National University of Singapore Discovery API

openapi: 3.2.0
info:
  title: NUS Identity Provider API (vafs.nus.edu.sg) Discovery API
  version: '2026-08-19'
  description: "The National University of Singapore operates its own federated identity service at\n`vafs.nus.edu.sg` (\"NUS VAFS\" — the university's Active Directory Federation Services\ndeployment). It is the one substantial machine-readable, institution-operated API surface\nNUS publishes to the open internet, and it is the front door to essentially every gated\nNUS system.\n\nThe host is unambiguously NUS's own engineering, not a vendor's:\n\n  * `vafs.nus.edu.sg` resolves inside NUS's own address space (137.132.21.18).\n  * Its TLS certificate is an Extended Validation certificate issued to\n    `jurisdictionC=SG, businessCategory=Private Organization, serialNumber=200604346E,\n    O=National University of Singapore, CN=vafs.nus.edu.sg` — NUS is the validated\n    organization, not a hosting provider.\n  * The SAML entityID it asserts is `https://vafs.nus.edu.sg/adfs/services/trust`.\n\nThis document is DERIVED — every path, parameter, scope and response below was read out of\nthe institution's own live OpenID Connect discovery document at\n`https://vafs.nus.edu.sg/adfs/.well-known/openid-configuration` and its JWKS at\n`https://vafs.nus.edu.sg/adfs/discovery/keys`, both fetched 2026-08-19. NUS does not itself\npublish an OpenAPI description; nothing here is invented, but the OpenAPI packaging is\nAPI Evangelist's, not the university's.\n\nThe service speaks OpenID Connect 1.0 / OAuth 2.0, SAML 2.0, WS-Federation and WS-Trust\nfrom the same endpoint family. The SAML half is described in\n`identity-federation/nus-identity-federation.yml`.\n"
  contact:
    name: NUS Information Technology
    url: https://nusit.nus.edu.sg/
  termsOfService: https://nus.edu.sg/ormc/personal-data-protection/nus-privacy-notice
  x-operator: institution
  x-operator-evidence:
  - TLS certificate subject O=National University of Singapore (DigiCert EV RSA CA G2)
  - A record 137.132.21.18 within NUS-assigned address space
  - SAML entityID https://vafs.nus.edu.sg/adfs/services/trust
  x-method: derived
  x-source: https://vafs.nus.edu.sg/adfs/.well-known/openid-configuration
  x-generated: '2026-08-19'
servers:
- url: https://vafs.nus.edu.sg
  description: NUS federated identity service (production)
tags:
- name: Discovery
  description: Machine-readable metadata describing the identity service and its signing keys.
paths:
  /adfs/.well-known/openid-configuration:
    get:
      tags:
      - Discovery
      operationId: getOpenIdConfiguration
      summary: OpenID Connect discovery document
      description: Returns the OpenID Provider metadata for the NUS identity service, per OpenID Connect Discovery 1.0. Publicly readable, no authentication.
      security: []
      responses:
        '200':
          description: OpenID Provider metadata.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OpenIdConfiguration'
  /adfs/discovery/keys:
    get:
      tags:
      - Discovery
      operationId: getJwks
      summary: JSON Web Key Set
      description: Returns the RSA public keys used to verify ID tokens and access tokens issued by this provider (RFC 7517). Publicly readable, no authentication.
      security: []
      responses:
        '200':
          description: JWKS document.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Jwks'
  /FederationMetadata/2007-06/FederationMetadata.xml:
    get:
      tags:
      - Discovery
      operationId: getFederationMetadata
      summary: SAML 2.0 / WS-Federation metadata
      description: Returns the signed SAML 2.0 metadata document for entityID `https://vafs.nus.edu.sg/adfs/services/trust`, carrying both an IDPSSODescriptor and an SPSSODescriptor, four SingleLogoutService bindings, and 76 declared claim types. Publicly readable, no authentication.
      security: []
      responses:
        '200':
          description: Signed SAML 2.0 EntityDescriptor.
          content:
            application/samlmetadata+xml:
              schema:
                type: string
                format: xml
components:
  schemas:
    Jwks:
      type: object
      required:
      - keys
      properties:
        keys:
          type: array
          items:
            type: object
            required:
            - kty
            - use
            - alg
            - kid
            - n
            - e
            properties:
              kty:
                type: string
                example: RSA
              use:
                type: string
                example: sig
              alg:
                type: string
                example: RS256
              kid:
                type: string
              x5t:
                type: string
              n:
                type: string
                description: RSA modulus
                base64url.: null
              e:
                type: string
                example: AQAB
              x5c:
                type: array
                items:
                  type: string
    OpenIdConfiguration:
      type: object
      description: OpenID Provider metadata as returned by the live NUS discovery endpoint.
      required:
      - issuer
      - authorization_endpoint
      - token_endpoint
      - jwks_uri
      properties:
        issuer:
          type: string
          example: https://vafs.nus.edu.sg/adfs
        authorization_endpoint:
          type: string
          example: https://vafs.nus.edu.sg/adfs/oauth2/authorize/
        token_endpoint:
          type: string
          example: https://vafs.nus.edu.sg/adfs/oauth2/token/
        jwks_uri:
          type: string
          example: https://vafs.nus.edu.sg/adfs/discovery/keys
        userinfo_endpoint:
          type: string
          example: https://vafs.nus.edu.sg/adfs/userinfo
        end_session_endpoint:
          type: string
          example: https://vafs.nus.edu.sg/adfs/oauth2/logout
        device_authorization_endpoint:
          type: string
          example: https://vafs.nus.edu.sg/adfs/oauth2/devicecode
        access_token_issuer:
          type: string
          example: https://vafs.nus.edu.sg/adfs/services/trust
        scopes_supported:
          type: array
          items:
            type: string
        response_types_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        subject_types_supported:
          type: array
          items:
            type: string
            enum:
            - pairwise
        id_token_signing_alg_values_supported:
          type: array
          items:
            type: string
        token_endpoint_auth_methods_supported:
          type: array
          items:
            type: string
        claims_supported:
          type: array
          items:
            type: string
        frontchannel_logout_supported:
          type: boolean
        frontchannel_logout_session_supported:
          type: boolean
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    clientSecretBasic:
      type: http
      scheme: basic
      description: client_secret_basic client authentication.
    clientSecretPost:
      type: apiKey
      in: header
      name: Authorization
      description: Placeholder for client_secret_post; the provider also advertises private_key_jwt and windows_client_authentication.
    oidc:
      type: openIdConnect
      openIdConnectUrl: https://vafs.nus.edu.sg/adfs/.well-known/openid-configuration