OIDC endpoints

The provider's endpoints, discovery metadata and grant types.

On this page

The endpoints and metadata below are generated from the provider's capability table, which is also what the discovery document at /.well-known/openid-configuration serves. Read the paths from discovery rather than hard-coding them. A row marked as not available is not offered.

Endpoints#

Member	Path	Mounted
`authorization_endpoint`	`/authorize`	Yes
`pushed_authorization_request_endpoint`	`/par`	Yes
`token_endpoint`	`/token`	Yes
`userinfo_endpoint`	`/userinfo`	Yes
`introspection_endpoint`	`/introspect`	Yes
`revocation_endpoint`	`/revoke`	Yes
`end_session_endpoint`	`/logout`	Yes
`backchannel_authentication_endpoint`	`/bc-authorize`	Not available
`jwks_uri`	`/.well-known/jwks.json`	Yes

Discovery metadata#

Member	Value
`response_types_supported`	`code`
`response_modes_supported`	`query, form_post`
`grant_types_supported`	`authorization_code, refresh_token, client_credentials, urn:ietf:params:oauth:grant-type:token-exchange`
`code_challenge_methods_supported`	`S256`
`token_endpoint_auth_methods_supported`	`private_key_jwt, tls_client_auth, none`
`token_endpoint_auth_signing_alg_values_supported`	`EdDSA, ES256`
`introspection_endpoint_auth_methods_supported`	`private_key_jwt, tls_client_auth, none`
`revocation_endpoint_auth_methods_supported`	`private_key_jwt, tls_client_auth, none`
`id_token_signing_alg_values_supported`	`EdDSA, ES256`
`dpop_signing_alg_values_supported`	`EdDSA, ES256`
`subject_types_supported`	`public, pairwise`
`scopes_supported`	`openid, profile, email, offline_access, tdaid.tenant`
`claims_supported`	`sub, name, email, email_verified, locale, zoneinfo, preferred_username, picture, updated_at, tid, tslug, acr, amr, auth_time, sid`
`acr_values_supported`	`aal1, aal2, aal3`
`backchannel_logout_supported`	`true`
`backchannel_logout_session_supported`	`true`
`authorization_response_iss_parameter_supported`	`true`
`tls_client_certificate_bound_access_tokens`	`true`
`resource_indicators_supported`	`true`
`authorization_details_types_supported`	`tdaid:agent_action, tdaid:elevation`
`require_pushed_authorization_requests`	`true`
`backchannel_token_delivery_modes_supported`	`poll`

Grant types#

Grant types
`authorization_code`
`refresh_token`
`client_credentials`
`urn:ietf:params:oauth:grant-type:token-exchange`

Authorization details types#

Authorization details types
`tdaid:agent_action`
`tdaid:elevation`

Scopes supported#

Scopes supported
`openid`
`profile`
`email`
`offline_access`
`tdaid.tenant`