Employee Navigator · Authentication Profile

Employeenavigator Authentication

Authentication

Employee Navigator secures its APIs with oauth2 and openIdConnect across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, refreshToken, implicit, deviceCode, and ciba flow(s).

CompanyBenefits AdministrationHuman ResourcesInsuranceEmployee BenefitsPayrollHealth InsuranceHRISOpen EnrollmentACA ComplianceIdentityOpenID Connect
Methods: oauth2, openIdConnect Schemes: 2 OAuth flows: authorizationCode, clientCredentials, refreshToken, implicit, deviceCode, ciba API key in:

Security Schemes

OpenIDConnect openIdConnect
OAuth2 oauth2
· flows: authorizationCode, clientCredentials, implicit, deviceCode, ciba

Source

Authentication Profile

employeenavigator-authentication.yml Raw ↑ 
generated: '2026-08-06'
method: probed
source: https://www.employeenavigator.com/identity/.well-known/openid-configuration
docs: https://www.employeenavigator.com/security/
notes: >-
  Derived verbatim from the anonymously-served OpenID Connect discovery document
  at the Employee Navigator identity host, not from an OpenAPI securitySchemes
  block — Employee Navigator publishes no public OpenAPI. The server is a Duende
  IdentityServer instance mounted at /identity on the apex web host and fronts
  every named Employee Navigator platform API service (see
  scopes/employeenavigator-scopes.yml).
summary:
  types:
  - oauth2
  - openIdConnect
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - refreshToken
  - implicit
  - deviceCode
  - ciba
  bearer_format: JWT
  scope_count: 66
schemes:
- name: OpenIDConnect
  type: openIdConnect
  openIdConnectUrl: https://www.employeenavigator.com/identity/.well-known/openid-configuration
  issuer: https://www.employeenavigator.com/identity
  sources:
  - well-known/employeenavigator-openid-configuration.json
- name: OAuth2
  type: oauth2
  sources:
  - well-known/employeenavigator-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://www.employeenavigator.com/identity/connect/authorize
    tokenUrl: https://www.employeenavigator.com/identity/connect/token
    refreshUrl: https://www.employeenavigator.com/identity/connect/token
  - flow: clientCredentials
    tokenUrl: https://www.employeenavigator.com/identity/connect/token
  - flow: implicit
    authorizationUrl: https://www.employeenavigator.com/identity/connect/authorize
  - flow: deviceCode
    deviceAuthorizationUrl: https://www.employeenavigator.com/identity/connect/deviceauthorization
    tokenUrl: https://www.employeenavigator.com/identity/connect/token
    grant_type: urn:ietf:params:oauth:grant-type:device_code
  - flow: ciba
    backchannelAuthenticationUrl: https://www.employeenavigator.com/identity/connect/ciba
    grant_type: urn:openid:params:grant-type:ciba
    delivery_modes:
    - poll
endpoints:
  issuer: https://www.employeenavigator.com/identity
  authorization: https://www.employeenavigator.com/identity/connect/authorize
  token: https://www.employeenavigator.com/identity/connect/token
  userinfo: https://www.employeenavigator.com/identity/connect/userinfo
  jwks: https://www.employeenavigator.com/identity/.well-known/openid-configuration/jwks
  introspection: https://www.employeenavigator.com/identity/connect/introspect
  revocation: https://www.employeenavigator.com/identity/connect/revocation
  end_session: https://www.employeenavigator.com/identity/connect/endsession
  check_session_iframe: https://www.employeenavigator.com/identity/connect/checksession
  device_authorization: https://www.employeenavigator.com/identity/connect/deviceauthorization
  backchannel_authentication: https://www.employeenavigator.com/identity/connect/ciba
client_authentication:
- client_secret_basic
- client_secret_post
proof_of_possession:
  pkce: true
  pkce_methods:
  - plain
  - S256
  dpop: true
  dpop_signing_algs:
  - RS256
  - RS384
  - RS512
  - PS256
  - PS384
  - PS512
  - ES256
  - ES384
  - ES512
tokens:
  id_token_signing_algs:
  - RS256
  subject_types:
  - public
  offline_access: true
  request_object_supported: true
logout:
  frontchannel_logout: true
  frontchannel_logout_session: true
  backchannel_logout: true
  backchannel_logout_session: true
claims:
- sub
- name
- family_name
- given_name
- middle_name
- nickname
- preferred_username
- profile
- picture
- website
- gender
- birthdate
- zoneinfo
- locale
- updated_at
- email
- email_verified
prompt_values:
- none
- login
- consent
- select_account
response_types:
- code
- token
- id_token
- id_token token
- code id_token
- code token
- code id_token token
response_modes:
- form_post
- query
- fragment
x-evidence:
  fetched: '2026-08-06'
  url: https://www.employeenavigator.com/identity/.well-known/openid-configuration
  http_status: 200
  content_type: application/json; charset=UTF-8
x-access:
  client_registration: manual
  note: >-
    No dynamic client registration endpoint is advertised. API client
    credentials are issued to carriers, payroll companies and other partners
    through Employee Navigator's partner onboarding; there is no public
    self-service developer signup.