Canada Life API Gateway (OAuth 2.0 / OpenID Connect)

aid: great-west-lifeco:canada-life-api-gateway
name: Canada Life API Gateway (OAuth 2.0 / OpenID Connect)
description: The production API gateway of Canada Life, Great-West Lifeco's Canadian operating brand,
  at api.canadalife.com. It publishes no documentation, but it does serve a real OpenID Connect discovery
  document anonymously at /.well-known/openid-configuration (HTTP 200) - the only machine-readable contract
  published anywhere in the Great-West Lifeco group. The document declares issuer https://api.canadalife.com,
  a token endpoint at /oauth2/v1/generate, live JWKS at /oauth2/v1/jwks (HTTP 200), revocation at /oauth2/v1/revoke
  and userinfo at /oauth2/v1/userinfo, with RS256 ID-token signing and client_secret_basic / client_secret_post
  / client_secret_jwt client authentication. The authorization endpoint is deliberately published as /oauth2/v1/authorize-NOT-SUPPORTED,
  so the gateway is machine-to-machine only, and scopes_supported is an empty array. Anonymous calls to
  protected paths return an Apigee error envelope naming the Consumer-Key and pointing to https://apimarketplace.canadalife.com
  - a digitalML-hosted Canada Life API marketplace whose hostname CNAMEs to canadalife.digitalml.com and
  does not resolve on the public internet. Entitlement is therefore partner-only, with no public request
  path.
humanURL: https://www.canadalife.com/
baseURL: https://api.canadalife.com
tags:
- OAuth
- OpenID Connect
- Authorization
- Canada
- Partner Gated
properties:
- type: OpenIDConnect
  url: well-known/great-west-lifeco-openid-configuration.json
- type: Authentication
  url: authentication/great-west-lifeco-authentication.yml
- type: ErrorCatalog
  url: errors/great-west-lifeco-problem-types.yml