Ory

Ory OAuth2 (Admin) API

Privileged Hydra client, token, consent, and key management.

GitHub OpenAPI

Operations 18

GET /admin/oauth2/clients List OAuth2 clients #
POST /admin/oauth2/clients Create an OAuth2 client #
GET /admin/oauth2/clients/{id} Get an OAuth2 client #
PUT /admin/oauth2/clients/{id} Replace an OAuth2 client #
PATCH /admin/oauth2/clients/{id} Patch an OAuth2 client #
DELETE /admin/oauth2/clients/{id} Delete an OAuth2 client #
POST /admin/oauth2/introspect Introspect an OAuth2 token #
GET /admin/oauth2/auth/requests/login Get an OAuth2 login request #
PUT /admin/oauth2/auth/requests/login/accept Accept an OAuth2 login request #
GET /admin/oauth2/auth/requests/consent Get an OAuth2 consent request #
PUT /admin/oauth2/auth/requests/consent/accept Accept an OAuth2 consent request #
PUT /admin/oauth2/auth/requests/logout/accept Accept an OAuth2 logout request #
DELETE /admin/oauth2/tokens Delete OAuth2 access tokens for a client #
GET /admin/keys/{set} Get a JSON Web Key Set #
POST /admin/keys/{set} Generate a JSON Web Key Set #
DELETE /admin/keys/{set} Delete a JSON Web Key Set #
GET /admin/trust/grants List trusted JWT-bearer grant issuers #
POST /admin/trust/grants Trust a JWT-bearer grant issuer #

Documentation

📖
Documentation
https://www.ory.com/docs/kratos/self-service
📖
APIReference
https://www.ory.com/docs/kratos/reference/api
📖
Documentation
https://www.ory.com/docs/kratos/manage-identities/overview
📖
Documentation
https://www.ory.com/docs/oauth2-openid-connect-do-you-need-use-cases-products
📖
APIReference
https://www.ory.com/docs/hydra/reference/api
📖
Documentation
https://www.ory.com/docs/hydra/guides/oauth2-clients
📖
Documentation
https://www.ory.com/docs/keto/concepts/api-overview
📖
APIReference
https://www.ory.com/docs/keto/reference/rest-api
📖
Documentation
https://www.ory.com/docs/keto/reference/ory-permission-language
📖
Documentation
https://www.ory.com/docs/kratos/self-service/flows/verify-email-account-activation
📖
Documentation
https://www.ory.com/docs/kratos/organizations
📖
APIReference
https://www.ory.com/docs/reference/api
📖
Documentation
https://www.ory.com/docs/guides/manage-project-via-api
📖
Documentation
https://www.ory.com/docs/concepts/personal-access-token
📖
APIReference
https://www.ory.com/docs/guides/manage-project-via-api
📖
Documentation
https://www.ory.com/docs/guides/event-streams/aws-sns
📖
Documentation
https://www.ory.com/pricing

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/ory/refs/heads/main/openapi/ory-oauth2-admin-api-openapi.yml

Other Resources

🔗
PostmanCollection
https://raw.githubusercontent.com/api-evangelist/ory/refs/heads/main/collections/ory-network.postman_collection.json
🔗
OpenCollection
https://raw.githubusercontent.com/api-evangelist/ory/refs/heads/main/collections/ory-network.opencollection.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/ory-oauth2-admin-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

ory-oauth2-admin-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Ory Network OAuth2 (Admin) API
  description: Ory is open-source identity and access infrastructure, delivered as the Ory Network managed cloud.
  version: '1.0'
  contact:
    name: Ory
    url: https://www.ory.com
  license:
    name: Apache-2.0
    url: https://github.com/ory/kratos/blob/master/LICENSE
servers:
- url: https://{project-slug}.projects.oryapis.com
  description: Ory Network project (Kratos, Hydra, Keto, Courier)
  variables:
    project-slug:
      default: your-project-slug
      description: The slug of your Ory Network project.
- url: https://api.console.ory.sh
  description: Ory Network Console API (control plane)
security:
- oryApiKey: []
tags:
- name: OAuth2 (Admin)
  description: Privileged Hydra client, token, consent, and key management.
paths:
  /admin/oauth2/clients:
    get:
      operationId: listOAuth2Clients
      tags:
      - OAuth2 (Admin)
      summary: List OAuth2 clients
      responses:
        '200':
          description: A page of OAuth2 clients.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OAuth2Client'
    post:
      operationId: createOAuth2Client
      tags:
      - OAuth2 (Admin)
      summary: Create an OAuth2 client
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuth2Client'
      responses:
        '201':
          description: The created client.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Client'
  /admin/oauth2/clients/{id}:
    parameters:
    - name: id
      in: path
      required: true
      schema:
        type: string
    get:
      operationId: getOAuth2Client
      tags:
      - OAuth2 (Admin)
      summary: Get an OAuth2 client
      responses:
        '200':
          description: The client.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Client'
    put:
      operationId: setOAuth2Client
      tags:
      - OAuth2 (Admin)
      summary: Replace an OAuth2 client
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuth2Client'
      responses:
        '200':
          description: The updated client.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Client'
    patch:
      operationId: patchOAuth2Client
      tags:
      - OAuth2 (Admin)
      summary: Patch an OAuth2 client
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                type: object
                additionalProperties: true
      responses:
        '200':
          description: The patched client.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Client'
    delete:
      operationId: deleteOAuth2Client
      tags:
      - OAuth2 (Admin)
      summary: Delete an OAuth2 client
      responses:
        '204':
          description: Client deleted.
  /admin/oauth2/introspect:
    post:
      operationId: introspectOAuth2Token
      tags:
      - OAuth2 (Admin)
      summary: Introspect an OAuth2 token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                token:
                  type: string
                scope:
                  type: string
      responses:
        '200':
          description: The introspection result (active flag and claims).
  /admin/oauth2/auth/requests/login:
    get:
      operationId: getOAuth2LoginRequest
      tags:
      - OAuth2 (Admin)
      summary: Get an OAuth2 login request
      parameters:
      - name: login_challenge
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The login request.
  /admin/oauth2/auth/requests/login/accept:
    put:
      operationId: acceptOAuth2LoginRequest
      tags:
      - OAuth2 (Admin)
      summary: Accept an OAuth2 login request
      parameters:
      - name: login_challenge
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The redirect to continue the flow.
  /admin/oauth2/auth/requests/consent:
    get:
      operationId: getOAuth2ConsentRequest
      tags:
      - OAuth2 (Admin)
      summary: Get an OAuth2 consent request
      parameters:
      - name: consent_challenge
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The consent request.
  /admin/oauth2/auth/requests/consent/accept:
    put:
      operationId: acceptOAuth2ConsentRequest
      tags:
      - OAuth2 (Admin)
      summary: Accept an OAuth2 consent request
      parameters:
      - name: consent_challenge
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The redirect to complete consent.
  /admin/oauth2/auth/requests/logout/accept:
    put:
      operationId: acceptOAuth2LogoutRequest
      tags:
      - OAuth2 (Admin)
      summary: Accept an OAuth2 logout request
      parameters:
      - name: logout_challenge
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The redirect to complete logout.
  /admin/oauth2/tokens:
    delete:
      operationId: deleteOAuth2Tokens
      tags:
      - OAuth2 (Admin)
      summary: Delete OAuth2 access tokens for a client
      parameters:
      - name: client_id
        in: query
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Tokens deleted.
  /admin/keys/{set}:
    parameters:
    - name: set
      in: path
      required: true
      schema:
        type: string
    get:
      operationId: getJsonWebKeySet
      tags:
      - OAuth2 (Admin)
      summary: Get a JSON Web Key Set
      responses:
        '200':
          description: The key set.
    post:
      operationId: createJsonWebKeySet
      tags:
      - OAuth2 (Admin)
      summary: Generate a JSON Web Key Set
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      responses:
        '201':
          description: The created key set.
    delete:
      operationId: deleteJsonWebKeySet
      tags:
      - OAuth2 (Admin)
      summary: Delete a JSON Web Key Set
      responses:
        '204':
          description: Key set deleted.
  /admin/trust/grants:
    get:
      operationId: listTrustedJwtGrantIssuers
      tags:
      - OAuth2 (Admin)
      summary: List trusted JWT-bearer grant issuers
      responses:
        '200':
          description: The trusted issuers.
    post:
      operationId: trustJwtGrantIssuer
      tags:
      - OAuth2 (Admin)
      summary: Trust a JWT-bearer grant issuer
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
      responses:
        '201':
          description: The created trust relationship.
components:
  schemas:
    OAuth2Client:
      type: object
      properties:
        client_id:
          type: string
        client_name:
          type: string
        client_secret:
          type: string
        redirect_uris:
          type: array
          items:
            type: string
            format: uri
        grant_types:
          type: array
          items:
            type: string
        response_types:
          type: array
          items:
            type: string
        scope:
          type: string
        token_endpoint_auth_method:
          type: string
  securitySchemes:
    oryApiKey:
      type: http
      scheme: bearer
      description: 'Ory API key. Project admin endpoints use an Ory project API key (ory_pat_...); Console endpoints use a workspace API key (ory_wak_...). Passed as `Authorization: Bearer <token>`.'