Reference

The Reference is for looking something up, not for learning it. When you have an error code and want its meaning, a claim and want its type, or a lifetime and want its number, this is where to look. It is for developers who have already read the guides, and for anyone who needs one fact fast.

Some of these pages are generated from the tables the server runs on: the error codes, the API routes, the OIDC endpoints and the scopes. A test regenerates that data and fails when the committed copy differs, so those pages cannot drift from the code without a failing check. The other pages are written by hand from the code.

The Reference has two halves. The generated half is a set of tables: what exists. The written half is a set of short pages that put the tables in context: what to expect and what to do. The written pages link to the generated ones, and the generated ones link back to the guides that explain how to use the pieces.

generated:  Error codes | API | OIDC endpoints | Scopeswritten:    Token claims | Token lifetimes | Assurance and method values            Grant types and client authentication | HTTP status codes            Account API at a glance | Versioning policy

I got an error and need its meaning.

1. Error codes: find the code and its status.
2. HTTP status codes and Retry-After: what to do per endpoint.
3. Troubleshooting: the symptom pages for the common ones.

I am verifying a token.

1. Token claims: which claim appears where.
2. Token lifetimes: how long each lives.
3. Assurance and method values: what acr and amr can say.

I am calling the account API.

1. Account API at a glance: the rules every route shares.
2. API: every route with its shapes.
3. Versioning policy: what is and is not promised about change.

Error codes lists every code the API and the OAuth endpoints return, with its status and what to do. API lists the account routes with the shape of every request and response. OIDC endpoints lists the provider's endpoints, discovery metadata and grant types, and marks any that are not mounted. Scopes lists the scopes a client may request and what each grants.

Token claims lists every claim in an ID token, an access token and the userinfo response, and when it is present. Token lifetimes puts the public numbers in one place: sessions, codes, each token and each proof. Assurance and method values lists the acr values an application can ask for, the amr values a token can carry and which sign-in produces which.

Grant types and client authentication lists the grants the token endpoint accepts, how each kind of client proves itself and the algorithms involved. HTTP status codes and Retry-After says which status to expect from which endpoint and how to honour Retry-After. Account API at a glance explains what the account API under the profile prefix is for, who may call it, how it authenticates and what it refuses. Versioning policy says what carries a version today and what has none.

None for lookup. To understand an entry, read the guide it links to, for example Tokens for claims or Flows for grants.

How long does an access token live? At most 15 minutes. See Token lifetimes.

Where is the list of scopes? See Scopes.

What do I do on a 429? Wait for Retry-After. See HTTP status codes and Retry-After.

Is there a compatibility guarantee? Not yet. See Versioning policy.

Does a personal access token work everywhere in the account API? No, it works on the profile only. See Account API at a glance.

It does not teach how to use the pieces, which is in Build with identity, or why they exist, which is in Concepts. It does not list the administrator API or the private browser sign-in requests. What the platform keeps about you is in the Trust documents.