The Janssen Authorization Server REST API — a certified OpenID Provider implementing OAuth 2.0, OpenID Connect Core, dynamic client registration, CIBA backchannel authentication, UMA 2.0 resource registration, Pushed Authorization Requests, Software Statement Assertions, token status lists and an AuthZEN configuration endpoint. 46 operations across 33 paths.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/jans-auth-server-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
# raw swagger spec link:
# https://raw.githubusercontent.com/JanssenProject/jans/jans-auth-server/master/docs/swagger.yaml
# https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/jans-auth-server/master/docs/swagger.yaml
openapi: 3.0.1
info:
title: Janssen Authorization Server
description: Janssen Authorization Server - OAuth 2.0 server; OpenID Connect Provider (OP) & UMA Authorization Server (AS)
contact:
name: Contact
url: https://github.com/JanssenProject/jans/discussions
license:
name: License
url: https://github.com/JanssenProject/jans/blob/main/LICENSE
version: "OAS Version"
servers:
- url: https://jans.local.io/jans-auth
tags:
- name: About
description: Janssen Authorization Server is an open source OpenID Connect Provider (OP) and UMA Authorization Server (AS). The project also includes OpenID Connect Client code which can be used by websites to validate tokens. Server currently implements all required aspects of the OpenID Connect stack, including an OAuth 2.0 authorization server, Simple Web Discovery, Dynamic Client Registration, JSON Web Tokens, JSON Web Keys, and User Info Endpoint.
paths:
/.well-known/authzen-configuration:
get:
tags:
- AuthZEN Access Evaluation Discovery
summary: Gets Access Evaluation configuration data.
description: Gets Access Evaluation configuration data.
operationId: authzen-configuration
responses:
200:
description: OK
content:
application/json:
schema:
type: object
description: AuthZEN Access Evaluation Discovery
required:
- access_evaluation_v1_endpoint
properties:
access_evaluation_v1_endpoint:
type: string
description: "URL of the Access Evaluation endpoint."
example: https://sample.com/jans-auth/restv1/evaluate
500:
description: Error during request processing endpoint.
content:
application/json:
schema:
type: object
required:
- error
- error_description
properties:
error:
type: string
format: enum
example:
- server_error
error_description:
type: string
details:
type: string
/restv1/evaluation:
post:
tags:
- Access Evaluation
summary: Access Evaluation AuthZEN
description: Evaluates whether a subject is authorized to perform a specific action on a resource.
operationId: post_access_evaluation
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
subject:
$ref: '#/components/schemas/Subject'
action:
$ref: '#/components/schemas/Action'
resource:
$ref: '#/components/schemas/Resource'
context:
$ref: '#/components/schemas/Context'
required:
- subject
- action
- resource
responses:
200:
description: Access evaluation result
content:
application/json:
schema:
$ref: '#/components/schemas/EvaluationResponse'
400:
description: Invalid request
500:
description: Internal server error
/restv1/authorize-challenge:
post:
tags:
- Authorization Challenge
summary: The Authorization Challenge Endpoint performs Authentication of the End-User by native application to obtain an authorization code.
description: The Authorization Challenge Endpoint performs Authentication of the End-User by native application to obtain an authorization code.
operationId: post_authorize_challenge
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- client_id
properties:
client_id:
type: string
description: OAuth 2.0 Client Identifier valid at the Authorization Server.
scope:
type: string
description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
auth_session:
type: string
description: If the client has previously obtained a auth session
use_auth_session:
type: boolean
description: If return back in response auth_session. By default AS does not return auth_session
state:
type: string
description: Opaque value used to maintain state between the request and the callback.
nonce:
type: string
description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
login_hint:
type: string
description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
acr_values:
type: string
description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
amr_values:
type: string
description: AMR Values.
request_session_id:
type: string
description: Request session id.
session_id:
type: string
description: Session id of this call.
origin_headers:
type: string
description: Origin headers. Used in custom workflows.
custom_response_headers:
type: string
description: Custom Response Headers.
logout_status_jwt:
type: string
description: Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful.
responses:
200:
description: OK
content:
application/json:
schema:
title: AuthorizationChallengeResponse
description: Authorization Challenge Response
required:
- authorization_code
type: object
properties:
authorization_code:
type: string
description: Authorization Code
example: uY29tL2F1dGhlbnRpY
logout_status_jwt:
type: string
description: Logout Status JWT
example: eyJraWQiOiJjb25uZWN0XzA3ZjQ3ZmRkLTg0NTYtNDMzOC1iYTRmLWNhNmU0NDBmYjljOV9zaWdfcnMyNTYiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9
400:
$ref: '#/components/responses/InvalidRequest'
401:
$ref: '#/components/responses/Unauthorized'
500:
$ref: '#/components/responses/InternalServerError'
/restv1/authorize:
get:
tags:
- Authorization
summary: The Authorization Endpoint performs Authentication of the End-User.
description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
operationId: get_authorize
parameters:
- name: scope
in: query
required: true
description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
schema:
type: string
- name: response_type
in: query
required: true
description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
schema:
type: string
- name: client_id
in: query
required: true
description: OAuth 2.0 Client Identifier valid at the Authorization Server.
schema:
type: string
- name: redirect_uri
in: query
required: true
description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
schema:
type: string
- name: state
in: query
required: false
description: Opaque value used to maintain state between the request and the callback.
schema:
type: string
- name: response_mode
in: query
required: false
description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
schema:
type: string
- name: nonce
in: query
required: false
description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
schema:
type: string
- name: display
in: query
required: false
description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
schema:
type: string
- name: prompt
in: query
required: false
description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are - none, login, consent, select_account.
schema:
type: string
- name: max_age
in: query
required: false
description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
schema:
type: integer
- name: ui_locales
in: query
required: false
description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
#example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
schema:
type: string
- name: id_token_hint
in: query
required: false
description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
schema:
type: string
- name: login_hint
in: query
required: false
description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
schema:
type: string
- name: acr_values
in: query
required: false
description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
schema:
type: string
- name: amr_values
in: query
required: false
description: AMR Values.
schema:
type: string
- name: request
in: query
required: false
description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
schema:
type: string
- name: request_uri
in: query
required: false
description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
schema:
type: string
- name: request_session_id
in: query
required: false
description: Request session id.
schema:
type: string
- name: session_id
in: query
required: false
description: Session id of this call.
schema:
type: string
- name: origin_headers
in: query
required: false
description: Origin headers. Used in custom workflows.
schema:
type: string
- name: code_challenge
in: query
required: false
description: PKCE code challenge.
schema:
type: string
- name: code_challenge_method
in: query
required: false
description: PKCE code challenge method.
schema:
type: string
- name: custom_response_headers
in: query
required: false
description: Custom Response Headers.
schema:
type: string
- name: claims
in: query
required: false
description: Requested Claims.
schema:
type: string
- name: auth_req_id
in: query
required: false
description: CIBA authentication request Id.
schema:
type: string
- name: dpop_jkt
in: query
required: false
description: The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function
schema:
type: string
- name: logout_status_jwt
in: query
required: false
description: Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful.
schema:
type: string
- name: authorization_details
in: query
required: false
description: The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field.
schema:
type: string
responses:
200:
description: OK
content: {}
302:
description: Error codes for authorization endpoint.
content:
application/json:
schema:
title: AuthorizeError
type: object
required:
- error
- error_description
properties:
error:
type: string
format: enum
example:
- invalid_request
- unauthorized_client
- disabled_client
- access_denied
- retry
- unsupported_response_type
- invalid_scope
- server_error
- temporarily_unavailable
- invalid_request_redirect_uri
- invalid_authorization_details
- login_required
- session_selection_required
- consent_required
- user_mismatched
- request_not_supported
- request_uri_not_supported
- invalid_request_uri
- invalid_request_object
- authentication_session_invalid
- invalid_authentication_method
error_description:
type: string
details:
type: string
400:
$ref: '#/components/responses/InvalidRequest'
401:
$ref: '#/components/responses/Unauthorized'
500:
$ref: '#/components/responses/InternalServerError'
post:
tags:
- Authorization
summary: The Authorization Endpoint performs Authentication of the End-User.
description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
operationId: post_authorize
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- scope
- response_type
- client_id
- redirect_uri
properties:
scope:
type: string
description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
response_type:
type: string
description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
client_id:
type: string
description: OAuth 2.0 Client Identifier valid at the Authorization Server.
redirect_uri:
type: string
description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
state:
type: string
description: Opaque value used to maintain state between the request and the callback.
response_mode:
type: string
description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
nonce:
type: string
description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
display:
type: string
description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
prompt:
type: string
description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
max_age:
type: integer
description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
ui_locales:
type: string
description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
id_token_hint:
type: string
description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
login_hint:
type: string
description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
acr_values:
type: string
description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
amr_values:
type: string
description: AMR Values.
request:
type: string
description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
request_uri:
type: string
description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
request_session_id:
type: string
description: Request session id.
session_id:
type: string
description: Session id of this call.
origin_headers:
type: string
description: Origin headers. Used in custom workflows.
code_challenge:
type: string
description: PKCE code challenge.
code_challenge_method:
type: string
description: PKCE code challenge method.
custom_response_headers:
type: string
description: Custom Response Headers.
claims:
type: string
description: Requested Claims.
auth_req_id:
type: string
description: CIBA authentication request Id.
dpop_jkt:
type: string
description: The JSON Web Key (JWK) Thumbprint [RFC7638] of the proof-of-possession public key using the SHA-256 hash function
logout_status_jwt:
type: string
description: Possible values are true or false. Returns back Logout Status JWT if send logout_status_jwt=true and authorization is successful.
authorization_details:
type: string
description: The request parameter authorization_details contains, in JSON notation, an array of objects. Each JSON object contains the data to specify the authorization requirements for a certain type of resource. The type of resource or access requirement is determined by the type field.
responses:
200:
description: OK
content: {}
302:
description: Error codes for authorization endpoint.
content:
application/json:
schema:
title: AuthorizeError
type: object
required:
- error
- error_description
properties:
error:
type: string
format: enum
example:
- invalid_request
- unauthorized_client
- disabled_client
- access_denied
- retry
- unsupported_response_type
- invalid_scope
- server_error
- temporarily_unavailable
- invalid_request_redirect_uri
- invalid_authorization_details
- login_required
- session_selection_required
- consent_required
- user_mismatched
- request_not_supported
- request_uri_not_supported
- invalid_request_uri
- invalid_request_object
- authentication_session_invalid
- invalid_authentication_method
error_description:
type: string
details:
type: string
400:
$ref: '#/components/responses/InvalidRequest'
401:
$ref: '#/components/responses/Unauthorized'
500:
$ref: '#/components/responses/InternalServerError'
/restv1/par:
post:
tags:
- Authorization
summary: The Pushed Authorization Endpoint performs Authentication Request registration
description: Registers Pushed Authorization Request at Pushed Authorization Endpoint using request parameters defined by https://datatracker.ietf.org/doc/html/draft-ietf-oauth-par-08.
operationId: post_par
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- scope
- response_type
- client_id
- redirect_uri
properties:
scope:
type: string
description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
response_type:
type: string
description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
client_id:
type: string
description: OAuth 2.0 Client Identifier valid at the Authorization Server.
redirect_uri:
type: string
description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
state:
type: string
description: Opaque value used to maintain state between the request and the callback.
response_mode:
type: string
description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
nonce:
type: string
description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
display:
type: string
description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
prompt:
type: string
description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
max_age:
type: integer
description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
ui_locales:
type: string
description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
id_token_hint:
type: string
description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
login_hint:
type: string
description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
acr_values:
type: string
description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
amr_values:
type: string
description: AMR Values.
request:
type: string
description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
request_session_id:
type: string
description: Request session id.
session_id:
type: string
description: Session id of this call.
origin_headers:
type: string
description: Origin headers. Used in custom workflows.
code_challenge:
type: string
description: PKCE code challenge.
code_challenge_method:
type: string
description: PKCE code challenge method.
custom_response_headers:
type: string
description: Custom Response Headers.
claims:
type: string
description: Requested Claims.
responses:
201:
description: Created
content:
application/json:
schema:
title: ParResponse
type: object
required:
- request_uri
- expires_in
properties:
request_uri:
type: string
description: The request URI corresponding to the authorization request posted. This URI is used as reference to the respective request data in the subsequent authorization request only. The way the authorization process obtains the authorization request data is at the discretion of the authorization server and out of scope of this specification. There is no need to make the authorization request data available to other parties via this URI.
expires_in:
# --- truncated at 32 KB (231 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/gluu/refs/heads/main/openapi/gluu-jans-auth-server-openapi.yml