openapi: 3.0.3
info:
contact:
email: hi@ory.sh
description: 'Documentation for all of Ory Hydra''s APIs.
'
license:
name: Apache 2.0
title: Ory Hydra api oidc API
version: ''
tags:
- description: OpenID Connect
name: oidc
paths:
/.well-known/openid-configuration:
get:
description: 'A mechanism for an OpenID Connect Relying Party to discover the End-User''s OpenID Provider and obtain information needed to interact with it, including its OAuth 2.0 endpoint locations.
Popular libraries for OpenID Connect clients include oidc-client-js (JavaScript), go-oidc (Golang), and others.
For a full list of clients go here: https://openid.net/developers/certified/'
operationId: discoverOidcConfiguration
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/oidcConfiguration'
description: oidcConfiguration
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
summary: OpenID Connect Discovery
tags:
- oidc
x-ory-ratelimit-bucket: hydra-public-high
/credentials:
post:
description: 'This endpoint creates a verifiable credential that attests that the user
authenticated with the provided access token owns a certain public/private key
pair.
More information can be found at
https://openid.net/specs/openid-connect-userinfo-vc-1_0.html.'
operationId: createVerifiableCredential
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateVerifiableCredentialRequestBody'
x-originalParamName: Body
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/verifiableCredentialResponse'
description: verifiableCredentialResponse
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/verifiableCredentialPrimingResponse'
description: verifiableCredentialPrimingResponse
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
summary: Issues a Verifiable Credential
tags:
- oidc
x-ory-ratelimit-bucket: hydra-admin-medium
/oauth2/register:
post:
description: 'This endpoint behaves like the administrative counterpart (`createOAuth2Client`) but is capable of facing the
public internet directly and can be used in self-service. It implements the OpenID Connect
Dynamic Client Registration Protocol. This feature needs to be enabled in the configuration. This endpoint
is disabled by default. It can be enabled by an administrator.
Please note that using this endpoint you are not able to choose the `client_secret` nor the `client_id` as those
values will be server generated when specifying `token_endpoint_auth_method` as `client_secret_basic` or
`client_secret_post`.
The `client_secret` will be returned in the response and you will not be able to retrieve it later on.
Write the secret down and keep it somewhere safe.'
operationId: createOidcDynamicClient
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
description: Dynamic Client Registration Request Body
required: true
x-originalParamName: Body
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
description: oAuth2Client
'400':
$ref: '#/components/responses/errorOAuth2BadRequest'
default:
$ref: '#/components/responses/errorOAuth2Default'
summary: Register OAuth2 Client using OpenID Dynamic Client Registration
tags:
- oidc
x-ory-ratelimit-bucket: hydra-public-low
/oauth2/register/{id}:
delete:
description: 'This endpoint behaves like the administrative counterpart (`deleteOAuth2Client`) but is capable of facing the
public internet directly and can be used in self-service. It implements the OpenID Connect
Dynamic Client Registration Protocol. This feature needs to be enabled in the configuration. This endpoint
is disabled by default. It can be enabled by an administrator.
To use this endpoint, you will need to present the client''s authentication credentials. If the OAuth2 Client
uses the Token Endpoint Authentication Method `client_secret_post`, you need to present the client secret in the URL query.
If it uses `client_secret_basic`, present the Client ID and the Client Secret in the Authorization header.
OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are
generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.'
operationId: deleteOidcDynamicClient
parameters:
- description: The id of the OAuth 2.0 Client.
in: path
name: id
required: true
schema:
type: string
responses:
'204':
$ref: '#/components/responses/emptyResponse'
default:
content:
application/json:
schema:
$ref: '#/components/schemas/genericError'
description: genericError
security:
- bearer: []
summary: Delete OAuth 2.0 Client using the OpenID Dynamic Client Registration Management Protocol
tags:
- oidc
x-ory-ratelimit-bucket: hydra-public-low
get:
description: 'This endpoint behaves like the administrative counterpart (`getOAuth2Client`) but is capable of facing the
public internet directly and can be used in self-service. It implements the OpenID Connect
Dynamic Client Registration Protocol.
To use this endpoint, you will need to present the client''s authentication credentials. If the OAuth2 Client
uses the Token Endpoint Authentication Method `client_secret_post`, you need to present the client secret in the URL query.
If it uses `client_secret_basic`, present the Client ID and the Client Secret in the Authorization header.'
operationId: getOidcDynamicClient
parameters:
- description: The id of the OAuth 2.0 Client.
in: path
name: id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
description: oAuth2Client
default:
$ref: '#/components/responses/errorOAuth2Default'
security:
- bearer: []
summary: Get OAuth2 Client using OpenID Dynamic Client Registration
tags:
- oidc
x-ory-ratelimit-bucket: hydra-admin-high
put:
description: 'This endpoint behaves like the administrative counterpart (`setOAuth2Client`) but is capable of facing the
public internet directly to be used by third parties. It implements the OpenID Connect
Dynamic Client Registration Protocol.
This feature is disabled per default. It can be enabled by a system administrator.
If you pass `client_secret` the secret is used, otherwise the existing secret is used. If set, the secret is echoed in the response.
It is not possible to retrieve it later on.
To use this endpoint, you will need to present the client''s authentication credentials. If the OAuth2 Client
uses the Token Endpoint Authentication Method `client_secret_post`, you need to present the client secret in the URL query.
If it uses `client_secret_basic`, present the Client ID and the Client Secret in the Authorization header.
OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are
generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.'
operationId: setOidcDynamicClient
parameters:
- description: OAuth 2.0 Client ID
in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
description: OAuth 2.0 Client Request Body
required: true
x-originalParamName: Body
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/oAuth2Client'
description: oAuth2Client
'404':
$ref: '#/components/responses/errorOAuth2NotFound'
default:
$ref: '#/components/responses/errorOAuth2Default'
security:
- bearer: []
summary: Set OAuth2 Client using OpenID Dynamic Client Registration
tags:
- oidc
x-ory-ratelimit-bucket: hydra-public-low
/oauth2/sessions/logout:
get:
description: 'This endpoint initiates and completes user logout at the Ory OAuth2 & OpenID provider and initiates OpenID Connect Front- / Back-channel logout:
https://openid.net/specs/openid-connect-frontchannel-1_0.html
https://openid.net/specs/openid-connect-backchannel-1_0.html
Back-channel logout is performed asynchronously and does not affect logout flow.'
operationId: revokeOidcSession
responses:
'302':
$ref: '#/components/responses/emptyResponse'
summary: OpenID Connect Front- and Back-channel Enabled Logout
tags:
- oidc
x-ory-ratelimit-bucket: hydra-public-medium
/userinfo:
get:
description: 'This endpoint returns the payload of the ID Token, including `session.id_token` values, of
the provided OAuth 2.0 Access Token''s consent request.
In the case of authentication error, a WWW-Authenticate header might be set in the response
with more information about the error. See [the spec](https://datatracker.ietf.org/doc/html/rfc6750#section-3)
for more details about header format.'
operationId: getOidcUserInfo
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/oidcUserInfo'
description: oidcUserInfo
default:
content:
application/json:
schema:
$ref: '#/components/schemas/errorOAuth2'
description: errorOAuth2
security:
- oauth2: []
summary: OpenID Connect Userinfo
tags:
- oidc
x-ory-ratelimit-bucket: hydra-public-medium
components:
schemas:
oidcUserInfo:
description: OpenID Connect Userinfo
properties:
birthdate:
description: End-User's birthday, represented as an ISO 8601:2004 [ISO8601‑2004] YYYY-MM-DD format. The year MAY be 0000, indicating that it is omitted. To represent only the year, YYYY format is allowed. Note that depending on the underlying platform's date related function, providing just year can result in varying month and day, so the implementers need to take this factor into account to correctly process the dates.
type: string
email:
description: End-User's preferred e-mail address. Its value MUST conform to the RFC 5322 [RFC5322] addr-spec syntax. The RP MUST NOT rely upon this value being unique, as discussed in Section 5.7.
type: string
email_verified:
description: True if the End-User's e-mail address has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this e-mail address was controlled by the End-User at the time the verification was performed. The means by which an e-mail address is verified is context-specific, and dependent upon the trust framework or contractual agreements within which the parties are operating.
type: boolean
family_name:
description: Surname(s) or last name(s) of the End-User. Note that in some cultures, people can have multiple family names or no family name; all can be present, with the names being separated by space characters.
type: string
gender:
description: End-User's gender. Values defined by this specification are female and male. Other values MAY be used when neither of the defined values are applicable.
type: string
given_name:
description: Given name(s) or first name(s) of the End-User. Note that in some cultures, people can have multiple given names; all can be present, with the names being separated by space characters.
type: string
locale:
description: End-User's locale, represented as a BCP47 [RFC5646] language tag. This is typically an ISO 639-1 Alpha-2 [ISO639‑1] language code in lowercase and an ISO 3166-1 Alpha-2 [ISO3166‑1] country code in uppercase, separated by a dash. For example, en-US or fr-CA. As a compatibility note, some implementations have used an underscore as the separator rather than a dash, for example, en_US; Relying Parties MAY choose to accept this locale syntax as well.
type: string
middle_name:
description: Middle name(s) of the End-User. Note that in some cultures, people can have multiple middle names; all can be present, with the names being separated by space characters. Also note that in some cultures, middle names are not used.
type: string
name:
description: End-User's full name in displayable form including all name parts, possibly including titles and suffixes, ordered according to the End-User's locale and preferences.
type: string
nickname:
description: Casual name of the End-User that may or may not be the same as the given_name. For instance, a nickname value of Mike might be returned alongside a given_name value of Michael.
type: string
phone_number:
description: End-User's preferred telephone number. E.164 [E.164] is RECOMMENDED as the format of this Claim, for example, +1 (425) 555-1212 or +56 (2) 687 2400. If the phone number contains an extension, it is RECOMMENDED that the extension be represented using the RFC 3966 [RFC3966] extension syntax, for example, +1 (604) 555-1234;ext=5678.
type: string
phone_number_verified:
description: True if the End-User's phone number has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this phone number was controlled by the End-User at the time the verification was performed. The means by which a phone number is verified is context-specific, and dependent upon the trust framework or contractual agreements within which the parties are operating. When true, the phone_number Claim MUST be in E.164 format and any extensions MUST be represented in RFC 3966 format.
type: boolean
picture:
description: URL of the End-User's profile picture. This URL MUST refer to an image file (for example, a PNG, JPEG, or GIF image file), rather than to a Web page containing an image. Note that this URL SHOULD specifically reference a profile photo of the End-User suitable for displaying when describing the End-User, rather than an arbitrary photo taken by the End-User.
type: string
preferred_username:
description: Non-unique shorthand name by which the End-User wishes to be referred to at the RP, such as janedoe or j.doe. This value MAY be any valid JSON string including special characters such as @, /, or whitespace.
type: string
profile:
description: URL of the End-User's profile page. The contents of this Web page SHOULD be about the End-User.
type: string
sub:
description: Subject - Identifier for the End-User at the IssuerURL.
type: string
updated_at:
description: Time the End-User's information was last updated. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.
format: int64
type: integer
website:
description: URL of the End-User's Web page or blog. This Web page SHOULD contain information published by the End-User or an organization that the End-User is affiliated with.
type: string
zoneinfo:
description: String from zoneinfo [zoneinfo] time zone database representing the End-User's time zone. For example, Europe/Paris or America/Los_Angeles.
type: string
type: object
oAuth2Client:
description: 'OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are
generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.'
properties:
access_token_strategy:
description: 'OAuth 2.0 Access Token Strategy
AccessTokenStrategy is the strategy used to generate access tokens.
Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see https://www.ory.com/docs/oauth2-oidc/jwt-access-token
Setting the strategy here overrides the global setting in `strategies.access_token`.'
type: string
allowed_cors_origins:
description: 'OAuth 2.0 Client Allowed CORS Origins
One or more URLs (scheme://host[:port]) which are allowed to make CORS requests
to the /oauth/token endpoint. If this array is empty, the server''s CORS origin configuration (`CORS_ALLOWED_ORIGINS`)
will be used instead. If this array is set, the allowed origins are appended to the server''s CORS origin configuration.
Be aware that environment variable `CORS_ENABLED` MUST be set to `true` for this to work.'
items:
type: string
type: array
audience:
description: 'OAuth 2.0 Client Audience
An allow-list defining the audiences this client is allowed to request tokens for. An audience limits
the applicability of an OAuth 2.0 Access Token to, for example, certain API endpoints. The value is a list
of URLs. URLs MUST NOT contain whitespaces.'
example: https://mydomain.com/api/users, https://mydomain.com/api/posts
items:
type: string
type: array
authorization_code_grant_access_token_lifespan:
$ref: '#/components/schemas/NullDuration'
authorization_code_grant_id_token_lifespan:
$ref: '#/components/schemas/NullDuration'
authorization_code_grant_refresh_token_lifespan:
$ref: '#/components/schemas/NullDuration'
backchannel_logout_session_required:
description: 'OpenID Connect Back-Channel Logout Session Required
Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout
Token to identify the RP session with the OP when the backchannel_logout_uri is used.
If omitted, the default value is false.'
type: boolean
backchannel_logout_uri:
description: 'OpenID Connect Back-Channel Logout URI
RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.'
type: string
client_credentials_grant_access_token_lifespan:
$ref: '#/components/schemas/NullDuration'
client_id:
description: 'OAuth 2.0 Client ID
The ID is immutable. If no ID is provided, a UUID4 will be generated.'
type: string
client_name:
description: 'OAuth 2.0 Client Name
The human-readable name of the client to be presented to the
end-user during authorization.'
type: string
client_secret:
description: 'OAuth 2.0 Client Secret
The secret will be included in the create request as cleartext, and then
never again. The secret is kept in hashed format and is not recoverable once lost.'
type: string
client_secret_expires_at:
description: 'OAuth 2.0 Client Secret Expires At
The field is currently not supported and its value is always 0.'
format: int64
type: integer
client_uri:
description: 'OAuth 2.0 Client URI
ClientURI is a URL string of a web page providing information about the client.
If present, the server SHOULD display this URL to the end-user in
a clickable fashion.'
type: string
contacts:
description: 'OAuth 2.0 Client Contact
An array of strings representing ways to contact people responsible
for this client, typically email addresses.'
example: help@example.org
items:
type: string
type: array
created_at:
description: 'OAuth 2.0 Client Creation Date
CreatedAt returns the timestamp of the client''s creation.'
format: date-time
type: string
device_authorization_grant_access_token_lifespan:
$ref: '#/components/schemas/NullDuration'
device_authorization_grant_id_token_lifespan:
$ref: '#/components/schemas/NullDuration'
device_authorization_grant_refresh_token_lifespan:
$ref: '#/components/schemas/NullDuration'
frontchannel_logout_session_required:
description: 'OpenID Connect Front-Channel Logout Session Required
Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be
included to identify the RP session with the OP when the frontchannel_logout_uri is used.
If omitted, the default value is false.'
type: boolean
frontchannel_logout_uri:
description: 'OpenID Connect Front-Channel Logout URI
RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query
parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the
request and to determine which of the potentially multiple sessions is to be logged out; if either is
included, both MUST be.'
type: string
grant_types:
description: 'OAuth 2.0 Client Grant Types
An array of OAuth 2.0 grant types the client is allowed to use. Can be one
of:
Client Credentials Grant: `client_credentials`
Authorization Code Grant: `authorization_code`
OpenID Connect Implicit Grant (deprecated!): `implicit`
Refresh Token Grant: `refresh_token`
OAuth 2.0 Token Exchange: `urn:ietf:params:oauth:grant-type:jwt-bearer`
OAuth 2.0 Device Code Grant: `urn:ietf:params:oauth:grant-type:device_code`'
items:
type: string
type: array
implicit_grant_access_token_lifespan:
$ref: '#/components/schemas/NullDuration'
implicit_grant_id_token_lifespan:
$ref: '#/components/schemas/NullDuration'
jwks:
$ref: '#/components/schemas/jsonWebKeySet'
jwks_uri:
description: 'OAuth 2.0 Client JSON Web Key Set URL
URL for the Client''s JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains
the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the
Client''s encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing
and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced
JWK Set to indicate each key''s intended usage. Although some algorithms allow the same key to be used for both
signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used
to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST
match those in the certificate.'
type: string
jwt_bearer_grant_access_token_lifespan:
$ref: '#/components/schemas/NullDuration'
logo_uri:
description: 'OAuth 2.0 Client Logo URI
A URL string referencing the client''s logo.'
type: string
metadata:
$ref: '#/components/schemas/JSONRawMessage'
owner:
description: 'OAuth 2.0 Client Owner
Owner is a string identifying the owner of the OAuth 2.0 Client.'
type: string
policy_uri:
description: 'OAuth 2.0 Client Policy URI
PolicyURI is a URL string that points to a human-readable privacy policy document
that describes how the deployment organization collects, uses,
retains, and discloses personal data.'
type: string
post_logout_redirect_uris:
description: 'Allowed Post-Redirect Logout URIs
Array of URLs supplied by the RP to which it MAY request that the End-User''s User Agent be redirected using the
post_logout_redirect_uri parameter after a logout has been performed.'
items:
type: string
type: array
redirect_uris:
description: 'OAuth 2.0 Client Redirect URIs
RedirectURIs is an array of allowed redirect urls for the client.'
example: http://mydomain/oauth/callback
items:
type: string
type: array
refresh_token_grant_access_token_lifespan:
$ref: '#/components/schemas/NullDuration'
refresh_token_grant_id_token_lifespan:
$ref: '#/components/schemas/NullDuration'
refresh_token_grant_refresh_token_lifespan:
$ref: '#/components/schemas/NullDuration'
registration_access_token:
description: 'OpenID Connect Dynamic Client Registration Access Token
RegistrationAccessToken can be used to update, get, or delete the OAuth2 Client. It is sent when creating a client
using Dynamic Client Registration.'
type: string
registration_client_uri:
description: 'OpenID Connect Dynamic Client Registration URL
RegistrationClientURI is the URL used to update, get, or delete the OAuth2 Client.'
type: string
request_object_signing_alg:
description: 'OpenID Connect Request Object Signing Algorithm
JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects
from this Client MUST be rejected, if not signed with this algorithm.'
type: string
request_uris:
description: 'OpenID Connect Request URIs
Array of request_uri values that are pre-registered by the RP for use at the OP. Servers MAY cache the
contents of the files referenced by these URIs and not retrieve them at the time they are used in a request.
OPs can require that request_uri values used be pre-registered with the require_request_uri_registration
discovery parameter.'
items:
type: string
type: array
response_types:
description: 'OAuth 2.0 Client Response Types
An array of the OAuth 2.0 response type strings that the client can
use at the authorization endpoint. Can be one of:
Needed for OpenID Connect Implicit Grant:
Returns ID Token to redirect URI: `id_token`
Returns Access token redirect URI: `token`
Needed for Authorization Code Grant: `code`'
items:
type: string
type: array
scope:
description: 'OAuth 2.0 Client Scope
Scope is a string containing a space-separated list of scope values (as
described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client
can use when requesting access tokens.'
example: scope1 scope-2 scope.3 scope:4
type: string
sector_identifier_uri:
description: 'OpenID Connect Sector Identifier URI
URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a
file with a single JSON array of redirect_uri values.'
type: string
skip_consent:
description: 'SkipConsent skips the consent screen for this client. This field can only
be set from the admin API.'
type: boolean
skip_logout_consent:
description: 'SkipLogoutConsent skips the logout consent screen for this client. This field can only
be set from the admin API.'
type: boolean
subject_type:
description: 'OpenID Connect Subject Type
The `subject_types_supported` Discovery parameter contains a
list of the supported subject_type values for this server. Valid types include `pairwise` and `public`.'
type: string
token_endpoint_auth_method:
default: client_secret_basic
description: 'OAuth 2.0 Token Endpoint Authentication Method
Requested Client Authentication method for the Token Endpoint. The options are:
`client_secret_basic`: (default) Send `client_id` and `client_secret` as `application/x-www-form-urlencoded` encoded in the HTTP Authorization header.
`client_secret_post`: Send `client_id` and `client_secret` as `application/x-www-form-urlencoded` in the HTTP body.
`private_key_jwt`: Use JSON Web Tokens to authenticate the client.
`none`: Used for public clients (native apps, mobile apps) which can not have secrets.'
type: string
token_endpoint_auth_signing_alg:
description: 'OAuth 2.0 Token Endpoint Signing Algorithm
Requested Client Authentication signing algorithm for the Token Endpoint.'
type: string
tos_uri:
description: 'OAuth 2.0 Client Terms of Service URI
A URL string pointing to a human-readable terms of service
document for the client that describes a contractual relationship
between the end-user and the client that the end-user accepts when
authorizing the client.'
type: string
updated_at:
description: 'OAuth 2.0 Client Last Update Date
UpdatedAt returns the timestamp of the last update.'
format: date-time
type: string
userinfo_signed_response_alg:
description: 'OpenID Connect Request Userinfo Signed Response Algorithm
JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT
[JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims
as a UTF-8 encoded JSON object using the application/json content-type.'
type: string
title: OAuth 2.0 Client
type: object
jsonWebKeySet:
description: JSON Web Key Set
properties:
keys:
description: 'List of JSON Web Keys
The value of the "keys" parameter is an array of JSON Web Key (JWK)
values. By default, the order of the JWK values within the array does
not imply an order of preference among them, although applications
of JWK Sets can choose to assign a meaning to the order for their
purposes, if desired.'
items:
$ref: '#/components/schemas/jsonWebKey'
type: array
type: object
genericError:
properties:
# --- truncated at 32 KB (54 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/ory/refs/heads/main/openapi/ory-oidc-api-openapi.yml