Uniphore Authentication

generated: '2026-08-14'
method: searched
source: https://uniphore.us.auth0.com/.well-known/openid-configuration
docs: https://uniphore.github.io/baic-docs/
note: >-
  Uniphore publishes no OpenAPI, so this profile is not derived from
  securitySchemes. It is assembled from two real, fetched sources: (1) the
  anonymous OIDC / RFC 8414 discovery document served by Uniphore's dedicated
  Auth0 identity tenant (uniphore.us.auth0.com), saved verbatim under
  well-known/, and (2) the public BAIC Installation Guide, which documents the
  machine-to-machine token exchange and the Bearer scheme used against the
  Business AI Cloud platform API.
summary:
  types:
  - oauth2
  - openIdConnect
  - http
  api_key_in: []
  oauth2_flows:
  - clientCredentials
  - authorizationCode
  - refreshToken
  - deviceCode
  - tokenExchange
  bearer_format: JWT
  pkce: true
  mtls: false
schemes:
- name: openIdConnect
  type: openIdConnect
  openIdConnectUrl: https://uniphore.us.auth0.com/.well-known/openid-configuration
  issuer: https://uniphore.us.auth0.com/
  provider: Auth0 (Uniphore-dedicated tenant)
  endpoints:
    authorization: https://uniphore.us.auth0.com/authorize
    token: https://uniphore.us.auth0.com/oauth/token
    userinfo: https://uniphore.us.auth0.com/userinfo
    jwks: well-known/uniphore-jwks.json
    revocation: https://uniphore.us.auth0.com/oauth/revoke
    registration: https://uniphore.us.auth0.com/oidc/register
    device_authorization: https://uniphore.us.auth0.com/oauth/device/code
  grant_types:
  - client_credentials
  - authorization_code
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  - http://auth0.com/oauth/grant-type/password-realm
  - http://auth0.com/oauth/grant-type/passwordless/otp
  - http://auth0.com/oauth/grant-type/mfa-oob
  - http://auth0.com/oauth/grant-type/mfa-otp
  - http://auth0.com/oauth/grant-type/mfa-recovery-code
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - none
  code_challenge_methods:
  - S256
  - plain
  id_token_signing_alg: [RS256, HS256, PS256]
  dpop: true
  backchannel_logout: true
  sources:
  - well-known/uniphore-openid-configuration.json
- name: m2mBearer
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: >-
    Machine-to-machine access token for the Business AI Cloud (BAIC) platform
    API. Exchange a client_id / client_secret pair at the deployment's
    forge-user-management service, then present the returned access_token as
    an Authorization: Bearer header on every platform API call.
  token_endpoint_path: /auth/m2m-token
  token_request_params:
  - client_id
  - client_secret
  response_field: access_token
  header: 'Authorization: Bearer <token>'
  sources:
  - https://uniphore.github.io/baic-docs/
- name: ucaptureIdentityServer
  type: openIdConnect
  product: U-Capture
  description: >-
    U-Capture (Red Box heritage) runs its own Identity Server. External identity providers are
    registered through the Identity Server API, and the documentation names four supported
    federation protocols for external user login and SSO: OpenID Connect, OAuth, WS-Federation
    and SAML. Authorisation inside U-Capture is expressed as Roles plus Claim Maps that bind
    external identity claims to U-Capture access privileges; Tenant records are readable through
    the Identity Server Read API but configurable only by Uniphore engineers. All API
    microservices sit behind an API Gateway that performs authentication and authorisation, SSL
    termination and whitelisting.
  protocols: [OpenID Connect, OAuth, WS-Federation, SAML]
  authorization_model: [Roles, Users, Claim Maps]
  directory_integration: LDAP (LDAP Configuration API)
  token_details_published: false
  token_details_note: >-
    No token endpoint, grant type, header form or scope list is published for U-Capture; the docs
    describe features and functions, not the wire contract.
  sources:
  - https://support-rb.uniphore.com/conversa/DevelopConversa/DevelopUCaptureV2.0/UCaptureIdentityServerAPIs/API_Overview.htm
  - https://support-rb.uniphore.com/conversa/DevelopConversa/DevelopUCaptureV2.0/UCaptureRESTAPIs/API_Gateway.htm
- name: oidcSso
  type: openIdConnect
  description: >-
    BAIC deployments support enterprise OIDC single sign-on, configured through
    the forge-user-management service (oidcSso.oauthBaseUrl) and an oidc-secrets
    Kubernetes Secret. The identity provider is customer-supplied.
  configurable: true
  sources:
  - https://uniphore.github.io/baic-docs/
x-evidence:
- url: https://support-rb.uniphore.com/conversa/DevelopConversa/DevelopUCaptureV2.0/UCaptureIdentityServerAPIs/API_Overview.htm
  http_status: 200
  content_type: text/html
  fetched: '2026-08-14'
- url: https://uniphore.us.auth0.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json
  fetched: '2026-08-02'
- url: https://uniphore.us.auth0.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json
  fetched: '2026-08-02'
- url: https://uniphore.github.io/baic-docs/
  http_status: 200
  content_type: text/html
  fetched: '2026-08-02'