Logius .well Known API

openapi: 3.2.0
info:
  title: Logius .well Known API
  version: 1.0.0
  description: 'Operations tagged .well Known across 2 of this provider''s published API definitions: logius-fsc-manager-openapi.yml, logius-fsc-manager-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{managerUrl}:8443/v1
  variables:
    managerUrl:
      default: localhost
      description: URL of the Manager
tags:
- name: .well Known
paths:
  /.well-known/jwks.json:
    get:
      summary: Return a JSON Web Key Set as defined in RFC 7517
      operationId: getJSONWebKeySet
      responses:
        200:
          description: JSON Web Key Set to validate JSON Web Signatures, according to [RFC 7517](https://www.ietf.org/rfc/rfc7517.txt), with the additional restrictions on algorithms listed in the [FSC](https://commonground.gitlab.io/standards/fsc/core/draft-fsc-core-00.html#name-access-token)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/jwks'
      tags:
      - .well Known
    servers:
    - url: https://{managerUrl}:8443/v1
      variables:
        managerUrl:
          default: localhost
          description: URL of the Manager
components:
  schemas:
    jwks:
      description: JSON Web Key Set to validate JSON Web Signatures, according to [RFC 7517](https://www.ietf.org/rfc/rfc7517.txt), with the additional restrictions on algorithms listed in the [FSC](https://commonground.gitlab.io/standards/fsc/core/draft-fsc-core-00.html#name-access-token)
      type: object
      properties:
        keys:
          type: array
          items:
            $ref: '#/components/schemas/jwk'
      required:
      - keys
    jwk:
      type: object
      description: The value of the "keys" parameter is an array of JWK values. By default, the order of the JWK values within the array does not imply an order of preference among them, although applications of JWK Sets can choose to assign a meaning to the order for their purposes, if desired.
      properties:
        kty:
          type: string
          description: 'Public Key Type. This parameter identifies the cryptographic algorithm

            family used with the key, such as "RSA" or "EC".  "kty" values should

            either be registered in the IANA "JSON Web Key Types" registry

            established by [JWA] or be a value that contains a Collision-

            Resistant Name. The "kty" value is a case-sensitive string.  This

            member MUST be present in a JWK.

            '
          enum:
          - RSA
          - EC
        use:
          type: string
          description: 'Public Key Use. This parameter identifies the intended use of

            the public key. The "use" parameter is employed to indicate whether

            a public key is used for encrypting data or verifying the signature

            on data.

            '
          enum:
          - sig
          - enc
        key_ops:
          type: array
          items:
            type: string
            enum:
            - sign
            - verify
            - encrypt
            - decrypt
            - wrapKey
            - unwrapKey
            - deriveKey
            - deriveBits
          description: 'Public Key Operations. This parameter identifies the operation(s)

            for which the key is intended to be used. The "key_ops" parameter is

            intended for use cases in which public, private, or symmetric keys

            may be present.


            Its value is an array of key operation values.

            '
        alg:
          type: string
          description: 'Public Key Algorithm. This parameter identifies the algorithm intended for

            use with the key. The values used should either be registered in the

            IANA "JSON Web Signature and Encryption Algorithms" registry

            established by [JWA] or be a value that contains a Collision-

            Resistant Name. The "alg" value is a case-sensitive ASCII string.

            Use of this member is OPTIONAL.

            '
          enum:
          - RS256
          - RS384
          - RS512
          - ES256
          - ES384
          - ES512
          - PS256
          - PS384
          - PS512
        kid:
          type: string
          description: 'Public Key ID. This parameter is used to match a specific key.  This

            is used, for instance, to choose among a set of keys within a JWK Set

            during key rollover.  The structure of the "kid" value is

            unspecified.  When "kid" values are used within a JWK Set, different

            keys within the JWK Set SHOULD use distinct "kid" values.  (One

            example in which different keys might use the same "kid" value is if

            they have different "kty" (key type) values but are considered to be

            equivalent alternatives by the application using them.)  The "kid"

            value is a case-sensitive string.  Use of this member is OPTIONAL.

            When used with JWS or JWE, the "kid" value is used to match a JWS or

            JWE "kid" Header Parameter value.

            '
        x5u:
          type: string
          format: url
          description: 'Public Key X.509 URL. This parameter is a URI [RFC3986] that refers to a

            resource for an X.509 public key certificate or certificate chain

            [RFC5280].  The identified resource MUST provide a representation of

            the certificate or certificate chain that conforms to RFC 5280

            [RFC5280] in PEM-encoded form, with each certificate delimited as

            specified in Section 6.1 of RFC 4945 [RFC4945].  The key in the first

            certificate MUST match the public key represented by other members of

            the JWK.  The protocol used to acquire the resource MUST provide

            integrity protection; an HTTP GET request to retrieve the certificate

            MUST use TLS [RFC2818] [RFC5246]; the identity of the server MUST be

            validated, as per Section 6 of RFC 6125 [RFC6125].  Use of this

            member is OPTIONAL.

            '
        x5c:
          type: array
          description: 'Public Key X.509 certificate chain. This parameter contains a chain of one

            or more PKIX certificates [RFC5280].  The certificate chain is

            represented as a JSON array of certificate value strings.  Each

            string in the array is a base64-encoded (Section 4 of [RFC4648] --

            not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value.

            The PKIX certificate containing the key value MUST be the first

            certificate.  This MAY be followed by additional certificates, with

            each subsequent certificate being the one used to certify the

            previous one.  The key in the first certificate MUST match the public

            key represented by other members of the JWK.  Use of this member is

            OPTIONAL.

            '
          items:
            type: string
        x5t:
          type: string
          description: 'Public Key X.509 certificate SHA-1 thumbprint. This parameter is a

            base64url-encoded SHA-1 thumbprint (a.k.a. digest) of the DER

            encoding of an X.509 certificate [RFC5280]. Note that certificate

            thumbprints are also sometimes known as certificate fingerprints.

            The key in the certificate MUST match the public key represented by

            other members of the JWK. Use of this member is OPTIONAL.

            '
        x5t#s256:
          type: string
          description: 'Public Key X.509 certificate SHA-256 thumbprint. This parameter is a base64url-encoded SHA-256 thumbprint (a.k.a. digest)

            of the DER encoding of the X.509 certificate [RFC5280] corresponding

            to the key used to digitally sign the JWS. Note that certificate

            thumbprints are also sometimes known as certificate fingerprints.

            Use of this Header Parameter is OPTIONAL.

            '
      oneOf:
      - $ref: '#/components/schemas/ecPublicKey'
      - $ref: '#/components/schemas/rsaPublicKey'
      required:
      - kty
    ecPublicKey:
      type: object
      properties:
        crv:
          type: string
        x:
          type: string
          format: byte
          description: 'Public Key x coordinate. This parameter contains the x coordinate for the

            Elliptic Curve point. It is represented as the base64url encoding of

            the octet string representation of the coordinate, as defined in

            Section 2.3.5 of SEC1 [SEC1]. The length of this octet string MUST

            be the full size of a coordinate for the curve specified in the "crv"

            parameter. For example, if the value of "crv" is "P-521", the octet

            string must be 66 octets long.

            '
        y:
          type: string
          format: byte
          description: 'Public Key y coordinate. This parameter contains the y coordinate for the

            Elliptic Curve point. It is represented as the base64url encoding of

            the octet string representation of the coordinate, as defined in

            Section 2.3.5 of SEC1 [SEC1]. The length of this octet string MUST

            be the full size of a coordinate for the curve specified in the "crv"

            parameter. For example, if the value of "crv" is "P-521", the octet

            string must be 66 octets long.

            '
          minLength: 66
          maxLength: 66
    rsaPublicKey:
      type: object
      properties:
        n:
          type: string
          format: byte
          description: 'Public Key modulus. This parameter contains the modulus value for the RSA

            public key. It is represented as a Base64urlUInt-encoded value.


            Note that implementers have found that some cryptographic libraries

            prefix an extra zero-valued octet to the modulus representations they

            return, for instance, returning 257 octets for a 2048-bit key, rather

            than 256. Implementations using such libraries will need to take

            care to omit the extra octet from the base64url-encoded

            representation.

            '
        e:
          type: string
          format: byte
          description: 'Public Key exponent. This parameter contains the exponent value for the RSA

            public key. It is represented as a Base64urlUInt-encoded value.


            For instance, when representing the value 65537, the octet sequence

            to be base64url-encoded MUST consist of the three octets [1, 0, 1];

            the resulting representation for this value is "AQAB".

            '
x-refined-from:
- logius-fsc-manager-openapi.yml
- logius-fsc-manager-openapi.yml