University of Sussex · Authentication Profile

University Of Sussex Authentication

Authentication

University of Sussex secures its APIs with saml2, oidc, and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, implicit, refreshToken, deviceCode, and ciba flow(s).

UniversityHigher EducationEducationUnited KingdomRussell GroupPublic Research UniversityIdentity FederationResearch RepositoryLibraryLearning ManagementResearchOpen Access
Methods: saml2, oidc, oauth2 Schemes: 3 OAuth flows: authorizationCode, implicit, refreshToken, deviceCode, ciba API key in:

Security Schemes

Shibboleth SAML 2.0 Identity Provider saml2
Okta OpenID Connect (Sussex tenant) oidc
· flows: authorizationCode
Canvas LMS (Sussex tenant) oauth2

Source

Authentication Profile

university-of-sussex-authentication.yml Raw ↑ 
# x-method: derived
# x-source-url: https://okta.sussex.ac.uk/.well-known/openid-configuration
# Authorship: written by API Evangelist tooling from LIVE PROBES of the URL above.
# `x-method: derived` is the provenance-manifest vocabulary (build-provenance-manifest.py,
# which has no `probed` term); `method: probed` below is the enrichment-pipeline vocabulary.
# They agree: this artifact is ours, and its facts came off the wire, not off a claim.
# University of Sussex — authentication surfaces
# Rebuilt 2026-08-30. The previous version of this file was DERIVED FROM FIGSHARE'S
# generic v2 OpenAPI and described Figshare's OAuth server, not the university's.
# It has been removed. Everything below was probed live against Sussex-controlled hosts.
generated: '2026-08-30'
method: probed
source: live HTTPS probes of idp.sussex.ac.uk and okta.sussex.ac.uk
provider: University of Sussex
providerId: university-of-sussex

summary:
  types:
  - saml2
  - oidc
  - oauth2
  oauth2_flows:
  - authorizationCode
  - implicit
  - refreshToken
  - deviceCode
  - ciba
  public_developer_registration: false
  note: >-
    Neither surface is a public developer API. Both gate access to enrolled Sussex
    applications and require institutional affiliation; there is no self-serve client
    registration for outside developers. They are recorded because they are the
    institution's only live, machine-readable contracts.

schemes:
- name: Shibboleth SAML 2.0 Identity Provider
  type: saml2
  x-operator: institution
  entity_id: https://idp.sussex.ac.uk/shibboleth
  metadata_url: https://idp.sussex.ac.uk/idp/shibboleth
  scope: sussex.ac.uk
  federation: UK Access Management Federation / eduGAIN (scope asserted in metadata; federation
    registration not independently confirmed on 2026-08-30)
  sources:
  - url: https://idp.sussex.ac.uk/idp/shibboleth
    status: 200

- name: Okta OpenID Connect (Sussex tenant)
  type: oidc
  x-operator: tenant
  issuer: https://okta.sussex.ac.uk
  discovery_url: https://okta.sussex.ac.uk/.well-known/openid-configuration
  vendor_host: sussexac.customdomains.okta.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://okta.sussex.ac.uk/oauth2/v1/authorize
    tokenUrl: https://okta.sussex.ac.uk/oauth2/v1/token
    pkce: S256
  endpoints:
    userinfo: https://okta.sussex.ac.uk/oauth2/v1/userinfo
    jwks: https://okta.sussex.ac.uk/oauth2/v1/keys
    introspection: https://okta.sussex.ac.uk/oauth2/v1/introspect
    revocation: https://okta.sussex.ac.uk/oauth2/v1/revoke
    end_session: https://okta.sussex.ac.uk/oauth2/v1/logout
    device_authorization: https://okta.sussex.ac.uk/oauth2/v1/device/authorize
    pushed_authorization_request: https://okta.sussex.ac.uk/oauth2/v1/par
    dynamic_client_registration: https://okta.sussex.ac.uk/oauth2/v1/clients
  id_token_signing_alg_values_supported:
  - RS256
  dpop_signing_alg_values_supported:
  - RS256
  - RS384
  - RS512
  - ES256
  - ES384
  - ES512
  sources:
  - url: https://okta.sussex.ac.uk/.well-known/openid-configuration
    status: 200

- name: Canvas LMS (Sussex tenant)
  type: oauth2
  x-operator: tenant
  summary: >-
    canvas.sussex.ac.uk answers /api/v1/* with 401 {"status":"unauthenticated"}. Canvas uses
    OAuth2 bearer tokens issued per user; there is no public client registration on this tenant.
  vendor_host: universityofsussex-vanity.instructure.com
  sources:
  - url: https://canvas.sussex.ac.uk/api/v1/accounts
    status: 401
  - url: https://canvas.sussex.ac.uk/api/lti/security/jwks
    status: 200

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/university-of-sussex-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.