Skip to main content
API docs by Redocly

Ory APIs (latest)

Download OpenAPI specification:Download

API Support: support@ory.sh License: Apache 2.0 Terms of Service

Documentation for all public and administrative Ory APIs. Administrative APIs can only be accessed with a valid Personal Access Token. Public APIs are mostly used in browsers.

identity

APIs for managing identities.

List Identities

Lists all identities in the system.

Authorizations:
oryAccessToken
query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Deprecated Items per Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This is the number of items per page.

page
integer <int64>

Deprecated Pagination Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.

For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the Link header.

page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Page Size

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

consistency
string
Enum: "" "strong" "eventual"

Read Consistency Level (preview)

The read consistency level determines the consistency guarantee for reads:

strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. eventual (very fast): The result will return data that is about 4.8 seconds old.

The default consistency guarantee can be changed in the Ory Network Console or using the Ory CLI with ory patch project --replace '/previews/default_read_consistency_level="strong"'.

Setting the default consistency level to eventual may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:

GET /admin/identities

This feature is in preview and only available in Ory Network. ConsistencyLevelUnset ConsistencyLevelUnset is the unset / default consistency level. strong ConsistencyLevelStrong ConsistencyLevelStrong is the strong consistency level. eventual ConsistencyLevelEventual ConsistencyLevelEventual is the eventual consistency level using follower read timestamps.

ids
Array of strings

List of ids used to filter identities. If this list is empty, then no filter will be applied.

credentials_identifier
string

CredentialsIdentifier is the identifier (username, email) of the credentials to look up using exact match. Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used.

preview_credentials_identifier_similar
string

This is an EXPERIMENTAL parameter that WILL CHANGE. Do NOT rely on consistent, deterministic behavior. THIS PARAMETER WILL BE REMOVED IN AN UPCOMING RELEASE WITHOUT ANY MIGRATION PATH.

CredentialsIdentifierSimilar is the (partial) identifier (username, email) of the credentials to look up using similarity search. Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used.

include_credential
Array of strings

Include Credentials in Response

Include any credential, for example password or oidc, in the response. When set to oidc, This will return the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token and the OpenID Connect ID Token if available.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create multiple identities

Creates multiple identities. This endpoint can also be used to import credentials for instance passwords, social sign in configurations or multifactor methods.

Authorizations:
oryAccessToken
Request Body schema: application/json
Array of objects (identityPatch)

Identities holds the list of patches to apply

required

Array
object (createIdentityBody)

Create Identity Body

patch_id
string <uuid>

The ID of this patch.

The patch ID is optional. If specified, the ID will be returned in the response, so consumers of this API can correlate the response with the patch.

Responses

Request samples

Content type
application/json
{
  • "identities": [
    ]
}

Response samples

Content type
application/json
{
  • "identities": [
    ]
}

Create an Identity

Create an identity. This endpoint can also be used to import credentials for instance passwords, social sign in configurations or multifactor methods.

Authorizations:
oryAccessToken
Request Body schema: application/json
object (identityWithCredentials)

Create Identity and Import Credentials

metadata_admin
any

Store metadata about the user which is only accessible through admin APIs such as GET /admin/identities/<id>.

metadata_public
any

Store metadata about the identity which the identity itself can see when calling for example the session endpoint. Do not store sensitive information (e.g. credit score) about the identity in this field.

Array of objects (recoveryIdentityAddress)

RecoveryAddresses contains all the addresses that can be used to recover an identity.

Use this structure to import recovery addresses for an identity. Please keep in mind that the address needs to be represented in the Identity Schema or this field will be overwritten on the next identity update.

schema_id
required
string

SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.

state
string
Enum: "active" "inactive"

State is the identity's state. active StateActive inactive StateInactive

traits
required
object

Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in schema_url.

Array of objects (verifiableIdentityAddress)

VerifiableAddresses contains all the addresses that can be verified by the user.

Use this structure to import verified addresses for an identity. Please keep in mind that the address needs to be represented in the Identity Schema or this field will be overwritten on the next identity update.

Responses

Request samples

Content type
application/json
{
  • "credentials": {
    },
  • "metadata_admin": null,
  • "metadata_public": null,
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "state": "active",
  • "traits": { },
  • "verifiable_addresses": [
    ]
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "metadata_admin": { },
  • "metadata_public": { },
  • "organization_id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Delete an Identity

Calling this endpoint irrecoverably and permanently deletes the identity given its ID. This action can not be undone. This endpoint returns 204 when the identity was deleted or when the identity was not found, in which case it is assumed that is has been deleted already.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Get an Identity

Return an identity by its ID. You can optionally include credentials (e.g. social sign in connections) in the response by using the include_credential query parameter.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID must be set to the ID of identity you want to get

query Parameters
include_credential
Array of strings
Items Enum: "password" "oidc" "totp" "lookup_secret" "webauthn" "code" "passkey" "profile" "link_recovery" "code_recovery"

Include Credentials in Response

Include any credential, for example password or oidc, in the response. When set to oidc, This will return the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token and the OpenID Connect ID Token if available.

Responses

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "metadata_admin": { },
  • "metadata_public": { },
  • "organization_id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Patch an Identity

Partially updates an identity's field using JSON Patch. The fields id, stateChangedAt and credentials can not be updated using this method.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID must be set to the ID of identity you want to update

Request Body schema: application/json
Array
from
string

This field is used together with operation "move" and uses JSON Pointer notation.

Learn more about JSON Pointers.

op
required
string
Enum: "add" "remove" "replace" "move" "copy" "test"

The operation to be performed. One of "add", "remove", "replace", "move", "copy", or "test".

path
required
string

The path to the target path. Uses JSON pointer notation.

Learn more about JSON Pointers.

value
any

The value to be used within the operations.

Learn more about JSON Pointers.

Responses

Request samples

Content type
application/json
[
  • {
    }
]

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "metadata_admin": { },
  • "metadata_public": { },
  • "organization_id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Update an Identity

This endpoint updates an identity. The full identity payload (except credentials) is expected. It is possible to update the identity's credentials as well.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID must be set to the ID of identity you want to update

Request Body schema: application/json
object (identityWithCredentials)

Create Identity and Import Credentials

metadata_admin
any

Store metadata about the user which is only accessible through admin APIs such as GET /admin/identities/<id>.

metadata_public
any

Store metadata about the identity which the identity itself can see when calling for example the session endpoint. Do not store sensitive information (e.g. credit score) about the identity in this field.

schema_id
required
string

SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. If set will update the Identity's SchemaID.

state
required
string
Enum: "active" "inactive"

State is the identity's state. active StateActive inactive StateInactive

traits
required
object

Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in schema_id.

Responses

Request samples

Content type
application/json
{
  • "credentials": {
    },
  • "metadata_admin": null,
  • "metadata_public": null,
  • "schema_id": "string",
  • "state": "active",
  • "traits": { }
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "metadata_admin": { },
  • "metadata_public": { },
  • "organization_id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Delete a credential for a specific identity

Delete an identity credential by its type You can only delete second factor (aal2) credentials.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

type
required
string
Enum: "password" "oidc" "totp" "lookup_secret" "webauthn" "code" "passkey" "profile" "link_recovery" "code_recovery"

Type is the type of credentials to be deleted. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow). It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Delete & Invalidate an Identity's Sessions

Calling this endpoint irrecoverably and permanently deletes and invalidates all sessions that belong to the given Identity.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

List an Identity's Sessions

This endpoint returns all sessions that belong to the given Identity.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Deprecated Items per Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This is the number of items per page.

page
integer <int64>

Deprecated Pagination Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.

For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the Link header.

page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Page Size

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

active
boolean

Active is a boolean flag that filters out sessions based on the state. If no value is provided, all sessions are returned.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Recovery Code

This endpoint creates a recovery code which should be given to the user in order for them to recover (or activate) their account.

Authorizations:
oryAccessToken
Request Body schema: application/json
expires_in
string^([0-9]+(ns|us|ms|s|m|h))*$

Code Expires In

The recovery code will expire after that amount of time has passed. Defaults to the configuration value of selfservice.methods.code.config.lifespan.

flow_type
string (Type is the flow type.)

The flow type can either be api or browser.

identity_id
required
string <uuid>

Identity to Recover

The identity's ID you wish to recover.

Responses

Request samples

Content type
application/json
{
  • "expires_in": "string",
  • "flow_type": "string",
  • "identity_id": "011a42b9-62d7-49eb-8328-c2e454af88a1"
}

Response samples

Content type
application/json
{
  • "expires_at": "2019-08-24T14:15:22Z",
  • "recovery_code": "string",
  • "recovery_link": "string"
}

Create a Recovery Link

This endpoint creates a recovery link which should be given to the user in order for them to recover (or activate) their account.

Authorizations:
oryAccessToken
query Parameters
return_to
string
Request Body schema: application/json
expires_in
string^[0-9]+(ns|us|ms|s|m|h)$

Link Expires In

The recovery link will expire after that amount of time has passed. Defaults to the configuration value of selfservice.methods.code.config.lifespan.

identity_id
required
string <uuid>

Identity to Recover

The identity's ID you wish to recover.

Responses

Request samples

Content type
application/json
{
  • "expires_in": "string",
  • "identity_id": "011a42b9-62d7-49eb-8328-c2e454af88a1"
}

Response samples

Content type
application/json
{
  • "expires_at": "2019-08-24T14:15:22Z",
  • "recovery_link": "string"
}

List All Sessions

Listing all sessions that exist.

Authorizations:
oryAccessToken
query Parameters
page_size
integer <int64> [ 1 .. 1000 ]
Default: 250

Items per Page

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

active
boolean

Active is a boolean flag that filters out sessions based on the state. If no value is provided, all sessions are returned.

expand
Array of strings
Items Enum: "identity" "devices"

ExpandOptions is a query parameter encoded list of all properties that must be expanded in the Session. If no value is provided, the expandable properties are skipped.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Deactivate a Session

Calling this endpoint deactivates the specified session. Session data is not deleted.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the session's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Get Session

This endpoint is useful for:

Getting a session object with all specified expandables that exist in an administrative context.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the session's ID.

query Parameters
expand
Array of strings
Items Enum: "identity" "devices"

ExpandOptions is a query parameter encoded list of all properties that must be expanded in the Session. Example - ?expand=Identity&expand=Devices If no value is provided, the expandable properties are skipped.

Responses

Response samples

Content type
application/json
{
  • "active": true,
  • "authenticated_at": "2019-08-24T14:15:22Z",
  • "authentication_methods": [
    ],
  • "authenticator_assurance_level": "aal0",
  • "devices": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "tokenized": "string"
}

Extend a Session

Calling this endpoint extends the given session ID. If session.earliest_possible_extend is set it will only extend the session after the specified time has passed.

This endpoint returns per default a 204 No Content response on success. Older Ory Network projects may return a 200 OK response with the session in the body. Returning the session as part of the response will be deprecated in the future and should not be relied upon.

Retrieve the session ID from the /sessions/whoami endpoint / toSession SDK method.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the session's ID.

Responses

Response samples

Content type
application/json
{
  • "active": true,
  • "authenticated_at": "2019-08-24T14:15:22Z",
  • "authentication_methods": [
    ],
  • "authenticator_assurance_level": "aal0",
  • "devices": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "tokenized": "string"
}

Get all Identity Schemas

Returns a list of all identity schemas currently in use.

query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Deprecated Items per Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This is the number of items per page.

page
integer <int64>

Deprecated Pagination Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.

For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the Link header.

page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Page Size

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get Identity JSON Schema

Return a specific identity schema.

path Parameters
id
required
string

ID must be set to the ID of schema you want to get

Responses

Response samples

Content type
application/json
{ }

frontend

Endpoints used by frontend applications (e.g. Single-Page-App, Native Apps, Server Apps, ...) to manage a user's own profile.

Get WebAuthn JavaScript

This endpoint provides JavaScript which is needed in order to perform WebAuthn login and registration.

If you are building a JavaScript Browser App (e.g. in ReactJS or AngularJS) you will need to load this file:

<script src="https://public-kratos.example.org/.well-known/ory/webauthn.js" type="script" async />

More information can be found at Ory Kratos User Login and User Registration Documentation.

Responses

Response samples

Content type
application/json
"string"

Get User-Flow Errors

This endpoint returns the error associated with a user-facing self service errors.

This endpoint supports stub values to help you implement the error UI:

?id=stub:500 - returns a stub 500 (Internal Server Error) error.

More information can be found at Ory Kratos User User Facing Error Documentation.

query Parameters
id
required
string

Error is the error's ID

Responses

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "error": { },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "updated_at": "2019-08-24T14:15:22Z"
}

Submit a Login Flow

Use this endpoint to complete a login flow. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and responds with HTTP 200 and a application/json body with the session token on success; HTTP 410 if the original flow expired with the appropriate error messages set and optionally a use_flow_id parameter in the body; HTTP 400 on form validation errors.

Browser flows expect a Content-Type of application/x-www-form-urlencoded or application/json to be sent in the body and respond with a HTTP 303 redirect to the post/after login URL or the return_to value if it was set and if the login succeeded; a HTTP 303 redirect to the login UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of application/json will not redirect but instead respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

If this endpoint is called with Accept: application/json in the header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
flow
required
string

The Login Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /login?flow=abcde).

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
code
string

Code is the 6 digits code sent to the user

csrf_token
required
string

CSRFToken is the anti-CSRF token

identifier
string

Identifier is the code identifier The identifier requires that the user has already completed the registration or settings with code flow.

method
required
string

Method should be set to "code" when logging in using the code strategy.

resend
string

Resend is set when the user wants to resend the code

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "code": "string",
  • "csrf_token": "string",
  • "identifier": "string",
  • "method": "code",
  • "resend": "string",
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "continue_with": [
    ],
  • "session": {
    },
  • "session_token": "string"
}

Create Login Flow for Native Apps

This endpoint initiates a login flow for native apps that do not use a browser, such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error will be returned unless the URL query parameter ?refresh=true is set.

To fetch an existing login flow call /self-service/login/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks, including CSRF login attacks.

In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. session_aal1_required: Multi-factor auth (e.g. 2fa) was requested but the user has no session yet. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
refresh
boolean

Refresh a login session

If set to true, this will refresh an existing login session by asking the user to sign in again. This will reset the authenticated_at time of the session.

aal
string

Request a Specific AuthenticationMethod Assurance Level

Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This allows you to ask for multi-factor authentication. When an identity sign in using e.g. username+password, the AAL is 1. If you wish to "upgrade" the session's security by asking the user to perform TOTP / WebAuth/ ... you would set this to "aal2".

return_session_token_exchange_code
boolean

EnableSessionTokenExchangeCode requests the login flow to include a code that can be used to retrieve the session token after the login flow has been completed.

return_to
string

The URL to return the browser to after the flow was completed.

via
string

Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "refresh": true,
  • "request_url": "string",
  • "requested_aal": "aal0",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    },
  • "updated_at": "2019-08-24T14:15:22Z"
}

Create Login Flow for Browsers

This endpoint initializes a browser-based user login flow. This endpoint will set the appropriate cookies and anti-CSRF measures required for browser-based flows.

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.login.ui_url with the flow ID set as the query parameter ?flow=. If a valid user session exists already, the browser will be redirected to urls.default_redirect_url unless the query parameter ?refresh=true was set.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. session_aal1_required: Multi-factor auth (e.g. 2fa) was requested but the user has no session yet. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

The optional query parameter login_challenge is set when using Kratos with Hydra in an OAuth2 flow. See the oauth2_provider.url configuration option.

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
refresh
boolean

Refresh a login session

If set to true, this will refresh an existing login session by asking the user to sign in again. This will reset the authenticated_at time of the session.

aal
string

Request a Specific AuthenticationMethod Assurance Level

Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This allows you to ask for multi-factor authentication. When an identity sign in using e.g. username+password, the AAL is 1. If you wish to "upgrade" the session's security by asking the user to perform TOTP / WebAuth/ ... you would set this to "aal2".

return_to
string

The URL to return the browser to after the flow was completed.

login_challenge
string

An optional Hydra login challenge. If present, Kratos will cooperate with Ory Hydra to act as an OAuth2 identity provider.

The value for this parameter comes from login_challenge URL Query parameter sent to your application (e.g. /login?login_challenge=abcde).

organization
string

An optional organization ID that should be used for logging this user in. This parameter is only effective in the Ory Network.

via
string

Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "refresh": true,
  • "request_url": "string",
  • "requested_aal": "aal0",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    },
  • "updated_at": "2019-08-24T14:15:22Z"
}

Get Login Flow

This endpoint returns a login flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/login', async function (req, res) {
const flow = await client.getLoginFlow(req.header('cookie'), req.query['flow'])

res.render('login', flow)
})

This request may fail due to several reasons. The error.id can be one of:

session_already_available: The user is already signed in. self_service_flow_expired: The flow is expired and you should request a new one.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
id
required
string

The Login Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /login?flow=abcde).

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "refresh": true,
  • "request_url": "string",
  • "requested_aal": "aal0",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    },
  • "updated_at": "2019-08-24T14:15:22Z"
}

Update Logout Flow

This endpoint logs out an identity in a self-service manner.

If the Accept HTTP header is not set to application/json, the browser will be redirected (HTTP 303 See Other) to the return_to parameter of the initial request or fall back to urls.default_return_to.

If the Accept HTTP header is set to application/json, a 204 No Content response will be sent on successful logout instead.

This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...). For API clients you can call the /self-service/logout/api URL directly with the Ory Session Token.

More information can be found at Ory Kratos User Logout Documentation.

query Parameters
token
string

A Valid Logout Token

If you do not have a logout token because you only have a session cookie, call /self-service/logout/browser to generate a URL for this endpoint.

return_to
string

The URL to return to after the logout was completed.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Perform Logout for Native Apps

Use this endpoint to log out an identity using an Ory Session Token. If the Ory Session Token was successfully revoked, the server returns a 204 No Content response. A 204 No Content response is also sent when the Ory Session Token has been revoked already before.

If the Ory Session Token is malformed or does not exist a 403 Forbidden response will be returned.

This endpoint does not remove any HTTP Cookies - use the Browser-Based Self-Service Logout Flow instead.

Request Body schema: application/json
session_token
required
string

The Session Token

Invalidate this session token.

Responses

Request samples

Content type
application/json
{
  • "session_token": "string"
}

Response samples

Content type
application/json
{
  • "error": {
    }
}

Create a Logout URL for Browsers

This endpoint initializes a browser-based user logout flow and a URL which can be used to log out the user.

This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...). For API clients you can call the /self-service/logout/api URL directly with the Ory Session Token.

The URL is only valid for the currently signed in user. If no user is signed in, this endpoint returns a 401 error.

When calling this endpoint from a backend, please ensure to properly forward the HTTP cookies.

query Parameters
return_to
string

Return to URL

The URL to which the browser should be redirected to after the logout has been performed.

header Parameters
cookie
string

HTTP Cookies

If you call this endpoint from a backend, please include the original Cookie header in the request.

Responses

Response samples

Content type
application/json
{
  • "logout_token": "string",
  • "logout_url": "string"
}

Update Recovery Flow

Use this endpoint to update a recovery flow. This endpoint behaves differently for API and browser flows and has several states:

choose_method expects flow (in the URL query) and email (in the body) to be sent and works with API- and Browser-initiated flows. For API clients and Browser clients with HTTP Header Accept: application/json it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid. and a HTTP 303 See Other redirect with a fresh recovery flow if the flow was otherwise invalid (e.g. expired). For Browser clients without HTTP Header Accept or with Accept: text/* it returns a HTTP 303 See Other redirect to the Recovery UI URL with the Recovery Flow ID appended. sent_email is the success state after choose_method for the link method and allows the user to request another recovery email. It works for both API and Browser-initiated flows and returns the same responses as the flow in choose_method state. passed_challenge expects a token to be sent in the URL query and given the nature of the flow ("sending a recovery link") does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL (if the link was valid) and instructs the user to update their password, or a redirect to the Recover UI URL with a new Recovery Flow ID which contains an error message that the recovery link was invalid.

More information can be found at Ory Kratos Account Recovery Documentation.

query Parameters
flow
required
string

The Recovery Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /recovery?flow=abcde).

token
string

Recovery Token

The recovery token which completes the recovery request. If the token is invalid (e.g. expired) an error will be shown to the end-user.

This parameter is usually set in a link and not used by any direct API call.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
code
string

Code from the recovery email

If you want to submit a code, use this field, but make sure to not include the email field, as well.

csrf_token
string

Sending the anti-csrf token is only required for browser login flows.

email
string

The email address of the account to recover

If the email belongs to a valid account, a recovery email will be sent.

If you want to notify the email address if the account does not exist, see the notify_unknown_recipients flag

If a code was already sent, including this field in the payload will invalidate the sent code and re-send a new code.

format: email

method
required
string

Method is the method that should be used for this recovery flow

Allowed values are link and code. link RecoveryStrategyLink code RecoveryStrategyCode

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "code": "string",
  • "csrf_token": "string",
  • "email": "string",
  • "method": "code",
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Recovery Flow for Native Apps

This endpoint initiates a recovery flow for API clients such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error.

On an existing recovery flow, use the getRecoveryFlow API endpoint.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos Account Recovery Documentation.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Recovery Flow for Browsers

This endpoint initializes a browser-based account recovery flow. Once initialized, the browser will be redirected to selfservice.flows.recovery.ui_url with the flow ID set as the query parameter ?flow=. If a valid user session exists, the browser is returned to the configured return URL.

If this endpoint is called via an AJAX request, the response contains the recovery flow without any redirects or a 400 bad request error if the user is already authenticated.

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos Account Recovery Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Get Recovery Flow

This endpoint returns a recovery flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/recovery', async function (req, res) {
const flow = await client.getRecoveryFlow(req.header('Cookie'), req.query['flow'])

res.render('recovery', flow)
})

More information can be found at Ory Kratos Account Recovery Documentation.

query Parameters
id
required
string

The Flow ID

The value for this parameter comes from request URL Query parameter sent to your application (e.g. /recovery?flow=abcde).

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Update Registration Flow

Use this endpoint to complete a registration flow by sending an identity's traits and password. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and respond with HTTP 200 and a application/json body with the created identity success - if the session hook is configured the session and session_token will also be included; HTTP 410 if the original flow expired with the appropriate error messages set and optionally a use_flow_id parameter in the body; HTTP 400 on form validation errors.

Browser flows expect a Content-Type of application/x-www-form-urlencoded or application/json to be sent in the body and respond with a HTTP 303 redirect to the post/after registration URL or the return_to value if it was set and if the registration succeeded; a HTTP 303 redirect to the registration UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of application/json will not redirect but instead respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

If this endpoint is called with Accept: application/json in the header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
flow
required
string

The Registration Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /registration?flow=abcde).

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
code
string

The OTP Code sent to the user

csrf_token
string

The CSRF Token

method
required
string

Method to use

This field must be set to code when using the code method.

resend
string

Resend restarts the flow with a new code

traits
required
object

The identity's traits

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "code": "string",
  • "csrf_token": "string",
  • "method": "code",
  • "resend": "string",
  • "traits": { },
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "continue_with": [
    ],
  • "identity": {
    },
  • "session": {
    },
  • "session_token": "string"
}

Create Registration Flow for Native Apps

This endpoint initiates a registration flow for API clients such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error will be returned unless the URL query parameter ?refresh=true is set.

To fetch an existing registration flow call /self-service/registration/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
return_session_token_exchange_code
boolean

EnableSessionTokenExchangeCode requests the login flow to include a code that can be used to retrieve the session token after the login flow has been completed.

return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "request_url": "string",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Registration Flow for Browsers

This endpoint initializes a browser-based user registration flow. This endpoint will set the appropriate cookies and anti-CSRF measures required for browser-based flows.

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.registration.ui_url with the flow ID set as the query parameter ?flow=. If a valid user session exists already, the browser will be redirected to urls.default_redirect_url.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

If this endpoint is called via an AJAX request, the response contains the registration flow without a redirect.

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

login_challenge
string

Ory OAuth 2.0 Login Challenge.

If set will cooperate with Ory OAuth2 and OpenID to act as an OAuth2 server / OpenID Provider.

The value for this parameter comes from login_challenge URL Query parameter sent to your application (e.g. /registration?login_challenge=abcde).

This feature is compatible with Ory Hydra when not running on the Ory Network.

after_verification_return_to
string

The URL to return the browser to after the verification flow was completed.

After the registration flow is completed, the user will be sent a verification email. Upon completing the verification flow, this URL will be used to override the default selfservice.flows.verification.after.default_redirect_to value.

organization
string

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "request_url": "string",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Get Registration Flow

This endpoint returns a registration flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/registration', async function (req, res) {
const flow = await client.getRegistrationFlow(req.header('cookie'), req.query['flow'])

res.render('registration', flow)
})

This request may fail due to several reasons. The error.id can be one of:

session_already_available: The user is already signed in. self_service_flow_expired: The flow is expired and you should request a new one.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
id
required
string

The Registration Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /registration?flow=abcde).

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "request_url": "string",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Complete Settings Flow

Use this endpoint to complete a settings flow by sending an identity's updated password. This endpoint behaves differently for API and browser flows.

API-initiated flows expect application/json to be sent in the body and respond with HTTP 200 and an application/json body with the session token on success; HTTP 303 redirect to a fresh settings flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors. HTTP 401 when the endpoint is called without a valid session token. HTTP 403 when selfservice.flows.settings.privileged_session_max_age was reached or the session's AAL is too low. Implies that the user needs to re-authenticate.

Browser flows without HTTP Header Accept or with Accept: text/* respond with a HTTP 303 redirect to the post/after settings URL or the return_to value if it was set and if the flow succeeded; a HTTP 303 redirect to the Settings UI URL with the flow ID containing the validation errors otherwise. a HTTP 303 redirect to the login endpoint when selfservice.flows.settings.privileged_session_max_age was reached or the session's AAL is too low.

Browser flows with HTTP Header Accept: application/json respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 401 when the endpoint is called without a valid session cookie. HTTP 403 when the page is accessed without a session cookie or the session's AAL is too low. HTTP 400 on form validation errors.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called with a Accept: application/json HTTP header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_refresh_required: The identity requested to change something that needs a privileged session. Redirect the identity to the login init endpoint with query parameters ?refresh=true&return_to=<the-current-browser-url>, or initiate a refresh login flow otherwise. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The flow was interrupted with session_refresh_required but apparently some other identity logged in instead. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

Authorizations:
None
query Parameters
flow
required
string

The Settings Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /settings?flow=abcde).

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
csrf_token
string

CSRFToken is the anti-CSRF token

lookup_secret_confirm
boolean

If set to true will save the regenerated lookup secrets

lookup_secret_disable
boolean

Disables this method if true.

lookup_secret_regenerate
boolean

If set to true will regenerate the lookup secrets

lookup_secret_reveal
boolean

If set to true will reveal the lookup secrets

method
required
string

Method

Should be set to "lookup" when trying to add, update, or remove a lookup pairing.

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "csrf_token": "string",
  • "lookup_secret_confirm": true,
  • "lookup_secret_disable": true,
  • "lookup_secret_regenerate": true,
  • "lookup_secret_reveal": true,
  • "method": "lookup_secret",
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Settings Flow for Native Apps

This endpoint initiates a settings flow for API clients such as mobile devices, smart TVs, and so on. You must provide a valid Ory Kratos Session Token for this endpoint to respond with HTTP 200 OK.

To fetch an existing settings flow call /self-service/settings/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Settings Flow for Browsers

This endpoint initializes a browser-based user settings flow. Once initialized, the browser will be redirected to selfservice.flows.settings.ui_url with the flow ID set as the query parameter ?flow=. If no valid Ory Kratos Session Cookie is included in the request, a login flow will be initialized.

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.settings.ui_url with the flow ID set as the query parameter ?flow=. If no valid user session was set, the browser will be redirected to the login endpoint.

If this endpoint is called via an AJAX request, the response contains the settings flow without any redirects or a 401 forbidden error if no valid session was set.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Get Settings Flow

When accessing this endpoint through Ory Kratos' Public API you must ensure that either the Ory Kratos Session Cookie or the Ory Kratos Session Token are set.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

You can access this endpoint without credentials when using Ory Kratos' Admin API.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The flow was interrupted with session_refresh_required but apparently some other identity logged in instead.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

query Parameters
id
required
string

ID is the Settings Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /settings?flow=abcde).

header Parameters
X-Session-Token
string

The Session Token

When using the SDK in an app without a browser, please include the session token here.

Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Complete Verification Flow

Use this endpoint to complete a verification flow. This endpoint behaves differently for API and browser flows and has several states:

choose_method expects flow (in the URL query) and email (in the body) to be sent and works with API- and Browser-initiated flows. For API clients and Browser clients with HTTP Header Accept: application/json it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid and a HTTP 303 See Other redirect with a fresh verification flow if the flow was otherwise invalid (e.g. expired). For Browser clients without HTTP Header Accept or with Accept: text/* it returns a HTTP 303 See Other redirect to the Verification UI URL with the Verification Flow ID appended. sent_email is the success state after choose_method when using the link method and allows the user to request another verification email. It works for both API and Browser-initiated flows and returns the same responses as the flow in choose_method state. passed_challenge expects a token to be sent in the URL query and given the nature of the flow ("sending a verification link") does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL (if the link was valid) and instructs the user to update their password, or a redirect to the Verification UI URL with a new Verification Flow ID which contains an error message that the verification link was invalid.

More information can be found at Ory Kratos Email and Phone Verification Documentation.

query Parameters
flow
required
string

The Verification Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /verification?flow=abcde).

token
string

Verification Token

The verification token which completes the verification request. If the token is invalid (e.g. expired) an error will be shown to the end-user.

This parameter is usually set in a link and not used by any direct API call.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
code
string

Code from the recovery email

If you want to submit a code, use this field, but make sure to not include the email field, as well.

csrf_token
string

Sending the anti-csrf token is only required for browser login flows.

email
string

The email address to verify

If the email belongs to a valid account, a verifiation email will be sent.

If you want to notify the email address if the account does not exist, see the notify_unknown_recipients flag

If a code was already sent, including this field in the payload will invalidate the sent code and re-send a new code.

format: email

method
required
string

Method is the method that should be used for this verification flow

Allowed values are link and code. link VerificationStrategyLink code VerificationStrategyCode

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "code": "string",
  • "csrf_token": "string",
  • "email": "string",
  • "method": "code",
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Verification Flow for Native Apps

This endpoint initiates a verification flow for API clients such as mobile devices, smart TVs, and so on.

To fetch an existing verification flow call /self-service/verification/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Email and Phone Verification Documentation.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Verification Flow for Browser Clients

This endpoint initializes a browser-based account verification flow. Once initialized, the browser will be redirected to selfservice.flows.verification.ui_url with the flow ID set as the query parameter ?flow=.

If this endpoint is called via an AJAX request, the response contains the recovery flow without any redirects.

This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...).

More information can be found at Ory Kratos Email and Phone Verification Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Get Verification Flow

This endpoint returns a verification flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/recovery', async function (req, res) {
const flow = await client.getVerificationFlow(req.header('cookie'), req.query['flow'])

res.render('verification', flow)
})

More information can be found at Ory Kratos Email and Phone Verification Documentation.

query Parameters
id
required
string

The Flow ID

The value for this parameter comes from request URL Query parameter sent to your application (e.g. /verification?flow=abcde).

header Parameters
cookie
string

HTTP Cookies

When using the SDK on the server side you must include the HTTP Cookie Header originally sent to your HTTP handler here.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Disable my other sessions

Calling this endpoint invalidates all except the current session that belong to the logged-in user. Session data are not deleted.

header Parameters
X-Session-Token
string

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
{
  • "count": 0
}

Get My Active Sessions

This endpoints returns all other active sessions that belong to the logged-in user. The current session can be retrieved by calling the /sessions/whoami endpoint.

query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Deprecated Items per Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This is the number of items per page.

page
integer <int64>

Deprecated Pagination Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.

For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the Link header.

page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Page Size

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

header Parameters
X-Session-Token
string

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Exchange Session Token

query Parameters
init_code
required
string

The part of the code return when initializing the flow.

return_to_code
required
string

The part of the code returned by the return_to URL.

Responses

Response samples

Content type
application/json
{
  • "continue_with": [
    ],
  • "session": {
    },
  • "session_token": "string"
}

Check Who the Current HTTP Session Belongs To

Uses the HTTP Headers in the GET request to determine (e.g. by using checking the cookies) who is authenticated. Returns a session object in the body or 401 if the credentials are invalid or no credentials were sent. When the request it successful it adds the user ID to the 'X-Kratos-Authenticated-Identity-Id' header in the response.

If you call this endpoint from a server-side application, you must forward the HTTP Cookie Header to this endpoint:

pseudo-code example
router.get('/protected-endpoint', async function (req, res) {
const session = await client.toSession(undefined, req.header('cookie'))

console.log(session)
})

When calling this endpoint from a non-browser application (e.g. mobile app) you must include the session token:

pseudo-code example
...
const session = await client.toSession("the-session-token")

console.log(session)

When using a token template, the token is included in the tokenized field of the session.

pseudo-code example
...
const session = await client.toSession("the-session-token", { tokenize_as: "example-jwt-template" })

console.log(session.tokenized) // The JWT

Depending on your configuration this endpoint might return a 403 status code if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

This endpoint is useful for:

AJAX calls. Remember to send credentials and set up CORS correctly! Reverse proxies and API Gateways Server-side calls - use the X-Session-Token header!

This endpoint authenticates users by checking:

if the Cookie HTTP header was set containing an Ory Kratos Session Cookie; if the Authorization: bearer <ory-session-token> HTTP header was set with a valid Ory Kratos Session Token; if the X-Session-Token HTTP header was set with a valid Ory Kratos Session Token.

If none of these headers are set or the cookie or token are invalid, the endpoint returns a HTTP 401 status code.

As explained above, this request may fail due to several reasons. The error.id can be one of:

session_inactive: No active session was found in the request (e.g. no Ory Session Cookie / Ory Session Token). session_aal2_required: An active session was found but it does not fulfil the Authenticator Assurance Level, implying that the session must (e.g.) authenticate the second factor.

query Parameters
tokenize_as
string

Returns the session additionally as a token (such as a JWT)

The value of this parameter has to be a valid, configured Ory Session token template. For more information head over to the documentation.

header Parameters
X-Session-Token
string
Example: MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string
Example: ory_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
{
  • "active": true,
  • "authenticated_at": "2019-08-24T14:15:22Z",
  • "authentication_methods": [
    ],
  • "authenticator_assurance_level": "aal0",
  • "devices": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "tokenized": "string"
}

Disable one of my sessions

Calling this endpoint invalidates the specified session. The current session cannot be revoked. Session data are not deleted.

path Parameters
id
required
string

ID is the session's ID.

header Parameters
X-Session-Token
string

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

courier

APIs for managing email and SMS message delivery.

List Messages

Lists all messages by given status and recipient.

Authorizations:
oryAccessToken
query Parameters
page_size
integer <int64> [ 1 .. 1000 ]
Default: 250

Items per Page

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

status
string (courierMessageStatus)
Enum: "queued" "sent" "processing" "abandoned"

Status filters out messages based on status. If no value is provided, it doesn't take effect on filter.

recipient
string

Recipient filters out messages based on recipient. If no value is provided, it doesn't take effect on filter.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get a Message

Gets a specific messages by the given ID.

Authorizations:
oryAccessToken
path Parameters
id
required
string

MessageID is the ID of the message.

Responses

Response samples

Content type
application/json
{
  • "body": "string",
  • "channel": "string",
  • "created_at": "2019-08-24T14:15:22Z",
  • "dispatches": [
    ],
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "recipient": "string",
  • "send_count": 0,
  • "status": "queued",
  • "subject": "string",
  • "template_type": "recovery_invalid",
  • "type": "email",
  • "updated_at": "2019-08-24T14:15:22Z"
}

metadata

Server Metadata provides relevant information about the running server. Only available when self-hosting this service.

Return Running Software Version.

This endpoint returns the version of Ory Kratos.

If the service supports TLS Edge Termination, this endpoint does not require the X-Forwarded-Proto header to be set.

Be aware that if you are running multiple nodes of this service, the version will never refer to the cluster state, only to a single instance.

Authorizations:
oryAccessToken

Responses

Response samples

Content type
application/json
{
  • "version": "string"
}

wellknown

Discover Well-Known JSON Web Keys

This endpoint returns JSON Web Keys required to verifying OpenID Connect ID Tokens and, if enabled, OAuth 2.0 JWT Access Tokens. This endpoint can be used with client libraries like node-jwks-rsa among others.

Responses

Response samples

Content type
application/json
{
  • "keys": [
    ]
}

oidc

OpenID Connect Discovery

A mechanism for an OpenID Connect Relying Party to discover the End-User's OpenID Provider and obtain information needed to interact with it, including its OAuth 2.0 endpoint locations.

Popular libraries for OpenID Connect clients include oidc-client-js (JavaScript), go-oidc (Golang), and others. For a full list of clients go here: https://openid.net/developers/certified/

Responses

Response samples

Content type
application/json
{
  • "authorization_endpoint": "https://playground.ory.sh/ory-hydra/public/oauth2/auth",
  • "backchannel_logout_session_supported": true,
  • "backchannel_logout_supported": true,
  • "claims_parameter_supported": true,
  • "claims_supported": [
    ],
  • "code_challenge_methods_supported": [
    ],
  • "credentials_endpoint_draft_00": "string",
  • "credentials_supported_draft_00": [
    ],
  • "end_session_endpoint": "string",
  • "frontchannel_logout_session_supported": true,
  • "frontchannel_logout_supported": true,
  • "grant_types_supported": [
    ],
  • "id_token_signed_response_alg": [
    ],
  • "id_token_signing_alg_values_supported": [
    ],
  • "issuer": "https://playground.ory.sh/ory-hydra/public/",
  • "jwks_uri": "https://{slug}.projects.oryapis.com/.well-known/jwks.json",
  • "registration_endpoint": "https://playground.ory.sh/ory-hydra/admin/client",
  • "request_object_signing_alg_values_supported": [
    ],
  • "request_parameter_supported": true,
  • "request_uri_parameter_supported": true,
  • "require_request_uri_registration": true,
  • "response_modes_supported": [
    ],
  • "response_types_supported": [
    ],
  • "revocation_endpoint": "string",
  • "scopes_supported": [
    ],
  • "subject_types_supported": [
    ],
  • "token_endpoint": "https://playground.ory.sh/ory-hydra/public/oauth2/token",
  • "token_endpoint_auth_methods_supported": [
    ],
  • "userinfo_endpoint": "string",
  • "userinfo_signed_response_alg": [
    ],
  • "userinfo_signing_alg_values_supported": [
    ]
}

Issues a Verifiable Credential

This endpoint creates a verifiable credential that attests that the user authenticated with the provided access token owns a certain public/private key pair.

More information can be found at https://openid.net/specs/openid-connect-userinfo-vc-1_0.html.

Request Body schema: application/json
format
string
object (VerifiableCredentialProof contains the proof of a verifiable credential.)
types
Array of strings

Responses

Request samples

Content type
application/json
{
  • "format": "string",
  • "proof": {
    },
  • "types": [
    ]
}

Response samples

Content type
application/json
{
  • "credential_draft_00": "string",
  • "format": "string"
}

Register OAuth2 Client using OpenID Dynamic Client Registration

This endpoint behaves like the administrative counterpart (createOAuth2Client) but is capable of facing the public internet directly and can be used in self-service. It implements the OpenID Connect Dynamic Client Registration Protocol. This feature needs to be enabled in the configuration. This endpoint is disabled by default. It can be enabled by an administrator.

Please note that using this endpoint you are not able to choose the client_secret nor the client_id as those values will be server generated when specifying token_endpoint_auth_method as client_secret_basic or client_secret_post.

The client_secret will be returned in the response and you will not be able to retrieve it later on. Write the secret down and keep it somewhere safe.

Request Body schema: application/json

Dynamic Client Registration Request Body

access_token_strategy
string

OAuth 2.0 Access Token Strategy

AccessTokenStrategy is the strategy used to generate access tokens. Valid options are jwt and opaque. jwt is a bad idea, see https://www.ory.sh/docs/hydra/advanced#json-web-tokens Setting the stragegy here overrides the global setting in strategies.access_token.

allowed_cors_origins
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
audience
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
authorization_code_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
backchannel_logout_session_required
boolean

OpenID Connect Back-Channel Logout Session Required

Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.

backchannel_logout_uri
string

OpenID Connect Back-Channel Logout URI

RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.

client_credentials_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
client_id
string

OAuth 2.0 Client ID

The ID is immutable. If no ID is provided, a UUID4 will be generated.

client_name
string

OAuth 2.0 Client Name

The human-readable name of the client to be presented to the end-user during authorization.

client_secret
string

OAuth 2.0 Client Secret

The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost.

client_secret_expires_at
integer <int64>

OAuth 2.0 Client Secret Expires At

The field is currently not supported and its value is always 0.

client_uri
string

OAuth 2.0 Client URI

ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion.

contacts
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
created_at
string <date-time>

OAuth 2.0 Client Creation Date

CreatedAt returns the timestamp of the client's creation.

frontchannel_logout_session_required
boolean

OpenID Connect Front-Channel Logout Session Required

Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session with the OP when the frontchannel_logout_uri is used. If omitted, the default value is false.

frontchannel_logout_uri
string

OpenID Connect Front-Channel Logout URI

RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the request and to determine which of the potentially multiple sessions is to be logged out; if either is included, both MUST be.

grant_types
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
implicit_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
implicit_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
jwks
any

OAuth 2.0 Client JSON Web Key Set

Client's JSON Web Key Set [JWK] document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it MUST NOT use jwks. One significant downside of jwks is that it does not enable key rotation (which jwks_uri does, as described in Section 10 of OpenID Connect Core 1.0 [OpenID.Core]). The jwks_uri and jwks parameters MUST NOT be used together.

jwks_uri
string

OAuth 2.0 Client JSON Web Key Set URL

URL for the Client's JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the Client's encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.

jwt_bearer_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
logo_uri
string

OAuth 2.0 Client Logo URI

A URL string referencing the client's logo.

metadata
object (JSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger.)
owner
string

OAuth 2.0 Client Owner

Owner is a string identifying the owner of the OAuth 2.0 Client.

policy_uri
string

OAuth 2.0 Client Policy URI

PolicyURI is a URL string that points to a human-readable privacy policy document that describes how the deployment organization collects, uses, retains, and discloses personal data.

post_logout_redirect_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
redirect_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
refresh_token_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
registration_access_token
string

OpenID Connect Dynamic Client Registration Access Token

RegistrationAccessToken can be used to update, get, or delete the OAuth2 Client. It is sent when creating a client using Dynamic Client Registration.

registration_client_uri
string

OpenID Connect Dynamic Client Registration URL

RegistrationClientURI is the URL used to update, get, or delete the OAuth2 Client.

request_object_signing_alg
string

OpenID Connect Request Object Signing Algorithm

JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects from this Client MUST be rejected, if not signed with this algorithm.

request_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
response_types
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
scope
string

OAuth 2.0 Client Scope

Scope is a string containing a space-separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens.

sector_identifier_uri
string

OpenID Connect Sector Identifier URI

URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.

skip_consent
boolean

SkipConsent skips the consent screen for this client. This field can only be set from the admin API.

skip_logout_consent
boolean

SkipLogoutConsent skips the logout consent screen for this client. This field can only be set from the admin API.

subject_type
string

OpenID Connect Subject Type

The subject_types_supported Discovery parameter contains a list of the supported subject_type values for this server. Valid types include pairwise and public.

token_endpoint_auth_method
string
Default: "client_secret_basic"

OAuth 2.0 Token Endpoint Authentication Method

Requested Client Authentication method for the Token Endpoint. The options are:

client_secret_basic: (default) Send client_id and client_secret as application/x-www-form-urlencoded encoded in the HTTP Authorization header. client_secret_post: Send client_id and client_secret as application/x-www-form-urlencoded in the HTTP body. private_key_jwt: Use JSON Web Tokens to authenticate the client. none: Used for public clients (native apps, mobile apps) which can not have secrets.

token_endpoint_auth_signing_alg
string

OAuth 2.0 Token Endpoint Signing Algorithm

Requested Client Authentication signing algorithm for the Token Endpoint.

tos_uri
string

OAuth 2.0 Client Terms of Service URI

A URL string pointing to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client.

updated_at
string <date-time>

OAuth 2.0 Client Last Update Date

UpdatedAt returns the timestamp of the last update.

userinfo_signed_response_alg
string

OpenID Connect Request Userinfo Signed Response Algorithm

JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT [JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims as a UTF-8 encoded JSON object using the application/json content-type.

Responses

Request samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Response samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Delete OAuth 2.0 Client using the OpenID Dynamic Client Registration Management Protocol

This endpoint behaves like the administrative counterpart (deleteOAuth2Client) but is capable of facing the public internet directly and can be used in self-service. It implements the OpenID Connect Dynamic Client Registration Protocol. This feature needs to be enabled in the configuration. This endpoint is disabled by default. It can be enabled by an administrator.

To use this endpoint, you will need to present the client's authentication credentials. If the OAuth2 Client uses the Token Endpoint Authentication Method client_secret_post, you need to present the client secret in the URL query. If it uses client_secret_basic, present the Client ID and the Client Secret in the Authorization header.

OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.

Authorizations:
bearer
path Parameters
id
required
string

The id of the OAuth 2.0 Client.

Responses

Response samples

Content type
application/json
{
  • "code": 404,
  • "debug": "SQL field \"foo\" is not a bool.",
  • "details": null,
  • "error": {
    },
  • "id": "string",
  • "message": "The resource could not be found",
  • "reason": "User with ID 1234 does not exist.",
  • "request": "d7ef54b1-ec15-46e6-bccb-524b82c035e6",
  • "status": "Not Found"
}

Get OAuth2 Client using OpenID Dynamic Client Registration

This endpoint behaves like the administrative counterpart (getOAuth2Client) but is capable of facing the public internet directly and can be used in self-service. It implements the OpenID Connect Dynamic Client Registration Protocol.

To use this endpoint, you will need to present the client's authentication credentials. If the OAuth2 Client uses the Token Endpoint Authentication Method client_secret_post, you need to present the client secret in the URL query. If it uses client_secret_basic, present the Client ID and the Client Secret in the Authorization header.

Authorizations:
bearer
path Parameters
id
required
string

The id of the OAuth 2.0 Client.

Responses

Response samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Set OAuth2 Client using OpenID Dynamic Client Registration

This endpoint behaves like the administrative counterpart (setOAuth2Client) but is capable of facing the public internet directly to be used by third parties. It implements the OpenID Connect Dynamic Client Registration Protocol.

This feature is disabled per default. It can be enabled by a system administrator.

If you pass client_secret the secret is used, otherwise the existing secret is used. If set, the secret is echoed in the response. It is not possible to retrieve it later on.

To use this endpoint, you will need to present the client's authentication credentials. If the OAuth2 Client uses the Token Endpoint Authentication Method client_secret_post, you need to present the client secret in the URL query. If it uses client_secret_basic, present the Client ID and the Client Secret in the Authorization header.

OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.

Authorizations:
bearer
path Parameters
id
required
string

OAuth 2.0 Client ID

Request Body schema: application/json

OAuth 2.0 Client Request Body

access_token_strategy
string

OAuth 2.0 Access Token Strategy

AccessTokenStrategy is the strategy used to generate access tokens. Valid options are jwt and opaque. jwt is a bad idea, see https://www.ory.sh/docs/hydra/advanced#json-web-tokens Setting the stragegy here overrides the global setting in strategies.access_token.

allowed_cors_origins
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
audience
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
authorization_code_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
backchannel_logout_session_required
boolean

OpenID Connect Back-Channel Logout Session Required

Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.

backchannel_logout_uri
string

OpenID Connect Back-Channel Logout URI

RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.

client_credentials_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
client_id
string

OAuth 2.0 Client ID

The ID is immutable. If no ID is provided, a UUID4 will be generated.

client_name
string

OAuth 2.0 Client Name

The human-readable name of the client to be presented to the end-user during authorization.

client_secret
string

OAuth 2.0 Client Secret

The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost.

client_secret_expires_at
integer <int64>

OAuth 2.0 Client Secret Expires At

The field is currently not supported and its value is always 0.

client_uri
string

OAuth 2.0 Client URI

ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion.

contacts
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
created_at
string <date-time>

OAuth 2.0 Client Creation Date

CreatedAt returns the timestamp of the client's creation.

frontchannel_logout_session_required
boolean

OpenID Connect Front-Channel Logout Session Required

Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session with the OP when the frontchannel_logout_uri is used. If omitted, the default value is false.

frontchannel_logout_uri
string

OpenID Connect Front-Channel Logout URI

RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the request and to determine which of the potentially multiple sessions is to be logged out; if either is included, both MUST be.

grant_types
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
implicit_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
implicit_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
jwks
any

OAuth 2.0 Client JSON Web Key Set

Client's JSON Web Key Set [JWK] document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it MUST NOT use jwks. One significant downside of jwks is that it does not enable key rotation (which jwks_uri does, as described in Section 10 of OpenID Connect Core 1.0 [OpenID.Core]). The jwks_uri and jwks parameters MUST NOT be used together.

jwks_uri
string

OAuth 2.0 Client JSON Web Key Set URL

URL for the Client's JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the Client's encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.

jwt_bearer_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
logo_uri
string

OAuth 2.0 Client Logo URI

A URL string referencing the client's logo.

metadata
object (JSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger.)
owner
string

OAuth 2.0 Client Owner

Owner is a string identifying the owner of the OAuth 2.0 Client.

policy_uri
string

OAuth 2.0 Client Policy URI

PolicyURI is a URL string that points to a human-readable privacy policy document that describes how the deployment organization collects, uses, retains, and discloses personal data.

post_logout_redirect_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
redirect_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
refresh_token_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
registration_access_token
string

OpenID Connect Dynamic Client Registration Access Token

RegistrationAccessToken can be used to update, get, or delete the OAuth2 Client. It is sent when creating a client using Dynamic Client Registration.

registration_client_uri
string

OpenID Connect Dynamic Client Registration URL

RegistrationClientURI is the URL used to update, get, or delete the OAuth2 Client.

request_object_signing_alg
string

OpenID Connect Request Object Signing Algorithm

JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects from this Client MUST be rejected, if not signed with this algorithm.

request_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
response_types
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
scope
string

OAuth 2.0 Client Scope

Scope is a string containing a space-separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens.

sector_identifier_uri
string

OpenID Connect Sector Identifier URI

URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.

skip_consent
boolean

SkipConsent skips the consent screen for this client. This field can only be set from the admin API.

skip_logout_consent
boolean

SkipLogoutConsent skips the logout consent screen for this client. This field can only be set from the admin API.

subject_type
string

OpenID Connect Subject Type

The subject_types_supported Discovery parameter contains a list of the supported subject_type values for this server. Valid types include pairwise and public.

token_endpoint_auth_method
string
Default: "client_secret_basic"

OAuth 2.0 Token Endpoint Authentication Method

Requested Client Authentication method for the Token Endpoint. The options are:

client_secret_basic: (default) Send client_id and client_secret as application/x-www-form-urlencoded encoded in the HTTP Authorization header. client_secret_post: Send client_id and client_secret as application/x-www-form-urlencoded in the HTTP body. private_key_jwt: Use JSON Web Tokens to authenticate the client. none: Used for public clients (native apps, mobile apps) which can not have secrets.

token_endpoint_auth_signing_alg
string

OAuth 2.0 Token Endpoint Signing Algorithm

Requested Client Authentication signing algorithm for the Token Endpoint.

tos_uri
string

OAuth 2.0 Client Terms of Service URI

A URL string pointing to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client.

updated_at
string <date-time>

OAuth 2.0 Client Last Update Date

UpdatedAt returns the timestamp of the last update.

userinfo_signed_response_alg
string

OpenID Connect Request Userinfo Signed Response Algorithm

JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT [JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims as a UTF-8 encoded JSON object using the application/json content-type.

Responses

Request samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Response samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

OpenID Connect Front- and Back-channel Enabled Logout

This endpoint initiates and completes user logout at the Ory OAuth2 & OpenID provider and initiates OpenID Connect Front- / Back-channel logout:

https://openid.net/specs/openid-connect-frontchannel-1_0.html https://openid.net/specs/openid-connect-backchannel-1_0.html

Back-channel logout is performed asynchronously and does not affect logout flow.

Responses

OpenID Connect Userinfo

This endpoint returns the payload of the ID Token, including session.id_token values, of the provided OAuth 2.0 Access Token's consent request.

In the case of authentication error, a WWW-Authenticate header might be set in the response with more information about the error. See the spec for more details about header format.

Authorizations:
oauth2

Responses

Response samples

Content type
application/json
{
  • "birthdate": "string",
  • "email": "string",
  • "email_verified": true,
  • "family_name": "string",
  • "gender": "string",
  • "given_name": "string",
  • "locale": "string",
  • "middle_name": "string",
  • "name": "string",
  • "nickname": "string",
  • "phone_number": "string",
  • "phone_number_verified": true,
  • "picture": "string",
  • "preferred_username": "string",
  • "profile": "string",
  • "sub": "string",
  • "updated_at": 0,
  • "website": "string",
  • "zoneinfo": "string"
}

oAuth2

List OAuth 2.0 Clients

This endpoint lists all clients in the database, and never returns client secrets. As a default it lists the first 100 clients.

Authorizations:
oryAccessToken
query Parameters
page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Items per Page

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

client_name
string

The name of the clients to filter by.

owner
string

The owner of the clients to filter by.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create OAuth 2.0 Client

Create a new OAuth 2.0 client. If you pass client_secret the secret is used, otherwise a random secret is generated. The secret is echoed in the response. It is not possible to retrieve it later on.

Authorizations:
oryAccessToken
Request Body schema: application/json

OAuth 2.0 Client Request Body

access_token_strategy
string

OAuth 2.0 Access Token Strategy

AccessTokenStrategy is the strategy used to generate access tokens. Valid options are jwt and opaque. jwt is a bad idea, see https://www.ory.sh/docs/hydra/advanced#json-web-tokens Setting the stragegy here overrides the global setting in strategies.access_token.

allowed_cors_origins
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
audience
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
authorization_code_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
backchannel_logout_session_required
boolean

OpenID Connect Back-Channel Logout Session Required

Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.

backchannel_logout_uri
string

OpenID Connect Back-Channel Logout URI

RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.

client_credentials_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
client_id
string

OAuth 2.0 Client ID

The ID is immutable. If no ID is provided, a UUID4 will be generated.

client_name
string

OAuth 2.0 Client Name

The human-readable name of the client to be presented to the end-user during authorization.

client_secret
string

OAuth 2.0 Client Secret

The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost.

client_secret_expires_at
integer <int64>

OAuth 2.0 Client Secret Expires At

The field is currently not supported and its value is always 0.

client_uri
string

OAuth 2.0 Client URI

ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion.

contacts
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
created_at
string <date-time>

OAuth 2.0 Client Creation Date

CreatedAt returns the timestamp of the client's creation.

frontchannel_logout_session_required
boolean

OpenID Connect Front-Channel Logout Session Required

Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session with the OP when the frontchannel_logout_uri is used. If omitted, the default value is false.

frontchannel_logout_uri
string

OpenID Connect Front-Channel Logout URI

RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the request and to determine which of the potentially multiple sessions is to be logged out; if either is included, both MUST be.

grant_types
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
implicit_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
implicit_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
jwks
any

OAuth 2.0 Client JSON Web Key Set

Client's JSON Web Key Set [JWK] document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it MUST NOT use jwks. One significant downside of jwks is that it does not enable key rotation (which jwks_uri does, as described in Section 10 of OpenID Connect Core 1.0 [OpenID.Core]). The jwks_uri and jwks parameters MUST NOT be used together.

jwks_uri
string

OAuth 2.0 Client JSON Web Key Set URL

URL for the Client's JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the Client's encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.

jwt_bearer_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
logo_uri
string

OAuth 2.0 Client Logo URI

A URL string referencing the client's logo.

metadata
object (JSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger.)
owner
string

OAuth 2.0 Client Owner

Owner is a string identifying the owner of the OAuth 2.0 Client.

policy_uri
string

OAuth 2.0 Client Policy URI

PolicyURI is a URL string that points to a human-readable privacy policy document that describes how the deployment organization collects, uses, retains, and discloses personal data.

post_logout_redirect_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
redirect_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
refresh_token_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
registration_access_token
string

OpenID Connect Dynamic Client Registration Access Token

RegistrationAccessToken can be used to update, get, or delete the OAuth2 Client. It is sent when creating a client using Dynamic Client Registration.

registration_client_uri
string

OpenID Connect Dynamic Client Registration URL

RegistrationClientURI is the URL used to update, get, or delete the OAuth2 Client.

request_object_signing_alg
string

OpenID Connect Request Object Signing Algorithm

JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects from this Client MUST be rejected, if not signed with this algorithm.

request_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
response_types
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
scope
string

OAuth 2.0 Client Scope

Scope is a string containing a space-separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens.

sector_identifier_uri
string

OpenID Connect Sector Identifier URI

URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.

skip_consent
boolean

SkipConsent skips the consent screen for this client. This field can only be set from the admin API.

skip_logout_consent
boolean

SkipLogoutConsent skips the logout consent screen for this client. This field can only be set from the admin API.

subject_type
string

OpenID Connect Subject Type

The subject_types_supported Discovery parameter contains a list of the supported subject_type values for this server. Valid types include pairwise and public.

token_endpoint_auth_method
string
Default: "client_secret_basic"

OAuth 2.0 Token Endpoint Authentication Method

Requested Client Authentication method for the Token Endpoint. The options are:

client_secret_basic: (default) Send client_id and client_secret as application/x-www-form-urlencoded encoded in the HTTP Authorization header. client_secret_post: Send client_id and client_secret as application/x-www-form-urlencoded in the HTTP body. private_key_jwt: Use JSON Web Tokens to authenticate the client. none: Used for public clients (native apps, mobile apps) which can not have secrets.

token_endpoint_auth_signing_alg
string

OAuth 2.0 Token Endpoint Signing Algorithm

Requested Client Authentication signing algorithm for the Token Endpoint.

tos_uri
string

OAuth 2.0 Client Terms of Service URI

A URL string pointing to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client.

updated_at
string <date-time>

OAuth 2.0 Client Last Update Date

UpdatedAt returns the timestamp of the last update.

userinfo_signed_response_alg
string

OpenID Connect Request Userinfo Signed Response Algorithm

JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT [JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims as a UTF-8 encoded JSON object using the application/json content-type.

Responses

Request samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Response samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Delete OAuth 2.0 Client

Delete an existing OAuth 2.0 Client by its ID.

OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.

Make sure that this endpoint is well protected and only callable by first-party components.

Authorizations:
oryAccessToken
path Parameters
id
required
string

The id of the OAuth 2.0 Client.

Responses

Response samples

Content type
application/json
{
  • "code": 404,
  • "debug": "SQL field \"foo\" is not a bool.",
  • "details": null,
  • "error": {
    },
  • "id": "string",
  • "message": "The resource could not be found",
  • "reason": "User with ID 1234 does not exist.",
  • "request": "d7ef54b1-ec15-46e6-bccb-524b82c035e6",
  • "status": "Not Found"
}

Get an OAuth 2.0 Client

Get an OAuth 2.0 client by its ID. This endpoint never returns the client secret.

OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.

Authorizations:
oryAccessToken
path Parameters
id
required
string

The id of the OAuth 2.0 Client.

Responses

Response samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Patch OAuth 2.0 Client

Patch an existing OAuth 2.0 Client using JSON Patch. If you pass client_secret the secret will be updated and returned via the API. This is the only time you will be able to retrieve the client secret, so write it down and keep it safe.

OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.

Authorizations:
oryAccessToken
path Parameters
id
required
string

The id of the OAuth 2.0 Client.

Request Body schema: application/json

OAuth 2.0 Client JSON Patch Body

Array
from
string

This field is used together with operation "move" and uses JSON Pointer notation.

Learn more about JSON Pointers.

op
required
string
Enum: "add" "remove" "replace" "move" "copy" "test"

The operation to be performed. One of "add", "remove", "replace", "move", "copy", or "test".

path
required
string

The path to the target path. Uses JSON pointer notation.

Learn more about JSON Pointers.

value
any

The value to be used within the operations.

Learn more about JSON Pointers.

Responses

Request samples

Content type
application/json
[
  • {
    }
]

Response samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Set OAuth 2.0 Client

Replaces an existing OAuth 2.0 Client with the payload you send. If you pass client_secret the secret is used, otherwise the existing secret is used.

If set, the secret is echoed in the response. It is not possible to retrieve it later on.

OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.

Authorizations:
oryAccessToken
path Parameters
id
required
string

OAuth 2.0 Client ID

Request Body schema: application/json

OAuth 2.0 Client Request Body

access_token_strategy
string

OAuth 2.0 Access Token Strategy

AccessTokenStrategy is the strategy used to generate access tokens. Valid options are jwt and opaque. jwt is a bad idea, see https://www.ory.sh/docs/hydra/advanced#json-web-tokens Setting the stragegy here overrides the global setting in strategies.access_token.

allowed_cors_origins
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
audience
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
authorization_code_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
backchannel_logout_session_required
boolean

OpenID Connect Back-Channel Logout Session Required

Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.

backchannel_logout_uri
string

OpenID Connect Back-Channel Logout URI

RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.

client_credentials_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
client_id
string

OAuth 2.0 Client ID

The ID is immutable. If no ID is provided, a UUID4 will be generated.

client_name
string

OAuth 2.0 Client Name

The human-readable name of the client to be presented to the end-user during authorization.

client_secret
string

OAuth 2.0 Client Secret

The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost.

client_secret_expires_at
integer <int64>

OAuth 2.0 Client Secret Expires At

The field is currently not supported and its value is always 0.

client_uri
string

OAuth 2.0 Client URI

ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion.

contacts
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
created_at
string <date-time>

OAuth 2.0 Client Creation Date

CreatedAt returns the timestamp of the client's creation.

frontchannel_logout_session_required
boolean

OpenID Connect Front-Channel Logout Session Required

Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session with the OP when the frontchannel_logout_uri is used. If omitted, the default value is false.

frontchannel_logout_uri
string

OpenID Connect Front-Channel Logout URI

RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the request and to determine which of the potentially multiple sessions is to be logged out; if either is included, both MUST be.

grant_types
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
implicit_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
implicit_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
jwks
any

OAuth 2.0 Client JSON Web Key Set

Client's JSON Web Key Set [JWK] document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it MUST NOT use jwks. One significant downside of jwks is that it does not enable key rotation (which jwks_uri does, as described in Section 10 of OpenID Connect Core 1.0 [OpenID.Core]). The jwks_uri and jwks parameters MUST NOT be used together.

jwks_uri
string

OAuth 2.0 Client JSON Web Key Set URL

URL for the Client's JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the Client's encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.

jwt_bearer_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
logo_uri
string

OAuth 2.0 Client Logo URI

A URL string referencing the client's logo.

metadata
object (JSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger.)
owner
string

OAuth 2.0 Client Owner

Owner is a string identifying the owner of the OAuth 2.0 Client.

policy_uri
string

OAuth 2.0 Client Policy URI

PolicyURI is a URL string that points to a human-readable privacy policy document that describes how the deployment organization collects, uses, retains, and discloses personal data.

post_logout_redirect_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
redirect_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
refresh_token_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
registration_access_token
string

OpenID Connect Dynamic Client Registration Access Token

RegistrationAccessToken can be used to update, get, or delete the OAuth2 Client. It is sent when creating a client using Dynamic Client Registration.

registration_client_uri
string

OpenID Connect Dynamic Client Registration URL

RegistrationClientURI is the URL used to update, get, or delete the OAuth2 Client.

request_object_signing_alg
string

OpenID Connect Request Object Signing Algorithm

JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects from this Client MUST be rejected, if not signed with this algorithm.

request_uris
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
response_types
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
scope
string

OAuth 2.0 Client Scope

Scope is a string containing a space-separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens.

sector_identifier_uri
string

OpenID Connect Sector Identifier URI

URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.

skip_consent
boolean

SkipConsent skips the consent screen for this client. This field can only be set from the admin API.

skip_logout_consent
boolean

SkipLogoutConsent skips the logout consent screen for this client. This field can only be set from the admin API.

subject_type
string

OpenID Connect Subject Type

The subject_types_supported Discovery parameter contains a list of the supported subject_type values for this server. Valid types include pairwise and public.

token_endpoint_auth_method
string
Default: "client_secret_basic"

OAuth 2.0 Token Endpoint Authentication Method

Requested Client Authentication method for the Token Endpoint. The options are:

client_secret_basic: (default) Send client_id and client_secret as application/x-www-form-urlencoded encoded in the HTTP Authorization header. client_secret_post: Send client_id and client_secret as application/x-www-form-urlencoded in the HTTP body. private_key_jwt: Use JSON Web Tokens to authenticate the client. none: Used for public clients (native apps, mobile apps) which can not have secrets.

token_endpoint_auth_signing_alg
string

OAuth 2.0 Token Endpoint Signing Algorithm

Requested Client Authentication signing algorithm for the Token Endpoint.

tos_uri
string

OAuth 2.0 Client Terms of Service URI

A URL string pointing to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client.

updated_at
string <date-time>

OAuth 2.0 Client Last Update Date

UpdatedAt returns the timestamp of the last update.

userinfo_signed_response_alg
string

OpenID Connect Request Userinfo Signed Response Algorithm

JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT [JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims as a UTF-8 encoded JSON object using the application/json content-type.

Responses

Request samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Response samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Set OAuth2 Client Token Lifespans

Set lifespans of different token types issued for this OAuth 2.0 client. Does not modify other fields.

Authorizations:
oryAccessToken
path Parameters
id
required
string

OAuth 2.0 Client ID

Request Body schema: application/json
authorization_code_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
authorization_code_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
client_credentials_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
implicit_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
implicit_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
jwt_bearer_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_access_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_id_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$
refresh_token_grant_refresh_token_lifespan
string or null (NullDuration) ^[0-9]+(ns|us|ms|s|m|h)$

Responses

Request samples

Content type
application/json
{
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string"
}

Response samples

Content type
application/json
{
  • "access_token_strategy": "string",
  • "allowed_cors_origins": [
    ],
  • "audience": [
    ],
  • "authorization_code_grant_access_token_lifespan": "string",
  • "authorization_code_grant_id_token_lifespan": "string",
  • "authorization_code_grant_refresh_token_lifespan": "string",
  • "backchannel_logout_session_required": true,
  • "backchannel_logout_uri": "string",
  • "client_credentials_grant_access_token_lifespan": "string",
  • "client_id": "string",
  • "client_name": "string",
  • "client_secret": "string",
  • "client_secret_expires_at": 0,
  • "client_uri": "string",
  • "contacts": [
    ],
  • "created_at": "2019-08-24T14:15:22Z",
  • "frontchannel_logout_session_required": true,
  • "frontchannel_logout_uri": "string",
  • "grant_types": [
    ],
  • "implicit_grant_access_token_lifespan": "string",
  • "implicit_grant_id_token_lifespan": "string",
  • "jwks": null,
  • "jwks_uri": "string",
  • "jwt_bearer_grant_access_token_lifespan": "string",
  • "logo_uri": "string",
  • "metadata": { },
  • "owner": "string",
  • "policy_uri": "string",
  • "post_logout_redirect_uris": [
    ],
  • "redirect_uris": [
    ],
  • "refresh_token_grant_access_token_lifespan": "string",
  • "refresh_token_grant_id_token_lifespan": "string",
  • "refresh_token_grant_refresh_token_lifespan": "string",
  • "registration_access_token": "string",
  • "registration_client_uri": "string",
  • "request_object_signing_alg": "string",
  • "request_uris": [
    ],
  • "response_types": [
    ],
  • "scope": "scope1 scope-2 scope.3 scope:4",
  • "sector_identifier_uri": "string",
  • "skip_consent": true,
  • "skip_logout_consent": true,
  • "subject_type": "string",
  • "token_endpoint_auth_method": "client_secret_basic",
  • "token_endpoint_auth_signing_alg": "string",
  • "tos_uri": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "userinfo_signed_response_alg": "string"
}

Get OAuth 2.0 Consent Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell Ory now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells Ory if the subject accepted or rejected the request.

The default consent provider is available via the Ory Managed Account Experience. To customize the consent provider, please head over to the OAuth 2.0 documentation.

Authorizations:
oryAccessToken
query Parameters
consent_challenge
required
string

OAuth 2.0 Consent Request Challenge

Responses

Response samples

Content type
application/json
{
  • "acr": "string",
  • "amr": [
    ],
  • "challenge": "string",
  • "client": {
    },
  • "context": { },
  • "login_challenge": "string",
  • "login_session_id": "string",
  • "oidc_context": {
    },
  • "request_url": "string",
  • "requested_access_token_audience": [
    ],
  • "requested_scope": [
    ],
  • "skip": true,
  • "subject": "string"
}

Accept OAuth 2.0 Consent Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell Ory now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells Ory if the subject accepted or rejected the request.

This endpoint tells Ory that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider includes additional information, such as session data for access and ID tokens, and if the consent request should be used as basis for future requests.

The response contains a redirect URL which the consent provider should redirect the user-agent to.

The default consent provider is available via the Ory Managed Account Experience. To customize the consent provider, please head over to the OAuth 2.0 documentation.

Authorizations:
oryAccessToken
query Parameters
consent_challenge
required
string

OAuth 2.0 Consent Request Challenge

Request Body schema: application/json
context
object (JSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger.)
grant_access_token_audience
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
grant_scope
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
handled_at
string <date-time> (NullTime implements sql.NullTime functionality.)
remember
boolean

Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope.

remember_for
integer <int64>

RememberFor sets how long the consent authorization should be remembered for in seconds. If set to 0, the authorization will be remembered indefinitely.

object (Pass session data to a consent request.)

Responses

Request samples

Content type
application/json
{
  • "context": { },
  • "grant_access_token_audience": [
    ],
  • "grant_scope": [
    ],
  • "handled_at": "2019-08-24T14:15:22Z",
  • "remember": true,
  • "remember_for": 0,
  • "session": {
    }
}

Response samples

Content type
application/json
{
  • "redirect_to": "string"
}

Reject OAuth 2.0 Consent Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell Ory now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells Ory if the subject accepted or rejected the request.

This endpoint tells Ory that the subject has not authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider must include a reason why the consent was not granted.

The response contains a redirect URL which the consent provider should redirect the user-agent to.

The default consent provider is available via the Ory Managed Account Experience. To customize the consent provider, please head over to the OAuth 2.0 documentation.

Authorizations:
oryAccessToken
query Parameters
consent_challenge
required
string

OAuth 2.0 Consent Request Challenge

Request Body schema: application/json
error
string

The error should follow the OAuth2 error format (e.g. invalid_request, login_required).

Defaults to request_denied.

error_debug
string

Debug contains information to help resolve the problem as a developer. Usually not exposed to the public but only in the server logs.

error_description
string

Description of the error in a human readable format.

error_hint
string

Hint to help resolve the error.

status_code
integer <int64>

Represents the HTTP status code of the error (e.g. 401 or 403)

Defaults to 400

Responses

Request samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "string",
  • "status_code": 0
}

Response samples

Content type
application/json
{
  • "redirect_to": "string"
}

Get OAuth 2.0 Login Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service about it.

Per default, the login provider is Ory itself. You may use a different login provider which needs to be a web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

Authorizations:
oryAccessToken
query Parameters
login_challenge
required
string

OAuth 2.0 Login Request Challenge

Responses

Response samples

Content type
application/json
{
  • "challenge": "string",
  • "client": {
    },
  • "oidc_context": {
    },
  • "request_url": "string",
  • "requested_access_token_audience": [
    ],
  • "requested_scope": [
    ],
  • "session_id": "string",
  • "skip": true,
  • "subject": "string"
}

Accept OAuth 2.0 Login Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service about it.

The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

This endpoint tells Ory that the subject has successfully authenticated and includes additional information such as the subject's ID and if Ory should remember the subject's subject agent for future authentication attempts by setting a cookie.

The response contains a redirect URL which the login provider should redirect the user-agent to.

Authorizations:
oryAccessToken
query Parameters
login_challenge
required
string

OAuth 2.0 Login Request Challenge

Request Body schema: application/json
acr
string

ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it to express that, for example, a user authenticated using two factor authentication.

amr
Array of strings (StringSliceJSONFormat represents []string{} which is encoded to/from JSON for SQL storage.)
context
object (JSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger.)
extend_session_lifespan
boolean

Extend OAuth2 authentication session lifespan

If set to true, the OAuth2 authentication cookie lifespan is extended. This is for example useful if you want the user to be able to use prompt=none continuously.

This value can only be set to true if the user has an authentication, which is the case if the skip value is true.

force_subject_identifier
string

ForceSubjectIdentifier forces the "pairwise" user ID of the end-user that authenticated. The "pairwise" user ID refers to the (Pairwise Identifier Algorithm)[http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg] of the OpenID Connect specification. It allows you to set an obfuscated subject ("user") identifier that is unique to the client.

Please note that this changes the user ID on endpoint /userinfo and sub claim of the ID Token. It does not change the sub claim in the OAuth 2.0 Introspection.

Per default, ORY Hydra handles this value with its own algorithm. In case you want to set this yourself you can use this field. Please note that setting this field has no effect if pairwise is not configured in ORY Hydra or the OAuth 2.0 Client does not expect a pairwise identifier (set via subject_type key in the client's configuration).

Please also be aware that ORY Hydra is unable to properly compute this value during authentication. This implies that you have to compute this value on every authentication process (probably depending on the client ID or some other unique value).

If you fail to compute the proper value, then authentication processes which have id_token_hint set might fail.

identity_provider_session_id
string

IdentityProviderSessionID is the session ID of the end-user that authenticated. If specified, we will use this value to propagate the logout.

remember
boolean

Remember, if set to true, tells ORY Hydra to remember this user by telling the user agent (browser) to store a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, he/she will not be asked to log in again.

remember_for
integer <int64>

RememberFor sets how long the authentication should be remembered for in seconds. If set to 0, the authorization will be remembered for the duration of the browser session (using a session cookie).

subject
required
string

Subject is the user ID of the end-user that authenticated.

Responses

Request samples

Content type
application/json
{
  • "acr": "string",
  • "amr": [
    ],
  • "context": { },
  • "extend_session_lifespan": true,
  • "force_subject_identifier": "string",
  • "identity_provider_session_id": "string",
  • "remember": true,
  • "remember_for": 0,
  • "subject": "string"
}

Response samples

Content type
application/json
{
  • "redirect_to": "string"
}

Reject OAuth 2.0 Login Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service about it.

The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

This endpoint tells Ory that the subject has not authenticated and includes a reason why the authentication was denied.

The response contains a redirect URL which the login provider should redirect the user-agent to.

Authorizations:
oryAccessToken
query Parameters
login_challenge
required
string

OAuth 2.0 Login Request Challenge

Request Body schema: application/json
error
string

The error should follow the OAuth2 error format (e.g. invalid_request, login_required).

Defaults to request_denied.

error_debug
string

Debug contains information to help resolve the problem as a developer. Usually not exposed to the public but only in the server logs.

error_description
string

Description of the error in a human readable format.

error_hint
string

Hint to help resolve the error.

status_code
integer <int64>

Represents the HTTP status code of the error (e.g. 401 or 403)

Defaults to 400

Responses

Request samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "string",
  • "status_code": 0
}

Response samples

Content type
application/json
{
  • "redirect_to": "string"
}

Get OAuth 2.0 Session Logout Request

Use this endpoint to fetch an Ory OAuth 2.0 logout request.

Authorizations:
oryAccessToken
query Parameters
logout_challenge
required
string

Responses

Response samples

Content type
application/json
{
  • "challenge": "string",
  • "client": {
    },
  • "request_url": "string",
  • "rp_initiated": true,
  • "sid": "string",
  • "subject": "string"
}

Accept OAuth 2.0 Session Logout Request

When a user or an application requests Ory OAuth 2.0 to remove the session state of a subject, this endpoint is used to confirm that logout request.

The response contains a redirect URL which the consent provider should redirect the user-agent to.

Authorizations:
oryAccessToken
query Parameters
logout_challenge
required
string

OAuth 2.0 Logout Request Challenge

Responses

Response samples

Content type
application/json
{
  • "redirect_to": "string"
}

Reject OAuth 2.0 Session Logout Request

When a user or an application requests Ory OAuth 2.0 to remove the session state of a subject, this endpoint is used to deny that logout request. No HTTP request body is required.

The response is empty as the logout provider has to chose what action to perform next.

Authorizations:
oryAccessToken
query Parameters
logout_challenge
required
string

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "The redirect URL is not allowed.",
  • "status_code": 401
}

Revoke OAuth 2.0 Consent Sessions of a Subject

This endpoint revokes a subject's granted consent sessions and invalidates all associated OAuth 2.0 Access Tokens. You may also only revoke sessions for a specific OAuth 2.0 Client ID.

Authorizations:
oryAccessToken
query Parameters
subject
required
string

OAuth 2.0 Consent Subject

The subject whose consent sessions should be deleted.

client
string

OAuth 2.0 Client ID

If set, deletes only those consent sessions that have been granted to the specified OAuth 2.0 Client ID.

all
boolean

Revoke All Consent Sessions

If set to true deletes all consent sessions by the Subject that have been granted.

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "The redirect URL is not allowed.",
  • "status_code": 401
}

List OAuth 2.0 Consent Sessions of a Subject

This endpoint lists all subject's granted consent sessions, including client and granted scope. If the subject is unknown or has not granted any consent sessions yet, the endpoint returns an empty JSON array with status code 200 OK.

Authorizations:
oryAccessToken
query Parameters
page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Items per Page

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

subject
required
string

The subject to list the consent sessions for.

login_session_id
string

The login session id to list the consent sessions for.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Revokes OAuth 2.0 Login Sessions by either a Subject or a SessionID

This endpoint invalidates authentication sessions. After revoking the authentication session(s), the subject has to re-authenticate at the Ory OAuth2 Provider. This endpoint does not invalidate any tokens.

If you send the subject in a query param, all authentication sessions that belong to that subject are revoked. No OpenID Connect Front- or Back-channel logout is performed in this case.

Alternatively, you can send a SessionID via sid query param, in which case, only the session that is connected to that SessionID is revoked. OpenID Connect Back-channel logout is performed in this case.

Authorizations:
oryAccessToken
query Parameters
subject
string

OAuth 2.0 Subject

The subject to revoke authentication sessions for.

sid
string

OAuth 2.0 Subject

The subject to revoke authentication sessions for.

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "The redirect URL is not allowed.",
  • "status_code": 401
}

Introspect OAuth2 Access and Refresh Tokens

The introspection endpoint allows to check if a token (both refresh and access) is active or not. An active token is neither expired nor revoked. If a token is active, additional information on the token will be included. You can set additional data for a token by setting session.access_token during the consent flow.

Authorizations:
oryAccessToken
Request Body schema: application/x-www-form-urlencoded
scope
string

An optional, space separated list of required scopes. If the access token was not granted one of the scopes, the result of active will be false.

token
required
string

The string value of the token. For access tokens, this is the "access_token" value returned from the token endpoint defined in OAuth 2.0. For refresh tokens, this is the "refresh_token" value returned.

Responses

Response samples

Content type
application/json
{
  • "active": true,
  • "aud": [
    ],
  • "client_id": "string",
  • "exp": 0,
  • "ext": {
    },
  • "iat": 0,
  • "iss": "string",
  • "nbf": 0,
  • "obfuscated_subject": "string",
  • "scope": "string",
  • "sub": "string",
  • "token_type": "string",
  • "token_use": "string",
  • "username": "string"
}

Delete OAuth 2.0 Access Tokens from specific OAuth 2.0 Client

This endpoint deletes OAuth2 access tokens issued to an OAuth 2.0 Client from the database.

Authorizations:
oryAccessToken
query Parameters
client_id
required
string

OAuth 2.0 Client ID

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "The redirect URL is not allowed.",
  • "status_code": 401
}

List Trusted OAuth2 JWT Bearer Grant Type Issuers

Use this endpoint to list all trusted JWT Bearer Grant Type Issuers.

Authorizations:
oryAccessToken
query Parameters
MaxItems
integer <int64>
DefaultItems
integer <int64>
issuer
string

If optional "issuer" is supplied, only jwt-bearer grants with this issuer will be returned.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Trust OAuth2 JWT Bearer Grant Type Issuer

Use this endpoint to establish a trust relationship for a JWT issuer to perform JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants RFC7523.

Authorizations:
oryAccessToken
Request Body schema: application/json
allow_any_subject
boolean

The "allow_any_subject" indicates that the issuer is allowed to have any principal as the subject of the JWT.

expires_at
required
string <date-time>

The "expires_at" indicates, when grant will expire, so we will reject assertion from "issuer" targeting "subject".

issuer
required
string

The "issuer" identifies the principal that issued the JWT assertion (same as "iss" claim in JWT).

required
object (jsonWebKey)
scope
required
Array of strings

The "scope" contains list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749])

subject
string

The "subject" identifies the principal that is the subject of the JWT.

Responses

Request samples

Content type
application/json
{
  • "allow_any_subject": true,
  • "expires_at": "2019-08-24T14:15:22Z",
  • "issuer": "https://jwt-idp.example.com",
  • "jwk": {
    },
  • "scope": [
    ],
  • "subject": "mike@example.com"
}

Response samples

Content type
application/json
{
  • "allow_any_subject": true,
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "9edc811f-4e28-453c-9b46-4de65f00217f",
  • "issuer": "https://jwt-idp.example.com",
  • "public_key": {},
  • "scope": [
    ],
  • "subject": "mike@example.com"
}

Delete Trusted OAuth2 JWT Bearer Grant Type Issuer

Use this endpoint to delete trusted JWT Bearer Grant Type Issuer. The ID is the one returned when you created the trust relationship.

Once deleted, the associated issuer will no longer be able to perform the JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grant.

Authorizations:
oryAccessToken
path Parameters
id
required
string

The id of the desired grant

Responses

Response samples

Content type
application/json
{
  • "code": 404,
  • "debug": "SQL field \"foo\" is not a bool.",
  • "details": null,
  • "error": {
    },
  • "id": "string",
  • "message": "The resource could not be found",
  • "reason": "User with ID 1234 does not exist.",
  • "request": "d7ef54b1-ec15-46e6-bccb-524b82c035e6",
  • "status": "Not Found"
}

Get Trusted OAuth2 JWT Bearer Grant Type Issuer

Use this endpoint to get a trusted JWT Bearer Grant Type Issuer. The ID is the one returned when you created the trust relationship.

Authorizations:
oryAccessToken
path Parameters
id
required
string

The id of the desired grant

Responses

Response samples

Content type
application/json
{
  • "allow_any_subject": true,
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "9edc811f-4e28-453c-9b46-4de65f00217f",
  • "issuer": "https://jwt-idp.example.com",
  • "public_key": {},
  • "scope": [
    ],
  • "subject": "mike@example.com"
}

OAuth 2.0 Authorize Endpoint

Use open source libraries to perform OAuth 2.0 and OpenID Connect available for any programming language. You can find a list of libraries at https://oauth.net/code/

The Ory SDK is not yet able to this endpoint properly.

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "The redirect URL is not allowed.",
  • "status_code": 401
}

Revoke OAuth 2.0 Access or Refresh Token

Revoking a token (both access and refresh) means that the tokens will be invalid. A revoked access token can no longer be used to make access requests, and a revoked refresh token can no longer be used to refresh an access token. Revoking a refresh token also invalidates the access token that was created with it. A token may only be revoked by the client the token was generated for.

Authorizations:
basicoauth2
Request Body schema: application/x-www-form-urlencoded
client_id
string
client_secret
string
token
required
string

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "The redirect URL is not allowed.",
  • "status_code": 401
}

The OAuth 2.0 Token Endpoint

Use open source libraries to perform OAuth 2.0 and OpenID Connect available for any programming language. You can find a list of libraries here https://oauth.net/code/

The Ory SDK is not yet able to this endpoint properly.

Authorizations:
basicoauth2
Request Body schema: application/x-www-form-urlencoded
client_id
string
code
string
grant_type
required
string
redirect_uri
string
refresh_token
string

Responses

Response samples

Content type
application/json
{
  • "access_token": "string",
  • "expires_in": 0,
  • "id_token": "string",
  • "refresh_token": "string",
  • "scope": "string",
  • "token_type": "string"
}

jwk

Delete JSON Web Key Set

Use this endpoint to delete a complete JSON Web Key Set and all the keys in that set.

A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.

Authorizations:
oryAccessToken
path Parameters
set
required
string

The JSON Web Key Set

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "The redirect URL is not allowed.",
  • "status_code": 401
}

Retrieve a JSON Web Key Set

This endpoint can be used to retrieve JWK Sets stored in ORY Hydra.

A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.

Authorizations:
oryAccessToken
path Parameters
set
required
string

JSON Web Key Set ID

Responses

Response samples

Content type
application/json
{
  • "keys": [
    ]
}

Create JSON Web Key

This endpoint is capable of generating JSON Web Key Sets for you. There a different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.

A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.

Authorizations:
oryAccessToken
path Parameters
set
required
string

The JSON Web Key Set ID

Request Body schema: application/json
alg
required
string

JSON Web Key Algorithm

The algorithm to be used for creating the key. Supports RS256, ES256, ES512, HS512, and HS256.

kid
required
string

JSON Web Key ID

The Key ID of the key to be created.

use
required
string

JSON Web Key Use

The "use" (public key use) parameter identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data. Valid values are "enc" and "sig".

Responses

Request samples

Content type
application/json
{
  • "alg": "string",
  • "kid": "string",
  • "use": "string"
}

Response samples

Content type
application/json
{
  • "keys": [
    ]
}

Update a JSON Web Key Set

Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.

A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.

Authorizations:
oryAccessToken
path Parameters
set
required
string

The JSON Web Key Set ID

Request Body schema: application/json
Array of objects (jsonWebKey)

List of JSON Web Keys

The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among them, although applications of JWK Sets can choose to assign a meaning to the order for their purposes, if desired.

Array
alg
required
string

The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry established by [JWA] or be a value that contains a Collision- Resistant Name.

crv
string
d
string
dp
string
dq
string
e
string
k
string
kid
required
string

The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is unspecified. When "kid" values are used within a JWK Set, different keys within the JWK Set SHOULD use distinct "kid" values. (One example in which different keys might use the same "kid" value is if they have different "kty" (key type) values but are considered to be equivalent alternatives by the application using them.) The "kid" value is a case-sensitive string.

kty
required
string

The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types" registry established by [JWA] or be a value that contains a Collision- Resistant Name. The "kty" value is a case-sensitive string.

n
string
p
string
q
string
qi
string
use
required
string

Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data. Values are commonly "sig" (signature) or "enc" (encryption).

x
string
x5c
Array of strings

The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each string in the array is a base64-encoded (Section 4 of [RFC4648] -- not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value. The PKIX certificate containing the key value MUST be the first certificate.

y
string

Responses

Request samples

Content type
application/json
{
  • "keys": [
    ]
}

Response samples

Content type
application/json
{
  • "keys": [
    ]
}

Delete JSON Web Key

Use this endpoint to delete a single JSON Web Key.

A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.

Authorizations:
oryAccessToken
path Parameters
set
required
string

The JSON Web Key Set

kid
required
string

The JSON Web Key ID (kid)

Responses

Response samples

Content type
application/json
{
  • "error": "string",
  • "error_debug": "string",
  • "error_description": "string",
  • "error_hint": "The redirect URL is not allowed.",
  • "status_code": 401
}

Get JSON Web Key

This endpoint returns a singular JSON Web Key contained in a set. It is identified by the set and the specific key ID (kid).

Authorizations:
oryAccessToken
path Parameters
set
required
string

JSON Web Key Set ID

kid
required
string

JSON Web Key ID

Responses

Response samples

Content type
application/json
{
  • "keys": [
    ]
}

Set JSON Web Key

Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.

A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.

Authorizations:
oryAccessToken
path Parameters
set
required
string

The JSON Web Key Set ID

kid
required
string

JSON Web Key ID

Request Body schema: application/json
alg
required
string

The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry established by [JWA] or be a value that contains a Collision- Resistant Name.

crv
string
d
string
dp
string
dq
string
e
string
k
string
kid
required
string

The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is unspecified. When "kid" values are used within a JWK Set, different keys within the JWK Set SHOULD use distinct "kid" values. (One example in which different keys might use the same "kid" value is if they have different "kty" (key type) values but are considered to be equivalent alternatives by the application using them.) The "kid" value is a case-sensitive string.

kty
required
string

The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types" registry established by [JWA] or be a value that contains a Collision- Resistant Name. The "kty" value is a case-sensitive string.

n
string
p
string
q
string
qi
string
use
required
string

Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data. Values are commonly "sig" (signature) or "enc" (encryption).

x
string
x5c
Array of strings

The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each string in the array is a base64-encoded (Section 4 of [RFC4648] -- not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value. The PKIX certificate containing the key value MUST be the first certificate.

y
string

Responses

Request samples

Content type
application/json
{
  • "alg": "RS256",
  • "crv": "P-256",
  • "d": "T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE",
  • "dp": "G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0",
  • "dq": "s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk",
  • "e": "AQAB",
  • "k": "GawgguFyGrWKav7AX4VKUg",
  • "kid": "1603dfe0af8f4596",
  • "kty": "RSA",
  • "n": "vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0",
  • "p": "6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ",
  • "q": "0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ",
  • "qi": "GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU",
  • "use": "sig",
  • "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
  • "x5c": [
    ],
  • "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0"
}

Response samples

Content type
application/json
{
  • "alg": "RS256",
  • "crv": "P-256",
  • "d": "T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE",
  • "dp": "G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0",
  • "dq": "s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk",
  • "e": "AQAB",
  • "k": "GawgguFyGrWKav7AX4VKUg",
  • "kid": "1603dfe0af8f4596",
  • "kty": "RSA",
  • "n": "vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0",
  • "p": "6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ",
  • "q": "0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ",
  • "qi": "GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU",
  • "use": "sig",
  • "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
  • "x5c": [
    ],
  • "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0"
}

relationship

Delete Relationships

Use this endpoint to delete relationships

Authorizations:
oryAccessToken
query Parameters
namespace
string

Namespace of the Relationship

object
string

Object of the Relationship

relation
string

Relation of the Relationship

subject_id
string

SubjectID of the Relationship

subject_set.namespace
string

Namespace of the Subject Set

subject_set.object
string

Object of the Subject Set

subject_set.relation
string

Relation of the Subject Set

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Patch Multiple Relationships

Use this endpoint to patch one or more relationships.

Authorizations:
oryAccessToken
Request Body schema: application/json
Array
action
string
Enum: "insert" "delete"
object (relationship)

Relationship

Responses

Request samples

Content type
application/json
[
  • {
    }
]

Response samples

Content type
application/json
{
  • "error": {
    }
}

Create a Relationship

Use this endpoint to create a relationship.

Authorizations:
oryAccessToken
Request Body schema: application/json
namespace
string

Namespace to query

object
string

Object to query

relation
string

Relation to query

subject_id
string

SubjectID to query

Either SubjectSet or SubjectID can be provided.

object (subjectSet)

Responses

Request samples

Content type
application/json
{
  • "namespace": "string",
  • "object": "string",
  • "relation": "string",
  • "subject_id": "string",
  • "subject_set": {
    }
}

Response samples

Content type
application/json
{
  • "namespace": "string",
  • "object": "string",
  • "relation": "string",
  • "subject_id": "string",
  • "subject_set": {
    }
}

Query namespaces

Get all namespaces

Authorizations:
oryAccessToken

Responses

Response samples

Content type
application/json
{
  • "namespaces": [
    ]
}

Check the syntax of an OPL file

The OPL file is expected in the body of the request.

Authorizations:
oryAccessToken
Request Body schema: text/plain
string (checkOplSyntaxBody)

Ory Permission Language Document

Responses

Response samples

Content type
application/json
{
  • "errors": [
    ]
}

Query relationships

Get all relationships that match the query. Only the namespace field is required.

Authorizations:
oryAccessToken
query Parameters
page_token
string
page_size
integer <int64>
namespace
string

Namespace of the Relationship

object
string

Object of the Relationship

relation
string

Relation of the Relationship

subject_id
string

SubjectID of the Relationship

subject_set.namespace
string

Namespace of the Subject Set

subject_set.object
string

Object of the Subject Set

subject_set.relation
string

Relation of the Subject Set

Responses

Response samples

Content type
application/json
{
  • "next_page_token": "string",
  • "relation_tuples": [
    ]
}

project

List All Projects

Lists all projects you have access to.

Authorizations:
oryNetworkCookie

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Project

Creates a new project.

Authorizations:
oryNetworkCookie
Request Body schema: application/json
environment
required
string
Enum: "prod" "stage" "dev"

The environment of the project. prod Production stage Staging dev Development

name
required
string

The name of the project to be created

workspace_id
string <uuid>

The workspace to create the project in.

Responses

Request samples

Content type
application/json
{
  • "environment": "prod",
  • "name": "string",
  • "workspace_id": "0967198e-ec7b-4c6b-b4d3-f71244cadbe9"
}

Response samples

Content type
application/json
{
  • "cors_admin": {
    },
  • "cors_public": {
    },
  • "environment": "prod",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "name": "string",
  • "revision_id": "f8f7f022-982b-4bef-ba7d-4bb808fdbe2a",
  • "services": {
    },
  • "slug": "string",
  • "state": "running",
  • "workspace_id": "string"
}

Irrecoverably purge a project

!! Use with extreme caution !!

Using this API endpoint you can purge (completely delete) a project and its data. This action can not be undone and will delete ALL your data.

!! Use with extreme caution !!

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

Responses

Response samples

Content type
application/json
{
  • "code": 404,
  • "debug": "SQL field \"foo\" is not a bool.",
  • "details": null,
  • "error": {
    },
  • "id": "string",
  • "message": "The resource could not be found",
  • "reason": "User with ID 1234 does not exist.",
  • "request": "d7ef54b1-ec15-46e6-bccb-524b82c035e6",
  • "status": "Not Found"
}

Get a Project

Get a projects you have access to by its ID.

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

Responses

Response samples

Content type
application/json
{
  • "cors_admin": {
    },
  • "cors_public": {
    },
  • "environment": "prod",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "name": "string",
  • "revision_id": "f8f7f022-982b-4bef-ba7d-4bb808fdbe2a",
  • "services": {
    },
  • "slug": "string",
  • "state": "running",
  • "workspace_id": "string"
}

Patch an Ory Network Project Configuration

Deprecated: Use the patchProjectWithRevision endpoint instead to specify the exact revision the patch was generated for.

This endpoints allows you to patch individual Ory Network project configuration keys for Ory's services (identity, permission, ...). The configuration format is fully compatible with the open source projects for the respective services (e.g. Ory Kratos for Identity, Ory Keto for Permissions).

This endpoint expects the version key to be set in the payload. If it is unset, it will try to import the config as if it is from the most recent version.

If you have an older version of a configuration, you should set the version key in the payload!

While this endpoint is able to process all configuration items related to features (e.g. password reset), it does not support operational configuration items (e.g. port, tracing, logging) otherwise available in the open source.

For configuration items that can not be translated to the Ory Network, this endpoint will return a list of warnings to help you understand which parts of your config could not be processed.

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

Request Body schema: application/json
Array
from
string

This field is used together with operation "move" and uses JSON Pointer notation.

Learn more about JSON Pointers.

op
required
string
Enum: "add" "remove" "replace" "move" "copy" "test"

The operation to be performed. One of "add", "remove", "replace", "move", "copy", or "test".

path
required
string

The path to the target path. Uses JSON pointer notation.

Learn more about JSON Pointers.

value
any

The value to be used within the operations.

Learn more about JSON Pointers.

Responses

Request samples

Content type
application/json
[
  • {
    }
]

Response samples

Content type
application/json
{
  • "project": {
    },
  • "warnings": [
    ]
}

Update an Ory Network Project Configuration

This endpoints allows you to update the Ory Network project configuration for individual services (identity, permission, ...). The configuration is fully compatible with the open source projects for the respective services (e.g. Ory Kratos for Identity, Ory Keto for Permissions).

This endpoint expects the version key to be set in the payload. If it is unset, it will try to import the config as if it is from the most recent version.

If you have an older version of a configuration, you should set the version key in the payload!

While this endpoint is able to process all configuration items related to features (e.g. password reset), it does not support operational configuration items (e.g. port, tracing, logging) otherwise available in the open source.

For configuration items that can not be translated to the Ory Network, this endpoint will return a list of warnings to help you understand which parts of your config could not be processed.

Be aware that updating any service's configuration will completely override your current configuration for that service!

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

Request Body schema: application/json
required
object (projectCors)
required
object (projectCors)
name
required
string

The name of the project.

required
object (projectServices)

Responses

Request samples

Content type
application/json
{
  • "cors_admin": {
    },
  • "cors_public": {
    },
  • "name": "string",
  • "services": {
    }
}

Response samples

Content type
application/json
{
  • "project": {
    },
  • "warnings": [
    ]
}

listOrganizations

List all B2B SSO Organizations for a project

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

Responses

Response samples

Content type
application/json
{
  • "organizations": [
    ]
}

createOrganization

Create a B2B SSO Organization

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

Request Body schema: application/json
domains
Array of strings

Domains contains the list of organization's domains.

label
string

Label contains the organization's label.

Responses

Request samples

Content type
application/json
{
  • "domains": [
    ],
  • "label": "string"
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "domains": [
    ],
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "label": "string",
  • "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9",
  • "updated_at": "2019-08-24T14:15:22Z"
}

deleteOrganization

Delete a B2B SSO Organization for a project

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

organization_id
required
string

Organization ID

The Organization's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Returns a B2B SSO Organization for a project by its ID

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

organization_id
required
string

Organization ID

The Organization's ID.

Responses

Response samples

Content type
application/json
{
  • "organization": {
    }
}

updateOrganization

Update a B2B SSO Organization for a project

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

organization_id
required
string

Organization ID

The Organization's ID.

Request Body schema: application/json
domains
Array of strings

Domains contains the list of organization's domains.

label
string

Label contains the organization's label.

Responses

Request samples

Content type
application/json
{
  • "domains": [
    ],
  • "label": "string"
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "domains": [
    ],
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "label": "string",
  • "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9",
  • "updated_at": "2019-08-24T14:15:22Z"
}

Get all members associated with this project

This endpoint requires the user to be a member of the project with the role OWNER or DEVELOPER.

Authorizations:
oryNetworkCookie
path Parameters
project
required
string

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Remove a member associated with this project

This also sets their invite status to REMOVED. This endpoint requires the user to be a member of the project with the role OWNER.

Authorizations:
oryNetworkCookie
path Parameters
project
required
string
member
required
string

Responses

Response samples

Content type
application/json
{
  • "code": 404,
  • "debug": "SQL field \"foo\" is not a bool.",
  • "details": null,
  • "error": {
    },
  • "id": "string",
  • "message": "The resource could not be found",
  • "reason": "User with ID 1234 does not exist.",
  • "request": "d7ef54b1-ec15-46e6-bccb-524b82c035e6",
  • "status": "Not Found"
}

List a project's API Tokens

A list of all the project's API tokens.

Authorizations:
oryNetworkCookie
path Parameters
project
required
string

The Project ID or Project slug

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create project API token

Create an API token for a project.

Authorizations:
oryNetworkCookie
path Parameters
project
required
string

The Project ID or Project slug

Request Body schema: application/json
name
required
string

The Token Name

A descriptive name for the token.

in: body

Responses

Request samples

Content type
application/json
{
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "name": "string",
  • "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
  • "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "value": "string"
}

Delete project API token

Deletes an API token and immediately removes it.

Authorizations:
oryNetworkCookie
path Parameters
project
required
string

The Project ID or Project slug

token_id
required
string

The Token ID

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

events

List all event streams for the project. This endpoint is not paginated.

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

Responses

Response samples

Content type
application/json
{
  • "event_streams": [
    ]
}

Create an event stream for your project.

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

Request Body schema: application/json
role_arn
required
string

The AWS IAM role ARN to assume when publishing to the SNS topic.

topic_arn
required
string

The AWS SNS topic ARN.

type
required
string
Value: "sns"

The type of the event stream (AWS SNS, GCP Pub/Sub, etc).

Responses

Request samples

Content type
application/json
{
  • "role_arn": "string",
  • "topic_arn": "string",
  • "type": "sns"
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "role_arn": "string",
  • "topic_arn": "string",
  • "type": "string",
  • "updated_at": "2019-08-24T14:15:22Z"
}

Remove an event stream from a project

Remove an event stream from a project.

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

event_stream_id
required
string

Event Stream ID

The ID of the event stream to be deleted, as returned when created.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Update an event stream for a project.

Authorizations:
oryNetworkCookie
path Parameters
project_id
required
string

Project ID

The project's ID.

event_stream_id
required
string

Event Stream ID

The event stream's ID.

Request Body schema: application/json
role_arn
required
string

The AWS IAM role ARN to assume when publishing to the SNS topic.

topic_arn
required
string

The AWS SNS topic ARN.

type
required
string
Value: "sns"

The type of the event stream (AWS SNS, GCP Pub/Sub, etc).

Responses

Request samples

Content type
application/json
{
  • "role_arn": "string",
  • "topic_arn": "string",
  • "type": "sns"
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "role_arn": "string",
  • "topic_arn": "string",
  • "type": "string",
  • "updated_at": "2019-08-24T14:15:22Z"
}

permission

Check a permission

To learn how relationship tuples and the check works, head over to the documentation.

Authorizations:
oryAccessToken
query Parameters
namespace
string

Namespace of the Relationship

object
string

Object of the Relationship

relation
string

Relation of the Relationship

subject_id
string

SubjectID of the Relationship

subject_set.namespace
string

Namespace of the Subject Set

subject_set.object
string

Object of the Subject Set

subject_set.relation
string

Relation of the Subject Set

max-depth
integer <int64>

Responses

Response samples

Content type
application/json
{
  • "allowed": true
}

Check a permission

To learn how relationship tuples and the check works, head over to the documentation.

Authorizations:
oryAccessToken
query Parameters
max-depth
integer <int64>
Request Body schema: application/json
namespace
string

Namespace to query

object
string

Object to query

relation
string

Relation to query

subject_id
string

SubjectID to query

Either SubjectSet or SubjectID can be provided.

object (subjectSet)

Responses

Request samples

Content type
application/json
{
  • "namespace": "string",
  • "object": "string",
  • "relation": "string",
  • "subject_id": "string",
  • "subject_set": {
    }
}

Response samples

Content type
application/json
{
  • "allowed": true
}

Check a permission

To learn how relationship tuples and the check works, head over to the documentation.

Authorizations:
oryAccessToken
query Parameters
namespace
string

Namespace of the Relationship

object
string

Object of the Relationship

relation
string

Relation of the Relationship

subject_id
string

SubjectID of the Relationship

subject_set.namespace
string

Namespace of the Subject Set

subject_set.object
string

Object of the Subject Set

subject_set.relation
string

Relation of the Subject Set

max-depth
integer <int64>

Responses

Response samples

Content type
application/json
{
  • "allowed": true
}

Check a permission

To learn how relationship tuples and the check works, head over to the documentation.

Authorizations:
oryAccessToken
query Parameters
max-depth
integer <int64>
Request Body schema: application/json
namespace
string

Namespace to query

object
string

Object to query

relation
string

Relation to query

subject_id
string

SubjectID to query

Either SubjectSet or SubjectID can be provided.

object (subjectSet)

Responses

Request samples

Content type
application/json
{
  • "namespace": "string",
  • "object": "string",
  • "relation": "string",
  • "subject_id": "string",
  • "subject_set": {
    }
}

Response samples

Content type
application/json
{
  • "allowed": true
}

Expand a Relationship into permissions.

Use this endpoint to expand a relationship tuple into permissions.

Authorizations:
oryAccessToken
query Parameters
namespace
required
string

Namespace of the Subject Set

object
required
string

Object of the Subject Set

relation
required
string

Relation of the Subject Set

max-depth
integer <int64>

Responses

Response samples

Content type
application/json
{
  • "children": [
    ],
  • "tuple": {
    },
  • "type": "union"
}

workspace

List workspaces the user is a member of

Authorizations:
oryNetworkCookie
query Parameters
page_size
integer <int64> [ 1 .. 1000 ]
Default: 250

Items per Page

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

Responses

Response samples

Content type
application/json
{
  • "has_next_page": true,
  • "next_page_token": "string",
  • "workspaces": [
    ]
}

Create a new workspace

Authorizations:
oryNetworkCookie
Request Body schema: application/json
name
required
string

The name of the workspace

Responses

Request samples

Content type
application/json
{
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "name": "string",
  • "subscription_id": "string",
  • "subscription_plan": "string",
  • "updated_at": "2019-08-24T14:15:22Z"
}

Get a workspace

Any workspace member can access this endpoint.

Authorizations:
oryNetworkCookie
path Parameters
workspace
required
string

Responses

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "name": "string",
  • "subscription_id": "string",
  • "subscription_plan": "string",
  • "updated_at": "2019-08-24T14:15:22Z"
}

Update an workspace

Workspace members with the role OWNER can access this endpoint.

Authorizations:
oryNetworkCookie
path Parameters
workspace
required
string
Request Body schema: application/json
name
required
string

The name of the workspace.

Responses

Request samples

Content type
application/json
{
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "name": "string",
  • "subscription_id": "string",
  • "subscription_plan": "string",
  • "updated_at": "2019-08-24T14:15:22Z"
}

List all projects of a workspace

Any workspace member can access this endpoint.

Authorizations:
oryNetworkCookie
path Parameters
workspace
required
string

Responses

Response samples

Content type
application/json
{
  • "has_next_page": true,
  • "next_page": "string",
  • "projects": [
    ]
}