GXS Internal
Identity serverAPI reference

OAuth and OpenID Connect

/oauth2/authorize

GET
/oauth2/authorize

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Query Parameters

response_type?string

OAuth 2.1 response type (e.g., 'code')

client_id*string

OAuth 2.1 client ID

redirect_uri?string

OAuth 2.1 redirect URI

Formaturi
scope?string

OAuth 2.1 scopes (space-separated)

state?string

OAuth 2.1 state parameter

request_uri?string

Pushed Authorization Request URI referencing stored parameters

code_challenge?string

PKCE code challenge

code_challenge_method?string

PKCE code challenge method

nonce?string

OpenID Connect nonce

max_age?integer

Maximum authentication age in seconds; forces re-authentication when exceeded

Range0 <= value
resource?array<string>

Requested protected resource(s) for the access token. May be supplied multiple times as repeated 'resource' query parameters (RFC 8707) or as an array of strings.

prompt?string

OAuth2 prompt parameter

Response Body

Redirect to client with code or error

curl -X GET 'https://dev.auth.graphxserver.io/api/auth/oauth2/authorize?client_id=string'
Empty

/oauth2/authorize

POST
/oauth2/authorize

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Query Parameters

response_type?string

OAuth 2.1 response type (e.g., 'code')

client_id*string

OAuth 2.1 client ID

redirect_uri?string

OAuth 2.1 redirect URI

Formaturi
scope?string

OAuth 2.1 scopes (space-separated)

state?string

OAuth 2.1 state parameter

request_uri?string

Pushed Authorization Request URI referencing stored parameters

code_challenge?string

PKCE code challenge

code_challenge_method?string

PKCE code challenge method

nonce?string

OpenID Connect nonce

max_age?integer

Maximum authentication age in seconds; forces re-authentication when exceeded

Range0 <= value
resource?array<string>

Requested protected resource(s) for the access token. May be supplied multiple times as repeated 'resource' query parameters (RFC 8707) or as an array of strings.

prompt?string

OAuth2 prompt parameter

Response Body

Redirect to client with code or error

curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/authorize?client_id=string'
Empty

/oauth2/consent

POST
/oauth2/consent

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
accept*boolean

Accept or deny user consent for a set of scopes

scope?string
claims?string|
oauth_query?string

Response Body

Consent processed successfully

application/json
  1. response
redirect_uri*string

The URI to redirect to, either with an authorization code or an error

Formaturi
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/consent' \  -H 'Content-Type: application/json' \  -d '{  "accept": true}'
{  "redirect_uri": "http://example.com"}

/oauth2/continue

POST
/oauth2/continue

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
selected?boolean
created?boolean
postLogin?boolean
oauth_query?string

Response Body

Consent processed successfully

application/json
  1. response
redirect_uri*string

The URI to redirect to, either with an authorization code or an error

Formaturi
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/continue' \  -H 'Content-Type: application/json' \  -d '{}'
{  "redirect_uri": "http://example.com"}

/oauth2/token

POST
/oauth2/token

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Header Parameters

DPoP?string

RFC 9449 DPoP proof JWT for issuing DPoP-bound tokens

Request Body

application/json
  1. body
grant_type*string

OAuth2 grant type

client_id?string

OAuth2 client ID

client_secret?string

OAuth2 client secret

code?string

Authorization code (for authorization_code grant)

code_verifier?string

PKCE code verifier (for authorization_code grant)

redirect_uri?string

Redirect URI (for authorization_code grant)

Formaturi
refresh_token?string

Refresh token (for refresh_token grant)

resource?|array<string>

Requested protected resource(s) for the access token

scope?string

Requested scopes (for client_credentials grant)

Response Body

Access token response

application/json
  1. response
access_token*string

The access token issued by the authorization server

token_type*string

The type of the token issued

Value in"Bearer""DPoP"
expires_in*number

Lifetime in seconds of the access token

refresh_token?string

Refresh token, if issued

scope?string

Scopes granted by the access token

id_token?string

ID Token (if OpenID Connect)

curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/token' \  -H 'Content-Type: application/json' \  -d '{  "grant_type": "string"}'
{  "access_token": "string",  "token_type": "Bearer",  "expires_in": 0,  "refresh_token": "string",  "scope": "string",  "id_token": "string"}

/oauth2/introspect

POST
/oauth2/introspect

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
client_id?string

OAuth2 client ID

client_secret?string

OAuth2 client secret

token*string

The token to introspect (access or refresh token)

token_type_hint?string

Hint about the token type. Recognized values: access_token, refresh_token.

Response Body

Token introspection response

application/json
  1. response
active*boolean

Whether the token is active

scope?string

Scopes associated with the token

client_id?string

Client ID associated with the token

username?string

Username associated with the token

token_type?string

Type of the token

exp?number

Expiration time of the token (seconds since epoch)

iat?number

Issued at time (seconds since epoch)

nbf?number

Not before time (seconds since epoch)

sub?string

Subject of the token

aud?string

Audience of the token

iss?string

Issuer of the token

jti?string

JWT ID

curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/introspect' \  -H 'Content-Type: application/json' \  -d '{  "token": "string"}'
{  "active": true,  "scope": "string",  "client_id": "string",  "username": "string",  "token_type": "string",  "exp": 0,  "iat": 0,  "nbf": 0,  "sub": "string",  "aud": "string",  "iss": "string",  "jti": "string"}

/oauth2/revoke

POST
/oauth2/revoke

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
client_id?string

OAuth2 client ID

client_secret?string

OAuth2 client secret

token*string

The token to revoke (access or refresh token)

token_type_hint?string

Hint about the token type. Recognized values: access_token, refresh_token.

Response Body

Token revoked successfully. The response body is empty.

application/json
  1. response

Empty object on success

curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/revoke' \  -H 'Content-Type: application/json' \  -d '{  "token": "string"}'
{}

/oauth2/userinfo

GET
/oauth2/userinfo

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Header Parameters

Authorization?string

Bearer or DPoP access token

DPoP?string

RFC 9449 DPoP proof JWT when using a DPoP-bound access token

Response Body

User information retrieved successfully

application/json
  1. response
sub*string

Subject identifier (user ID)

email?string

User's email address, included if 'email' scope is granted

Formatemail
name?string

User's full name, included if 'profile' scope is granted

picture?string

User's profile picture URL, included if 'profile' scope is granted

Formaturi
given_name?string

User's given name, included if 'profile' scope is granted

family_name?string

User's family name, included if 'profile' scope is granted

email_verified?boolean

Whether the email is verified, included if 'email' scope is granted

curl -X GET 'https://dev.auth.graphxserver.io/api/auth/oauth2/userinfo'
{  "sub": "string",  "email": "user@example.com",  "name": "string",  "picture": "http://example.com",  "given_name": "string",  "family_name": "string",  "email_verified": true}

/oauth2/userinfo

POST
/oauth2/userinfo

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Header Parameters

Authorization?string

Bearer or DPoP access token

DPoP?string

RFC 9449 DPoP proof JWT when using a DPoP-bound access token

Request Body

application/json
  1. body
access_token?string

Response Body

User information retrieved successfully

application/json
  1. response
sub*string

Subject identifier (user ID)

email?string

User's email address, included if 'email' scope is granted

Formatemail
name?string

User's full name, included if 'profile' scope is granted

picture?string

User's profile picture URL, included if 'profile' scope is granted

Formaturi
given_name?string

User's given name, included if 'profile' scope is granted

family_name?string

User's family name, included if 'profile' scope is granted

email_verified?boolean

Whether the email is verified, included if 'email' scope is granted

curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/userinfo' \  -H 'Content-Type: application/json' \  -d '{}'
{  "sub": "string",  "email": "user@example.com",  "name": "string",  "picture": "http://example.com",  "given_name": "string",  "family_name": "string",  "email_verified": true}

/oauth2/end-session

GET
/oauth2/end-session

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Response Body

Logout completed, or an HTML confirmation page was returned for browser navigation. A redirect is used only for an exact registered post_logout_redirect_uri.

  1. response
redirect_uri?string

URI to redirect to after logout (if post_logout_redirect_uri was provided)

Formaturi
message?string

Success message

curl -X GET 'https://dev.auth.graphxserver.io/api/auth/oauth2/end-session'
{  "redirect_uri": "http://example.com",  "message": "string"}

/oauth2/end-session

POST
/oauth2/end-session

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
id_token_hint?string
client_id?string
post_logout_redirect_uri?string
state?string

Response Body

Logout completed, or an HTML confirmation page was returned for browser navigation. A redirect is used only for an exact registered post_logout_redirect_uri.

  1. response
redirect_uri?string

URI to redirect to after logout (if post_logout_redirect_uri was provided)

Formaturi
message?string

Success message

curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/end-session' \  -H 'Content-Type: application/json' \  -d '{}'
{  "redirect_uri": "http://example.com",  "message": "string"}

/oauth2/end-session/confirm

POST
/oauth2/end-session/confirm

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
action*"confirm"
Value in"confirm"

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/end-session/confirm' \  -H 'Content-Type: application/json' \  -d '{  "action": "confirm"}'
{  "message": "string"}

/oauth2/register

POST
/oauth2/register

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
redirect_uris?array<string>
scope?string
client_name?string
client_uri?string
logo_uri?string
contacts?array<>
tos_uri?string
policy_uri?string
software_id?string
software_version?string
software_statement?string
post_logout_redirect_uris?array<string>
backchannel_logout_uri?string
backchannel_logout_session_required?boolean
token_endpoint_auth_method?string
Length1 <= length
jwks?
jwks_uri?string
grant_types?array<>
response_types?array<>
application_type?string
Value in"web""native"
subject_type?string
Value in"public""pairwise"
dpop_bound_access_tokens?boolean
resources?array<string>
skip_consent?string

Response Body

OAuth2 application registered successfully

application/json
  1. response
client_id*string

Unique identifier for the client

client_secret?string

Secret key for the client

client_secret_expires_at?number

Time the client secret will expire. If 0, the client secret will never expire.

scope?string

Space-separated scopes allowed by the client

user_id?string

ID of the user who registered the client, null if registered anonymously

client_id_issued_at?number

Creation timestamp of this client

client_name?string

Name of the OAuth2 application

client_uri?string

Name of the OAuth2 application

logo_uri?string

Icon URL for the application

contacts?array<string>

List representing ways to contact people responsible for this client, typically email addresses

tos_uri?string

Client's terms of service uri

policy_uri?string

Client's policy uri

software_id?string

Unique identifier assigned by the developer to help in the dynamic registration process

software_version?string

Version identifier for the software_id

software_statement?string

JWT containing metadata values about the client software as claims

redirect_uris?array<>

List of allowed redirect uris

post_logout_redirect_uris?array<>

List of allowed logout redirect uris

backchannel_logout_uri?string

RP URL to receive signed Logout Tokens when the end-user's OP session terminates

Formaturi
backchannel_logout_session_required?boolean

Whether the RP requires a sid claim in every Logout Token

token_endpoint_auth_method?string

Requested authentication method for the token endpoint

grant_types?array<string>

Grant types the client may use at the token endpoint

response_types?array<>

Response types the client may use at the authorization endpoint

application_type?string

OIDC application type used to classify redirect URI policy

Value in"web""native"
resources?array<>

Final resource identifiers linked to the registered client

disabled?boolean

Whether the client is disabled

curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/register' \  -H 'Content-Type: application/json' \  -d '{}'
{  "client_id": "string",  "client_secret": "string",  "client_secret_expires_at": 0,  "scope": "string",  "user_id": "string",  "client_id_issued_at": 0,  "client_name": "string",  "client_uri": "string",  "logo_uri": "string",  "contacts": [    "string"  ],  "tos_uri": "string",  "policy_uri": "string",  "software_id": "string",  "software_version": "string",  "software_statement": "string",  "redirect_uris": [    "http://example.com"  ],  "post_logout_redirect_uris": [    "http://example.com"  ],  "backchannel_logout_uri": "http://example.com",  "backchannel_logout_session_required": true,  "token_endpoint_auth_method": "string",  "grant_types": [    "string"  ],  "response_types": [    "code"  ],  "application_type": "web",  "resources": [    "http://example.com"  ],  "disabled": true}

/oauth2/create-client

POST
/oauth2/create-client

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
redirect_uris?array<string>
scope?string
client_name?string
client_uri?string
logo_uri?string
contacts?array<>
tos_uri?string
policy_uri?string
software_id?string
software_version?string
software_statement?string
post_logout_redirect_uris?array<string>
backchannel_logout_uri?string
backchannel_logout_session_required?boolean
token_endpoint_auth_method?string
Length1 <= length
application_type?string
Value in"web""native"
jwks?
jwks_uri?string
grant_types?array<>
response_types?array<>
dpop_bound_access_tokens?boolean

Response Body

OAuth2 application registered successfully

application/json
  1. response
client_id*string

Unique identifier for the client

client_secret?string

Secret key for the client

client_secret_expires_at?number

Time the client secret will expire. If 0, the client secret will never expire.

scope?string

Space-separated scopes allowed by the client

user_id?string

ID of the user who registered the client, null if registered anonymously

client_id_issued_at?number

Creation timestamp of this client

client_name?string

Name of the OAuth2 application

client_uri?string

URI of the OAuth2 application

logo_uri?string

Icon URI for the application

contacts?array<string>

List representing ways to contact people responsible for this client, typically email addresses

tos_uri?string

Client's terms of service uri

policy_uri?string

Client's policy uri

software_id?string

Unique identifier assigned by the developer to help in the dynamic registration process

software_version?string

Version identifier for the software_id

software_statement?string

JWT containing metadata values about the client software as claims

redirect_uris?array<>

List of allowed redirect uris

token_endpoint_auth_method?string

Requested authentication method for the token endpoint

grant_types?array<string>

Grant types the client may use at the token endpoint

response_types?array<>

Response types the client may use at the authorization endpoint

application_type?string

OIDC application type used to classify redirect URI policy

Value in"web""native"
resources?array<>

Final server-owned resources linked to the client

disabled?boolean

Whether the client is disabled

metadata?

Additional metadata for the application

curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/create-client' \  -H 'Content-Type: application/json' \  -d '{}'
{  "client_id": "string",  "client_secret": "string",  "client_secret_expires_at": 0,  "scope": "string",  "user_id": "string",  "client_id_issued_at": 0,  "client_name": "string",  "client_uri": "string",  "logo_uri": "string",  "contacts": [    "string"  ],  "tos_uri": "string",  "policy_uri": "string",  "software_id": "string",  "software_version": "string",  "software_statement": "string",  "redirect_uris": [    "http://example.com"  ],  "token_endpoint_auth_method": "string",  "grant_types": [    "string"  ],  "response_types": [    "code"  ],  "application_type": "web",  "resources": [    "http://example.com"  ],  "disabled": true,  "metadata": {}}

/oauth2/get-client

GET
/oauth2/get-client

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Query Parameters

client_id?string

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X GET 'https://dev.auth.graphxserver.io/api/auth/oauth2/get-client'
{  "message": "string"}

/oauth2/public-client

GET
/oauth2/public-client

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Query Parameters

client_id?string

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X GET 'https://dev.auth.graphxserver.io/api/auth/oauth2/public-client'
{  "message": "string"}

/oauth2/public-client-prelogin

POST
/oauth2/public-client-prelogin

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
client_id*string
oauth_query?string

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/public-client-prelogin' \  -H 'Content-Type: application/json' \  -d '{  "client_id": "string"}'
{  "message": "string"}

/oauth2/get-clients

GET
/oauth2/get-clients

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X GET 'https://dev.auth.graphxserver.io/api/auth/oauth2/get-clients'
{  "message": "string"}

/oauth2/update-client

POST
/oauth2/update-client

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
client_id*string
update*

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/update-client' \  -H 'Content-Type: application/json' \  -d '{  "client_id": "string",  "update": {}}'
{  "message": "string"}

/oauth2/client/rotate-secret

POST
/oauth2/client/rotate-secret

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
client_id*string

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/client/rotate-secret' \  -H 'Content-Type: application/json' \  -d '{  "client_id": "string"}'
{  "message": "string"}

/oauth2/delete-client

POST
/oauth2/delete-client

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
client_id*string

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/delete-client' \  -H 'Content-Type: application/json' \  -d '{  "client_id": "string"}'
{  "message": "string"}
GET
/oauth2/get-consent

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Query Parameters

id?string

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X GET 'https://dev.auth.graphxserver.io/api/auth/oauth2/get-consent'
{  "message": "string"}

/oauth2/get-consents

GET
/oauth2/get-consents

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X GET 'https://dev.auth.graphxserver.io/api/auth/oauth2/get-consents'
{  "message": "string"}
POST
/oauth2/update-consent

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
id*string
update*

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/update-consent' \  -H 'Content-Type: application/json' \  -d '{  "id": "string",  "update": {    "scopes": [      "string"    ]  }}'
{  "message": "string"}
POST
/oauth2/delete-consent

Authorization

bearerAuth
headerAuthorizationBearer <token>

Bearer token authentication

Request Body

application/json
  1. body
id*string

Response Body

Bad Request. Usually due to missing parameters, or invalid parameters.

application/json
  1. response
message*string
curl -X POST 'https://dev.auth.graphxserver.io/api/auth/oauth2/delete-consent' \  -H 'Content-Type: application/json' \  -d '{  "id": "string"}'
{  "message": "string"}

Identity API reference

Browse the identity server's OpenAPI endpoints inside this documentation.

Authorization

Next Page