Infisical OIDC Auth API
The OIDC Auth API from Infisical — 2 operation(s) for oidc auth.
OpenAPI Specification
openapi: 3.0.3
info:
title: Infisical Admin OIDC Auth API
description: List of all available APIs that can be consumed
version: 0.0.1
servers:
- url: https://us.infisical.com
description: Production server (US)
- url: https://eu.infisical.com
description: Production server (EU)
- url: http://localhost:8080
description: Local server
tags:
- name: OIDC Auth
paths:
/api/v1/auth/oidc-auth/login:
post:
operationId: loginWithOidcAuth
tags:
- OIDC Auth
description: Login with OIDC Auth for machine identity
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
identityId:
type: string
description: The ID of the machine identity to login.
jwt:
type: string
organizationSlug:
type: string
minLength: 1
maxLength: 64
description: When set, this will scope the login session to the specified organization the machine identity has access to. If omitted, the session defaults to the organization where the machine identity was created in.
required:
- identityId
- jwt
additionalProperties: false
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
accessToken:
type: string
expiresIn:
type: number
accessTokenMaxTTL:
type: number
tokenType:
type: string
enum:
- Bearer
required:
- accessToken
- expiresIn
- accessTokenMaxTTL
- tokenType
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
/api/v1/auth/oidc-auth/identities/{identityId}:
post:
operationId: attachOidcAuth
tags:
- OIDC Auth
description: Attach OIDC Auth configuration onto machine identity
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
oidcDiscoveryUrl:
type: string
format: uri
minLength: 1
description: The URL used to retrieve the OpenID Connect configuration from the identity provider.
caCert:
type: string
default: ''
description: The PEM-encoded CA cert for establishing secure communication with the Identity Provider endpoints.
boundIssuer:
type: string
minLength: 1
description: The unique identifier of the identity provider issuing the JWT.
boundAudiences:
type: string
default: ''
description: The list of intended recipients.
boundClaims:
type: object
additionalProperties:
type: string
description: The attributes that should be present in the JWT for it to be valid.
claimMetadataMapping:
type: object
additionalProperties:
type: string
description: The attributes that should be present in the permission metadata from the JWT.
boundSubject:
type: string
default: ''
description: The expected principal that is the subject of the JWT.
accessTokenTrustedIps:
type: array
items:
type: object
properties:
ipAddress:
type: string
required:
- ipAddress
additionalProperties: false
minItems: 1
default:
- ipAddress: 0.0.0.0/0
- ipAddress: ::/0
description: The IPs or CIDR ranges that access tokens can be used from.
accessTokenTTL:
type: integer
minimum: 0
maximum: 315360000
default: 2592000
description: The lifetime for an access token in seconds.
accessTokenMaxTTL:
type: integer
minimum: 0
maximum: 315360000
default: 2592000
description: The maximum lifetime for an access token in seconds.
accessTokenNumUsesLimit:
type: integer
minimum: 0
default: 0
description: The maximum number of times that an access token can be used.
required:
- oidcDiscoveryUrl
- boundIssuer
- boundClaims
additionalProperties: false
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to attach the configuration onto.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityOidcAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
identityId:
type: string
format: uuid
oidcDiscoveryUrl:
type: string
boundIssuer:
type: string
boundAudiences:
type: string
boundClaims: {}
claimMetadataMapping:
nullable: true
boundSubject:
type: string
nullable: true
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
caCert:
type: string
required:
- id
- identityId
- oidcDiscoveryUrl
- boundIssuer
- boundAudiences
- createdAt
- updatedAt
- caCert
additionalProperties: false
required:
- identityOidcAuth
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
patch:
operationId: updateOidcAuth
tags:
- OIDC Auth
description: Update OIDC Auth configuration on machine identity
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
oidcDiscoveryUrl:
type: string
format: uri
minLength: 1
description: The new URL used to retrieve the OpenID Connect configuration from the identity provider.
caCert:
type: string
default: ''
description: The new PEM-encoded CA cert for establishing secure communication with the Identity Provider endpoints.
boundIssuer:
type: string
minLength: 1
description: The new unique identifier of the identity provider issuing the JWT.
boundAudiences:
type: string
default: ''
description: The new list of intended recipients.
boundClaims:
type: object
additionalProperties:
type: string
description: The new attributes that should be present in the JWT for it to be valid.
claimMetadataMapping:
type: object
additionalProperties:
type: string
description: The new attributes that should be present in the permission metadata from the JWT.
boundSubject:
type: string
default: ''
description: The new expected principal that is the subject of the JWT.
accessTokenTrustedIps:
type: array
items:
type: object
properties:
ipAddress:
type: string
required:
- ipAddress
additionalProperties: false
minItems: 1
default:
- ipAddress: 0.0.0.0/0
- ipAddress: ::/0
description: The new IPs or CIDR ranges that access tokens can be used from.
accessTokenTTL:
type: integer
minimum: 0
maximum: 315360000
default: 2592000
description: The new lifetime for an access token in seconds.
accessTokenMaxTTL:
type: integer
minimum: 0
maximum: 315360000
default: 2592000
description: The new maximum lifetime for an access token in seconds.
accessTokenNumUsesLimit:
type: integer
minimum: 0
default: 0
description: The new maximum number of times that an access token can be used.
additionalProperties: false
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to update the auth method for.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityOidcAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
identityId:
type: string
format: uuid
oidcDiscoveryUrl:
type: string
boundIssuer:
type: string
boundAudiences:
type: string
boundClaims: {}
claimMetadataMapping:
nullable: true
boundSubject:
type: string
nullable: true
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
caCert:
type: string
required:
- id
- identityId
- oidcDiscoveryUrl
- boundIssuer
- boundAudiences
- createdAt
- updatedAt
- caCert
additionalProperties: false
required:
- identityOidcAuth
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
get:
operationId: getOidcAuth
tags:
- OIDC Auth
description: Retrieve OIDC Auth configuration on machine identity
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to retrieve the auth method for.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityOidcAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
identityId:
type: string
format: uuid
oidcDiscoveryUrl:
type: string
boundIssuer:
type: string
boundAudiences:
type: string
boundClaims: {}
claimMetadataMapping:
nullable: true
boundSubject:
type: string
nullable: true
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
caCert:
type: string
required:
- id
- identityId
- oidcDiscoveryUrl
- boundIssuer
- boundAudiences
- createdAt
- updatedAt
- caCert
additionalProperties: false
required:
- identityOidcAuth
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
delete:
operationId: deleteOidcAuth
tags:
- OIDC Auth
description: Delete OIDC Auth configuration on machine identity
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to revoke the auth method for.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityOidcAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
identityId:
type: string
format: uuid
oidcDiscoveryUrl:
type: string
boundIssuer:
type: string
boundAudiences:
type: string
boundClaims: {}
claimMetad
# --- truncated at 32 KB (36 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/infisical/refs/heads/main/openapi/infisical-oidc-auth-api-openapi.yml