OpenAPI Specification
openapi: 3.0.3
info:
contact:
email: hi@ory.sh
description: 'Documentation for all of Ory Hydra''s APIs.
'
license:
name: Apache 2.0
title: Ory Hydra api jwk API
version: ''
tags:
- description: JSON Web Keys
name: jwk
paths:
/admin/keys/{set}:
delete:
description: 'Use this endpoint to delete a complete JSON Web Key Set and all the keys in that set.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
operationId: deleteJsonWebKeySet
parameters:
- description: The JSON Web Key Set
in: path
name: set
required: true
schema:
type: string
responses:
'204':
$ref: '#/components/responses/emptyResponse'
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
summary: Delete JSON Web Key Set
tags:
- jwk
x-ory-ratelimit-bucket: hydra-admin-low
get:
description: 'This endpoint can be used to retrieve JWK Sets stored in ORY Hydra.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
operationId: getJsonWebKeySet
parameters:
- description: JSON Web Key Set ID
in: path
name: set
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/jsonWebKeySet'
description: jsonWebKeySet
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
summary: Retrieve a JSON Web Key Set
tags:
- jwk
x-ory-ratelimit-bucket: hydra-admin-medium
post:
description: 'This endpoint is capable of generating JSON Web Key Sets for you. There are different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymmetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
operationId: createJsonWebKeySet
parameters:
- description: The JSON Web Key Set ID
in: path
name: set
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/createJsonWebKeySet'
required: true
x-originalParamName: Body
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/jsonWebKeySet'
description: jsonWebKeySet
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
summary: Create JSON Web Key
tags:
- jwk
x-ory-ratelimit-bucket: hydra-admin-low
put:
description: 'Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
operationId: setJsonWebKeySet
parameters:
- description: The JSON Web Key Set ID
in: path
name: set
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/jsonWebKeySet'
x-originalParamName: Body
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/jsonWebKeySet'
description: jsonWebKeySet
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
summary: Update a JSON Web Key Set
tags:
- jwk
x-ory-ratelimit-bucket: hydra-admin-low
/admin/keys/{set}/{kid}:
delete:
description: 'Use this endpoint to delete a single JSON Web Key.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A
JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses
this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens),
and allows storing user-defined keys as well.'
operationId: deleteJsonWebKey
parameters:
- description: The JSON Web Key Set
in: path
name: set
required: true
schema:
type: string
- description: The JSON Web Key ID (kid)
in: path
name: kid
required: true
schema:
type: string
responses:
'204':
$ref: '#/components/responses/emptyResponse'
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
summary: Delete JSON Web Key
tags:
- jwk
x-ory-ratelimit-bucket: hydra-admin-low
get:
description: This endpoint returns a singular JSON Web Key contained in a set. It is identified by the set and the specific key ID (kid).
operationId: getJsonWebKey
parameters:
- description: JSON Web Key Set ID
in: path
name: set
required: true
schema:
type: string
- description: JSON Web Key ID
in: path
name: kid
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/jsonWebKeySet'
description: jsonWebKeySet
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
summary: Get JSON Web Key
tags:
- jwk
x-ory-ratelimit-bucket: hydra-admin-medium
put:
description: 'Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.'
operationId: setJsonWebKey
parameters:
- description: The JSON Web Key Set ID
in: path
name: set
required: true
schema:
type: string
- description: JSON Web Key ID
in: path
name: kid
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/jsonWebKey'
x-originalParamName: Body
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/jsonWebKey'
description: jsonWebKey
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
summary: Set JSON Web Key
tags:
- jwk
x-ory-ratelimit-bucket: hydra-admin-low
components:
schemas:
jsonWebKeySet:
description: JSON Web Key Set
properties:
keys:
description: 'List of JSON Web Keys
The value of the "keys" parameter is an array of JSON Web Key (JWK)
values. By default, the order of the JWK values within the array does
not imply an order of preference among them, although applications
of JWK Sets can choose to assign a meaning to the order for their
purposes, if desired.'
items:
$ref: '#/components/schemas/jsonWebKey'
type: array
type: object
jsonWebKey:
properties:
alg:
description: 'The "alg" (algorithm) parameter identifies the algorithm intended for
use with the key. The values used should either be registered in the
IANA "JSON Web Signature and Encryption Algorithms" registry
established by [JWA] or be a value that contains a Collision-
Resistant Name.'
example: RS256
type: string
crv:
example: P-256
type: string
d:
example: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE
type: string
dp:
example: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0
type: string
dq:
example: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk
type: string
e:
example: AQAB
type: string
k:
example: GawgguFyGrWKav7AX4VKUg
type: string
kid:
description: 'The "kid" (key ID) parameter is used to match a specific key. This
is used, for instance, to choose among a set of keys within a JWK Set
during key rollover. The structure of the "kid" value is
unspecified. When "kid" values are used within a JWK Set, different
keys within the JWK Set SHOULD use distinct "kid" values. (One
example in which different keys might use the same "kid" value is if
they have different "kty" (key type) values but are considered to be
equivalent alternatives by the application using them.) The "kid"
value is a case-sensitive string.'
example: 1603dfe0af8f4596
type: string
kty:
description: 'The "kty" (key type) parameter identifies the cryptographic algorithm
family used with the key, such as "RSA" or "EC". "kty" values should
either be registered in the IANA "JSON Web Key Types" registry
established by [JWA] or be a value that contains a Collision-
Resistant Name. The "kty" value is a case-sensitive string.'
example: RSA
type: string
n:
example: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0
type: string
p:
example: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ
type: string
q:
example: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ
type: string
qi:
example: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU
type: string
use:
description: 'Use ("public key use") identifies the intended use of
the public key. The "use" parameter is employed to indicate whether
a public key is used for encrypting data or verifying the signature
on data. Values are commonly "sig" (signature) or "enc" (encryption).'
example: sig
type: string
x:
example: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU
type: string
x5c:
description: 'The "x5c" (X.509 certificate chain) parameter contains a chain of one
or more PKIX certificates [RFC5280]. The certificate chain is
represented as a JSON array of certificate value strings. Each
string in the array is a base64-encoded (Section 4 of [RFC4648] --
not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value.
The PKIX certificate containing the key value MUST be the first
certificate.'
items:
type: string
type: array
y:
example: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0
type: string
required:
- use
- kty
- kid
- alg
type: object
createJsonWebKeySet:
description: Create JSON Web Key Set Request Body
properties:
alg:
description: 'JSON Web Key Algorithm
The algorithm to be used for creating the key. Supports `RS256`, `ES256`, `ES512`, `HS512`, and `HS256`.'
type: string
kid:
description: 'JSON Web Key ID
The Key ID of the key to be created.'
type: string
use:
description: 'JSON Web Key Use
The "use" (public key use) parameter identifies the intended use of
the public key. The "use" parameter is employed to indicate whether
a public key is used for encrypting data or verifying the signature
on data. Valid values are "enc" and "sig".'
type: string
required:
- alg
- use
- kid
type: object
errorOAuth2:
description: Error
properties:
error:
description: Error
type: string
error_debug:
description: 'Error Debug Information
Only available in dev mode.'
type: string
error_description:
description: Error Description
type: string
error_hint:
description: 'Error Hint
Helps the user identify the error cause.'
example: The redirect URL is not allowed.
type: string
status_code:
description: HTTP Status Code
example: 401
format: int64
type: integer
type: object
responses:
emptyResponse:
description: 'Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 204.'
securitySchemes:
basic:
scheme: basic
type: http
bearer:
scheme: bearer
type: http
oauth2:
flows:
authorizationCode:
authorizationUrl: https://hydra.demo.ory.sh/oauth2/auth
scopes:
offline: A scope required when requesting refresh tokens (alias for `offline_access`)
offline_access: A scope required when requesting refresh tokens
openid: Request an OpenID Connect ID Token
tokenUrl: https://hydra.demo.ory.sh/oauth2/token
type: oauth2
x-forwarded-proto: string
x-request-id: string