_mismatched
                    - request_not_supported
                    - request_uri_not_supported
                    - invalid_request_uri
                    - invalid_request_object
                    - authentication_session_invalid
                    - invalid_authentication_method
                  error_description:
                    type: string
                  details:
                    type: string
        400:
          $ref: '#/components/responses/InvalidRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        500:
          $ref: '#/components/responses/InternalServerError'
  /restv1/par:
    post:
      tags:
      - Authorization
      summary: The Pushed Authorization Endpoint performs Authentication Request registration
      description: Registers Pushed Authorization Request at Pushed Authorization Endpoint using request parameters defined by https://datatracker.ietf.org/doc/html/draft-ietf-oauth-par-08.
      operationId: post_par
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - scope
              - response_type
              - client_id
              - redirect_uri
              properties:
                scope:
                  type: string
                  description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
                response_type:
                  type: string
                  description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
                client_id:
                  type: string
                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
                redirect_uri:
                  type: string
                  description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
                state:
                  type: string
                  description: Opaque value used to maintain state between the request and the callback.
                response_mode:
                  type: string
                  description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
                nonce:
                  type: string
                  description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
                display:
                  type: string
                  description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
                prompt:
                  type: string
                  description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
                max_age:
                  type: integer
                  description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
                ui_locales:
                  type: string
                  description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
                  example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
                id_token_hint:
                  type: string
                  description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
                login_hint:
                  type: string
                  description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
                acr_values:
                  type: string
                  description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
                amr_values:
                  type: string
                  description: AMR Values.
                request:
                  type: string
                  description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
                request_session_id:
                  type: string
                  description: Request session id.
                session_id:
                  type: string
                  description: Session id of this call.
                origin_headers:
                  type: string
                  description: Origin headers. Used in custom workflows.
                code_challenge:
                  type: string
                  description: PKCE code challenge.
                code_challenge_method:
                  type: string
                  description: PKCE code challenge method.
                custom_response_headers:
                  type: string
                  description: Custom Response Headers.
                claims:
                  type: string
                  description: Requested Claims.
      responses:
        201:
          description: Created
          content:
            application/json:
              schema:
                title: ParResponse
                type: object
                required:
                - request_uri
                - expires_in
                properties:
                  request_uri:
                    type: string
                    description: The request URI corresponding to the authorization request posted.  This URI is used as reference to the respective request data in the subsequent authorization request only. The way the authorization process obtains the authorization request data is at the discretion of the authorization server and out of scope of this specification.  There is no need to make the authorization request data available to other parties via this URI.
                  expires_in:
                    type: string
                    description: A JSON number that represents the lifetime of the request URI in seconds as a positive integer.  The request URI lifetime is at the discretion of the authorization server but will typically be relatively short (e.g., between 5 and 600 seconds).
        302:
          description: Error codes for pushed authorization endpoint.
          content:
            application/json:
              schema:
                title: AuthorizeError
                type: object
                required:
                - error
                - error_description
                properties:
                  error:
                    type: string
                    format: enum
                    example:
                    - invalid_request
                    - unauthorized_client
                    - disabled_client
                    - access_denied
                    - retry
                    - unsupported_response_type
                    - invalid_scope
                    - server_error
                    - temporarily_unavailable
                    - invalid_request_object
                    - invalid_authentication_method
                  error_description:
                    type: string
                  details:
                    type: string
        400:
          $ref: '#/components/responses/InvalidRequest'
        401:
          $ref: '#/components/responses/Unauthorized'
        403:
          $ref: '#/components/responses/AccessDenied'
        500:
          $ref: '#/components/responses/InternalServerError'
  /restv1/bc-authorize:
    post:
      tags:
      - Authorization
      summary: Performs backchannel authorization of the end-user
      description: The Backchannel Authentication Endpoint is used to initiate an out-of-band authentication of the end-user.
      operationId: bc-authorize
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - client_id
              - scope
              - client_notification_token
              properties:
                client_id:
                  type: string
                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
                scope:
                  type: string
                  description: CIBA authentication requests must contain the openid scope value.
                client_notification_token:
                  type: string
                  description: It is a bearer token provided by the Client that will be used by the OpenID Provider to authenticate the callback request to the Client. It is required if the Client is registered to use Ping or Push modes.
                acr_values:
                  type: string
                  description: Requested Authentication Context Class Reference values.
                login_hint_token:
                  type: string
                  description: A token containing information identifying the end-user for whom authentication is being requested.
                id_token_hint:
                  type: string
                  description: An ID Token previously issued to the Client by the OpenID Provider being passed back as a hint to identify the end-user for whom authentication is being requested.
                login_hint:
                  type: string
                  description: A hint to the OpenID Provider regarding the end-user for whom authentication is being requested.
                binding_message:
                  type: string
                  description: A human readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user.
                user_code:
                  type: string
                  description: A secret code, such as password or pin, known only to the user but verifiable by the OP.
                requested_expiry:
                  type: integer
                  description: A positive integer allowing the client to request the expires_in value for the auth_req_id the server will return.
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                title: Backchannel Authorization
                required:
                - AUTH_REQ_ID
                - EXPIRES_IN
                - INTERVAL
                type: object
                properties:
                  AUTH_REQ_ID:
                    type: string
                  EXPIRES_IN:
                    type: integer
                  INTERVAL:
                    type: integer
        400:
          $ref: '#/components/responses/InvalidRequest'
        401:
          description: Unauthorized CIBA (Client Initiated Backchannel Authentication) access.
          content:
            application/json:
              schema:
                type: object
                required:
                - error
                - error_description
                properties:
                  error:
                    type: string
                    format: enum
                    example:
                    - invalid_request
                    - invalid_scope
                    - expired_login_hint_token
                    - unknown_user_id
                    - unauthorized_client
                    - missing_user_code
                    - invalid_user_code
                    - invalid_binding_message
                    - invalid_client
                    - unauthorized_end_user_device
                    - access_denied
                  error_description:
                    type: string
                  details:
                    type: string
        403:
          $ref: '#/components/responses/AccessDenied'
components:
  responses:
    AccessDenied:
      description: Invalid details provided hence access denied.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Unauthorized access request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal error occured. Please check log file for details.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InvalidRequest:
      description: Invalid parameters are provided to endpoint.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      required:
      - error
      - error_description
      type: object
      properties:
        error:
          type: string
        error_description:
          type: string
        details:
          type: string
  securitySchemes:
    bearer:
      type: http
      scheme: bearer