{"items":[{"type":"link","label":"Okta OpenID Connect & OAuth 2.0","link":"/openapi/okta-oauth/oauth","routeSlug":"/openapi/okta-oauth/oauth","content":{"contentType":"overview","meta":{"name":"Okta OpenID Connect & OAuth 2.0"},"children":[{"nodeType":"container","panels":[{"title":"Overview","titleTranslationKey":"info.title","children":[]},{"title":"Languages","titleTranslationKey":"languages.title","children":[{"kind":"languages","options":[{"key":"curl","title":"curl","lang":"curl"},{"key":"csharp","title":"C#","lang":"C#"},{"key":"java","title":"Java","lang":"Java"},{"key":"javascript","title":"JavaScript","lang":"JavaScript"},{"key":"node","title":"Node.js","lang":"Node.js"},{"key":"python","title":"Python","lang":"Python"},{"key":"go","title":"Go","lang":"Go"},{"key":"php","title":"PHP","lang":"PHP"},{"key":"ruby","title":"Ruby","lang":"Ruby"},{"key":"payload","title":"Payload","lang":"Payload"}]}]},{"title":"Servers","titleTranslationKey":"servers.title","children":[{"kind":"servers","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com","description":"The domain of your org. This can be a provided subdomain of an official okta domain (okta.com, oktapreview.com, and so on) or one of your configured custom domains."}}}],"mode":"default"}]}],"children":[{"nodeType":"overview-section-wrapper","children":[{"nodeType":"header","level":1,"label":"Okta OpenID Connect & OAuth 2.0","showPageActions":true},{"nodeType":"overview-section-wrapper","children":[{"nodeType":"markdoc","content":"OAuth 2.0 Protocol APIs"}],"sectionId":"/openapi/okta-oauth/oauth"},{"nodeType":"external-docs","url":"https://developer.okta.com","description":"Find more info here"}],"sectionId":"/openapi/okta-oauth/oauth"}]}]}},{"type":"group","label":"Dynamic Client Registration","link":"/openapi/okta-oauth/oauth/client","routeSlug":"/openapi/okta-oauth/oauth/client","items":[{"label":"List all client applications","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/client/listclients","routeSlug":"/openapi/okta-oauth/oauth/client/listclients","metadata":{"seo":{"title":"List all client applications","description":"OAuth 2.0 scope:okta.clients.read"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"listClients","name":"List all client applications","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1clients/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List all client applications","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"display":"flex","alignItems":"flex-start","gap":"8px","marginTop":"12px"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"a","attrs":{"href":"https://developer.okta.com/docs/api/oauth2/","style":{"padding":"4px 0px","flex":"0 0 135px","fontSize":"16px","fontWeight":"600","color":"#1d1d21","textDecoration":"none","marginBottom":"8px"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"OAuth 2.0 scope:"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"ul","attrs":{"style":{"padding":"0","margin":"0","listStyle":"none","display":"flex","flexWrap":"wrap","flex":"1"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"li","attrs":{"style":{"display":"inline-flex","alignItems":"center","backgroundColor":"#ededed","color":"#4b4b4b","padding":"4px 12px","borderRadius":"16px","fontSize":"14px","marginRight":"8px","marginBottom":"8px","lineHeight":"20px","border":"1px solid transparent"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"okta.clients.read"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Lists all the client apps with pagination"},"children":[]}]}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"after","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The cursor to use for pagination. It's an opaque string that specifies your current location in the list and is obtained from the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Link"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" response header. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/#pagination"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Pagination"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"after"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" cursor should be treated as an opaque value and obtained through the next link relation."},"children":[]}]}]}]}]},{"name":"limit","in":"query","schemaId":"schema_1518","description":"A limit on the number of objects to return."},{"name":"q","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Searches the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_name"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" property of clients for a matching value."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Search currently performs a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"startsWith"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" match, but this is an implementation detail and may change without notice."},"children":[]}]}]}]}]}],"pointer":"/paths/~1oauth2~1v1~1clients/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/v1/clients","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[{"name":"after","in":"query","schemaId":"components/schemas/Claim"},{"name":"limit","in":"query","schemaId":"schema_1518"},{"name":"q","in":"query","schemaId":"components/schemas/Claim"}],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","403","429"],"pointer":"/oauth2/v1/clients","href":"client/listclients","openApiOperationId":"listClients","summary":"List all client applications"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1519","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/200/content/application~1json/examples/All Clients"]}},"schemaId":"schema_1519","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/200/content/application~1json/examples/All Clients"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/403/content/application~1json/examples/Access denied"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/403/content/application~1json/examples/Access denied"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1clients/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"schema_1519","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/200/content/application~1json/examples/All Clients"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1519","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/200/content/application~1json/examples/All Clients"]}}},{"code":"403","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/403/content/application~1json/examples/Access denied"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/403/content/application~1json/examples/Access denied"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/clients"},{"label":"Register a client app","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/client/createclient","routeSlug":"/openapi/okta-oauth/oauth/client/createclient","metadata":{"seo":{"title":"Register a client app","description":"OAuth 2.0 scope:okta.clients.register"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"createClient","name":"Register a client app","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1clients/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Register a client app","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"display":"flex","alignItems":"flex-start","gap":"8px","marginTop":"12px"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"a","attrs":{"href":"https://developer.okta.com/docs/api/oauth2/","style":{"padding":"4px 0px","flex":"0 0 135px","fontSize":"16px","fontWeight":"600","color":"#1d1d21","textDecoration":"none","marginBottom":"8px"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"OAuth 2.0 scope:"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"ul","attrs":{"style":{"padding":"0","margin":"0","listStyle":"none","display":"flex","flexWrap":"wrap","flex":"1"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"li","attrs":{"style":{"display":"inline-flex","alignItems":"center","backgroundColor":"#ededed","color":"#4b4b4b","padding":"4px 12px","borderRadius":"16px","fontSize":"14px","marginRight":"8px","marginBottom":"8px","lineHeight":"20px","border":"1px solid transparent"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"okta.clients.register"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Registers a new client app"},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" You can create apps on the Apps endpoint ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/api/v1/apps"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") and default to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"consent_method=TRUSTED"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", while those created with Dynamic Client Registration ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/oauth2/v1/clients"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") default to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"consent_method=REQUIRED"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" If you want to specify the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", you can use the Applications API to create or update a client app."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Different app types have different valid values for the corresponding grant type:"},"children":[]}]}]},{"$$mdtype":"Node","type":"table","attributes":{},"children":[{"$$mdtype":"Node","type":"thead","attributes":{},"children":[{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"th","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"App Type"},"children":[]}]}]},{"$$mdtype":"Node","type":"th","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Valid Grant Type"},"children":[]}]}]},{"$$mdtype":"Node","type":"th","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Requirements"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"tbody","attributes":{},"children":[{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"browser"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"authorization_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"implicit"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:ietf:params:oauth:grant-type:saml2-bearer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The following grant types are "},"children":[]},{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"only: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:grant-type:otp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:grant-type:oob"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"http://auth0.com/oauth/grant-type/mfa-otp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"http://auth0.com/oauth/grant-type/mfa-oob"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[]}]}]},{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"native"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"authorization_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"implicit"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"password"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"refresh_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:ietf:params:oauth:grant-type:saml2-bearer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The following grant types are "},"children":[]},{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"only: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:grant-type:otp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:grant-type:oob"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"http://auth0.com/oauth/grant-type/mfa-otp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"http://auth0.com/oauth/grant-type/mfa-oob"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Must have at least "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"authorization_code"},"children":[]}]}]}]},{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"service"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_credentials"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:ietf:params:oauth:grant-type:saml2-bearer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The following grant types are "},"children":[]},{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"only: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:grant-type:otp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:grant-type:oob"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"http://auth0.com/oauth/grant-type/mfa-otp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"http://auth0.com/oauth/grant-type/mfa-oob"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Works with the OAuth 2.0 flow (not OpenID Connect)"},"children":[]}]}]}]},{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"web"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"authorization_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"implicit"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"refresh_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_credentials"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"(*), "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:ietf:params:oauth:grant-type:saml2-bearer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The following grant types are "},"children":[]},{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"only: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:grant-type:otp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:grant-type:oob"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"http://auth0.com/oauth/grant-type/mfa-otp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"http://auth0.com/oauth/grant-type/mfa-oob"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Must have at least "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"authorization_code"},"children":[]}]}]}]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_credentials"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" grant with a web app type allows you to use one "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for an app that needs to make user-specific calls and back-end calls for data."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"grant_types"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_types"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" values described above are partially orthogonal, as they refer to arguments passed to different endpoints in the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc6749"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OAuth 2.0 protocol"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". However, they are related in that the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"grant_types"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" available to a client influence the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_types"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that the client is allowed to use and vice versa. For instance, a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"grant_types"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" value that includes "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"authorization_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" implies a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_types"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" value that includes "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", as both values are defined as part of the OAuth 2.0 authorization code grant."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with JWKS","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with jwks_uri","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client with ID token encryption enabled"]}},"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with JWKS","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with jwks_uri","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client with ID token encryption enabled"],"pointer":"/paths/~1oauth2~1v1~1clients/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/clients","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with JWKS","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with jwks_uri","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client with ID token encryption enabled"]}},"responseCodes":["201","400","403","429"],"pointer":"/oauth2/v1/clients","href":"client/createclient","openApiOperationId":"createClient","summary":"Register a client app"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with JWKS","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with jwks_uri","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client with ID token encryption enabled"],"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with JWKS","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with jwks_uri","paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client with ID token encryption enabled"]}},"examples":[{},{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"201","description":"Created","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with JWKS","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with jwks_uri","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client with ID token encryption enabled"]}},"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with JWKS","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with jwks_uri","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client with ID token encryption enabled"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/400/content/application~1json/examples/API validation failed"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/400/content/application~1json/examples/API validation failed"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/403/content/application~1json/examples/Access denied"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/403/content/application~1json/examples/Access denied"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1clients/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"201","schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with JWKS","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with jwks_uri","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client with ID token encryption enabled"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with JWKS","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with jwks_uri","paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client with ID token encryption enabled"]}}},{"code":"400","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/400/content/application~1json/examples/API validation failed"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/400/content/application~1json/examples/API validation failed"]}}},{"code":"403","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/403/content/application~1json/examples/Access denied"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/403/content/application~1json/examples/Access denied"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/clients"},{"label":"Retrieve a client app","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/client/getclient","routeSlug":"/openapi/okta-oauth/oauth/client/getclient","metadata":{"seo":{"title":"Retrieve a client app","description":"CORSOAuth 2.0 scope:okta.clients.read"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"getClient","name":"Retrieve a client app","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Retrieve a client app","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"display":"flex","alignItems":"flex-start","gap":"8px","marginTop":"12px"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"a","attrs":{"href":"https://developer.okta.com/docs/api/oauth2/","style":{"padding":"4px 0px","flex":"0 0 135px","fontSize":"16px","fontWeight":"600","color":"#1d1d21","textDecoration":"none","marginBottom":"8px"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"OAuth 2.0 scope:"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"ul","attrs":{"style":{"padding":"0","margin":"0","listStyle":"none","display":"flex","flexWrap":"wrap","flex":"1"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"li","attrs":{"style":{"display":"inline-flex","alignItems":"center","backgroundColor":"#ededed","color":"#4b4b4b","padding":"4px 12px","borderRadius":"16px","fontSize":"14px","marginRight":"8px","marginBottom":"8px","lineHeight":"20px","border":"1px solid transparent"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"okta.clients.read"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Retrieves a client app by "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"clientId"},"children":[]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"clientId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the client app"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/v1/clients/{clientId}","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"clientId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","403","404","429"],"pointer":"/oauth2/v1/clients/{clientId}","href":"client/getclient","openApiOperationId":"getClient","summary":"Retrieve a client app"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/200/content/application~1json/examples/Web client"]}},"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/200/content/application~1json/examples/Web client"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/403/content/application~1json/examples/Access denied"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/403/content/application~1json/examples/Access denied"]},{"code":"404","description":"Not Found","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/404/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/404/content/application~1json/examples/Resource Not Found"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/200/content/application~1json/examples/Web client"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/200/content/application~1json/examples/Web client"]}}},{"code":"403","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/403/content/application~1json/examples/Access denied"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/403/content/application~1json/examples/Access denied"]}}},{"code":"404","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/404/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/404/content/application~1json/examples/Resource Not Found"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/clients/{clientId}"},{"label":"Replace a client app","deprecated":false,"httpVerb":"put","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/client/replaceclient","routeSlug":"/openapi/okta-oauth/oauth/client/replaceclient","metadata":{"seo":{"title":"Replace a client app","description":"OAuth 2.0 scope:okta.clients.manage"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"replaceClient","name":"Replace a client app","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/put","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Replace a client app","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"display":"flex","alignItems":"flex-start","gap":"8px","marginTop":"12px"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"a","attrs":{"href":"https://developer.okta.com/docs/api/oauth2/","style":{"padding":"4px 0px","flex":"0 0 135px","fontSize":"16px","fontWeight":"600","color":"#1d1d21","textDecoration":"none","marginBottom":"8px"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"OAuth 2.0 scope:"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"ul","attrs":{"style":{"padding":"0","margin":"0","listStyle":"none","display":"flex","flexWrap":"wrap","flex":"1"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"li","attrs":{"style":{"display":"inline-flex","alignItems":"center","backgroundColor":"#ededed","color":"#4b4b4b","padding":"4px 12px","borderRadius":"16px","fontSize":"14px","marginRight":"8px","marginBottom":"8px","lineHeight":"20px","border":"1px solid transparent"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"okta.clients.manage"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Replaces the settings for a client app."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" You must specify all settings when you update a client app. Partial updates aren't supported. If any settings are missing when you update a client app, the update fails. The exceptions are that you can't include "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret_expires_at"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id_issued_at"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in the request, and you can omit the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"clientId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the client app"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/put/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/requestBody/content/application~1json/examples/Web client"]}},"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/requestBody/content/application~1json/examples/Web client"],"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/put/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"PUT","path":"/oauth2/v1/clients/{clientId}","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"clientId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/requestBody/content/application~1json/examples/Web client"]}},"responseCodes":["200","400","403","404","429"],"pointer":"/oauth2/v1/clients/{clientId}","href":"client/replaceclient","openApiOperationId":"replaceClient","summary":"Replace a client app"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/requestBody/content/application~1json/examples/Web client"],"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/requestBody/content/application~1json/examples/Web client"]}},"examples":[{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/200/content/application~1json/examples/Web client"]}},"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/200/content/application~1json/examples/Web client"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/400/content/application~1json/examples/API validation failed"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/400/content/application~1json/examples/API validation failed"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/403/content/application~1json/examples/Access denied"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/403/content/application~1json/examples/Access denied"]},{"code":"404","description":"Not Found","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/404/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/404/content/application~1json/examples/Resource Not Found"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/put/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/200/content/application~1json/examples/Web client"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/200/content/application~1json/examples/Web client"]}}},{"code":"400","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/400/content/application~1json/examples/API validation failed"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/400/content/application~1json/examples/API validation failed"]}}},{"code":"403","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/403/content/application~1json/examples/Access denied"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/403/content/application~1json/examples/Access denied"]}}},{"code":"404","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/404/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/404/content/application~1json/examples/Resource Not Found"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/clients/{clientId}"},{"label":"Delete a client app","deprecated":false,"httpVerb":"delete","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/client/deleteclient","routeSlug":"/openapi/okta-oauth/oauth/client/deleteclient","metadata":{"seo":{"title":"Delete a client app","description":"OAuth 2.0 scope:okta.clients.manage"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"deleteClient","name":"Delete a client app","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/delete","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Delete a client app","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"display":"flex","alignItems":"flex-start","gap":"8px","marginTop":"12px"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"a","attrs":{"href":"https://developer.okta.com/docs/api/oauth2/","style":{"padding":"4px 0px","flex":"0 0 135px","fontSize":"16px","fontWeight":"600","color":"#1d1d21","textDecoration":"none","marginBottom":"8px"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"OAuth 2.0 scope:"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"ul","attrs":{"style":{"padding":"0","margin":"0","listStyle":"none","display":"flex","flexWrap":"wrap","flex":"1"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"li","attrs":{"style":{"display":"inline-flex","alignItems":"center","backgroundColor":"#ededed","color":"#4b4b4b","padding":"4px 12px","borderRadius":"16px","fontSize":"14px","marginRight":"8px","marginBottom":"8px","lineHeight":"20px","border":"1px solid transparent"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"okta.clients.manage"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Deletes a client app"},"children":[]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"clientId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the client app"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/delete/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"DELETE","path":"/oauth2/v1/clients/{clientId}","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"clientId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["204","403","404","429"],"pointer":"/oauth2/v1/clients/{clientId}","href":"client/deleteclient","openApiOperationId":"deleteClient","summary":"Delete a client app"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204","description":"No Content"},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/403/content/application~1json/examples/Access denied"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/403/content/application~1json/examples/Access denied"]},{"code":"404","description":"Not Found","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/404/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/404/content/application~1json/examples/Resource Not Found"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"204"},{"code":"403","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/403/content/application~1json/examples/Access denied"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/403/content/application~1json/examples/Access denied"]}}},{"code":"404","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/404/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/404/content/application~1json/examples/Resource Not Found"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/clients/{clientId}"},{"label":"Generate a new client secret","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/client/generatenewclientsecret","routeSlug":"/openapi/okta-oauth/oauth/client/generatenewclientsecret","metadata":{"seo":{"title":"Generate a new client secret","description":"OAuth 2.0 scope:okta.clients.manage"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"generateNewClientSecret","name":"Generate a new client secret","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Generate a new client secret","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"display":"flex","alignItems":"flex-start","gap":"8px","marginTop":"12px"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"a","attrs":{"href":"https://developer.okta.com/docs/api/oauth2/","style":{"padding":"4px 0px","flex":"0 0 135px","fontSize":"16px","fontWeight":"600","color":"#1d1d21","textDecoration":"none","marginBottom":"8px"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"OAuth 2.0 scope:"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"ul","attrs":{"style":{"padding":"0","margin":"0","listStyle":"none","display":"flex","flexWrap":"wrap","flex":"1"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"li","attrs":{"style":{"display":"inline-flex","alignItems":"center","backgroundColor":"#ededed","color":"#4b4b4b","padding":"4px 12px","borderRadius":"16px","fontSize":"14px","marginRight":"8px","marginBottom":"8px","lineHeight":"20px","border":"1px solid transparent"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"okta.clients.manage"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Generates a new client secret for the specified client app."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" This operation only applies to client apps that use the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret_post"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret_basic"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" method for token endpoint authorization."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"clientId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the client app"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/clients/{clientId}/lifecycle/newSecret","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"clientId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","403","404","429"],"pointer":"/oauth2/v1/clients/{clientId}/lifecycle/newSecret","href":"client/generatenewclientsecret","openApiOperationId":"generateNewClientSecret","summary":"Generate a new client secret"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/200/content/application~1json/examples/Web client"]}},"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/200/content/application~1json/examples/Web client"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/403/content/application~1json/examples/Access denied"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/403/content/application~1json/examples/Access denied"]},{"code":"404","description":"Not Found","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/404/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/404/content/application~1json/examples/Resource Not Found"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/200/content/application~1json/examples/Web client"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Client","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/200/content/application~1json/examples/Web client"]}}},{"code":"403","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/403/content/application~1json/examples/Access denied"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/403/content/application~1json/examples/Access denied"]}}},{"code":"404","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/404/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/404/content/application~1json/examples/Resource Not Found"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/clients/{clientId}/lifecycle/newSecret"}],"content":{"contentType":"group","meta":{"name":"Client"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Dynamic Client Registration","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The Dynamic Client Registration API provides operations to register and manage client apps for use with the Okta OAuth 2.0 and OpenID Connect endpoints. This API largely follows the contract defined in "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7591"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RFC7591: OAuth 2.0 Dynamic Client Registration Protocol"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://openid.net/specs/openid-connect-registration-1_0.html"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OpenID Connect Dynamic Client Registration 1.0"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Clients managed through this API are modeled as apps in Okta and appear in the apps section of the Admin Console. Changes made through the API appear in the Admin Console and vice versa. Tokens issued by these clients follow the rules for access tokens and ID tokens."},"children":[]}]}]}]}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/oauth2/v1/clients","summary":"List all client applications","prefix":{"name":"get","color":"get"},"badges":[],"link":"/client/listclients","deprecated":false},{"title":"/oauth2/v1/clients","summary":"Register a client app","prefix":{"name":"post","color":"post"},"badges":[],"link":"/client/createclient","deprecated":false},{"title":"/oauth2/v1/clients/{clientId}","summary":"Retrieve a client app","prefix":{"name":"get","color":"get"},"badges":[],"link":"/client/getclient","deprecated":false},{"title":"/oauth2/v1/clients/{clientId}","summary":"Replace a client app","prefix":{"name":"put","color":"put"},"badges":[],"link":"/client/replaceclient","deprecated":false},{"title":"/oauth2/v1/clients/{clientId}","summary":"Delete a client app","prefix":{"name":"delete","color":"delete"},"badges":[],"link":"/client/deleteclient","deprecated":false},{"title":"/oauth2/v1/clients/{clientId}/lifecycle/newSecret","summary":"Generate a new client secret","prefix":{"name":"post","color":"post"},"badges":[],"link":"/client/generatenewclientsecret","deprecated":false}]}]}]}]}},{"type":"group","label":"Custom Authorization Servers","link":"/openapi/okta-oauth/oauth/customas","routeSlug":"/openapi/okta-oauth/oauth/customas","items":[{"label":"Retrieve the OAuth 2.0 metadata","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/getwellknownoauthconfigurationcustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/getwellknownoauthconfigurationcustomas","metadata":{"seo":{"title":"Retrieve the OAuth 2.0 metadata","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"getWellKnownOAuthConfigurationCustomAS","name":"Retrieve the OAuth 2.0 metadata","isWebhook":false,"pointer":"/paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Retrieve the OAuth 2.0 metadata","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Retrieves OAuth 2.0 metadata for the specified custom authorization server. Clients can use this information to programmatically configure their interactions with Okta. Custom scopes are returned only when they are configured to be publicly discoverable. Custom claims are never returned."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Okta supports two URL formats for this endpoint. The RFC 8414-compliant format ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/.well-known/oauth-authorization-server/oauth2/{authorizationServerId}"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") is the current standard. The legacy format ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") remains supported for backwards compatibility with no planned removal date."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"client_id","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can configure clients to format the issuer differently. Pass in the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to ensure that the returned issuer format matches."},"children":[]}]}]}]}],"pointer":"/paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/.well-known/oauth-authorization-server/oauth2/{authorizationServerId}","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[{"name":"client_id","in":"query","schemaId":"components/schemas/Claim"}],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","400","404"],"pointer":"/.well-known/oauth-authorization-server/oauth2/{authorizationServerId}","href":"customas/getwellknownoauthconfigurationcustomas","openApiOperationId":"getWellKnownOAuthConfigurationCustomAS","summary":"Retrieve the OAuth 2.0 metadata"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthMetadata","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/200/content/application~1json/examples/OAuth 2.0 Metadata"]}},"schemaId":"components/schemas/OAuthMetadata","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/200/content/application~1json/examples/OAuth 2.0 Metadata"]},{"code":"400","description":"Invalid Client ID","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/400/content/application~1json/examples/Invalid Client ID"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/400/content/application~1json/examples/Invalid Client ID"]},{"code":"404","description":"Authorization Server Not Found","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/404/content/application~1json/examples/Invalid Client ID"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/404/content/application~1json/examples/Invalid Client ID"]}],"pointer":"/paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/OAuthMetadata","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/200/content/application~1json/examples/OAuth 2.0 Metadata"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthMetadata","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/200/content/application~1json/examples/OAuth 2.0 Metadata"]}}},{"code":"400","schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/400/content/application~1json/examples/Invalid Client ID"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/400/content/application~1json/examples/Invalid Client ID"]}}},{"code":"404","schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/404/content/application~1json/examples/Invalid Client ID"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/404/content/application~1json/examples/Invalid Client ID"]}}}],"examples":[]}]}]}]},"httpPath":"/.well-known/oauth-authorization-server/oauth2/{authorizationServerId}"},{"label":"Retrieve the OpenID Connect metadata","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/getwellknownopenidconfigurationcustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/getwellknownopenidconfigurationcustomas","metadata":{"seo":{"title":"Retrieve the OpenID Connect metadata","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"getWellKnownOpenIDConfigurationCustomAS","name":"Retrieve the OpenID Connect metadata","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Retrieve the OpenID Connect metadata","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returns OpenID Connect metadata for the specified custom authorization server. Clients can use this information to programmatically configure their interactions with Okta. Custom scopes are returned only when they are configured to be publicly discoverable. Custom claims are never returned."},"children":[]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"client_id","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can configure clients to format the issuer differently. Pass in the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to ensure that the returned issuer format matches."},"children":[]}]}]}]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/{authorizationServerId}/.well-known/openid-configuration","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[{"name":"client_id","in":"query","schemaId":"components/schemas/Claim"}],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","400","404"],"pointer":"/oauth2/{authorizationServerId}/.well-known/openid-configuration","href":"customas/getwellknownopenidconfigurationcustomas","openApiOperationId":"getWellKnownOpenIDConfigurationCustomAS","summary":"Retrieve the OpenID Connect metadata"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OidcMetadata","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"]}},"schemaId":"components/schemas/OidcMetadata","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"]},{"code":"400","description":"Invalid Client ID","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"]},{"code":"404","description":"Authorization Server Not Found","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/404/content/application~1json/examples/Invalid Client ID"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/404/content/application~1json/examples/Invalid Client ID"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/OidcMetadata","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OidcMetadata","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"]}}},{"code":"400","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"]}}},{"code":"404","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/404/content/application~1json/examples/Invalid Client ID"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/404/content/application~1json/examples/Invalid Client ID"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/.well-known/openid-configuration"},{"label":"/authorize","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/authorizecustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/authorizecustomas","metadata":{"seo":{"title":"/authorize","description":"This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This request authenticates the user and returns tokens along with an authorization grant to the client app as a part of the callback response."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"authorizeCustomAS","name":"/authorize","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/authorize","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This request authenticates the user and returns tokens along with an authorization grant to the client app as a part of the callback response."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"acr_values","in":"query","schemaId":"schema_1520","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can include an optional parameter in the authentication request. This parameter increases the level of user assurance."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" You can also provide multiple space-delimited values. The authorization server chooses one and reflects the chosen value in any resulting tokens."},"children":[]}]}]}]}]},{"name":"client_id","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Obtained during either manual client registration or through the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/client"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Dynamic Client Registration API"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". It identifies the client and must match the value preregistered in Okta."},"children":[]}]}]}],"required":true},{"name":"code_challenge","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A challenge for "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PKCE"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The challenge is verified in the access token request."},"children":[]}]}]}]},{"name":"code_challenge_method","in":"query","schemaId":"schema_1521","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Method used to derive the code challenge for "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PKCE"},"children":[]}]}]}]}]},{"name":"display","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"display"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter to be passed to the external identity provider when performing "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/identity-providers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"social login"},"children":[]}]}]}]}]},{"name":"enroll_amr_values","in":"query","schemaId":"schema_1522","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A space-delimited list of values indicating which authenticators to enroll in."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"enroll_amr_values"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is specified, then the value for "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"prompt"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" must be "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"enroll_authenticator"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The parameter value is space-delimited, for example, "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"pwd sms okta_verify"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is a valid request parameter value. You are prompted in the order of the amr values provided."},"children":[]}]}]}]}]},{"name":"idp_scope","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/identity-providers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"social login"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". These scopes are used in addition to the scopes already configured for the identity provider."},"children":[]}]}]}]},{"name":"idp","in":"query","schemaId":"components/schemas/Claim","description":"An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session."},{"name":"interclient_token","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A token used to SSO into the client app"},"children":[]}]}]}]},{"name":"login_hint","in":"query","schemaId":"components/schemas/Claim","description":"A username to pre-populate if prompting for authentication"},{"name":"max_age","in":"query","schemaId":"schema_1523","description":"Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta"},{"name":"nonce","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OIDC Specs"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"name":"prompt","in":"query","schemaId":"schema_1524","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If you don't specify the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"prompt"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter, the standard behavior occurs:"},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, the user is prompted to authenticate."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent."},"children":[]}]}]}]}]},{"name":"redirect_uri","in":"query","schemaId":"components/schemas/Claim","description":"Callback location where the authorization code or tokens should be sent. It must match the value preregistered in Okta during client registration.","required":true},{"name":"response_type","in":"query","schemaId":"schema_1525","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Any combination of "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The combination determines the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"flow"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"required":true},{"name":"response_mode","in":"query","schemaId":"schema_1526","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"How the authorization response should be returned. If "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is specified in the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", then "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"query"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" isn't allowed as a response mode. Defaults to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"fragment"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in implicit and hybrid flows."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Referrer-Policy"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" header is automatically included in the response when either the fragment or query parameter values are used. The header is set to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Referrer-Policy: no-referrer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"name":"request_uri","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Location where the authorization request payload data is referenced in an authorization request to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint. This is returned from a Pushed Authorization Request at the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/par"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint."},"children":[]}]}]}]},{"name":"request","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A JWT created by the client that enables requests to be passed as a single, self-contained parameter."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can't encrypt the JWT."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/build-self-signed-jwt/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Build a JWT for client authentication"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for information on how to build a JWT."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta supports the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.2"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"HMAC"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.3"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RSA"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.4"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ECDSA"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" signature algorithms. HMAC signatures require that the client have a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token_endpoint_auth_method"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that uses a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". RSA and ECDSA signatures require that the client registers a public key."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta recommends that you don't duplicate any request parameters in the JWT and the query URI. However, you can do so with "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"nonce"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code_challenge"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code_challenge_method"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". In those cases, the values in the JWT overrides the query URI values."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta validates the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"request"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter in the following ways:"},"children":[]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":true,"marker":"."},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iss"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is required and must be the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"aud"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JWT lifetime is evaluated using the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iat"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"exp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claims, if present. If the JWT is expired or not yet valid, Okta returns an "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"invalid_request_object"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" error. Okta rejects JWTs that expire more than one hour in the future."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta rejects the JWT if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"jti"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claim is present and it has already been processed."},"children":[]}]}]}]}]}]}]},{"name":"scope","in":"query","schemaId":"components/schemas/Claim","description":"A space-delimited string of scopes requested","required":true},{"name":"sessionToken","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta one-time session token. This is an Okta extension to the OpenID specification. The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"sessionToken"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" allows an API-based user sign-in flow."},"children":[]}]}]}]},{"name":"state","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A value that is returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta requires the OAuth 2.0 "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter on all requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint to prevent cross-site request forgery (CSRF)."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The OAuth 2.0 specification "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc6749#section-10.12"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"requires"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that clients protect their redirect URIs against CSRF by sending a value in the authorize request that binds the request to the user-agent's authenticated state."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Using the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is also a countermeasure to several other known attacks as outlined in "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc6819"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OAuth 2.0 Threat Model and Security Considerations"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"required":true},{"name":"resource","in":"query","schemaId":"schema_1527","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An absolute URI that identifies the target resource server that requests the access token."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The issued access token's "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"aud"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claim is set to this value. Repeat the parameter to request a token that's valid for multiple resource servers ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"?resource=https://api.example.com&resource=https://other.example.com"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", for example)."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://www.rfc-editor.org/info/rfc8707/#name-resource-parameter"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Resource Parameter"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Multiple audiences for custom authorization servers is a "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/docs/concepts/feature-lifecycle-management/#self-service-features"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"self-service Early Access (EA)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" feature. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Manage Early Access and Beta features"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to enable the feature."},"children":[]}]}]}]}]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/{authorizationServerId}/v1/authorize","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[{"name":"acr_values","in":"query","schemaId":"components/schemas/AcrValue"},{"name":"client_id","in":"query","required":true,"schemaId":"components/schemas/Claim"},{"name":"code_challenge","in":"query","schemaId":"components/schemas/Claim"},{"name":"code_challenge_method","in":"query","schemaId":"components/schemas/CodeChallengeMethod"},{"name":"display","in":"query","schemaId":"components/schemas/Claim"},{"name":"enroll_amr_values","in":"query","schemaId":"components/schemas/AmrValue"},{"name":"idp_scope","in":"query","schemaId":"components/schemas/Claim"},{"name":"idp","in":"query","schemaId":"components/schemas/Claim"},{"name":"interclient_token","in":"query","schemaId":"components/schemas/Claim"},{"name":"login_hint","in":"query","schemaId":"components/schemas/Claim"},{"name":"max_age","in":"query","schemaId":"schema_1523"},{"name":"nonce","in":"query","schemaId":"components/schemas/Claim"},{"name":"prompt","in":"query","schemaId":"components/schemas/Prompt"},{"name":"redirect_uri","in":"query","required":true,"schemaId":"components/schemas/Claim"},{"name":"response_type","in":"query","required":true,"schemaId":"components/schemas/ResponseTypesSupported"},{"name":"response_mode","in":"query","schemaId":"components/schemas/ResponseMode"},{"name":"request_uri","in":"query","schemaId":"components/schemas/Claim"},{"name":"request","in":"query","schemaId":"components/schemas/Claim"},{"name":"scope","in":"query","required":true,"schemaId":"components/schemas/Claim"},{"name":"sessionToken","in":"query","schemaId":"components/schemas/Claim"},{"name":"state","in":"query","required":true,"schemaId":"components/schemas/Claim"},{"name":"resource","in":"query","schemaId":"schema_1527","style":"form","explode":true}],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["429"],"pointer":"/oauth2/{authorizationServerId}/v1/authorize","href":"customas/authorizecustomas","openApiOperationId":"authorizeCustomAS","summary":"/authorize"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/authorize"},{"label":"/authorize","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/authorizecustomaswithpost","routeSlug":"/openapi/okta-oauth/oauth/customas/authorizecustomaswithpost","metadata":{"seo":{"title":"/authorize","description":"This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This endpoint method behaves the same as GET /oauth2/{authorizationServerId}/v1/authorize, except that all parameters are specified in the request body and submitted through the form post. No query parameters are allowed."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"authorizeCustomASWithPost","name":"/authorize","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/authorize","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This endpoint method behaves the same as "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/customas/authorizecustomas"},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"GET /oauth2/{authorizationServerId}/v1/authorize"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", except that all parameters are specified in the request body and submitted through the form post. No query parameters are allowed."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/AuthorizeWithPostCustomAS"}},"schemaId":"components/schemas/AuthorizeWithPostCustomAS","pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/authorize","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/AuthorizeWithPostCustomAS"}},"responseCodes":["429"],"pointer":"/oauth2/{authorizationServerId}/v1/authorize","href":"customas/authorizecustomaswithpost","openApiOperationId":"authorizeCustomASWithPost","summary":"/authorize"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/AuthorizeWithPostCustomAS","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/AuthorizeWithPostCustomAS"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/authorize"},{"label":"/bc/authorize","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/bcauthorizecustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/bcauthorizecustomas","metadata":{"seo":{"title":"/bc/authorize","description":"This endpoint returns a unique identifier (auth_req_id) that identifies the authentication flow while it tries to authenticate the user in the background. This auth_req_id value is used in subsequent token requests to the /token endpoint."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"bcAuthorizeCustomAS","name":"/bc/authorize","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/bc/authorize","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint returns a unique identifier ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"auth_req_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") that identifies the authentication flow while it tries to authenticate the user in the background. This "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"auth_req_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" value is used in subsequent token requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/bc/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"]}},"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/bc/authorize","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"]}},"responseCodes":["200","400","401","429"],"pointer":"/oauth2/{authorizationServerId}/v1/bc/authorize","href":"customas/bcauthorizecustomas","openApiOperationId":"bcAuthorizeCustomAS","summary":"/bc/authorize"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"]}},"examples":[{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/BackchannelAuthorizeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"]}},"schemaId":"components/schemas/BackchannelAuthorizeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/BackchannelAuthorizeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/BackchannelAuthorizeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/bc/authorize"},{"label":"/challenge","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/challenge-custom-as","routeSlug":"/openapi/okta-oauth/oauth/customas/challenge-custom-as","metadata":{"seo":{"title":"/challenge","description":"Initiates the challenge of subsequent factor(s) in a direct authentication flow after the token endpoint has responded with mfa_required. This endpoint is optional if the client is able to proceed without it, for example, the client knows it needs to follow up with an OTP and can prompt the end user for one."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"challenge-custom-as","name":"/challenge","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/challenge","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Initiates the challenge of subsequent factor(s) in a direct authentication flow after the token endpoint has responded with "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"mfa_required"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". This endpoint is optional if the client is able to proceed without it, for example, the client knows it needs to follow up with an OTP and can prompt the end user for one."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/challenge"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"]}},"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/challenge","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"]}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/{authorizationServerId}/v1/challenge","href":"customas/challenge-custom-as","openApiOperationId":"challenge-custom-as","summary":"/challenge"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"]}},"examples":[{},{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"The next factor type to challenge is returned and in the case of out-of-band factors, any information needed for the out-of-band transaction.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChallengeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"]}},"schemaId":"components/schemas/ChallengeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChallengeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChallengeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"]}}},{"code":"429","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/challenge"},{"label":"/device/authorize","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/deviceauthorizecustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/deviceauthorizecustomas","metadata":{"seo":{"title":"/device/authorize","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"deviceAuthorizeCustomAS","name":"/device/authorize","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/device/authorize","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returns a user code, device code, activation link, and QR code activation link"},"children":[]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/DeviceAuthorizeRequestCustomAS"}},"schemaId":"components/schemas/DeviceAuthorizeRequestCustomAS","pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/device/authorize","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/DeviceAuthorizeRequestCustomAS"}},"responseCodes":["200","400","401","429"],"pointer":"/oauth2/{authorizationServerId}/v1/device/authorize","href":"customas/deviceauthorizecustomas","openApiOperationId":"deviceAuthorizeCustomAS","summary":"/device/authorize"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/DeviceAuthorizeRequestCustomAS","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/DeviceAuthorizeRequestCustomAS"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Based on the type of token and whether it's active, the returned JSON contains a different set of information.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceAuthorizeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"]}},"schemaId":"components/schemas/DeviceAuthorizeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/DeviceAuthorizeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceAuthorizeResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/device/authorize"},{"label":"/introspect","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/introspectcustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/introspectcustomas","metadata":{"seo":{"title":"/introspect","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"introspectCustomAS","name":"/introspect","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/introspect","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint takes an access token, ID token, refresh token, or device secret and returns a boolean that indicates whether it's active. If the token is active, additional data about the token is also returned. If the token is invalid, expired, or revoked, it's considered inactive."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Ensure that you are using the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/introspect"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint of the same authorization server that you used to create the token."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/introspect"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". For public clients (such as single-page and mobile apps) that don't have a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", you must include the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" as a query parameter when calling the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/introspect"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint. Make sure that you aren't passing the Authorization header in the request."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/IntrospectionRequest"}},"schemaId":"components/schemas/IntrospectionRequest","pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/introspect","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/IntrospectionRequest"}},"responseCodes":["200","400","401","429"],"pointer":"/oauth2/{authorizationServerId}/v1/introspect","href":"customas/introspectcustomas","openApiOperationId":"introspectCustomAS","summary":"/introspect"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/IntrospectionRequest","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/IntrospectionRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Based on the type of token and whether it's active, the returned JSON contains a different set of information.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/IntrospectionResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"]}},"schemaId":"components/schemas/IntrospectionResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/IntrospectionResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/IntrospectionResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/introspect"},{"label":"/keys","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/oauthkeyscustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/oauthkeyscustomas","metadata":{"seo":{"title":"/keys","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"oauthKeysCustomAS","name":"/keys","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/keys","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Looking for how to obtain the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"jwks_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for your custom authorization server? See the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/customas/getwellknownopenidconfigurationcustomas"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"well-known OpenID Connect metadata endpoint"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/customas/getwellknownoauthconfigurationcustomas"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"well-known OAuth 2.0 metadata endpoint"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc7515"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JWS"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" signature validation."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The information returned from this endpoint could lag slightly, but eventually updates."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/{authorizationServerId}/v1/keys","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","429"],"pointer":"/oauth2/{authorizationServerId}/v1/keys","href":"customas/oauthkeyscustomas","openApiOperationId":"oauthKeysCustomAS","summary":"/keys"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthKeys","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/200/content/application~1json/examples/User information"]}},"schemaId":"components/schemas/OAuthKeys","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/200/content/application~1json/examples/User information"],"headers":{"Cache-Control":{"schema":{"type":"string"},"example":"max-age=3832304, must-revalidate"}},"headerSchemaId":"schema_1528"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/OAuthKeys","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/200/content/application~1json/examples/User information"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthKeys","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/200/content/application~1json/examples/User information"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/keys"},{"label":"/logout","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/logoutcustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/logoutcustomas","metadata":{"seo":{"title":"/logout","description":"Use this operation to sign a user out by removing their Okta browser session."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"logoutCustomAS","name":"/logout","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/logout","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use this operation to sign a user out by removing their Okta browser session."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to redirect the browser after the sign-out action is performed. Otherwise, the browser is redirected to the Okta sign-in page. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/sign-users-out/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Sign users out"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" (if specified)."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the ID token passed with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token_hint"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is invalid, the browser is redirected to an error page."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/logout"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. We may load an interstitial to do client-side logic before finally redirecting to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or sign-in page if no redirect is provided."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"id_token_hint","in":"query","schemaId":"components/schemas/Claim","description":"A valid ID token with a subject that matches the current session","required":true},{"name":"post_logout_redirect_uri","in":"query","schemaId":"components/schemas/Claim","description":"Location to redirect to after the logout is performed. It must match the value preregistered in Okta during client registration."},{"name":"state","in":"query","schemaId":"components/schemas/Claim","description":"An optional value that's returned as a query parameter during the redirect at the end of the flow"}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/{authorizationServerId}/v1/logout","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[{"name":"id_token_hint","in":"query","required":true,"schemaId":"components/schemas/Claim"},{"name":"post_logout_redirect_uri","in":"query","schemaId":"components/schemas/Claim"},{"name":"state","in":"query","schemaId":"components/schemas/Claim"}],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","429"],"pointer":"/oauth2/{authorizationServerId}/v1/logout","href":"customas/logoutcustomas","openApiOperationId":"logoutCustomAS","summary":"/logout"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Successful Logout"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/logout"},{"label":"/logout","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/logoutcustomaswithpost","routeSlug":"/openapi/okta-oauth/oauth/customas/logoutcustomaswithpost","metadata":{"seo":{"title":"/logout","description":"Use this operation to sign a user out by removing their Okta browser session. This is the recommended method over GET as you can wrap the parameters in the request body."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"logoutCustomASWithPost","name":"/logout","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/logout","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use this operation to sign a user out by removing their Okta browser session. This is the recommended method over GET as you can wrap the parameters in the request body."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to redirect the browser after the user is signs out. Otherwise, the browser is redirected to the Okta sign-in page. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/sign-users-out/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Sign users out"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" (if specified)."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the ID token passed with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token_hint"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is invalid, the browser is redirected to an error page."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" When making requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/logout"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint, the browser (user agent) should be redirected to the endpoint. You need to make a POST request from a form. A POST request to this endpoint from the backend doesn't completely terminate the session."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request custom authorization server example"]}},"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request custom authorization server example"],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/logout","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request custom authorization server example"]}},"responseCodes":["200","429"],"pointer":"/oauth2/{authorizationServerId}/v1/logout","href":"customas/logoutcustomaswithpost","openApiOperationId":"logoutCustomASWithPost","summary":"/logout"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request custom authorization server example"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request custom authorization server example"]}},"examples":[{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Successful Logout"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/logout"},{"label":"/par","deprecated":false,"httpVerb":"options","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/paroptionscustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/paroptionscustomas","metadata":{"seo":{"title":"/par","description":"Identity Engine"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"parOptionsCustomAS","name":"/par","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1par/options","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/par","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge oie","style":{"cursor":"pointer","background":"rgb(0, 41, 122)","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"Identity Engine"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use this operation to request the permitted communication options for the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/par"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" operation."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1par/options/parameters"},{"nodeType":"item-content","variant":"headers","label":"Headers","labelTranslationKey":"header","parameters":[{"name":"Origin","in":"header","schemaId":"components/schemas/Claim","description":"Indicates the origin of the client that's initiating the request","example":"example.okta.com"}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1par/options/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"OPTIONS","path":"/oauth2/{authorizationServerId}/v1/par","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[{"name":"Origin","in":"header","example":"example.okta.com","schemaId":"components/schemas/Claim"}],"cookie":[]},"security":[],"responseCodes":["204","429"],"pointer":"/oauth2/{authorizationServerId}/v1/par","href":"customas/paroptionscustomas","openApiOperationId":"parOptionsCustomAS","summary":"/par"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204","description":"Success","headers":{"Access-Control-Allow-Origin":{"schema":{"type":"string"},"example":"example.okta.com"},"Access-Control-Allow-Methods":{"schema":{"type":"string"},"example":"POST"},"Access-Control-Max-Age":{"schema":{"type":"string"},"example":3600},"Vary":{"schema":{"type":"string"},"example":"Origin"}},"headerSchemaId":"schema_1529"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1par/options/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"204"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/par"},{"label":"/par","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/parcustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/parcustomas","metadata":{"seo":{"title":"/par","description":"Identity Engine"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"parCustomAS","name":"/par","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1par/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/par","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge oie","style":{"cursor":"pointer","background":"rgb(0, 41, 122)","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"Identity Engine"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The pushed authorization request endpoint ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/par"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") promotes OAuth security by allowing the authorization server to authenticate the client before any user interaction happens. The increased confidence in the client's identity during the authorization process means the authorization server can refuse illegitimate requests much earlier in the process. This process prevents attempts to spoof clients or otherwise tamper with or misuse an authorization request and provides a simple way to make a confidential and integrity-protected request."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/par"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint allows an OAuth 2.0 client to push the payload of an authorization request directly to the authorization server. The authorization server provides a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"request_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" value in the response that you can use as a reference to the authorization request payload data in a subsequent call to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint through a user agent."},"children":[]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/ParRequest"}},"schemaId":"components/schemas/ParRequest","pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/par","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/json":{"schemaId":"components/schemas/ParRequest"}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/{authorizationServerId}/v1/par","href":"customas/parcustomas","openApiOperationId":"parCustomAS","summary":"/par"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/ParRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/ParRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ParResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"]}},"schemaId":"components/schemas/ParResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`","paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`","paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/ParResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ParResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`","paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`","paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/par"},{"label":"/primary-authenticate","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/primary-authenticate-custom-as","routeSlug":"/openapi/okta-oauth/oauth/customas/primary-authenticate-custom-as","metadata":{"seo":{"title":"/primary-authenticate","description":"Initiates direct authentication with an out-of-band authenticator"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"primary-authenticate-custom-as","name":"/primary-authenticate","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/primary-authenticate","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Initiates direct authentication with an out-of-band authenticator"},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/primary-authenticate"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/primary-authenticate","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/{authorizationServerId}/v1/primary-authenticate","href":"customas/primary-authenticate-custom-as","openApiOperationId":"primary-authenticate-custom-as","summary":"/primary-authenticate"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"examples":[{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Out-of-band authentication has successfully been initiated.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]}},"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]}}},{"code":"429","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/primary-authenticate"},{"label":"/revoke","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/revokecustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/revokecustomas","metadata":{"seo":{"title":"/revoke","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"revokeCustomAS","name":"/revoke","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/revoke","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The API takes an access or refresh token and revokes it. Revoked tokens are considered inactive at the introspection endpoint. A client may only revoke its own tokens. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/revoke-tokens/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Revoke tokens"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/revoke"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/RevokeRequestCustomAs"}},"schemaId":"components/schemas/RevokeRequestCustomAs","pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/revoke","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/RevokeRequestCustomAs"}},"responseCodes":["200","400","401","429"],"pointer":"/oauth2/{authorizationServerId}/v1/revoke","href":"customas/revokecustomas","openApiOperationId":"revokeCustomAS","summary":"/revoke"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/RevokeRequestCustomAs","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/RevokeRequestCustomAs"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Successful Revocation. Note that revoking an invalid, expired, or revoked token is still considered a success so information isn't leaked."},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200"},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/revoke"},{"label":"/token","deprecated":false,"httpVerb":"options","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/tokenoptionscustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/tokenoptionscustomas","metadata":{"seo":{"title":"/token","description":"Use this operation to request the permitted communication options for the /token endpoint."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"tokenOptionsCustomAS","name":"/token","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1token/options","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/token","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use this operation to request the permitted communication options for the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1token/options/parameters"},{"nodeType":"item-content","variant":"headers","label":"Headers","labelTranslationKey":"header","parameters":[{"name":"Origin","in":"header","schemaId":"components/schemas/Claim","description":"Indicates the origin of the client that's initiating the request","example":"example.okta.com"}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1token/options/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"OPTIONS","path":"/oauth2/{authorizationServerId}/v1/token","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[{"name":"Origin","in":"header","example":"example.okta.com","schemaId":"components/schemas/Claim"}],"cookie":[]},"security":[],"responseCodes":["204","429"],"pointer":"/oauth2/{authorizationServerId}/v1/token","href":"customas/tokenoptionscustomas","openApiOperationId":"tokenOptionsCustomAS","summary":"/token"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204","description":"Success","headers":{"Access-Control-Allow-Origin":{"schema":{"type":"string"},"example":"example.okta.com"},"Access-Control-Allow-Methods":{"schema":{"type":"string"},"example":"POST"},"Access-Control-Max-Age":{"schema":{"type":"string"},"example":3600},"Vary":{"schema":{"type":"string"},"example":"Origin"}},"headerSchemaId":"schema_1529"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1token/options/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"204"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/token"},{"label":"/token","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/tokencustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/tokencustomas","metadata":{"seo":{"title":"/token","description":"This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For password, client credentials, SAML 2.0 assertion, and refresh token flows, calling /token is the only step of the flow. For the authorization code flow, calling /token is the second step of the flow."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"tokenCustomAS","name":"/token","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1token/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/token","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/ropassword/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"password"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"client credentials"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/saml2assert/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SAML 2.0 assertion"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/refresh-tokens/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"refresh token"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" flows, calling "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is the only step of the flow. For the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"authorization code"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" flow, calling "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is the second step of the flow."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/TokenRequestCustomAs","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/JWT Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)"]}},"schemaId":"components/schemas/TokenRequestCustomAs","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/JWT Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)"],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/token","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/TokenRequestCustomAs","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/JWT Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)"]}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/{authorizationServerId}/v1/token","href":"customas/tokencustomas","openApiOperationId":"tokenCustomAS","summary":"/token"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/TokenRequestCustomAs","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/JWT Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/TokenRequestCustomAs","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/JWT Bearer","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)"]}},"examples":[{},{},{},{},{},{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Based on the scopes requested. The scopes specified in a request are included in the access token in the response.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/TokenResponseCustomAs","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/200/content/application~1json/examples/Token response"]}},"schemaId":"components/schemas/TokenResponseCustomAs","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/200/content/application~1json/examples/Token response"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/TokenResponseCustomAs","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/200/content/application~1json/examples/Token response"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/TokenResponseCustomAs","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/200/content/application~1json/examples/Token response"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type","paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/token"},{"label":"/userinfo","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/userinfocustomas","routeSlug":"/openapi/okta-oauth/oauth/customas/userinfocustomas","metadata":{"seo":{"title":"/userinfo","description":"CORSOAuth 2.0 scope:openid"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"userinfoCustomAS","name":"/userinfo","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/userinfo","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"display":"flex","alignItems":"flex-start","gap":"8px","marginTop":"12px"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"a","attrs":{"href":"https://developer.okta.com/docs/api/oauth2/","style":{"padding":"4px 0px","flex":"0 0 135px","fontSize":"16px","fontWeight":"600","color":"#1d1d21","textDecoration":"none","marginBottom":"8px"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"OAuth 2.0 scope:"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"ul","attrs":{"style":{"padding":"0","margin":"0","listStyle":"none","display":"flex","flexWrap":"wrap","flex":"1"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"li","attrs":{"style":{"display":"inline-flex","alignItems":"center","backgroundColor":"#ededed","color":"#4b4b4b","padding":"4px 12px","borderRadius":"16px","fontSize":"14px","marginRight":"8px","marginBottom":"8px","lineHeight":"20px","border":"1px solid transparent"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"openid"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returns information about the user that's the subject of the access token. Many of these claims are also included in the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/reference/api/oidc/#id-token"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ID token"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", but calling this endpoint always returns all of the user's claims. You can configure the ID token to include a subset of the user's claims. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Scope-dependent claims"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/{authorizationServerId}/v1/userinfo","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","401","403","429"],"pointer":"/oauth2/{authorizationServerId}/v1/userinfo","href":"customas/userinfocustomas","openApiOperationId":"userinfoCustomAS","summary":"/userinfo"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UserInfo","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"]}},"schemaId":"components/schemas/UserInfo","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"]},{"code":"401","description":"Unauthorized","headers":{"WWW-Authenticate":{"schema":{"type":"string"},"example":"Bearer error=\"invalid_token\", error_description=\"The access token is invalid\""}},"headerSchemaId":"schema_1530"},{"code":"403","description":"Forbidden","headers":{"WWW-Authenticate":{"schema":{"type":"string"},"example":"Bearer error=\"insufficient_scope\", error_description=\"The access token must provide access to at least one of these scopes - profile, email, address or phone\""}},"headerSchemaId":"schema_1531"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/UserInfo","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UserInfo","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"]}}},{"code":"401"},{"code":"403"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/userinfo"},{"label":"/oob-authenticate","deprecated":true,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/customas/oob-authenticate-custom-as","routeSlug":"/openapi/okta-oauth/oauth/customas/oob-authenticate-custom-as","metadata":{"seo":{"title":"/oob-authenticate","description":"Initiates direct authentication with an out-of-band authenticator"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"oob-authenticate-custom-as","name":"/oob-authenticate","deprecated":true,"isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/oob-authenticate","isWebhook":false,"deprecated":true,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Initiates direct authentication with an out-of-band authenticator"},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/oob-authenticate"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" This endpoint is deprecated. Use "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/orgas/primary-authenticate"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"/primary-authenticate"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" instead."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/{authorizationServerId}/v1/oob-authenticate","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/{authorizationServerId}/v1/oob-authenticate","href":"customas/oob-authenticate-custom-as","openApiOperationId":"oob-authenticate-custom-as","summary":"/oob-authenticate"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"examples":[{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Out-of-band authentication has successfully been initiated.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]}},"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]}}},{"code":"429","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/oob-authenticate"}],"content":{"contentType":"group","meta":{"name":"CustomAS"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Custom Authorization Servers","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use a custom authorization server to create and apply authorization policies to secure your APIs. An access token that's minted by a custom authorization server is consumed by your APIs."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Okta has two types of authorization servers: the org authorization server and the custom authorization server. To learn more about each type of authorization server and when to use them, see "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/auth-servers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Authorization servers"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/customize-authz-server/main/#create-an-authorization-server"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"create multiple custom authorization servers"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" within a single Okta org that you can use to protect your own resource servers. Within each authorization server, define your own custom OAuth 2.0 scopes, claims, and access policies to support authorization for your APIs."},"children":[]}]}]}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/.well-known/oauth-authorization-server/oauth2/{authorizationServerId}","summary":"Retrieve the OAuth 2.0 metadata","prefix":{"name":"get","color":"get"},"badges":[],"link":"/customas/getwellknownoauthconfigurationcustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/.well-known/openid-configuration","summary":"Retrieve the OpenID Connect metadata","prefix":{"name":"get","color":"get"},"badges":[],"link":"/customas/getwellknownopenidconfigurationcustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/authorize","summary":"/authorize","prefix":{"name":"get","color":"get"},"badges":[],"link":"/customas/authorizecustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/authorize","summary":"/authorize","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/authorizecustomaswithpost","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/bc/authorize","summary":"/bc/authorize","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/bcauthorizecustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/challenge","summary":"/challenge","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/challenge-custom-as","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/device/authorize","summary":"/device/authorize","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/deviceauthorizecustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/introspect","summary":"/introspect","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/introspectcustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/keys","summary":"/keys","prefix":{"name":"get","color":"get"},"badges":[],"link":"/customas/oauthkeyscustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/logout","summary":"/logout","prefix":{"name":"get","color":"get"},"badges":[],"link":"/customas/logoutcustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/logout","summary":"/logout","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/logoutcustomaswithpost","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/par","summary":"/par","prefix":{"name":"options","color":"options"},"badges":[],"link":"/customas/paroptionscustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/par","summary":"/par","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/parcustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/primary-authenticate","summary":"/primary-authenticate","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/primary-authenticate-custom-as","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/revoke","summary":"/revoke","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/revokecustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/token","summary":"/token","prefix":{"name":"options","color":"options"},"badges":[],"link":"/customas/tokenoptionscustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/token","summary":"/token","prefix":{"name":"post","color":"post"},"badges":[],"link":"/customas/tokencustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/userinfo","summary":"/userinfo","prefix":{"name":"get","color":"get"},"badges":[],"link":"/customas/userinfocustomas","deprecated":false},{"title":"/oauth2/{authorizationServerId}/v1/oob-authenticate","summary":"/oob-authenticate","prefix":{"name":"post","color":"http-deprecated"},"badges":[],"link":"/customas/oob-authenticate-custom-as","deprecated":true}]}]}]}]}},{"type":"group","label":"Global Token Revocation","link":"/openapi/okta-oauth/oauth/globaltokenrevocation","routeSlug":"/openapi/okta-oauth/oauth/globaltokenrevocation","items":[{"label":"Initiate the global revocation of all tokens and sessions","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/globaltokenrevocation/globaltokenrevocation","routeSlug":"/openapi/okta-oauth/oauth/globaltokenrevocation/globaltokenrevocation","metadata":{"seo":{"title":"Initiate the global revocation of all tokens and sessions","description":"OAuth 2.0 scope:okta.universalLogout.manage"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"globalTokenRevocation","name":"Initiate the global revocation of all tokens and sessions","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1global-token-revocation/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Initiate the global revocation of all tokens and sessions","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"display":"flex","alignItems":"flex-start","gap":"8px","marginTop":"12px"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"a","attrs":{"href":"https://developer.okta.com/docs/api/oauth2/","style":{"padding":"4px 0px","flex":"0 0 135px","fontSize":"16px","fontWeight":"600","color":"#1d1d21","textDecoration":"none","marginBottom":"8px"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"OAuth 2.0 scope:"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"ul","attrs":{"style":{"padding":"0","margin":"0","listStyle":"none","display":"flex","flexWrap":"wrap","flex":"1"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"li","attrs":{"style":{"display":"inline-flex","alignItems":"center","backgroundColor":"#ededed","color":"#4b4b4b","padding":"4px 12px","borderRadius":"16px","fontSize":"14px","marginRight":"8px","marginBottom":"8px","lineHeight":"20px","border":"1px solid transparent"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"okta.universalLogout.manage"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Initiates the global revocation of all tokens and sessions for a specified user enabling external identity providers to trigger a comprehensive sign-out process. This includes executing IdP-initiated sign-out flows across all apps that are using global token revocation and requiring users to re-authenticate to access protected resources."},"children":[]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/GlobalTokenRevocationRequest","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with opaque format","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (SAML)","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (OIDC)"]}},"schemaId":"components/schemas/GlobalTokenRevocationRequest","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with opaque format","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (SAML)","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (OIDC)"],"pointer":"/paths/~1oauth2~1v1~1global-token-revocation/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/global-token-revocation","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/json":{"schemaId":"components/schemas/GlobalTokenRevocationRequest","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with opaque format","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (SAML)","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (OIDC)"]}},"responseCodes":["204","400","403","429"],"pointer":"/oauth2/v1/global-token-revocation","href":"globaltokenrevocation/globaltokenrevocation","openApiOperationId":"globalTokenRevocation","summary":"Initiate the global revocation of all tokens and sessions"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/GlobalTokenRevocationRequest","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with opaque format","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (SAML)","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (OIDC)"],"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/GlobalTokenRevocationRequest","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with opaque format","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (SAML)","paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (OIDC)"]}},"examples":[{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204","description":"No Content"},{"code":"400","description":"Bad Request"},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/responses/403/content/application~1json/examples/Access denied"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/responses/403/content/application~1json/examples/Access denied"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1global-token-revocation/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"204"},{"code":"400"},{"code":"403","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/responses/403/content/application~1json/examples/Access denied"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/responses/403/content/application~1json/examples/Access denied"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1global-token-revocation/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/global-token-revocation"}],"content":{"contentType":"group","meta":{"name":"GlobalTokenRevocation"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Global Token Revocation","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The Global Token Revocation API provides a comprehensive solution for managing security across multiple apps and services. This API extends beyond the standard OAuth 2.0 token revocation, enabling the revocation of SSWS tokens and facilitating identity provider (IdP)-initiated sign-out processes."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"When you use the API, you revoke all tokens and sessions for a specified user by sending the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"sub_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in the request body. Use the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"opaque"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" format for Okta user IDs."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"For users authenticated through a SAML or OIDC IdP, use the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iss_sub"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" format to identify the user by issuer ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iss"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") and subject ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"sub"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"). See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Manage Early Access and Beta features"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to enable the feature: Third-Party IdP Global Token Revocation."},"children":[]}]}]}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/oauth2/v1/global-token-revocation","summary":"Initiate the global revocation of all tokens and sessions","prefix":{"name":"post","color":"post"},"badges":[],"link":"/globaltokenrevocation/globaltokenrevocation","deprecated":false}]}]}]}]}},{"type":"group","label":"Org Authorization Server","link":"/openapi/okta-oauth/oauth/orgas","routeSlug":"/openapi/okta-oauth/oauth/orgas","items":[{"label":"Retrieve the OpenID Connect metadata","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/getwellknownopenidconfiguration","routeSlug":"/openapi/okta-oauth/oauth/orgas/getwellknownopenidconfiguration","metadata":{"seo":{"title":"Retrieve the OpenID Connect metadata","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"getWellKnownOpenIDConfiguration","name":"Retrieve the OpenID Connect metadata","isWebhook":false,"pointer":"/paths/~1.well-known~1openid-configuration/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Retrieve the OpenID Connect metadata","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returns OpenID Connect metadata for the Okta org authorization server. Clients use this information to programmatically configure their interactions with Okta."},"children":[]}]}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"client_id","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can configure clients to format the issuer differently. Pass in the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to ensure that the returned issuer format matches."},"children":[]}]}]}]}],"pointer":"/paths/~1.well-known~1openid-configuration/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/.well-known/openid-configuration","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[{"name":"client_id","in":"query","schemaId":"components/schemas/Claim"}],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","400"],"pointer":"/.well-known/openid-configuration","href":"orgas/getwellknownopenidconfiguration","openApiOperationId":"getWellKnownOpenIDConfiguration","summary":"Retrieve the OpenID Connect metadata"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OidcMetadata","exampleIds":["paths/~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"]}},"schemaId":"components/schemas/OidcMetadata","exampleIds":["paths/~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"]},{"code":"400","description":"Invalid Client ID","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"]}],"pointer":"/paths/~1.well-known~1openid-configuration/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/OidcMetadata","exampleIds":["paths/~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OidcMetadata","exampleIds":["paths/~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"]}}},{"code":"400","schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"]}}}],"examples":[]}]}]}]},"httpPath":"/.well-known/openid-configuration"},{"label":"/authorize","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/authorize","routeSlug":"/openapi/okta-oauth/oauth/orgas/authorize","metadata":{"seo":{"title":"/authorize","description":"This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This request authenticates the user and returns tokens along with an authorization grant to the client app as a part of the callback response."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"authorize","name":"/authorize","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1authorize/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/authorize","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This request authenticates the user and returns tokens along with an authorization grant to the client app as a part of the callback response."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"acr_values","in":"query","schemaId":"schema_1520","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can include an optional parameter in the authentication request. This parameter increases the level of user assurance."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" You can also provide multiple space-delimited values. The authorization server chooses one and reflects the chosen value in any resulting tokens."},"children":[]}]}]}]}]},{"name":"client_id","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Obtained during either manual client registration or through the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/client"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Dynamic Client Registration API"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". It identifies the client and must match the value preregistered in Okta."},"children":[]}]}]}],"required":true},{"name":"code_challenge","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A challenge for "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PKCE"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The challenge is verified in the access token request."},"children":[]}]}]}]},{"name":"code_challenge_method","in":"query","schemaId":"schema_1521","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Method used to derive the code challenge for "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PKCE"},"children":[]}]}]}]}]},{"name":"display","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"display"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter to be passed to the external identity provider when performing "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/identity-providers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"social login"},"children":[]}]}]}]}]},{"name":"enroll_amr_values","in":"query","schemaId":"schema_1522","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A space-delimited list of values indicating which authenticators to enroll in."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"enroll_amr_values"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is specified, then the value for "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"prompt"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" must be "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"enroll_authenticator"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The parameter value is space-delimited, for example, "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"pwd sms okta_verify"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is a valid request parameter value. You are prompted in the order of the amr values provided."},"children":[]}]}]}]}]},{"name":"idp_scope","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/identity-providers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"social login"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". These scopes are used in addition to the scopes already configured for the identity provider."},"children":[]}]}]}]},{"name":"idp","in":"query","schemaId":"components/schemas/Claim","description":"An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session."},{"name":"interclient_token","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A token used to SSO into the client app"},"children":[]}]}]}]},{"name":"login_hint","in":"query","schemaId":"components/schemas/Claim","description":"A username to pre-populate if prompting for authentication"},{"name":"max_age","in":"query","schemaId":"schema_1523","description":"Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta"},{"name":"nonce","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OIDC Specs"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"name":"prompt","in":"query","schemaId":"schema_1524","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If you don't specify the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"prompt"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter, the standard behavior occurs:"},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, the user is prompted to authenticate."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent."},"children":[]}]}]}]}]},{"name":"redirect_uri","in":"query","schemaId":"components/schemas/Claim","description":"Callback location where the authorization code or tokens should be sent. It must match the value preregistered in Okta during client registration.","required":true},{"name":"response_type","in":"query","schemaId":"schema_1525","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Any combination of "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The combination determines the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"flow"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"required":true},{"name":"response_mode","in":"query","schemaId":"schema_1526","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"How the authorization response should be returned. If "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is specified in the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", then "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"query"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" isn't allowed as a response mode. Defaults to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"fragment"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in implicit and hybrid flows."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Referrer-Policy"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" header is automatically included in the response when either the fragment or query parameter values are used. The header is set to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Referrer-Policy: no-referrer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"name":"request_uri","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Location where the authorization request payload data is referenced in an authorization request to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint. This is returned from a Pushed Authorization Request at the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/par"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint."},"children":[]}]}]}]},{"name":"request","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A JWT created by the client that enables requests to be passed as a single, self-contained parameter."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can't encrypt the JWT."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/build-self-signed-jwt/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Build a JWT for client authentication"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for information on how to build a JWT."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta supports the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.2"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"HMAC"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.3"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RSA"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.4"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ECDSA"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" signature algorithms. HMAC signatures require that the client have a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token_endpoint_auth_method"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that uses a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". RSA and ECDSA signatures require that the client registers a public key."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta recommends that you don't duplicate any request parameters in the JWT and the query URI. However, you can do so with "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"nonce"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code_challenge"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code_challenge_method"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". In those cases, the values in the JWT overrides the query URI values."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta validates the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"request"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter in the following ways:"},"children":[]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":true,"marker":"."},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iss"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is required and must be the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"aud"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JWT lifetime is evaluated using the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iat"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"exp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claims, if present. If the JWT is expired or not yet valid, Okta returns an "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"invalid_request_object"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" error. Okta rejects JWTs that expire more than one hour in the future."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta rejects the JWT if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"jti"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claim is present and it has already been processed."},"children":[]}]}]}]}]}]}]},{"name":"scope","in":"query","schemaId":"components/schemas/Claim","description":"A space-delimited string of scopes requested","required":true},{"name":"sessionToken","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta one-time session token. This is an Okta extension to the OpenID specification. The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"sessionToken"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" allows an API-based user sign-in flow."},"children":[]}]}]}]},{"name":"state","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A value that is returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta requires the OAuth 2.0 "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter on all requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint to prevent cross-site request forgery (CSRF)."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The OAuth 2.0 specification "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc6749#section-10.12"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"requires"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that clients protect their redirect URIs against CSRF by sending a value in the authorize request that binds the request to the user-agent's authenticated state."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Using the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is also a countermeasure to several other known attacks as outlined in "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc6819"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OAuth 2.0 Threat Model and Security Considerations"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1v1~1authorize/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/v1/authorize","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[{"name":"acr_values","in":"query","schemaId":"components/schemas/AcrValue"},{"name":"client_id","in":"query","required":true,"schemaId":"components/schemas/Claim"},{"name":"code_challenge","in":"query","schemaId":"components/schemas/Claim"},{"name":"code_challenge_method","in":"query","schemaId":"components/schemas/CodeChallengeMethod"},{"name":"display","in":"query","schemaId":"components/schemas/Claim"},{"name":"enroll_amr_values","in":"query","schemaId":"components/schemas/AmrValue"},{"name":"idp_scope","in":"query","schemaId":"components/schemas/Claim"},{"name":"idp","in":"query","schemaId":"components/schemas/Claim"},{"name":"interclient_token","in":"query","schemaId":"components/schemas/Claim"},{"name":"login_hint","in":"query","schemaId":"components/schemas/Claim"},{"name":"max_age","in":"query","schemaId":"schema_1523"},{"name":"nonce","in":"query","schemaId":"components/schemas/Claim"},{"name":"prompt","in":"query","schemaId":"components/schemas/Prompt"},{"name":"redirect_uri","in":"query","required":true,"schemaId":"components/schemas/Claim"},{"name":"response_type","in":"query","required":true,"schemaId":"components/schemas/ResponseTypesSupported"},{"name":"response_mode","in":"query","schemaId":"components/schemas/ResponseMode"},{"name":"request_uri","in":"query","schemaId":"components/schemas/Claim"},{"name":"request","in":"query","schemaId":"components/schemas/Claim"},{"name":"scope","in":"query","required":true,"schemaId":"components/schemas/Claim"},{"name":"sessionToken","in":"query","schemaId":"components/schemas/Claim"},{"name":"state","in":"query","required":true,"schemaId":"components/schemas/Claim"}],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["429"],"pointer":"/oauth2/v1/authorize","href":"orgas/authorize","openApiOperationId":"authorize","summary":"/authorize"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1authorize/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/authorize"},{"label":"/authorize","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/authorizewithpost","routeSlug":"/openapi/okta-oauth/oauth/orgas/authorizewithpost","metadata":{"seo":{"title":"/authorize","description":"This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This endpoint method behaves the same as GET /oauth2/v1/authorize, except that all parameters are specified in the request body and submitted through the form post. No query parameters are allowed."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"authorizeWithPost","name":"/authorize","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1authorize/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/authorize","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This endpoint method behaves the same as "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/orgas/authorize"},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"GET /oauth2/v1/authorize"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", except that all parameters are specified in the request body and submitted through the form post. No query parameters are allowed."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/AuthorizeWithPost"}},"schemaId":"components/schemas/AuthorizeWithPost","pointer":"/paths/~1oauth2~1v1~1authorize/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/authorize","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/AuthorizeWithPost"}},"responseCodes":["429"],"pointer":"/oauth2/v1/authorize","href":"orgas/authorizewithpost","openApiOperationId":"authorizeWithPost","summary":"/authorize"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/AuthorizeWithPost","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/AuthorizeWithPost"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1authorize/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/authorize"},{"label":"/bc/authorize","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/bcauthorize","routeSlug":"/openapi/okta-oauth/oauth/orgas/bcauthorize","metadata":{"seo":{"title":"/bc/authorize","description":"This endpoint returns a unique identifier (auth_req_id) that identifies the authentication flow while it tries to authenticate the user in the background. This auth_req_id value is used in subsequent token requests to the /token endpoint."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"bcAuthorize","name":"/bc/authorize","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1bc~1authorize/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/bc/authorize","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint returns a unique identifier ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"auth_req_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") that identifies the authentication flow while it tries to authenticate the user in the background. This "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"auth_req_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" value is used in subsequent token requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/bc/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"]}},"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"],"pointer":"/paths/~1oauth2~1v1~1bc~1authorize/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/bc/authorize","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"]}},"responseCodes":["200","400","401","429"],"pointer":"/oauth2/v1/bc/authorize","href":"orgas/bcauthorize","openApiOperationId":"bcAuthorize","summary":"/bc/authorize"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/BackchannelAuthorizeRequest","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`","paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"]}},"examples":[{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/BackchannelAuthorizeResponse","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"]}},"schemaId":"components/schemas/BackchannelAuthorizeResponse","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1bc~1authorize/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/BackchannelAuthorizeResponse","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/BackchannelAuthorizeResponse","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/bc/authorize"},{"label":"/challenge","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/challenge","routeSlug":"/openapi/okta-oauth/oauth/orgas/challenge","metadata":{"seo":{"title":"/challenge","description":"Initiates the challenge of subsequent factor(s) in a direct authentication flow after the token endpoint has responded with mfa_required. This endpoint is optional if the client is able to proceed without it, for example, when the client knows it needs to follow up with an OTP and can prompt the end user for one."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"challenge","name":"/challenge","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1challenge/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/challenge","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Initiates the challenge of subsequent factor(s) in a direct authentication flow after the token endpoint has responded with "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"mfa_required"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". This endpoint is optional if the client is able to proceed without it, for example, when the client knows it needs to follow up with an OTP and can prompt the end user for one."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/challenge"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"]}},"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"],"pointer":"/paths/~1oauth2~1v1~1challenge/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/challenge","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"]}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/v1/challenge","href":"orgas/challenge","openApiOperationId":"challenge","summary":"/challenge"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/ChallengeRequest","exampleIds":["paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice","paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"]}},"examples":[{},{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"The next factor type to challenge is returned and in the case of out-of-band factors, any information needed for the out-of-band transaction.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChallengeResponse","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"]}},"schemaId":"components/schemas/ChallengeResponse","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"]}],"pointer":"/paths/~1oauth2~1v1~1challenge/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChallengeResponse","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChallengeResponse","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS","paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token","paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"]}}},{"code":"429","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/challenge"},{"label":"/device/authorize","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/deviceauthorize","routeSlug":"/openapi/okta-oauth/oauth/orgas/deviceauthorize","metadata":{"seo":{"title":"/device/authorize","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"deviceAuthorize","name":"/device/authorize","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1device~1authorize/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/device/authorize","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returns a user code, device code, activation link, and QR code activation link"},"children":[]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/DeviceAuthorizeRequest"}},"schemaId":"components/schemas/DeviceAuthorizeRequest","pointer":"/paths/~1oauth2~1v1~1device~1authorize/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/device/authorize","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/DeviceAuthorizeRequest"}},"responseCodes":["200","400","401","429"],"pointer":"/oauth2/v1/device/authorize","href":"orgas/deviceauthorize","openApiOperationId":"deviceAuthorize","summary":"/device/authorize"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/DeviceAuthorizeRequest","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/DeviceAuthorizeRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Based on the type of token and whether it's active, the returned JSON contains a different set of information.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceAuthorizeResponse","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"]}},"schemaId":"components/schemas/DeviceAuthorizeResponse","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1device~1authorize/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/DeviceAuthorizeResponse","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceAuthorizeResponse","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/device/authorize"},{"label":"/introspect","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/introspect","routeSlug":"/openapi/okta-oauth/oauth/orgas/introspect","metadata":{"seo":{"title":"/introspect","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"introspect","name":"/introspect","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1introspect/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/introspect","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint takes an access token, ID token, refresh token, or device secret and returns a boolean that indicates whether it's active. If the token is active, additional data about the token is also returned. If the token is invalid, expired, or revoked, it's considered inactive."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Be sure that you are using the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/introspect"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint of the same authorization server that you used to create the token."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/introspect"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". For public clients (such as single-page and mobile apps) that don't have a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", include the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" as a query parameter when calling the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/introspect"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint. Make sure that you aren't passing the Authorization header in the request."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/IntrospectionRequest"}},"schemaId":"components/schemas/IntrospectionRequest","pointer":"/paths/~1oauth2~1v1~1introspect/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/introspect","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/IntrospectionRequest"}},"responseCodes":["200","400","401","429"],"pointer":"/oauth2/v1/introspect","href":"orgas/introspect","openApiOperationId":"introspect","summary":"/introspect"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/IntrospectionRequest","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/IntrospectionRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Based on the type of token and whether it's active, the returned JSON contains a different set of information.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/IntrospectionResponse","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token","paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token","paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"]}},"schemaId":"components/schemas/IntrospectionResponse","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token","paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token","paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1introspect/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/IntrospectionResponse","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token","paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token","paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/IntrospectionResponse","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token","paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token","paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/introspect"},{"label":"/keys","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/oauthkeys","routeSlug":"/openapi/okta-oauth/oauth/orgas/oauthkeys","metadata":{"seo":{"title":"/keys","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"oauthKeys","name":"/keys","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1keys/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/keys","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Looking for how to obtain the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"jwks_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for your org authorization server? See the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/customas/getwellknownopenidconfigurationcustomas"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"well-known OpenID Connect metadata endpoint"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc7515"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JWS"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" signature validation."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The information returned from this endpoint could lag slightly, but eventually updates."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Okta returns "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"standard HTTP Cache-Control headers"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for applicable JWKS endpoints. Ensure that you respect the cache header directives, as they are updated based on the time of the request."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"For more information on key rotation and best practices, see "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/overview/#json-web-key-set"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JSON Web Key Set"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"client_id","in":"query","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of a client app. Providing this optional parameter includes any public keys associated with the signing keys of the app."},"children":[]}]}]}]}],"pointer":"/paths/~1oauth2~1v1~1keys/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/v1/keys","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[{"name":"client_id","in":"query","schemaId":"components/schemas/Claim"}],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","429"],"pointer":"/oauth2/v1/keys","href":"orgas/oauthkeys","openApiOperationId":"oauthKeys","summary":"/keys"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthKeys","exampleIds":["paths/~1oauth2~1v1~1keys/get/responses/200/content/application~1json/examples/User information"]}},"schemaId":"components/schemas/OAuthKeys","exampleIds":["paths/~1oauth2~1v1~1keys/get/responses/200/content/application~1json/examples/User information"],"headers":{"Cache-Control":{"schema":{"type":"string"},"example":"max-age=3832304, must-revalidate"}},"headerSchemaId":"schema_1528"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1keys/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/OAuthKeys","exampleIds":["paths/~1oauth2~1v1~1keys/get/responses/200/content/application~1json/examples/User information"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthKeys","exampleIds":["paths/~1oauth2~1v1~1keys/get/responses/200/content/application~1json/examples/User information"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/keys"},{"label":"/logout","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/logout","routeSlug":"/openapi/okta-oauth/oauth/orgas/logout","metadata":{"seo":{"title":"/logout","description":"Use this operation to sign a user out by removing their Okta browser session."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"logout","name":"/logout","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1logout/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/logout","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use this operation to sign a user out by removing their Okta browser session."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to redirect the browser after the sign-out action is performed. Otherwise, the browser is redirected to the Okta sign-in page. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/sign-users-out/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Sign users out"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" (if specified)."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the ID token passed with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token_hint"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is invalid, the browser is redirected to an error page."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" When making requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/logout"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint, the browser (user agent) should be redirected to the endpoint. You can't use AJAX with this endpoint. Okta may load an interstitial to do client-side logic before redirecting to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or sign-in page if no redirect is provided."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"id_token_hint","in":"query","schemaId":"components/schemas/Claim","description":"A valid ID token with a subject that matches the current session","required":true},{"name":"post_logout_redirect_uri","in":"query","schemaId":"components/schemas/Claim","description":"Location to redirect to after the logout is performed. It must match the value preregistered in Okta during client registration."},{"name":"state","in":"query","schemaId":"components/schemas/Claim","description":"An optional value that's returned as a query parameter during the redirect at the end of the flow"}],"pointer":"/paths/~1oauth2~1v1~1logout/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/v1/logout","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[{"name":"id_token_hint","in":"query","required":true,"schemaId":"components/schemas/Claim"},{"name":"post_logout_redirect_uri","in":"query","schemaId":"components/schemas/Claim"},{"name":"state","in":"query","schemaId":"components/schemas/Claim"}],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","429"],"pointer":"/oauth2/v1/logout","href":"orgas/logout","openApiOperationId":"logout","summary":"/logout"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Successful Logout"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1logout/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/logout"},{"label":"/logout","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/logoutwithpost","routeSlug":"/openapi/okta-oauth/oauth/orgas/logoutwithpost","metadata":{"seo":{"title":"/logout","description":"Use this operation to sign a user out by removing their Okta browser session. This is the recommended method over GET as you can wrap the parameters in the request body."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"logoutWithPost","name":"/logout","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1logout/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/logout","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use this operation to sign a user out by removing their Okta browser session. This is the recommended method over GET as you can wrap the parameters in the request body."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to redirect the browser after the user signs out. Otherwise, the browser is redirected to the Okta sign-in page. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/sign-users-out/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Sign users out"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" (if specified)."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the ID token passed with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token_hint"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is invalid, the browser is redirected to an error page."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"post_logout_redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" When making requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/logout"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint, the browser (user agent) should be redirected to the endpoint. You need to make a POST request from a form. A POST request to this endpoint from the backend doesn't completely terminate the session."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request org authorization server example"]}},"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request org authorization server example"],"pointer":"/paths/~1oauth2~1v1~1logout/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/logout","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request org authorization server example"]}},"responseCodes":["200","429"],"pointer":"/oauth2/v1/logout","href":"orgas/logoutwithpost","openApiOperationId":"logoutWithPost","summary":"/logout"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request org authorization server example"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/LogoutWithPost","exampleIds":["paths/~1oauth2~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request org authorization server example"]}},"examples":[{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Successful Logout"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1logout/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/logout"},{"label":"/par","deprecated":false,"httpVerb":"options","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/paroptions","routeSlug":"/openapi/okta-oauth/oauth/orgas/paroptions","metadata":{"seo":{"title":"/par","description":"Identity Engine"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"parOptions","name":"/par","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1par/options","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/par","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge oie","style":{"cursor":"pointer","background":"rgb(0, 41, 122)","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"Identity Engine"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use this operation to request the permitted communication options for the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/par"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" operation."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"headers","label":"Headers","labelTranslationKey":"header","parameters":[{"name":"Origin","in":"header","schemaId":"components/schemas/Claim","description":"Indicates the origin of the client that's initiating the request","example":"example.okta.com"}],"pointer":"/paths/~1oauth2~1v1~1par/options/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"OPTIONS","path":"/oauth2/v1/par","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[{"name":"Origin","in":"header","example":"example.okta.com","schemaId":"components/schemas/Claim"}],"cookie":[]},"security":[],"responseCodes":["204","429"],"pointer":"/oauth2/v1/par","href":"orgas/paroptions","openApiOperationId":"parOptions","summary":"/par"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204","description":"Success","headers":{"Access-Control-Allow-Origin":{"schema":{"type":"string"},"example":"example.okta.com"},"Access-Control-Allow-Methods":{"schema":{"type":"string"},"example":"POST"},"Access-Control-Max-Age":{"schema":{"type":"string"},"example":3600},"Vary":{"schema":{"type":"string"},"example":"Origin"}},"headerSchemaId":"schema_1529"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1par/options/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"204"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/par"},{"label":"/par","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/par","routeSlug":"/openapi/okta-oauth/oauth/orgas/par","metadata":{"seo":{"title":"/par","description":"Identity Engine"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"par","name":"/par","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1par/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/par","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge oie","style":{"cursor":"pointer","background":"rgb(0, 41, 122)","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"Identity Engine"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The pushed authorization request endpoint ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/par"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") promotes OAuth security by allowing the authorization server to authenticate the client before any user interaction happens. The increased confidence in the client's identity during the authorization process means the authorization server can refuse illegitimate requests much earlier in the process. This process prevents attempts to spoof clients or otherwise tamper with or misuse an authorization request and provides a simple way to make a confidential and integrity-protected request."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/par"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint allows an OAuth 2.0 client to push the payload of an authorization request directly to the authorization server. The authorization server provides a request URI value in the response. The request URI is a reference to the authorization request payload data in a subsequent call to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint through a user agent."},"children":[]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/ParRequest"}},"schemaId":"components/schemas/ParRequest","pointer":"/paths/~1oauth2~1v1~1par/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/par","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/json":{"schemaId":"components/schemas/ParRequest"}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/v1/par","href":"orgas/par","openApiOperationId":"par","summary":"/par"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/ParRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/ParRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ParResponse","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"]}},"schemaId":"components/schemas/ParResponse","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`","paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`","paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1par/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/ParResponse","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ParResponse","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`","paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`","paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/par"},{"label":"/primary-authenticate","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/primary-authenticate","routeSlug":"/openapi/okta-oauth/oauth/orgas/primary-authenticate","metadata":{"seo":{"title":"/primary-authenticate","description":"Initiates direct authentication with an out-of-band authenticator"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"primary-authenticate","name":"/primary-authenticate","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1primary-authenticate/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/primary-authenticate","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Initiates direct authentication with an out-of-band authenticator"},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/primary-authenticate"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"],"pointer":"/paths/~1oauth2~1v1~1primary-authenticate/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/primary-authenticate","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/v1/primary-authenticate","href":"orgas/primary-authenticate","openApiOperationId":"primary-authenticate","summary":"/primary-authenticate"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"examples":[{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Out-of-band authentication has successfully been initiated.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]}},"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}],"pointer":"/paths/~1oauth2~1v1~1primary-authenticate/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]}}},{"code":"429","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/primary-authenticate"},{"label":"/revoke","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/revoke","routeSlug":"/openapi/okta-oauth/oauth/orgas/revoke","metadata":{"seo":{"title":"/revoke","description":"CORS"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"revoke","name":"/revoke","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1revoke/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/revoke","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The API takes an access or refresh token and revokes it. Revoked tokens are considered inactive at the introspection endpoint. A client may only revoke its own tokens. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/revoke-tokens/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Revoke tokens"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/revoke"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/RevokeRequestOrgAs"}},"schemaId":"components/schemas/RevokeRequestOrgAs","pointer":"/paths/~1oauth2~1v1~1revoke/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/revoke","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/RevokeRequestOrgAs"}},"responseCodes":["200","400","401","429"],"pointer":"/oauth2/v1/revoke","href":"orgas/revoke","openApiOperationId":"revoke","summary":"/revoke"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/RevokeRequestOrgAs","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/RevokeRequestOrgAs"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Successful Revocation. Note that revoking an invalid, expired, or revoked token is still considered a success so information isn't leaked."},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1revoke/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200"},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter","paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request","paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/revoke"},{"label":"/token","deprecated":false,"httpVerb":"options","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/tokenoptions","routeSlug":"/openapi/okta-oauth/oauth/orgas/tokenoptions","metadata":{"seo":{"title":"/token","description":"Use this operation to request the permitted communication options for the /token operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"tokenOptions","name":"/token","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1token/options","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/token","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use this operation to request the permitted communication options for the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" operation."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"headers","label":"Headers","labelTranslationKey":"header","parameters":[{"name":"Origin","in":"header","schemaId":"components/schemas/Claim","description":"Indicates the origin of the client that's initiating the request","example":"example.okta.com"}],"pointer":"/paths/~1oauth2~1v1~1token/options/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"OPTIONS","path":"/oauth2/v1/token","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[{"name":"Origin","in":"header","example":"example.okta.com","schemaId":"components/schemas/Claim"}],"cookie":[]},"security":[],"responseCodes":["204","429"],"pointer":"/oauth2/v1/token","href":"orgas/tokenoptions","openApiOperationId":"tokenOptions","summary":"/token"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204","description":"Success","headers":{"Access-Control-Allow-Origin":{"schema":{"type":"string"},"example":"example.okta.com"},"Access-Control-Allow-Methods":{"schema":{"type":"string"},"example":"POST"},"Access-Control-Max-Age":{"schema":{"type":"string"},"example":3600},"Vary":{"schema":{"type":"string"},"example":"Origin"}},"headerSchemaId":"schema_1529"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1token/options/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"204"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/token"},{"label":"/token","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/token","routeSlug":"/openapi/okta-oauth/oauth/orgas/token","metadata":{"seo":{"title":"/token","description":"This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For password, client credentials, SAML 2.0 assertion, and refresh token flows, calling /token is the only step of the flow. For the authorization code flow, calling /token is the second step of the flow."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"token","name":"/token","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1token/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/token","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/ropassword/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"password"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"client credentials"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/saml2assert/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SAML 2.0 assertion"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/refresh-tokens/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"refresh token"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" flows, calling "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is the only step of the flow. For the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"authorization code"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" flow, calling "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is the second step of the flow."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/TokenRequestOrgAs","exampleIds":["paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Identity Assertion JWT Authorization Grant","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA vaulted secret for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA service account for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OAuth STS for AI agent"]}},"schemaId":"components/schemas/TokenRequestOrgAs","exampleIds":["paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Identity Assertion JWT Authorization Grant","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA vaulted secret for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA service account for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OAuth STS for AI agent"],"pointer":"/paths/~1oauth2~1v1~1token/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/token","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/TokenRequestOrgAs","exampleIds":["paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Identity Assertion JWT Authorization Grant","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA vaulted secret for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA service account for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OAuth STS for AI agent"]}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/v1/token","href":"orgas/token","openApiOperationId":"token","summary":"/token"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/TokenRequestOrgAs","exampleIds":["paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Identity Assertion JWT Authorization Grant","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA vaulted secret for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA service account for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OAuth STS for AI agent"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/TokenRequestOrgAs","exampleIds":["paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Identity Assertion JWT Authorization Grant","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA vaulted secret for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA service account for AI agent","paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OAuth STS for AI agent"]}},"examples":[{},{},{},{},{},{},{},{},{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Based on the scopes requested. The scopes specified in a request are included in the access token in the response.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/TokenResponseOrgAs","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Token response","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Identity Assertion JWT Authorization Grant","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA vaulted secret for AI agent","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA service account for AI agent","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OAuth STS for AI agent"]}},"schemaId":"components/schemas/TokenResponseOrgAs","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Token response","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Identity Assertion JWT Authorization Grant","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA vaulted secret for AI agent","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA service account for AI agent","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OAuth STS for AI agent"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1token/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/TokenResponseOrgAs","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Token response","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Identity Assertion JWT Authorization Grant","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA vaulted secret for AI agent","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA service account for AI agent","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OAuth STS for AI agent"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/TokenResponseOrgAs","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Token response","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Identity Assertion JWT Authorization Grant","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA vaulted secret for AI agent","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA service account for AI agent","paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OAuth STS for AI agent"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type","paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"]}}},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/token"},{"label":"/userinfo","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/userinfo","routeSlug":"/openapi/okta-oauth/oauth/orgas/userinfo","metadata":{"seo":{"title":"/userinfo","description":"CORSOAuth 2.0 scope:openid"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"userinfo","name":"/userinfo","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1userinfo/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/userinfo","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"marginTop":"16px","marginBottom":"24px","fontFamily":"sans-serif","display":"block","clear":"both"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"span","attrs":{"className":"lifecycle-badge cors","style":{"cursor":"pointer","background":"#6E6E6E","borderRadius":"6px","marginRight":"8px","padding":"3px","fontSize":"16px","verticalAlign":"super","color":"white","fontWeight":"bold","display":"inline-block"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"CORS"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"div","attrs":{"style":{"display":"flex","alignItems":"flex-start","gap":"8px","marginTop":"12px"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"a","attrs":{"href":"https://developer.okta.com/docs/api/oauth2/","style":{"padding":"4px 0px","flex":"0 0 135px","fontSize":"16px","fontWeight":"600","color":"#1d1d21","textDecoration":"none","marginBottom":"8px"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"OAuth 2.0 scope:"},"children":[]}]},{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"ul","attrs":{"style":{"padding":"0","margin":"0","listStyle":"none","display":"flex","flexWrap":"wrap","flex":"1"}}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","attributes":{"name":"li","attrs":{"style":{"display":"inline-flex","alignItems":"center","backgroundColor":"#ededed","color":"#4b4b4b","padding":"4px 12px","borderRadius":"16px","fontSize":"14px","marginRight":"8px","marginBottom":"8px","lineHeight":"20px","border":"1px solid transparent"}}},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"openid"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returns information about the user that's the subject of the access token. Many of these claims are also included in the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/reference/api/oidc/#id-token"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ID token"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", but calling this endpoint always returns all of the user's claims. You can configure the ID token to include a subset of the user's claims. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Scope-dependent claims"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/oauth2/v1/userinfo","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"responseCodes":["200","401","403","429"],"pointer":"/oauth2/v1/userinfo","href":"orgas/userinfo","openApiOperationId":"userinfo","summary":"/userinfo"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Success","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UserInfo","exampleIds":["paths/~1oauth2~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"]}},"schemaId":"components/schemas/UserInfo","exampleIds":["paths/~1oauth2~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"]},{"code":"401","description":"Unauthorized","headers":{"WWW-Authenticate":{"schema":{"type":"string"},"example":"Bearer error=\"invalid_token\", error_description=\"The access token is invalid\""}},"headerSchemaId":"schema_1530"},{"code":"403","description":"Forbidden","headers":{"WWW-Authenticate":{"schema":{"type":"string"},"example":"Bearer error=\"insufficient_scope\", error_description=\"The access token must provide access to at least one of these scopes - profile, email, address or phone\""}},"headerSchemaId":"schema_1531"},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"]}},"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"]}],"pointer":"/paths/~1oauth2~1v1~1userinfo/get/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/UserInfo","exampleIds":["paths/~1oauth2~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UserInfo","exampleIds":["paths/~1oauth2~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"]}}},{"code":"401"},{"code":"403"},{"code":"429","schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Error","exampleIds":["paths/~1oauth2~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/userinfo"},{"label":"/oob-authenticate","deprecated":true,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/orgas/oob-authenticate","routeSlug":"/openapi/okta-oauth/oauth/orgas/oob-authenticate","metadata":{"seo":{"title":"/oob-authenticate","description":"Initiates direct authentication with an out-of-band authenticator"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"oob-authenticate","name":"/oob-authenticate","deprecated":true,"isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1oob-authenticate/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/oob-authenticate","isWebhook":false,"deprecated":true,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Initiates direct authentication with an out-of-band authenticator"},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/oob-authenticate"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint requires client authentication. The method is configured per client app. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/guides/client-auth/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Client authentication methods"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" This endpoint is deprecated. Use "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"//openapi/okta-oauth/oauth/customas/primary-authenticate-custom-as"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"/primary-authenticate"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" instead."},"children":[]}]}]}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"],"pointer":"/paths/~1oauth2~1v1~1oob-authenticate/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/oauth2/v1/oob-authenticate","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"responseCodes":["200","400","401","403","429"],"pointer":"/oauth2/v1/oob-authenticate","href":"orgas/oob-authenticate","openApiOperationId":"oob-authenticate","summary":"/oob-authenticate"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"],"mediaTypes":["application/x-www-form-urlencoded"],"mediaTypeSchemas":{"application/x-www-form-urlencoded":{"schemaId":"components/schemas/OobAuthenticateRequest","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS","paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"]}},"examples":[{},{},{}]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"Out-of-band authentication has successfully been initiated.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]}},"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]},{"code":"400","description":"Bad Request","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]},{"code":"401","description":"Unauthorized","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]},{"code":"403","description":"Forbidden","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]},{"code":"429","description":"Too Many Requests","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}},"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}],"pointer":"/paths/~1oauth2~1v1~1oob-authenticate/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OobAuthenticateResponse","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS","paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"]}}},{"code":"400","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint","paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app","paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"]}}},{"code":"401","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"]}}},{"code":"403","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"]}}},{"code":"429","schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"],"mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/OAuthError","exampleIds":["paths/~1oauth2~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"]}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/oob-authenticate"}],"content":{"contentType":"group","meta":{"name":"OrgAS"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Org Authorization Server","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Every Okta org comes with a built-in authorization server called the org authorization server. Use the org authorization server to perform SSO with Okta for your OpenID Connect apps or to get an access token for the Okta APIs. You can't customize this authorization server with regards to audience, claims, policies, or scopes. Additionally, the resulting access token's issuer is "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"https://{yourOktaDomain}"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", which indicates that only Okta can consume or validate it. Your apps can't use or validate the access token."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Okta has two types of authorization servers: the org authorization server and the custom authorization server. To learn more about each type of authorization server and when to use them, see "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/auth-servers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Authorization servers"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/.well-known/openid-configuration","summary":"Retrieve the OpenID Connect metadata","prefix":{"name":"get","color":"get"},"badges":[],"link":"/orgas/getwellknownopenidconfiguration","deprecated":false},{"title":"/oauth2/v1/authorize","summary":"/authorize","prefix":{"name":"get","color":"get"},"badges":[],"link":"/orgas/authorize","deprecated":false},{"title":"/oauth2/v1/authorize","summary":"/authorize","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/authorizewithpost","deprecated":false},{"title":"/oauth2/v1/bc/authorize","summary":"/bc/authorize","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/bcauthorize","deprecated":false},{"title":"/oauth2/v1/challenge","summary":"/challenge","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/challenge","deprecated":false},{"title":"/oauth2/v1/device/authorize","summary":"/device/authorize","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/deviceauthorize","deprecated":false},{"title":"/oauth2/v1/introspect","summary":"/introspect","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/introspect","deprecated":false},{"title":"/oauth2/v1/keys","summary":"/keys","prefix":{"name":"get","color":"get"},"badges":[],"link":"/orgas/oauthkeys","deprecated":false},{"title":"/oauth2/v1/logout","summary":"/logout","prefix":{"name":"get","color":"get"},"badges":[],"link":"/orgas/logout","deprecated":false},{"title":"/oauth2/v1/logout","summary":"/logout","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/logoutwithpost","deprecated":false},{"title":"/oauth2/v1/par","summary":"/par","prefix":{"name":"options","color":"options"},"badges":[],"link":"/orgas/paroptions","deprecated":false},{"title":"/oauth2/v1/par","summary":"/par","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/par","deprecated":false},{"title":"/oauth2/v1/primary-authenticate","summary":"/primary-authenticate","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/primary-authenticate","deprecated":false},{"title":"/oauth2/v1/revoke","summary":"/revoke","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/revoke","deprecated":false},{"title":"/oauth2/v1/token","summary":"/token","prefix":{"name":"options","color":"options"},"badges":[],"link":"/orgas/tokenoptions","deprecated":false},{"title":"/oauth2/v1/token","summary":"/token","prefix":{"name":"post","color":"post"},"badges":[],"link":"/orgas/token","deprecated":false},{"title":"/oauth2/v1/userinfo","summary":"/userinfo","prefix":{"name":"get","color":"get"},"badges":[],"link":"/orgas/userinfo","deprecated":false},{"title":"/oauth2/v1/oob-authenticate","summary":"/oob-authenticate","prefix":{"name":"post","color":"http-deprecated"},"badges":[],"link":"/orgas/oob-authenticate","deprecated":true}]}]}]}]}},{"label":"/oauth2/v1/challenge","deprecated":false,"httpVerb":"x-okta-lifecycle","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/paths/~1oauth2~1v1~1challenge/x-okta-lifecycle","routeSlug":"/openapi/okta-oauth/oauth/paths/~1oauth2~1v1~1challenge/x-okta-lifecycle","metadata":{"seo":{"title":"/oauth2/v1/challenge"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"name":"/oauth2/v1/challenge","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1challenge/x-okta-lifecycle","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/oauth2/v1/challenge","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"empty-message","label":"No request data","labelTranslationKey":"noRequestData"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"X-OKTA-LIFECYCLE","path":"/oauth2/v1/challenge","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"pointer":"/oauth2/v1/challenge","href":"paths/~1oauth2~1v1~1challenge/x-okta-lifecycle"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/challenge"},{"label":"/oauth2/v1/global-token-revocation","deprecated":false,"httpVerb":"x-okta-lifecycle","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/paths/~1oauth2~1v1~1global-token-revocation/x-okta-lifecycle","routeSlug":"/openapi/okta-oauth/oauth/paths/~1oauth2~1v1~1global-token-revocation/x-okta-lifecycle","metadata":{"seo":{"title":"/oauth2/v1/global-token-revocation"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"name":"/oauth2/v1/global-token-revocation","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1global-token-revocation/x-okta-lifecycle","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/oauth2/v1/global-token-revocation","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"empty-message","label":"No request data","labelTranslationKey":"noRequestData"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"X-OKTA-LIFECYCLE","path":"/oauth2/v1/global-token-revocation","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"pointer":"/oauth2/v1/global-token-revocation","href":"paths/~1oauth2~1v1~1global-token-revocation/x-okta-lifecycle"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/global-token-revocation"},{"label":"/oauth2/v1/oob-authenticate","deprecated":false,"httpVerb":"x-okta-lifecycle","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/paths/~1oauth2~1v1~1oob-authenticate/x-okta-lifecycle","routeSlug":"/openapi/okta-oauth/oauth/paths/~1oauth2~1v1~1oob-authenticate/x-okta-lifecycle","metadata":{"seo":{"title":"/oauth2/v1/oob-authenticate"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"name":"/oauth2/v1/oob-authenticate","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1oob-authenticate/x-okta-lifecycle","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/oauth2/v1/oob-authenticate","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"empty-message","label":"No request data","labelTranslationKey":"noRequestData"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"X-OKTA-LIFECYCLE","path":"/oauth2/v1/oob-authenticate","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"pointer":"/oauth2/v1/oob-authenticate","href":"paths/~1oauth2~1v1~1oob-authenticate/x-okta-lifecycle"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/oob-authenticate"},{"label":"/oauth2/v1/primary-authenticate","deprecated":false,"httpVerb":"x-okta-lifecycle","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/paths/~1oauth2~1v1~1primary-authenticate/x-okta-lifecycle","routeSlug":"/openapi/okta-oauth/oauth/paths/~1oauth2~1v1~1primary-authenticate/x-okta-lifecycle","metadata":{"seo":{"title":"/oauth2/v1/primary-authenticate"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"name":"/oauth2/v1/primary-authenticate","isWebhook":false,"pointer":"/paths/~1oauth2~1v1~1primary-authenticate/x-okta-lifecycle","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/oauth2/v1/primary-authenticate","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"empty-message","label":"No request data","labelTranslationKey":"noRequestData"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"X-OKTA-LIFECYCLE","path":"/oauth2/v1/primary-authenticate","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"pointer":"/oauth2/v1/primary-authenticate","href":"paths/~1oauth2~1v1~1primary-authenticate/x-okta-lifecycle"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/v1/primary-authenticate"},{"label":"/oauth2/{authorizationServerId}/v1/challenge","deprecated":false,"httpVerb":"x-okta-lifecycle","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/paths/~1oauth2~1{authorizationserverid}~1v1~1challenge/x-okta-lifecycle","routeSlug":"/openapi/okta-oauth/oauth/paths/~1oauth2~1{authorizationserverid}~1v1~1challenge/x-okta-lifecycle","metadata":{"seo":{"title":"/oauth2/{authorizationServerId}/v1/challenge"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"name":"/oauth2/{authorizationServerId}/v1/challenge","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/x-okta-lifecycle","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/oauth2/{authorizationServerId}/v1/challenge","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/x-okta-lifecycle/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"X-OKTA-LIFECYCLE","path":"/oauth2/{authorizationServerId}/v1/challenge","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"pointer":"/oauth2/{authorizationServerId}/v1/challenge","href":"paths/~1oauth2~1{authorizationserverid}~1v1~1challenge/x-okta-lifecycle"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/challenge"},{"label":"/oauth2/{authorizationServerId}/v1/oob-authenticate","deprecated":false,"httpVerb":"x-okta-lifecycle","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/paths/~1oauth2~1{authorizationserverid}~1v1~1oob-authenticate/x-okta-lifecycle","routeSlug":"/openapi/okta-oauth/oauth/paths/~1oauth2~1{authorizationserverid}~1v1~1oob-authenticate/x-okta-lifecycle","metadata":{"seo":{"title":"/oauth2/{authorizationServerId}/v1/oob-authenticate"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"name":"/oauth2/{authorizationServerId}/v1/oob-authenticate","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/x-okta-lifecycle","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/oauth2/{authorizationServerId}/v1/oob-authenticate","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/x-okta-lifecycle/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"X-OKTA-LIFECYCLE","path":"/oauth2/{authorizationServerId}/v1/oob-authenticate","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"pointer":"/oauth2/{authorizationServerId}/v1/oob-authenticate","href":"paths/~1oauth2~1{authorizationserverid}~1v1~1oob-authenticate/x-okta-lifecycle"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/oob-authenticate"},{"label":"/oauth2/{authorizationServerId}/v1/primary-authenticate","deprecated":false,"httpVerb":"x-okta-lifecycle","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi/okta-oauth/oauth/paths/~1oauth2~1{authorizationserverid}~1v1~1primary-authenticate/x-okta-lifecycle","routeSlug":"/openapi/okta-oauth/oauth/paths/~1oauth2~1{authorizationserverid}~1v1~1primary-authenticate/x-okta-lifecycle","metadata":{"seo":{"title":"/oauth2/{authorizationServerId}/v1/primary-authenticate"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"name":"/oauth2/{authorizationServerId}/v1/primary-authenticate","isWebhook":false,"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/x-okta-lifecycle","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"/oauth2/{authorizationServerId}/v1/primary-authenticate","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"authorizationServerId","in":"path","schemaId":"components/schemas/Claim","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" of the authorization server"},"children":[]}]}]}],"required":true}],"pointer":"/paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/x-okta-lifecycle/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"X-OKTA-LIFECYCLE","path":"/oauth2/{authorizationServerId}/v1/primary-authenticate","servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"parameters":{"path":[{"name":"authorizationServerId","in":"path","required":true,"schemaId":"components/schemas/Claim"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"pointer":"/oauth2/{authorizationServerId}/v1/primary-authenticate","href":"paths/~1oauth2~1{authorizationserverid}~1v1~1primary-authenticate/x-okta-lifecycle"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com"}}}],"examples":[]}]}]}]},"httpPath":"/oauth2/{authorizationServerId}/v1/primary-authenticate"}],"store":{"schemaStore":{"components/schemas/AcrValue":{"id":"components/schemas/AcrValue","kind":"json-schema","title":"AcrValue","data":{"type":"string","enum":["phr","phrh","urn:okta:loa:1fa:any","urn:okta:loa:1fa:pwd","urn:okta:loa:2fa:any","urn:okta:loa:2fa:any:ifpossible"],"x-enumDescriptions":{"phr":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Phishing-Resistant. Requires users to provide possession factors that cryptographically verify the sign-in server (the origin). Currently, only the Passkey (FIDO2 WebAuthn) authenticator satisfies this requirement. Because phishing resistance implies "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-authenticators"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"device binding"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", that constraint is selected automatically when "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"phr"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is specified."},"children":[]}]}]}],"phrh":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Phishing-Resistant Hardware-Protected. Requires that you store keys being used to authenticate in secure hardware (TPM, Secure Enclave) on the device. Currently, only Okta Verify meets this constraint. Because hardware protection implies "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-authenticators"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"device binding"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", that constraint is selected automatically when "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"phrh"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is specified."},"children":[]}]}]}],"urn:okta:loa:1fa:any":"Any one factor. Allows one factor authentication with no requirements on which factor.","urn:okta:loa:1fa:pwd":"Password only. Allows one factor authentication that requires the user's password.","urn:okta:loa:2fa:any":"Any two factors. Allows two factor authentication with no requirements on which factors.","urn:okta:loa:2fa:any:ifpossible":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Any two factors, if possible. Allows two factor authentication with no requirements on which factors. Any two factors are presented only if the user is enrolled, otherwise any one factor is presented."},"children":[]}]}]}]}}},"components/schemas/AmrValue":{"id":"components/schemas/AmrValue","kind":"json-schema","title":"AmrValue","data":{"type":"string","enum":["duo","email","fed","google_otp","kba","oath_otp","okta_verify","opt","pop","pwd","rsa","sms","symantec","tel","yubikey"]}},"components/schemas/ApplicationType":{"id":"components/schemas/ApplicationType","kind":"json-schema","title":"ApplicationType","data":{"description":"The type of client app","default":"web","type":"string","enum":["browser","native","service","web"]}},"components/schemas/AuthorizeWithPost":{"id":"components/schemas/AuthorizeWithPost","kind":"json-schema","title":"AuthorizeWithPost","data":{"type":"object","properties":{"acr_values":{"allOf":[{"$ref":"#/components/schemas/AcrValue"},{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An optional parameter that you can include in the authentication request. This parameter increases the level of user assurance."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" You can provide multiple space-delimited values. The authorization server chooses one and reflects the chosen value in any resulting tokens."},"children":[]}]}]}]}]}]},"client_id":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Obtained during either manual client registration or through the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/client"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Dynamic Client Registration API"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". It identifies the client and must match the value preregistered in Okta."},"children":[]}]}]}],"type":"string"},"code_challenge":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A challenge for "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PKCE"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The challenge is verified in the access token request."},"children":[]}]}]}],"type":"string"},"code_challenge_method":{"allOf":[{"$ref":"#/components/schemas/CodeChallengeMethod"},{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Method used to derive the code challenge for "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PKCE"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},"display":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"display"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter to be passed to the external identity provider when performing "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/identity-providers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"social login"},"children":[]}]}]}]}],"type":"string"},"enroll_amr_values":{"allOf":[{"$ref":"#/components/schemas/AmrValue"},{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A space-delimited list of values indicating which authenticators to enroll in."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"enroll_amr_values"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is specified, then the value for "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"prompt"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" must be "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"enroll_authenticator"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The parameter value is space-delimited, for example, "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"pwd sms okta_verify"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is a valid request parameter value. You are prompted in the order of the amr values provided."},"children":[]}]}]}]}]}]},"idp":{"description":"An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.","type":"string"},"idp_scope":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An Okta extension to the OpenID specification. A space-delimited list of scopes you want to provide to the external identity provider when performing "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/identity-providers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"social login"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". These scopes are used in addition to the scopes already configured for the identity provider."},"children":[]}]}]}],"type":"string"},"login_hint":{"description":"A username to pre-populate if prompting for authentication","type":"string"},"max_age":{"description":"Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta","type":"integer"},"nonce":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OIDC Specs"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"type":"string"},"prompt":{"allOf":[{"$ref":"#/components/schemas/Prompt"},{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If no "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"prompt"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is specified, the standard behavior occurs:"},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, the user is prompted to authenticate."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent."},"children":[]}]}]}]}]}]},"redirect_uri":{"description":"Callback location where the authorization code or tokens should be sent. It must match the value preregistered in Okta during client registration.","type":"string"},"request":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A JWT created by the client that enables requests to be passed as a single, self-contained parameter."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can't encrypt the JWT."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/build-self-signed-jwt/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Build a JWT for client authentication"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta supports the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.2"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"HMAC"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.3"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RSA"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.4"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ECDSA"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" signature algorithms. HMAC signatures require that the client has a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token_endpoint_auth_method"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that uses a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". RSA and ECDSA signatures requires that the client registers a public key."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"We recommend that you don't duplicate any request parameters in both the JWT and the query URI itself. However, you can do so with "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"nonce"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code_challenge"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code_challenge_method"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". In those cases, the values in the JWT overrides the query URI values."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta validates the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"request"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter in the following ways:"},"children":[]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":true,"marker":"."},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iss"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is required and must be the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"aud"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JWT lifetime is evaluated using the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iat"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"exp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claims, if present. If the JWT is expired or not yet valid, Okta returns an "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"invalid_request_object"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" error. Okta rejects JWTs that expire more than one hour in the future."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta rejects the JWT if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"jti"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claim is present and it has already been processed."},"children":[]}]}]}]}]}]}],"type":"string"},"request_uri":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Location where the authorization request payload data is referenced in an authorization request to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint. This is returned from a Pushed Authorization Request at the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/par"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint."},"children":[]}]}]}],"type":"string"},"response_mode":{"allOf":[{"$ref":"#/components/schemas/ResponseMode"},{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"How the authorization response should be returned. If "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is specified in the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", then "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"query"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" isn't allowed as a response mode. Defaults to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"fragment"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in implicit and hybrid flows."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Referrer-Policy"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" header is automatically included in the response when either the fragment or query parameter values are used. The header is set to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Referrer-Policy: no-referrer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},"response_type":{"allOf":[{"$ref":"#/components/schemas/ResponseTypesSupported"},{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Any combination of "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The combination determines the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"flow"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}]},"scope":{"description":"A space-delimited string of scopes requested","type":"string"},"sessionToken":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta one-time session token. This is an Okta extension to the OpenID specification. The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"sessionToken"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" allows an API-based user sign-in flow."},"children":[]}]}]}],"type":"string"},"state":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A value to be returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta requires the OAuth 2.0 "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter on all requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint to prevent cross-site request forgery (CSRF)."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The OAuth 2.0 specification "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc6749#section-10.12"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"requires"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that clients protect their redirect URIs against CSRF by sending a value in the authorize request that binds the request to the user-agent's authenticated state."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Using the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter is also a countermeasure to several other known attacks as outlined in "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc6819"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OAuth 2.0 Threat Model and Security Considerations"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"type":"string"}},"required":["client_id","redirect_uri","response_type","scope","state"]}},"components/schemas/AuthorizeWithPostCustomAS":{"id":"components/schemas/AuthorizeWithPostCustomAS","kind":"json-schema","title":"AuthorizeWithPostCustomAS","data":{"allOf":[{"$ref":"#/components/schemas/AuthorizeWithPost"},{"type":"object","properties":{"resource":{"x-okta-lifecycle":{"lifecycle":"EA","isGenerallyAvailable":false,"SKUs":[]},"type":"array","items":{"type":"string","format":"uri"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An absolute URI that identifies the target resource server that requests the access token. Use this parameter to restrict the token to a specific resource server or servers."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Repeat the parameter to request a token that's valid for multiple resource servers. When this parameter is included in a request, the issued token's "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"aud"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claim is bound to the specified resource(s)."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Multiple audiences for custom authorization servers is a "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/docs/concepts/feature-lifecycle-management/#self-service-features"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"self-service Early Access (EA)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" feature. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Manage Early Access and Beta features"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to enable the feature."},"children":[]}]}]}]}]}}}]}},"components/schemas/BackchannelAuthorizeRequest":{"id":"components/schemas/BackchannelAuthorizeRequest","kind":"json-schema","title":"BackchannelAuthorizeRequest","data":{"additionalProperties":true,"type":"object","properties":{"binding_message":{"type":"string","description":"A message that appears for the user to identify the transaction"},"id_token_hint":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An ID token previously issued to the client as a hint to identify the user for whom authentication is being requested."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" You can specify either "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"login_hint"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token_hint"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in the authentication request, not both."},"children":[]}]}]}]},"login_hint":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A hint to the OpenID Provider regarding the user for whom authentication is being requested."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" You can specify either "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"login_hint"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token_hint"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in the authentication request, not both."},"children":[]}]}]}]},"request":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A JWT created by the client that enables requests to be passed as a single, self-contained parameter."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/build-self-signed-jwt/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Build a JWT for client authentication"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You can't encrypt the JWT."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta supports the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.2"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"HMAC"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.3"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RSA"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7518#section-3.4"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ECDSA"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" signature algorithms. HMAC signatures require the client to have a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token_endpoint_auth_method"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that uses a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". RSA and ECDSA signatures require the client to register a public key."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"You must specify "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"backchannel_authentication_request_signing_alg"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" either during client registration or when updating the client to use the signed authentication requests."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta validates the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"request"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter in the following ways:"},"children":[]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":true,"marker":"."},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iss"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is required and must be the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"aud"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JWT lifetime is evaluated using the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iat"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"exp"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claims, if present. If the JWT is expired or not yet valid, Okta returns an "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"invalid_request_object"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" error. Okta rejects JWTs that expire more than one hour in the future."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta rejects the JWT if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"jti"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claim is present and it's already been processed."},"children":[]}]}]}]}]}]}]},"requested_expiry":{"type":"integer","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Allows the client to request the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"expires_in"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" value in number of seconds for the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"auth_req_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that the server returns."},"children":[]}]}]}],"minimum":1,"maximum":300},"scope":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"openid"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is required for authentication requests. You can also include other scopes."},"children":[]}]}]}]}},"required":["id_token_hint","login_hint","scope"]}},"components/schemas/BackchannelAuthorizeResponse":{"id":"components/schemas/BackchannelAuthorizeResponse","kind":"json-schema","title":"BackchannelAuthorizeResponse","data":{"type":"object","properties":{"auth_req_id":{"type":"string","description":"A unique identifier to identify the authentication request made by the client"},"expires_in":{"type":"integer","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The expiration time of the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"auth_req_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in seconds"},"children":[]}]}]}],"minimum":1,"maximum":300},"interval":{"type":"integer","description":"The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint"}}}},"components/schemas/BindingMethod":{"id":"components/schemas/BindingMethod","kind":"json-schema","title":"BindingMethod","data":{"description":"The method used to bind the out-of-band channel with the primary channel.","type":"string","enum":["none","prompt","transfer"]}},"components/schemas/ChallengeHint":{"id":"components/schemas/ChallengeHint","kind":"json-schema","title":"ChallengeHint","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The type of challenge to prompt for in a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/primary-authenticate"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" request"},"children":[]}]}]}],"type":"string","enum":["urn:okta:params:oauth:grant-type:oob"]}},"components/schemas/ChallengeRequest":{"id":"components/schemas/ChallengeRequest","kind":"json-schema","title":"ChallengeRequest","data":{"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]},"type":"object","properties":{"challenge_types_supported":{"type":"string","description":"Space-separated list of direct authentication challenge types supported by the client"},"channel_hint":{"$ref":"#/components/schemas/Channel"},"mfa_token":{"type":"string","description":"The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests"}},"required":["mfa_token"]}},"components/schemas/ChallengeResponse":{"id":"components/schemas/ChallengeResponse","kind":"json-schema","title":"ChallengeResponse","data":{"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]},"type":"object","properties":{"binding_code":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The end-user verification code used to bind the authorization operation on the secondary channel with the primary channel. Present only if "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"binding_method=transfer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},"binding_method":{"$ref":"#/components/schemas/BindingMethod"},"challenge_type":{"type":"string","description":"The challenge type used for authentication"},"channel":{"$ref":"#/components/schemas/Channel"},"expires_in":{"type":"integer","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Number of seconds until the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"oob_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" expires"},"children":[]}]}]}]},"interval":{"type":"integer","description":"The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint"},"oob_code":{"type":"string","description":"A unique identifier for identifying the out-of-band transaction across multiple requests"}}}},"components/schemas/ChallengeType":{"id":"components/schemas/ChallengeType","kind":"json-schema","title":"ChallengeType","data":{"type":"string","enum":["http://auth0.com/oauth/grant-type/mfa-oob","http://auth0.com/oauth/grant-type/mfa-otp"]}},"components/schemas/Channel":{"id":"components/schemas/Channel","kind":"json-schema","title":"Channel","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The out-of-band channel for use with authentication. Required for all "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/primary-authenticate"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/challenge"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" requests with an out-of-band authenticator."},"children":[]}]}]}],"type":"string","enum":["push","sms","voice"]}},"components/schemas/Claim":{"id":"components/schemas/Claim","kind":"json-schema","title":"Claim","data":{"type":"string"}},"components/schemas/Client":{"id":"components/schemas/Client","kind":"json-schema","title":"Client","data":{"type":"object","properties":{"application_type":{"$ref":"#/components/schemas/ApplicationType"},"client_id":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Unique key for the client app. The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is immutable. When you create a client app, you can't specify the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" because Okta uses the app ID for the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"readOnly":true},"client_id_issued_at":{"type":"integer","readOnly":true,"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Time at which the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" was issued (measured in unix seconds)"},"children":[]}]}]}]},"client_name":{"type":"string","description":"Human-readable string name of the client app"},"client_secret":{"type":"string","readOnly":true,"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OAuth 2.0 client secret string (used for confidential clients). The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is shown only on the response of the creation or update of a client app (and only if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token_endpoint_auth_method"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is one that requires a client secret). You can't specify the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". If the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token_endpoint_auth_method"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" requires one, Okta generates a random "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for the client app."},"children":[]}]}]}],"nullable":true},"client_secret_expires_at":{"type":"integer","readOnly":true,"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Time at which the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" expires or 0 if it doesn't expire (measured in unix seconds)"},"children":[]}]}]}],"minimum":0,"nullable":true},"frontchannel_logout_session_required":{"type":"boolean","description":"Include user session details"},"frontchannel_logout_uri":{"type":"string","description":"URL where Okta sends the logout request","nullable":true},"grant_types":{"type":"array","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Array of OAuth 2.0 grant type strings. Default value: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"[authorization_code]"},"children":[]}]}]}],"items":{"$ref":"#/components/schemas/GrantType"}},"id_token_encrypted_response_alg":{"$ref":"#/components/schemas/OAuthIdTokenKeyEncryptionAlgorithm"},"initiate_login_uri":{"type":"string","description":"URL that a third party can use to initiate a sign-in flow by the client"},"jwks":{"type":"object","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7517#section-5"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JSON Web Key Set"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client"},"children":[]}]}]}],"properties":{"keys":{"type":"array","items":{"oneOf":[{"$ref":"#/components/schemas/JsonSigningWebKey"},{"$ref":"#/components/schemas/JsonEncryptionWebKey"}]}}}},"jwks_uri":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"URL string that references a "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7517#section-5"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JSON Web Key Set"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client"},"children":[]}]}]}]},"logo_uri":{"type":"string","description":"URL string that references a logo for the client consent dialog (not the sign-in dialog)","nullable":true},"policy_uri":{"type":"string","description":"URL string of a web page providing the client's policy document","nullable":true},"post_logout_redirect_uris":{"type":"string","description":"Array of redirection URI strings for use for relying party initiated logouts","items":{"type":"string"}},"redirect_uris":{"type":"array","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Array of redirection URI strings for use in redirect-based flows. All redirect URIs must be absolute URIs and must not include a fragment component. At least one redirect URI and response type is required for all client types, with the following exceptions: If the client uses the Resource Owner Password flow (if "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"grant_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" contains the value "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"password"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") or the Client Credentials flow (if "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"grant_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" contains the value "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_credentials"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"), then no redirect URI or response type is necessary. In these cases, you can pass either null or an empty array for these attributes."},"children":[]}]}]}],"items":{"type":"string"}},"request_object_signing_alg":{"$ref":"#/components/schemas/SigningAlgorithm"},"response_types":{"type":"array","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Array of OAuth 2.0 response type strings. Default value: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"[code]"},"children":[]}]}]}],"items":{"$ref":"#/components/schemas/ResponseType"}},"token_endpoint_auth_method":{"$ref":"#/components/schemas/EndpointAuthMethod"},"tos_uri":{"type":"string","description":"URL string of a web page providing the client's terms of service document","nullable":true}},"required":["client_name"]}},"components/schemas/CodeChallengeMethod":{"id":"components/schemas/CodeChallengeMethod","kind":"json-schema","title":"CodeChallengeMethod","data":{"type":"string","enum":["S256"]}},"components/schemas/ContentEncryptionAlgorithm":{"id":"components/schemas/ContentEncryptionAlgorithm","kind":"json-schema","title":"ContentEncryptionAlgorithm","data":{"x-okta-lifecycle":{"lifecycle":"GA","isGenerallyAvailable":true},"type":"string","enum":["A256GCM"]}},"components/schemas/DeviceAuthorizeRequest":{"id":"components/schemas/DeviceAuthorizeRequest","kind":"json-schema","title":"DeviceAuthorizeRequest","data":{"type":"object","properties":{"client_id":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Obtained during either manual client registration or through the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/client"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Dynamic Client Registration API"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". It identifies the client and must match the value preregistered in Okta."},"children":[]}]}]}]},"scope":{"type":"string","description":"A list of scopes that the client wants to include in the access token"}}}},"components/schemas/DeviceAuthorizeRequestCustomAS":{"id":"components/schemas/DeviceAuthorizeRequestCustomAS","kind":"json-schema","title":"DeviceAuthorizeRequestCustomAS","data":{"type":"object","properties":{"client_id":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Obtained during either manual client registration or through the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/openapi/okta-oauth/oauth/client"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Dynamic Client Registration API"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". It identifies the client and must match the value preregistered in Okta."},"children":[]}]}]}]},"resource":{"type":"array","items":{"type":"string","format":"uri"},"x-okta-lifecycle":{"lifecycle":"EA","isGenerallyAvailable":false,"SKUs":[]},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An absolute URI that identifies the target resource server for the device authorization request."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The issued access token's "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"aud"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claim is set to this value. Repeat the parameter to request a token that's valid for multiple resource servers ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"?resource=https://api.example.com&resource=https://other.example.com"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", for example)."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Multiple audiences for custom authorization servers is a "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/docs/concepts/feature-lifecycle-management/#self-service-features"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"self-service Early Access (EA)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" feature. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Manage Early Access and Beta features"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to enable the feature."},"children":[]}]}]}]}]},"scope":{"type":"string","description":"A list of scopes that the client wants to include in the access token"}}}},"components/schemas/DeviceAuthorizeResponse":{"id":"components/schemas/DeviceAuthorizeResponse","kind":"json-schema","title":"DeviceAuthorizeResponse","data":{"type":"object","properties":{"device_code":{"type":"string","description":"The device verification code"},"expires_in":{"type":"integer","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The expiration time of the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"device_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"user_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in seconds"},"children":[]}]}]}]},"interval":{"type":"integer","description":"The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint"},"user_code":{"type":"string","description":"The verification code for the end user"},"verification_uri":{"type":"string","description":"The URI that the end user visits to verify"},"verification_uri_complete":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The URI that includes the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"user_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that the end user alternatively visits to verify"},"children":[]}]}]}]}}}},"components/schemas/EndpointAuthMethod":{"id":"components/schemas/EndpointAuthMethod","kind":"json-schema","title":"EndpointAuthMethod","data":{"description":"Requested authentication method for OAuth 2.0 endpoints","type":"string","enum":["client_secret_basic","client_secret_jwt","client_secret_post","none","private_key_jwt"]}},"components/schemas/Error":{"id":"components/schemas/Error","kind":"json-schema","title":"Error","data":{"title":"Error","type":"object","properties":{"errorCauses":{"type":"array","items":{"type":"object","properties":{"errorSummary":{"type":"string"}}}},"errorCode":{"type":"string","description":"An Okta code for this type of error"},"errorId":{"type":"string","description":"A unique identifier for this error. Okta Support can use this to help with troubleshooting."},"errorLink":{"type":"string","description":"An Okta code for this type of error"},"errorSummary":{"type":"string","description":"A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error."}}}},"components/schemas/GlobalTokenRevocationRequest":{"id":"components/schemas/GlobalTokenRevocationRequest","kind":"json-schema","title":"GlobalTokenRevocationRequest","data":{"nullable":false,"type":"object","properties":{"sub_id":{"$ref":"#/components/schemas/sub_id"}}}},"components/schemas/GrantType":{"id":"components/schemas/GrantType","kind":"json-schema","title":"GrantType","data":{"description":"Determines the mechanism Okta uses to authorize the creation of the tokens","type":"string","enum":["authorization_code","client_credentials","implicit","interaction_code","password","refresh_token","urn:ietf:params:oauth:grant-type:device_code","urn:ietf:params:oauth:grant-type:jwt-bearer","urn:ietf:params:oauth:grant-type:saml2-bearer","urn:ietf:params:oauth:grant-type:token-exchange","urn:openid:params:grant-type:ciba","urn:okta:params:oauth:grant-type:otp","urn:okta:params:oauth:grant-type:oob","http://auth0.com/oauth/grant-type/mfa-otp","http://auth0.com/oauth/grant-type/mfa-oob"]}},"components/schemas/IntrospectionRequest":{"id":"components/schemas/IntrospectionRequest","kind":"json-schema","title":"IntrospectionRequest","data":{"type":"object","properties":{"token":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An access token, ID token, refresh token, or a device secret."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Although ID tokens can be sent to this endpoint, they are usually validated on the service provider or app side of a flow."},"children":[]}]}]}]}]},"token_type_hint":{"$ref":"#/components/schemas/TokenTypeHintIntrospect"}}}},"components/schemas/IntrospectionResponse":{"id":"components/schemas/IntrospectionResponse","kind":"json-schema","title":"IntrospectionResponse","data":{"additionalProperties":true,"type":"object","properties":{"active":{"type":"boolean","description":"Indicates whether the token is active or not"},"aud":{"type":"string","description":"The audience of the token"},"client_id":{"type":"string","description":"The ID of the client associated with the token"},"device_id":{"type":"string","description":"The ID of the device associated with the token"},"exp":{"type":"integer","description":"The expiration time of the token in seconds since January 1, 1970 UTC"},"iat":{"type":"integer","description":"The issuing time of the token in seconds since January 1, 1970 UTC"},"iss":{"type":"string","description":"The issuer of the token"},"jti":{"type":"string","description":"The identifier of the token"},"nbf":{"type":"integer","description":"Identifies the time (a timestamp in seconds since January 1, 1970 UTC) before which the token must not be accepted for processing"},"scope":{"type":"string","description":"A space-delimited list of scopes"},"sub":{"type":"string","description":"The subject of the token"},"token_type":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The type of token. The value is always "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Bearer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},"uid":{"type":"string","description":"The user ID. This parameter is returned only if the token is an access token and the subject is an end user."},"username":{"type":"string","description":"The username associated with the token."}}}},"components/schemas/JsonEncryptionWebKey":{"id":"components/schemas/JsonEncryptionWebKey","kind":"json-schema","title":"Encryption key","data":{"title":"Encryption key","allOf":[{"$ref":"#/components/schemas/JsonWebKeyBase"}],"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7517"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JSON Web Key (JWK)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is a JSON representation of a cryptographic key. Okta uses these keys to encrypt an ID token JWT minted by the org authorization server or custom authorization server. Okta supports only RSA keys for encrypting tokens."},"children":[]}]}]}],"x-okta-lifecycle":{"lifecycle":"GA","isGenerallyAvailable":true},"type":"object","properties":{"e":{"type":"string","description":"The key exponent of an RSA key"},"kty":{"type":"string","description":"The type of public key","enum":["RSA"]},"n":{"type":"string","description":"The modulus of the RSA key"},"use":{"description":"The intended use of the public key","type":"string","enum":["enc"]}}}},"components/schemas/JsonSigningWebKey":{"id":"components/schemas/JsonSigningWebKey","kind":"json-schema","title":"Signing key","data":{"title":"Signing key","allOf":[{"$ref":"#/components/schemas/JsonWebKeyBase"}],"oneOf":[{"$ref":"#/components/schemas/JsonWebKeyEC"},{"$ref":"#/components/schemas/JsonWebKeyRsa"}],"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7517"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JSON Web Key (JWK)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is a JSON representation of a cryptographic key. Okta can use these keys to verify the signature of a JWT when provided for the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"private_key_jwt"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens."},"children":[]}]}]}],"type":"object","properties":{"alg":{"$ref":"#/components/schemas/SigningAlgorithm"},"use":{"description":"The intended use of the public key","type":"string","enum":["sig"]}}}},"components/schemas/JsonWebKey":{"id":"components/schemas/JsonWebKey","kind":"json-schema","title":"JsonWebKey","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7517"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JSON Web Key (JWK)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is a JSON representation of a cryptographic key. Okta uses these keys to verify the signature of a JWT when provided for the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"private_key_jwt"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta can also use these keys to encrypt an ID token JWT minted by the org authorization server or custom authorization server. Okta supports only RSA keys for encrypting tokens."},"children":[]}]}]}],"type":"object","properties":{"alg":{"$ref":"#/components/schemas/SigningAlgorithm"},"kid":{"type":"string","description":"The unique identifier of the key"},"kty":{"$ref":"#/components/schemas/JsonWebKeyType"},"status":{"$ref":"#/components/schemas/JsonWebKeyStatus"},"use":{"$ref":"#/components/schemas/JsonWebKeyUse"}},"discriminator":{"propertyName":"kty","mapping":{"sig":"#/components/schemas/JsonWebKeyEC","enc":"#/components/schemas/JsonWebKeyRsa"}}}},"components/schemas/JsonWebKeyBase":{"id":"components/schemas/JsonWebKeyBase","kind":"json-schema","title":"JsonWebKeyBase","data":{"type":"object","properties":{"kid":{"type":"string","description":"The unique identifier of the key"}}}},"components/schemas/JsonWebKeyEC":{"id":"components/schemas/JsonWebKeyEC","kind":"json-schema","title":"EC signing key","data":{"title":"EC signing key","description":"An EC signing key","allOf":[{"$ref":"#/components/schemas/JsonSigningWebKey"}],"type":"object","properties":{"kty":{"type":"string","description":"The type of public key","enum":["EC"]},"x":{"type":"string","description":"The public x coordinate for the elliptic curve point"},"y":{"type":"string","description":"The public y coordinate for the elliptic curve point"}}}},"components/schemas/JsonWebKeyRsa":{"id":"components/schemas/JsonWebKeyRsa","kind":"json-schema","title":"RSA signing key","data":{"title":"RSA signing key","description":"An RSA signing key","allOf":[{"$ref":"#/components/schemas/JsonSigningWebKey"}],"type":"object","properties":{"e":{"type":"string","description":"The key exponent of an RSA key"},"kty":{"type":"string","description":"The type of public key","enum":["RSA"]},"n":{"type":"string","description":"The modulus of the RSA key"}}}},"components/schemas/JsonWebKeyStatus":{"id":"components/schemas/JsonWebKeyStatus","kind":"json-schema","title":"JsonWebKeyStatus","data":{"description":"The status of the public key","type":"string","enum":["ACTIVE","INACTIVE"]}},"components/schemas/JsonWebKeyType":{"id":"components/schemas/JsonWebKeyType","kind":"json-schema","title":"JsonWebKeyType","data":{"description":"The type of public key","type":"string","enum":["EC","RSA"]}},"components/schemas/JsonWebKeyUse":{"id":"components/schemas/JsonWebKeyUse","kind":"json-schema","title":"JsonWebKeyUse","data":{"description":"The intended use of the public key","type":"string","enum":["enc","sig"]}},"components/schemas/LogoutWithPost":{"id":"components/schemas/LogoutWithPost","kind":"json-schema","title":"LogoutWithPost","data":{"type":"object","properties":{"id_token_hint":{"description":"A valid ID token with a subject that matches the current session","type":"string"},"post_logout_redirect_uri":{"description":"Location to redirect to after the logout is performed. It must match the value preregistered in Okta during client registration.","type":"string"},"state":{"description":"An optional value that's returned as a query parameter during the redirect at the end of the flow","type":"string"}},"required":["id_token_hint"]}},"components/schemas/OAuthError":{"id":"components/schemas/OAuthError","kind":"json-schema","title":"OAuthError","data":{"type":"object","properties":{"error":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An error code defined in "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc6749#section-5.2"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RFC6749"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or other extension"},"children":[]}]}]}]},"error_description":{"type":"string","description":"A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error."}}}},"components/schemas/OAuthIdTokenKeyEncryptionAlgorithm":{"id":"components/schemas/OAuthIdTokenKeyEncryptionAlgorithm","kind":"json-schema","title":"OAuthIdTokenKeyEncryptionAlgorithm","data":{"description":"JWE alg algorithm for encrypting the ID token issued to this client. If this is requested, the response is signed, and then encrypted with the result being a nested JWT. The default, if omitted, is that no encryption is performed.","x-okta-lifecycle":{"lifecycle":"GA","isGenerallyAvailable":true},"type":"string","enum":["RSA-OAEP-256","RSA-OAEP-384","RSA-OAEP-512"]}},"components/schemas/OAuthKeys":{"id":"components/schemas/OAuthKeys","kind":"json-schema","title":"OAuthKeys","data":{"type":"object","properties":{"keys":{"type":"array","items":{"$ref":"#/components/schemas/JsonWebKey"}}}}},"components/schemas/OAuthMetadata":{"id":"components/schemas/OAuthMetadata","kind":"json-schema","title":"OAuthMetadata","data":{"type":"object","properties":{"authorization_endpoint":{"type":"string","description":"URL of the authorization server's authorization endpoint"},"backchannel_authentication_request_signing_alg_values_supported":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A list of signing algorithms that this authorization server supports for signed requests"},"children":[]}]}]}],"type":"array","items":{"$ref":"#/components/schemas/SigningAlgorithm"},"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]}},"backchannel_token_delivery_modes_supported":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The delivery modes that this authorization server supports for Client-Initiated Backchannel Authentication"},"children":[]}]}]}],"type":"array","items":{"$ref":"#/components/schemas/TokenDeliveryMode"},"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]}},"claims_supported":{"description":"A list of the claims supported by this authorization server","type":"array","items":{"$ref":"#/components/schemas/Claim"}},"code_challenge_methods_supported":{"description":"A list of PKCE code challenge methods supported by this authorization server","type":"array","items":{"$ref":"#/components/schemas/CodeChallengeMethod"}},"device_authorization_endpoint":{"type":"string"},"dpop_signing_alg_values_supported":{"description":"A list of signing algorithms supported by this authorization server for Demonstrating Proof-of-Possession (DPoP) JWTs","type":"array","items":{"type":"string","enum":["ES256","ES384","ES512","RS256","RS384","RS512"]},"x-okta-lifecycle":{"lifecycle":"TOMBSTONE","isGenerallyAvailable":false,"SKUs":[]}},"end_session_endpoint":{"description":"URL of the authorization server's logout endpoint","type":"string"},"grant_types_supported":{"description":"A list of the grant type values that this authorization server supports","type":"array","items":{"$ref":"#/components/schemas/GrantType"}},"introspection_endpoint":{"description":"URL of the authorization server's introspection endpoint","type":"string"},"introspection_endpoint_auth_methods_supported":{"description":"A list of client authentication methods supported by this introspection endpoint","type":"array","items":{"$ref":"#/components/schemas/EndpointAuthMethod"}},"issuer":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The authorization server's issuer identifier. In the context of this document, this is your authorization server's base URL. This becomes the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iss"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claim in an access token."},"children":[]}]}]}]},"jwks_uri":{"description":"URL of the authorization server's JSON Web Key Set document","type":"string"},"pushed_authorization_request_endpoint":{"type":"string"},"registration_endpoint":{"description":"URL of the authorization server's JSON Web Key Set document","type":"string"},"request_object_signing_alg_values_supported":{"description":"A list of signing algorithms that this authorization server supports for signed requests","type":"array","items":{"$ref":"#/components/schemas/SigningAlgorithm"}},"request_parameter_supported":{"description":"Indicates if request parameters are supported by this authorization server","type":"boolean"},"response_modes_supported":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A list of the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_mode"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" values that this authorization server supports"},"children":[]}]}]}],"type":"array","items":{"$ref":"#/components/schemas/ResponseMode"}},"response_types_supported":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A list of the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" values that this authorization server supports. Can be a combination of "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"type":"array","items":{"$ref":"#/components/schemas/ResponseTypesSupported"}},"revocation_endpoint":{"description":"URL of the authorization server's revocation endpoint","type":"string"},"revocation_endpoint_auth_methods_supported":{"description":"A list of client authentication methods supported by this revocation endpoint","type":"array","items":{"$ref":"#/components/schemas/EndpointAuthMethod"}},"scopes_supported":{"description":"A list of the scope values that this authorization server supports","type":"array","items":{"$ref":"#/components/schemas/Scope"}},"subject_types_supported":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A list of the subject identifier types that this authorization server supports. Valid types include "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"pairwise"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"public"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", but only "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"public"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is currently supported. See the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Subject Identifier Types"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" section in the OpenID Connect specification."},"children":[]}]}]}],"type":"array","items":{"$ref":"#/components/schemas/SubjectType"}},"token_endpoint":{"description":"URL of the authorization server's token endpoint","type":"string"},"token_endpoint_auth_methods_supported":{"description":"A list of client authentication methods supported by this token endpoint","type":"array","items":{"$ref":"#/components/schemas/EndpointAuthMethod"}}}}},"components/schemas/OidcMetadata":{"id":"components/schemas/OidcMetadata","kind":"json-schema","title":"OidcMetadata","data":{"allOf":[{"$ref":"#/components/schemas/OAuthMetadata"},{"type":"object","properties":{"id_token_encryption_alg_values_supported":{"description":"JSON array that contains a list of the JWE encryption algorithms (alg values) supported for the ID token to encode the claims in a JWT","type":"array","items":{"$ref":"#/components/schemas/OAuthIdTokenKeyEncryptionAlgorithm"},"x-okta-lifecycle":{"lifecycle":"GA","isGenerallyAvailable":true}},"id_token_encryption_enc_values_supported":{"description":"JSON array that contains a list of the JWE encryption algorithms (enc values) supported for the ID token to encode the claims in a JWT","type":"array","items":{"$ref":"#/components/schemas/ContentEncryptionAlgorithm"},"x-okta-lifecycle":{"lifecycle":"GA","isGenerallyAvailable":true}},"id_token_signing_alg_values_supported":{"description":"A list of signing algorithms that this authorization server supports for signing ID tokens","type":"array","items":{"$ref":"#/components/schemas/SigningAlgorithm"}},"userinfo_endpoint":{"description":"URL of the authorization server's userinfo endpoint","type":"string"}}}]}},"components/schemas/OobAuthenticateRequest":{"id":"components/schemas/OobAuthenticateRequest","kind":"json-schema","title":"OobAuthenticateRequest","data":{"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]},"type":"object","properties":{"challenge_hint":{"$ref":"#/components/schemas/ChallengeHint"},"channel_hint":{"$ref":"#/components/schemas/Channel"},"login_hint":{"type":"string","description":"The user sign-in information for whom authentication is being requested"}},"required":["login_hint","channel_hint","challenge_hint"]}},"components/schemas/OobAuthenticateResponse":{"id":"components/schemas/OobAuthenticateResponse","kind":"json-schema","title":"OobAuthenticateResponse","data":{"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]},"type":"object","properties":{"binding_code":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The end-user verification code used to bind the authorization operation on the secondary channel with the primary channel. Present only if "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"binding_method=transfer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},"binding_method":{"$ref":"#/components/schemas/BindingMethod"},"channel":{"$ref":"#/components/schemas/Channel"},"expires_in":{"type":"integer","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Number of seconds until the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"oob_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" expires"},"children":[]}]}]}]},"interval":{"type":"integer","description":"The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint"},"oob_code":{"type":"string","description":"A unique identifier for identifying the out-of-band transaction across multiple requests"}}}},"components/schemas/ParRequest":{"id":"components/schemas/ParRequest","kind":"json-schema","title":"ParRequest","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"See "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" query parameters for more information"},"children":[]}]}]}],"type":"object","properties":{"client_id":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Obtained during either manual client registration or through the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Dynamic Client Registration API"},"children":[]}]}]}]}],"type":"string"},"code_challenge":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A challenge for "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PKCE"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The challenge is verified in the access token request."},"children":[]}]}]}],"type":"string"},"code_challenge_method":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Method used to derive the code challenge for "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PKCE"},"children":[]}]}]}]}],"items":{"$ref":"#/components/schemas/CodeChallengeMethod"}},"display":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"display"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter to be passed to the external identity provider when performing "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/identity-providers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"social login"},"children":[]}]}]}]}]},"idp":{"type":"string","description":"An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session."},"idp_scope":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/identity-providers/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"social login"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". These scopes are used in addition to the scopes already configured for the identity provider."},"children":[]}]}]}]},"login_hint":{"type":"string","description":"A username to pre-populate if prompting for authentication"},"max_age":{"type":"integer","description":"Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta"},"nonce":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OIDC Specs"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},"prompt":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If you don't specify the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"prompt"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter, the standard behavior occurs:"},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, Okta prompts the user to authenticate."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"If scopes are requested that require consent and consent isn't yet given by the authenticated user, Okta prompts the user to give consent."},"children":[]}]}]}]}],"items":{"$ref":"#/components/schemas/Prompt"}},"redirect_uri":{"type":"string","description":"Callback location where you want the authorization code or tokens sent to. It must match the value preregistered in Okta during client registration."},"request":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Used to push a "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc9126#name-the-request-request-paramet"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Request Object JWT"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to the authorization server"},"children":[]}]}]}]},"response_mode":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"How Okta should return the authorization response. If "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is specified in the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", then "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"query"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" isn't allowed as a response mode. Defaults to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"fragment"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in implicit and hybrid flows."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Referrer-Policy"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" header is automatically included in the response when either the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"fragment"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"query"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" parameter values are used. The header is set to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Referrer-Policy: no-referrer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"items":{"$ref":"#/components/schemas/ResponseMode"}},"response_type":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Any combination of "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". The combination determines the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"flow"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}],"items":{"$ref":"#/components/schemas/ResponseTypesSupported"}},"scope":{"type":"string","description":"A space-delimited string of scopes requested"},"sessionToken":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Okta one-time session token. This is an Okta extension to the OpenID specification. The "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"sessionToken"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" allows an API-based user sign-in flow."},"children":[]}]}]}]},"state":{"type":"string","description":"A value returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters."}}}},"components/schemas/ParResponse":{"id":"components/schemas/ParResponse","kind":"json-schema","title":"ParResponse","data":{"type":"object","properties":{"expires_in":{"type":"integer","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Number of seconds until the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"request_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" expires"},"children":[]}]}]}]},"request_uri":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Location where the authorization request payload data is referenced in authorization requests to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint"},"children":[]}]}]}]}}}},"components/schemas/Prompt":{"id":"components/schemas/Prompt","kind":"json-schema","title":"Prompt","data":{"type":"string","enum":["consent","enroll_authenticator","login","login consent","none"],"x-enumDescriptions":{"none":"Don't prompt for authentication or consent. If an Okta session already exists, the user is silently authenticated. Otherwise, an error is returned.","login":"Always prompt the user for authentication, regardless of whether they have an Okta session.","consent":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Depending on the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/createapplication"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"values set for consent_method in the app and consent for the scope"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", display the Okta consent dialog, even if the user has already given consent. User consent is available for custom authorization servers (requires the API Access Management feature and the User Consent feature enabled)."},"children":[]}]}]}],"login consent":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Can also be "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"consent login"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" (order doesn't matter). The user is always prompted for authentication, and the user consent dialog appears depending on the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/createapplication"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"values set for consent_method in the app and consent on the scope"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", even if the user has already given consent."},"children":[]}]}]}],"enroll_authenticator":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This indicates that the intent is to enroll the user with an authenticator. The following other parameters must be used together with this value for a valid request:"},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"enroll_amr_values"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":": Value must be specified and indicates which authenticator method you're allowing the user to enroll."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":": Value must be "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"none"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", which means no tokens should be returned at the end of the flow."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"acr_values"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":": Value must be "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:loa:2fa:any:ifpossible"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", which means the user is prompted for at least one factor before enrollment."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"max_age"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":": Value must be "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"0"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", which means no existing session should be considered."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"scope"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"nonce"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" must not be specified, because no tokens are generated."},"children":[]}]}]}]}]}}},"components/schemas/ResponseMode":{"id":"components/schemas/ResponseMode","kind":"json-schema","title":"ResponseMode","data":{"type":"string","enum":["form_post","fragment","okta_post_message","query"],"x-enumDescriptions":{"fragment":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Parameters are encoded in the URL fragment added to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" when redirecting back to the client."},"children":[]}]}]}],"query":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Parameters are encoded in the query string added to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" when redirecting back to the client."},"children":[]}]}]}],"form_post":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Parameters are encoded as HTML form values ("},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"application/x-www-form-urlencoded"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" format) and are transmitted through the HTTP POST method to the client."},"children":[]}]}]}],"okta_post_message":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Uses "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"HTML5 Web Messaging"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", for example, "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"window.postMessage()"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" instead of the redirect for the authorization response from the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"okta_post_message"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is an adaptation of the "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/draft-sakimura-oauth-wmrm-00#section-4.1"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Web Message Response Mode"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This value provides a secure way for a single-page app to perform a sign-in flow in a pop-up window or an iFrame and receive the ID token, access token, and/or authorization code back in the parent page without leaving the context of that page."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Use the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"postMessage()"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" data object to help you when working with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"okta_post_message"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" value of the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_mode"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" request parameter."},"children":[]}]}]},{"$$mdtype":"Node","type":"table","attributes":{},"children":[{"$$mdtype":"Node","type":"thead","attributes":{},"children":[{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"th","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Parameter"},"children":[]}]}]},{"$$mdtype":"Node","type":"th","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Description"},"children":[]}]}]},{"$$mdtype":"Node","type":"th","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Data Type"},"children":[]}]}]}]}]},{"$$mdtype":"Node","type":"tbody","attributes":{},"children":[{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"access_token"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An access token. This is returned if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" included "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"string"},"children":[]}]}]}]},{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"error"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The error code, if something went wrong"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"string"},"children":[]}]}]}]},{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"error_description"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Additional error information (if any)"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"string"},"children":[]}]}]}]},{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"id_token"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An ID token. This is returned if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"response_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" includes "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"id_token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"string"},"children":[]}]}]}]},{"$$mdtype":"Node","type":"tr","attributes":{},"children":[{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"state"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The unmodified "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"state"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" value from the request"},"children":[]}]}]},{"$$mdtype":"Node","type":"td","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"string"},"children":[]}]}]}]}]}]}]}}},"components/schemas/ResponseType":{"id":"components/schemas/ResponseType","kind":"json-schema","title":"ResponseType","data":{"type":"string","enum":["code","id_token","none","token"]}},"components/schemas/ResponseTypesSupported":{"id":"components/schemas/ResponseTypesSupported","kind":"json-schema","title":"ResponseTypesSupported","data":{"type":"string","enum":["code","code id_token","code id_token token","code token","id_token","id_token token","token"]}},"components/schemas/RevokeRequestCustomAs":{"id":"components/schemas/RevokeRequestCustomAs","kind":"json-schema","title":"RevokeRequestCustomAs","data":{"type":"object","properties":{"token":{"type":"string","description":"An access token, refresh token, or a device secret","example":"<access_token_value>"},"token_type_hint":{"$ref":"#/components/schemas/TokenTypeHintRevokeCustomAs"}},"required":["token"]}},"components/schemas/RevokeRequestOrgAs":{"id":"components/schemas/RevokeRequestOrgAs","kind":"json-schema","title":"RevokeRequestOrgAs","data":{"type":"object","properties":{"token":{"type":"string","description":"The token to revoke","example":"<access_token_value>"},"token_type_hint":{"$ref":"#/components/schemas/TokenTypeHintRevokeOrgAs"}},"required":["token"]}},"components/schemas/Scope":{"id":"components/schemas/Scope","kind":"json-schema","title":"Scope","data":{"type":"string"}},"components/schemas/SigningAlgorithm":{"id":"components/schemas/SigningAlgorithm","kind":"json-schema","title":"SigningAlgorithm","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The type of "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc7517#section-5"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"JSON Web Key Set"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" algorithm that you must use for signing request objects. When you specify a value for the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"request_object_signing_alg"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" property, all request objects from the client are rejected if not signed with the specified algorithm. You must use the algorithm when the request object is passed by value (using the request parameter). If a value for "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"request_object_signing_alg"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" isn't specified, the default is any algorithm that's supported by both the client and the server."},"children":[]}]}]}],"type":"string","enum":["ES256","ES384","ES512","HS256","HS384","HS512","RS256","RS384","RS512"]}},"components/schemas/SubIdIssSub":{"id":"components/schemas/SubIdIssSub","kind":"json-schema","title":"Issuer-Subject Identifier","data":{"x-okta-lifecycle":{"lifecycle":"EA","isGenerallyAvailable":false,"SKUs":[]},"title":"Issuer-Subject Identifier","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Subject identifier using issuer and subject from third-party IdP"},"children":[]}]}]}],"type":"object","properties":{"format":{"type":"string","description":"The subject identifier format that uses the issuer and subject from third-party IdPs. It determines how users are identified in revocation requests.","nullable":false,"writeOnly":true,"enum":["iss_sub"]},"iss":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Issuer identifier from the IdP."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"For SAML IdPs, the issuer identifier is the IdP issuer."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"For OIDC IdPs, the issuer identifier is the issuer URL."},"children":[]}]}]}]}],"writeOnly":true,"nullable":false,"example":"https://idp.example.com"},"sub":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Subject identifier from the IdP."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"*"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"For SAML IdPs, the subject identifier is the NameID."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"For OIDC IdPs, the subject identifier is the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"sub"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claim."},"children":[]}]}]}]}],"writeOnly":true,"nullable":false,"example":"user@example.com"}},"required":["format","sub","iss"]}},"components/schemas/SubIdOpaque":{"id":"components/schemas/SubIdOpaque","kind":"json-schema","title":"Opaque subject identifier","data":{"title":"Opaque subject identifier","description":"Subject identifier that uses Okta's opaque user ID format","type":"object","properties":{"format":{"type":"string","description":"The subject identifier format that uses Okta's opaque user ID format. It determines how users are identified in revocation requests.","nullable":false,"writeOnly":true,"enum":["opaque"]},"id":{"type":"string","description":"ID of an existing Okta user","writeOnly":true,"nullable":false,"example":"00u1dnq5S0CfjlkpABCD"}},"required":["format","id"]}},"components/schemas/SubjectType":{"id":"components/schemas/SubjectType","kind":"json-schema","title":"SubjectType","data":{"type":"string","enum":["pairwise","public"]}},"components/schemas/TokenDeliveryMode":{"id":"components/schemas/TokenDeliveryMode","kind":"json-schema","title":"TokenDeliveryMode","data":{"type":"string","enum":["poll"]}},"components/schemas/TokenRequest":{"id":"components/schemas/TokenRequest","kind":"json-schema","title":"TokenRequest","data":{"type":"object","properties":{"grant_type":{"$ref":"#/components/schemas/GrantType"}}}},"components/schemas/TokenRequestAuthorizationCode":{"id":"components/schemas/TokenRequestAuthorizationCode","kind":"json-schema","title":"TokenRequestAuthorizationCode","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"code":{"type":"string","description":"The value is what was returned from the authorization endpoint. The code has a lifetime of 300 seconds."},"code_verifier":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Required if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code_challenge"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" was specified in the original "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" request. This value is the code verifier for PKCE. Okta uses it to recompute the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code_challenge"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and verify if it matches the original "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"code_challenge"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" in the authorization request."},"children":[]}]}]}]},"redirect_uri":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Specifies the callback location where the authorization was sent. This value must match the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"redirect_uri"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" used to generate the original "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"authorization_code"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}},"required":["code"]}]}},"components/schemas/TokenRequestAuthorizationCodeCustomAS":{"id":"components/schemas/TokenRequestAuthorizationCodeCustomAS","kind":"json-schema","title":"TokenRequestAuthorizationCodeCustomAS","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequestAuthorizationCode"},{"type":"object","properties":{"resource":{"x-okta-lifecycle":{"lifecycle":"EA","isGenerallyAvailable":false,"SKUs":[]},"type":"array","items":{"type":"string","format":"uri"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An absolute URI that identifies the target resource server that's requested the token. Use this parameter to restrict the token to a specific resource server or servers."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Repeat the parameter to request a token that's valid for multiple resource servers. The URI values must be a subset of the resources that are specified in the original "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" request."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Multiple audiences for custom authorization servers is a "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/docs/concepts/feature-lifecycle-management/#self-service-features"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"self-service Early Access (EA)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" feature. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Manage Early Access and Beta features"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to enable the feature."},"children":[]}]}]}]}]}}}]}},"components/schemas/TokenRequestCiba":{"id":"components/schemas/TokenRequestCiba","kind":"json-schema","title":"TokenRequestCiba","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"auth_req_id":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The value is what was returned from "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/bc/authorize"},"children":[]}]}]}],"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]}}},"required":["auth_req_id"]}]}},"components/schemas/TokenRequestClientCredentials":{"id":"components/schemas/TokenRequestClientCredentials","kind":"json-schema","title":"TokenRequestClientCredentials","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"scope":{"type":"string","description":"The scopes requested"}},"required":["scope"]}]}},"components/schemas/TokenRequestClientCredentialsCustomAS":{"id":"components/schemas/TokenRequestClientCredentialsCustomAS","kind":"json-schema","title":"TokenRequestClientCredentialsCustomAS","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequestClientCredentials"},{"type":"object","properties":{"resource":{"x-okta-lifecycle":{"lifecycle":"EA","isGenerallyAvailable":false,"SKUs":[]},"type":"array","items":{"type":"string","format":"uri"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An absolute URI that identifies the target resource server that's requested the token. Use this parameter to restrict the token to a specific resource server or servers."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Repeat the parameter to request a token that's valid for multiple resource servers."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Multiple audiences for custom authorization servers is a "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/docs/concepts/feature-lifecycle-management/#self-service-features"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"self-service Early Access (EA)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" feature. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Manage Early Access and Beta features"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to enable the feature."},"children":[]}]}]}]}]}}}]}},"components/schemas/TokenRequestCustomAs":{"id":"components/schemas/TokenRequestCustomAs","kind":"json-schema","title":"TokenRequestCustomAs","data":{"type":"object","properties":{"grant_type":{"$ref":"#/components/schemas/GrantType"}},"discriminator":{"propertyName":"grant_type","mapping":{"authorization_code":"#/components/schemas/TokenRequestAuthorizationCodeCustomAS","client_credentials":"#/components/schemas/TokenRequestClientCredentialsCustomAS","password":"#/components/schemas/TokenRequestPassword","refresh_token":"#/components/schemas/TokenRequestRefreshTokenCustomAS","urn:ietf:params:oauth:grant-type:saml2-bearer":"#/components/schemas/TokenRequestSamlBearer","urn:ietf:params:oauth:grant-type:token-exchange":"#/components/schemas/TokenRequestTokenExchangeCustomAs","urn:ietf:params:oauth:grant-type:device_code":"#/components/schemas/TokenRequestDeviceCodeCustomAS","urn:openid:params:grant-type:ciba":"#/components/schemas/TokenRequestCiba","urn:okta:params:oauth:grant-type:otp":"#/components/schemas/TokenRequestDirectAuthenticationOtp","urn:okta:params:oauth:grant-type:oob":"#/components/schemas/TokenRequestDirectAuthenticationOob","http://auth0.com/oauth/grant-type/mfa-otp":"#/components/schemas/TokenRequestDirectAuthenticationMfaOtp","http://auth0.com/oauth/grant-type/mfa-oob":"#/components/schemas/TokenRequestDirectAuthenticationMfaOob","urn:ietf:params:oauth:grant-type:jwt-bearer":"#/components/schemas/TokenRequestJwtBearer"}}}},"components/schemas/TokenRequestDeviceCode":{"id":"components/schemas/TokenRequestDeviceCode","kind":"json-schema","title":"TokenRequestDeviceCode","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"device_code":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The device verification code that was returned from the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/device/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" endpoint"},"children":[]}]}]}]}},"required":["device_code"]}]}},"components/schemas/TokenRequestDeviceCodeCustomAS":{"id":"components/schemas/TokenRequestDeviceCodeCustomAS","kind":"json-schema","title":"TokenRequestDeviceCodeCustomAS","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequestDeviceCode"},{"type":"object","properties":{"resource":{"x-okta-lifecycle":{"lifecycle":"EA","isGenerallyAvailable":false,"SKUs":[]},"type":"array","items":{"type":"string","format":"uri"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An absolute URI that identifies the target resource server. Use this parameter to restrict the token to a specific resource server or servers."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"It must be a subset of the resource(s) that are specified in the original "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/device/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" request."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Multiple audiences for custom authorization servers is a "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/docs/concepts/feature-lifecycle-management/#self-service-features"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"self-service Early Access (EA)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" feature. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Manage Early Access and Beta features"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to enable the feature."},"children":[]}]}]}]}]}}}]}},"components/schemas/TokenRequestDirectAuthReferenceValue":{"id":"components/schemas/TokenRequestDirectAuthReferenceValue","kind":"json-schema","title":"TokenRequestDirectAuthReferenceValue","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequestDirectAuthenticationOtp"},{"$ref":"#/components/schemas/TokenRequestDirectAuthenticationMfaOtp"},{"$ref":"#/components/schemas/TokenRequestDirectAuthenticationOob"},{"$ref":"#/components/schemas/TokenRequestDirectAuthenticationMfaOob"}],"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]}}},"components/schemas/TokenRequestDirectAuthenticationMfaOob":{"id":"components/schemas/TokenRequestDirectAuthenticationMfaOob","kind":"json-schema","title":"TokenRequestDirectAuthenticationMfaOob","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"grant_types_supported":{"description":"A list of the grant type values that this authorization server supports","type":"array","items":{"$ref":"#/components/schemas/GrantType"}},"mfa_token":{"type":"string","description":"The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests"},"oob_code":{"type":"string","description":"The value returned from a previous oob-authenticate or challenge request for identifying an out-of-band transaction across multiple requests"},"scope":{"type":"string","description":"The scopes requested"}},"required":["grant_type","mfa_token","oob_code"]}],"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]}}},"components/schemas/TokenRequestDirectAuthenticationMfaOtp":{"id":"components/schemas/TokenRequestDirectAuthenticationMfaOtp","kind":"json-schema","title":"TokenRequestDirectAuthenticationMfaOtp","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"grant_types_supported":{"description":"A list of the grant type values that this authorization server supports","type":"array","items":{"$ref":"#/components/schemas/GrantType"}},"mfa_token":{"type":"string","description":"The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests"},"otp":{"type":"string","description":"The one-time passcode for an enrolled authenticator of the user for whom authentication is being requested"},"scope":{"type":"string","description":"The scopes requested"}},"required":["grant_type","mfa_token","otp"]}],"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]}}},"components/schemas/TokenRequestDirectAuthenticationOob":{"id":"components/schemas/TokenRequestDirectAuthenticationOob","kind":"json-schema","title":"TokenRequestDirectAuthenticationOob","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"grant_types_supported":{"description":"A list of the grant type values that this authorization server supports","type":"array","items":{"$ref":"#/components/schemas/GrantType"}},"oob_code":{"type":"string","description":"The value returned from a previous oob-authenticate or challenge request for identifying an out-of-band transaction across multiple requests"},"scope":{"type":"string","description":"The scopes requested"}},"required":["grant_type","scope","oob_code"]}],"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]}}},"components/schemas/TokenRequestDirectAuthenticationOtp":{"id":"components/schemas/TokenRequestDirectAuthenticationOtp","kind":"json-schema","title":"TokenRequestDirectAuthenticationOtp","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"grant_types_supported":{"description":"A list of the grant type values that the client supports","type":"array","items":{"$ref":"#/components/schemas/GrantType"}},"login_hint":{"type":"string","description":"The user sign-in information for whom authentication is being requested"},"otp":{"type":"string","description":"The one-time passcode for an enrolled authenticator of the user for whom authentication is being requested"},"scope":{"type":"string","description":"The scopes requested"}},"required":["grant_type","scope","login_hint","otp"]}],"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":["Okta Identity Engine"]}}},"components/schemas/TokenRequestJwtBearer":{"id":"components/schemas/TokenRequestJwtBearer","kind":"json-schema","title":"TokenRequestJwtBearer","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"assertion":{"type":"string","description":"The JSON Web Token (JWT) assertion"},"scope":{"type":"string","description":"The scopes requested"}},"required":["assertion"]}],"x-okta-lifecycle":{"lifecycle":"LIMITED_GA","isGenerallyAvailable":false,"SKUs":[]}}},"components/schemas/TokenRequestOrgAs":{"id":"components/schemas/TokenRequestOrgAs","kind":"json-schema","title":"TokenRequestOrgAs","data":{"type":"object","properties":{"grant_type":{"$ref":"#/components/schemas/GrantType"}},"discriminator":{"propertyName":"grant_type","mapping":{"authorization_code":"#/components/schemas/TokenRequestAuthorizationCode","client_credentials":"#/components/schemas/TokenRequestClientCredentials","password":"#/components/schemas/TokenRequestPassword","refresh_token":"#/components/schemas/TokenRequestRefreshToken","urn:ietf:params:oauth:grant-type:saml2-bearer":"#/components/schemas/TokenRequestSamlBearer","urn:ietf:params:oauth:grant-type:token-exchange":"#/components/schemas/TokenRequestTokenExchangeOrgAs","urn:ietf:params:oauth:grant-type:device_code":"#/components/schemas/TokenRequestDeviceCode","urn:openid:params:grant-type:ciba":"#/components/schemas/TokenRequestCiba","urn:okta:params:oauth:grant-type:otp":"#/components/schemas/TokenRequestDirectAuthenticationOtp","urn:okta:params:oauth:grant-type:oob":"#/components/schemas/TokenRequestDirectAuthenticationOob","http://auth0.com/oauth/grant-type/mfa-otp":"#/components/schemas/TokenRequestDirectAuthenticationMfaOtp","http://auth0.com/oauth/grant-type/mfa-oob":"#/components/schemas/TokenRequestDirectAuthenticationMfaOob"}}}},"components/schemas/TokenRequestPassword":{"id":"components/schemas/TokenRequestPassword","kind":"json-schema","title":"TokenRequestPassword","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"password":{"type":"string","description":"The password of the matching user"},"scope":{"type":"string","description":"The scopes requested"},"username":{"type":"string","description":"The identifier for the user"}},"required":["password","scope","username"]}]}},"components/schemas/TokenRequestRefreshToken":{"id":"components/schemas/TokenRequestRefreshToken","kind":"json-schema","title":"TokenRequestRefreshToken","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"refresh_token":{"type":"string","description":"The refresh token"},"scope":{"type":"string","description":"The scopes requested. They must be a subset of the original scopes associated with the refresh token."}},"required":["refresh_token"]}]}},"components/schemas/TokenRequestRefreshTokenCustomAS":{"id":"components/schemas/TokenRequestRefreshTokenCustomAS","kind":"json-schema","title":"TokenRequestRefreshTokenCustomAS","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequestRefreshToken"},{"type":"object","properties":{"resource":{"x-okta-lifecycle":{"lifecycle":"EA","isGenerallyAvailable":false,"SKUs":[]},"type":"array","items":{"type":"string","format":"uri"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An absolute URI that identifies the target resource server. Use this parameter to restrict the token to a specific resource server or servers."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"It must be a subset of the resource(s) that are specified in the original "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/device/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" request."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" Multiple audiences for custom authorization servers is a "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"/docs/concepts/feature-lifecycle-management/#self-service-features"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"self-service Early Access (EA)"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" feature. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Manage Early Access and Beta features"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" to enable the feature."},"children":[]}]}]}]}]}}}]}},"components/schemas/TokenRequestSamlBearer":{"id":"components/schemas/TokenRequestSamlBearer","kind":"json-schema","title":"TokenRequestSamlBearer","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"type":"object","properties":{"assertion":{"type":"string","description":"The base64-encoded SAML Assertion","x-okta-lifecycle":{"lifecycle":"GA","isGenerallyAvailable":true}},"scope":{"type":"string","description":"The scopes requested"}},"required":["assertion","scope"]}]}},"components/schemas/TokenRequestTokenExchange":{"id":"components/schemas/TokenRequestTokenExchange","kind":"json-schema","title":"TokenRequestTokenExchange","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequest"},{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://tools.ietf.org/html/rfc8693"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RFC8693: OAuth 2.0 Token Exchange"},"children":[]}]}]}]}],"type":"object","properties":{"actor_token":{"type":"string","description":"A security token that represents the identity of the acting party"},"auth_req_id":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"oie"}},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" The value is what was returned from "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/bc/authorize"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},"scope":{"type":"string","description":"The scopes requested"},"subject_token":{"type":"string","description":"A security token that represents the identity of the party on behalf of whom the request is being made"}},"required":["subject_token"]}]}},"components/schemas/TokenRequestTokenExchangeCustomAs":{"id":"components/schemas/TokenRequestTokenExchangeCustomAs","kind":"json-schema","title":"TokenRequestTokenExchangeCustomAs","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequestTokenExchange"},{"type":"object","properties":{"actor_token_type":{"$ref":"#/components/schemas/TokenTypeCustomAs"},"audience":{"x-okta-lifecycle":{"lifecycle":"EA","isGenerallyAvailable":false,"SKUs":[]},"type":"array","items":{"type":"string"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle-container","attrs":{}},"children":[{"$$mdtype":"Node","type":"tag","tag":"html","inline":true,"attributes":{"name":"x-lifecycle","attrs":{"className":"ea"}},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The logical name of the target service or resource where the client intends to use the requested security tokens."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Repeat the parameter to request a token valid for multiple audiences."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://www.rfc-editor.org/rfc/rfc8693"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RFC 8693"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]},"requested_token_type":{"$ref":"#/components/schemas/TokenTypeCustomAs"},"subject_token_type":{"$ref":"#/components/schemas/TokenTypeCustomAs"}}}]}},"components/schemas/TokenRequestTokenExchangeOrgAs":{"id":"components/schemas/TokenRequestTokenExchangeOrgAs","kind":"json-schema","title":"TokenRequestTokenExchangeOrgAs","data":{"allOf":[{"$ref":"#/components/schemas/TokenRequestTokenExchange"},{"type":"object","properties":{"actor_token_type":{"$ref":"#/components/schemas/TokenTypeOrgAs"},"audience":{"type":"string","description":"The target audience for the requested token"},"requested_token_type":{"$ref":"#/components/schemas/TokenTypeOrgAs"},"subject_token_type":{"$ref":"#/components/schemas/TokenTypeOrgAs"}}}]}},"components/schemas/TokenResponse":{"id":"components/schemas/TokenResponse","kind":"json-schema","title":"TokenResponse","data":{"type":"object","properties":{"access_token":{"type":"string","description":"An access token"},"device_secret":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An opaque device secret. This is returned if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"device_sso"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" scope is granted."},"children":[]}]}]}]},"expires_in":{"type":"integer","description":"The expiration time of the access token in seconds"},"id_token":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An ID token. This is returned if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"openid"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" scope is granted."},"children":[]}]}]}]},"refresh_token":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"An opaque refresh token. This is returned if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"offline_access"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" scope is granted."},"children":[]}]}]}]},"scope":{"type":"string","description":"The scopes contained in the access token"},"token_type":{"$ref":"#/components/schemas/TokenResponseTokenType"}}}},"components/schemas/TokenResponseCustomAs":{"id":"components/schemas/TokenResponseCustomAs","kind":"json-schema","title":"TokenResponseCustomAs","data":{"allOf":[{"$ref":"#/components/schemas/TokenResponse"},{"type":"object","properties":{"issued_token_type":{"$ref":"#/components/schemas/TokenTypeCustomAs"}}}]}},"components/schemas/TokenResponseOrgAs":{"id":"components/schemas/TokenResponseOrgAs","kind":"json-schema","title":"TokenResponseOrgAs","data":{"allOf":[{"$ref":"#/components/schemas/TokenResponse"},{"type":"object","properties":{"issued_token_type":{"$ref":"#/components/schemas/TokenTypeOrgAs"},"service_account":{"$ref":"#/components/schemas/TokenResponseServiceAccount"},"vaulted_secret":{"$ref":"#/components/schemas/TokenResponseVaultedSecret"}}}]}},"components/schemas/TokenResponseServiceAccount":{"id":"components/schemas/TokenResponseServiceAccount","kind":"json-schema","title":"TokenResponseServiceAccount","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The service account credentials."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This is returned if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"issued_token_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:token-type:service-account"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" This is only available if you're subscribed to Okta for AI Agents. Contact Okta Support for more information."},"children":[]}]}]}]}],"type":"object","properties":{"password":{"type":"string","description":"The service account password"},"username":{"type":"string","description":"The service account username"}}}},"components/schemas/TokenResponseTokenType":{"id":"components/schemas/TokenResponseTokenType","kind":"json-schema","title":"TokenResponseTokenType","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The token type in a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" response. The value is generally "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Bearer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" except for a few instances of token exchange."},"children":[]}]}]}],"type":"string","enum":["Bearer","N_A"]}},"components/schemas/TokenResponseVaultedSecret":{"id":"components/schemas/TokenResponseVaultedSecret","kind":"json-schema","title":"TokenResponseVaultedSecret","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The vaulted secret containing key-value pairs."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"This is returned if the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"issued_token_type"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"urn:okta:params:oauth:token-type:vaulted-secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"blockquote","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"strong","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Note:"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" This is only available if you're subscribed to Okta for AI Agents. Contact Okta Support for more information."},"children":[]}]}]}]}],"additionalProperties":{"type":"string"},"type":"object"}},"components/schemas/TokenTypeCustomAs":{"id":"components/schemas/TokenTypeCustomAs","kind":"json-schema","title":"TokenTypeCustomAs","data":{"description":"The type of token for token exchange","type":"string","enum":["urn:ietf:params:oauth:token-type:access_token","urn:ietf:params:oauth:token-type:id_token","urn:ietf:params:oauth:token-type:jwt","urn:ietf:params:oauth:token-type:refresh_token","urn:ietf:params:oauth:token-type:saml1","urn:ietf:params:oauth:token-type:saml2","urn:okta:oauth:token-type:web_sso_token","urn:x-oath:params:oauth:token-type:device-secret","urn:okta:params:oauth:token-type:interclient_token"],"x-enumDescriptions":{"urn:ietf:params:oauth:token-type:access_token":"OAuth 2.0 access token","urn:ietf:params:oauth:token-type:id_token":"ID token","urn:ietf:params:oauth:token-type:jwt":"JSON Web Token (JWT)","urn:ietf:params:oauth:token-type:refresh_token":"OAuth 2.0 refresh token","urn:ietf:params:oauth:token-type:saml1":"SAML 1.1 assertion","urn:ietf:params:oauth:token-type:saml2":"SAML 2.0 assertion","urn:okta:oauth:token-type:web_sso_token":"Web SSO token","urn:x-oath:params:oauth:token-type:device-secret":"Device secret","urn:okta:params:oauth:token-type:interclient_token":"Interclient token"}}},"components/schemas/TokenTypeHintIntrospect":{"id":"components/schemas/TokenTypeHintIntrospect","kind":"json-schema","title":"TokenTypeHintIntrospect","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Indicates the type of "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" being passed"},"children":[]}]}]}],"type":"string","enum":["access_token","device_secret","id_token","refresh_token"]}},"components/schemas/TokenTypeHintRevokeCustomAs":{"id":"components/schemas/TokenTypeHintRevokeCustomAs","kind":"json-schema","title":"TokenTypeHintRevokeCustomAs","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Indicates the type of "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" being passed"},"children":[]}]}]}],"example":"access_token","type":"string","enum":["access_token","device_secret","refresh_token"],"x-enumDescriptions":{"access_token":"OAuth 2.0 access token","device_secret":"Device secret","refresh_token":"OAuth 2.0 refresh token"}}},"components/schemas/TokenTypeHintRevokeOrgAs":{"id":"components/schemas/TokenTypeHintRevokeOrgAs","kind":"json-schema","title":"TokenTypeHintRevokeOrgAs","data":{"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Indicates the type of "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"token"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" being passed"},"children":[]}]}]}],"example":"access_token","type":"string","enum":["access_token","device_secret","refresh_token","oauth_sts"],"x-enumDescriptions":{"access_token":"OAuth 2.0 access token","device_secret":"Device secret","refresh_token":"OAuth 2.0 refresh token","oauth_sts":"OAuth Security Token Service (STS). This type is only available if you're subscribed to Okta for AI Agents."}}},"components/schemas/TokenTypeOrgAs":{"id":"components/schemas/TokenTypeOrgAs","kind":"json-schema","title":"TokenTypeOrgAs","data":{"description":"The type of token for token exchange","type":"string","enum":["urn:ietf:params:oauth:token-type:access_token","urn:ietf:params:oauth:token-type:id_token","urn:ietf:params:oauth:token-type:jwt","urn:ietf:params:oauth:token-type:refresh_token","urn:ietf:params:oauth:token-type:saml1","urn:ietf:params:oauth:token-type:saml2","urn:okta:oauth:token-type:web_sso_token","urn:x-oath:params:oauth:token-type:device-secret","urn:okta:params:oauth:token-type:interclient_token","urn:ietf:params:oauth:token-type:id-jag","urn:okta:params:oauth:token-type:vaulted-secret","urn:okta:params:oauth:token-type:service-account","urn:okta:params:oauth:token-type:oauth-sts"],"x-enumDescriptions":{"urn:ietf:params:oauth:token-type:access_token":"OAuth 2.0 access token","urn:ietf:params:oauth:token-type:id_token":"ID token","urn:ietf:params:oauth:token-type:jwt":"JSON Web Token (JWT)","urn:ietf:params:oauth:token-type:refresh_token":"OAuth 2.0 refresh token","urn:ietf:params:oauth:token-type:saml1":"SAML 1.1 assertion","urn:ietf:params:oauth:token-type:saml2":"SAML 2.0 assertion","urn:okta:oauth:token-type:web_sso_token":"Web SSO token","urn:x-oath:params:oauth:token-type:device-secret":"Device secret","urn:okta:params:oauth:token-type:interclient_token":"Interclient token","urn:ietf:params:oauth:token-type:id-jag":"Identity Assertion JWT Authorization Grant (ID-JAG). This type is only available with Cross App Access or if you're subscribed to Okta for AI Agents.","urn:okta:params:oauth:token-type:vaulted-secret":"OPA vaulted secret. This type is only available if you're subscribed to Okta for AI Agents.","urn:okta:params:oauth:token-type:service-account":"OPA service account. This type is only available if you're subscribed to Okta for AI Agents.","urn:okta:params:oauth:token-type:oauth-sts":"OAuth Security Token Service (STS). This type is only available if you're subscribed to Okta for AI Agents."}}},"components/schemas/UserInfo":{"id":"components/schemas/UserInfo","kind":"json-schema","title":"UserInfo","data":{"additionalProperties":true,"type":"object","properties":{"sub":{"type":"string","description":"The subject identifier"}}}},"components/schemas/sub_id":{"id":"components/schemas/sub_id","kind":"json-schema","title":"sub_id","data":{"nullable":false,"description":"Subject identifier for the user whose tokens should be revoked","oneOf":[{"$ref":"#/components/schemas/SubIdOpaque"},{"$ref":"#/components/schemas/SubIdIssSub"}],"type":"object","discriminator":{"propertyName":"format","mapping":{"opaque":"#/components/schemas/SubIdOpaque","iss_sub":"#/components/schemas/SubIdIssSub"}}}},"schema_1518":{"kind":"json-schema","data":{"type":"integer","minimum":1,"maximum":200,"default":20},"id":"schema_1518"},"schema_1519":{"kind":"json-schema","data":{"type":"array","items":{"$ref":"#/components/schemas/Client"}},"id":"schema_1519"},"schema_1520":{"kind":"json-schema","data":{"$ref":"#/components/schemas/AcrValue"},"id":"schema_1520"},"schema_1521":{"kind":"json-schema","data":{"$ref":"#/components/schemas/CodeChallengeMethod"},"id":"schema_1521"},"schema_1522":{"kind":"json-schema","data":{"$ref":"#/components/schemas/AmrValue"},"id":"schema_1522"},"schema_1523":{"kind":"json-schema","data":{"type":"integer"},"id":"schema_1523"},"schema_1524":{"kind":"json-schema","data":{"$ref":"#/components/schemas/Prompt"},"id":"schema_1524"},"schema_1525":{"kind":"json-schema","data":{"$ref":"#/components/schemas/ResponseTypesSupported"},"id":"schema_1525"},"schema_1526":{"kind":"json-schema","data":{"$ref":"#/components/schemas/ResponseMode"},"id":"schema_1526"},"schema_1527":{"kind":"json-schema","data":{"type":"array","items":{"type":"string","format":"uri"}},"id":"schema_1527"},"schema_1528":{"kind":"json-schema","data":{"type":"object","properties":{"Cache-Control":{"type":"string","example":"max-age=3832304, must-revalidate"}}},"id":"schema_1528"},"schema_1529":{"kind":"json-schema","data":{"type":"object","properties":{"Access-Control-Allow-Origin":{"type":"string","example":"example.okta.com"},"Access-Control-Allow-Methods":{"type":"string","example":"POST"},"Access-Control-Max-Age":{"type":"string","example":3600},"Vary":{"type":"string","example":"Origin"}}},"id":"schema_1529"},"schema_1530":{"kind":"json-schema","data":{"type":"object","properties":{"WWW-Authenticate":{"type":"string","example":"Bearer error=\"invalid_token\", error_description=\"The access token is invalid\""}}},"id":"schema_1530"},"schema_1531":{"kind":"json-schema","data":{"type":"object","properties":{"WWW-Authenticate":{"type":"string","example":"Bearer error=\"insufficient_scope\", error_description=\"The access token must provide access to at least one of these scopes - profile, email, address or phone\""}}},"id":"schema_1531"}},"exampleStore":{"components/examples/BCAuthorizeRequestIdTokenHintExample":{"id":"components/examples/BCAuthorizeRequestIdTokenHintExample","value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","scope":"openid","binding_message":"Signing in from device","id_token_hint":"<id_token_hint_value>"}},"components/examples/BCAuthorizeRequestLoginHintExample":{"id":"components/examples/BCAuthorizeRequestLoginHintExample","value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","scope":"openid","binding_message":"Signing in from device","login_hint":"john.doe@example.com"}},"components/examples/BCAuthorizeSignedRequestExample":{"id":"components/examples/BCAuthorizeSignedRequestExample","value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","request":"<request_value>"}},"components/examples/BackchannelAuthorizeResponseExample":{"id":"components/examples/BackchannelAuthorizeResponseExample","value":{"auth_req_id":"ftJwF5ZwW2SGPPoTQEKtAr_U8_Ek3RvWyR","expires_in":300,"interval":5}},"components/examples/ChallengeErrorInvalidChallengeType":{"id":"components/examples/ChallengeErrorInvalidChallengeType","value":{"error":"access_denied","error_description":"`foo` isn't supported as a `challenge_type`. Try again with another value."},"summary":"Invalid Challenge Type"},"components/examples/ChallengeErrorInvalidMfaToken":{"id":"components/examples/ChallengeErrorInvalidMfaToken","value":{"error":"access_denied","error_description":"`foo` has expired. Use a new `oob_code` or `mfa_token` and try again."},"summary":"Invalid MFA Token"},"components/examples/ChallengeRequestOobExample":{"id":"components/examples/ChallengeRequestOobExample","value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","channel_hint":"push","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob"},"summary":"Initiate OOB challenge with Okta Verify"},"components/examples/ChallengeRequestOobSmsExample":{"id":"components/examples/ChallengeRequestOobSmsExample","value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","channel_hint":"sms","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob"},"summary":"Initiate OOB challenge with SMS"},"components/examples/ChallengeRequestOobVoiceExample":{"id":"components/examples/ChallengeRequestOobVoiceExample","value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","channel_hint":"voice","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob"},"summary":"Initiate OOB challenge with Voice"},"components/examples/ChallengeRequestOtpExample":{"id":"components/examples/ChallengeRequestOtpExample","value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp"},"summary":"Initiate OTP challenge"},"components/examples/ChallengeResponseMfaOobExample":{"id":"components/examples/ChallengeResponseMfaOobExample","value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"none","expires_in":300,"interval":5},"summary":"Challenge response out-of-band authenticator with Okta Verify"},"components/examples/ChallengeResponseMfaOtpExample":{"id":"components/examples/ChallengeResponseMfaOtpExample","value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-otp"},"summary":"Challenge response one-time passcode authenticator"},"components/examples/ChallengeResponseOktaVerifyNumberMatchChallengeExample":{"id":"components/examples/ChallengeResponseOktaVerifyNumberMatchChallengeExample","value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"transfer","binding_code":95,"expires_in":300,"interval":5},"summary":"Challenge response out-of-band authenticator with Okta Verify number matching challenge"},"components/examples/ChallengeResponseSmsExample":{"id":"components/examples/ChallengeResponseSmsExample","value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"sms","binding_method":"prompt","expires_in":300},"summary":"Challenge response out-of-band authenticator with SMS"},"components/examples/ChallengeResponseVoiceExample":{"id":"components/examples/ChallengeResponseVoiceExample","value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"voice","binding_method":"prompt","expires_in":300},"summary":"Challenge response out-of-band authenticator with Voice"},"components/examples/ClientRequestServiceJwks":{"id":"components/examples/ClientRequestServiceJwks","value":{"client_name":"Example Service Client","response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"private_key_jwt","application_type":"service","jwks":{"keys":[{"kty":"RSA","e":"AQAB","kid":"key1","n":"AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU="}]}}},"components/examples/ClientRequestServiceJwksUri":{"id":"components/examples/ClientRequestServiceJwksUri","value":{"client_name":"Example service client","response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"private_key_jwt","application_type":"service","jwks_uri":"https://www.example.com/oauth2/jwks-uri"}},"components/examples/ClientRequestWeb":{"id":"components/examples/ClientRequestWeb","value":{"client_name":"Example OAuth 2.0 client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["code","id_token"],"grant_types":["authorization_code","refresh_token","implicit"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login"}},"components/examples/ClientRequestWebUpdate":{"id":"components/examples/ClientRequestWebUpdate","value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_name":"Updated OAuth 2.0 client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["id_token","code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login"}},"components/examples/ClientRequestWebWithIdTokenEncryption":{"id":"components/examples/ClientRequestWebWithIdTokenEncryption","value":{"client_name":"Example web client with ID token encryption enabled","response_types":["code","token","id_token"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"private_key_jwt","application_type":"web","id_token_encrypted_response_alg":"RSA-OAEP-256","jwks":{"keys":[{"kty":"RSA","e":"AQAB","kid":"signingKey","use":"sig","n":"AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU="},{"kty":"RSA","e":"AQAB","use":"enc","kid":"encryptionKey","n":"zOrouIUCSMlRL0HU.....AJncrKuine49_CEVR4GPn="}]}}},"components/examples/ClientResponseServiceJwks":{"id":"components/examples/ClientResponseServiceJwks","value":{"client_id":"0oanq59zytBKVwQQ80h7","client_id_issued_at":1570131438,"client_name":"Example service client","client_uri":null,"logo_uri":null,"redirect_uris":[],"response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"private_key_jwt","application_type":"service","jwks":{"keys":[{"kty":"RSA","kid":"key1","use":null,"e":"AQAB","n":"AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU="}]}}},"components/examples/ClientResponseServiceJwksUri":{"id":"components/examples/ClientResponseServiceJwksUri","value":{"client_id":"0oaft59zxtBKVwQP80h7","client_id_issued_at":1570131440,"client_name":"Example service client","client_uri":null,"logo_uri":null,"redirect_uris":[],"response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"private_key_jwt","application_type":"service","jwks_uri":"https://www.example.com/oauth2/jwks-uri"}},"components/examples/ClientResponseWeb":{"id":"components/examples/ClientResponseWeb","value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe","client_id_issued_at":1453913425,"client_secret_expires_at":0,"client_name":"Example OAuth 2.0 client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["id_token","code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false}},"components/examples/ClientResponseWebUpdate":{"id":"components/examples/ClientResponseWebUpdate","value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe","client_id_issued_at":1453913425,"client_secret_expires_at":0,"client_name":"Updated OAuth Client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["id_token","code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false}},"components/examples/ClientResponseWebUpdateNewSecret":{"id":"components/examples/ClientResponseWebUpdateNewSecret","value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","client_id_issued_at":1453913425,"client_secret_expires_at":0,"client_name":"Updated OAuth Client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["id_token","code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false}},"components/examples/ClientResponseWebWithIdTokenEncryption":{"id":"components/examples/ClientResponseWebWithIdTokenEncryption","value":{"client_id":"0oanq59zytBKVwQQ80h7","client_id_issued_at":1570131438,"client_name":"Example web client with ID token encryption enabled","client_uri":null,"logo_uri":null,"redirect_uris":[],"response_types":["code","token","id_token"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"private_key_jwt","application_type":"web","id_token_encrypted_response_alg":"RSA-OAEP-256","jwks":{"keys":[{"kty":"RSA","e":"AQAB","kid":"signingKey","use":"sig","n":"AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU="},{"kty":"RSA","e":"AQAB","use":"enc","kid":"encryptionKey","n":"zOrouIUCSMlRL0HU.....AJncrKuine49_CEVR4GPn="}]}}},"components/examples/CustomASOAuthMetadata":{"id":"components/examples/CustomASOAuthMetadata","value":{"issuer":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7","authorization_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize","token_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token","registration_endpoint":"https://{yourOktaDomain}/oauth2/v1/clients","jwks_uri":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys","response_types_supported":["code","token","id_token","code id_token","code token","id_token token","code id_token token"],"response_modes_supported":["query","fragment","form_post","okta_post_message"],"grant_types_supported":["authorization_code","implicit","refresh_token","password","client_credentials","urn:ietf:params:oauth:grant-type:device_code"],"subject_types_supported":["public"],"scopes_supported":["okta.myAccount.email.manage","okta.myAccount.email.read","okta.myAccount.manage","okta.myAccount.phone.manage","okta.myAccount.phone.read","okta.myAccount.profile.manage","okta.myAccount.profile.read","okta.myAccount.read","openid","profile","email","address","phone","offline_access","device_sso"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"claims_supported":["ver","jti","iss","aud","iat","exp","cid","uid","scp","sub"],"code_challenge_methods_supported":["S256"],"introspection_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect","introspection_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"revocation_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke","revocation_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"end_session_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout","request_parameter_supported":true,"request_object_signing_alg_values_supported":["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],"device_authorization_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize","pushed_authorization_request_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par"}},"components/examples/CustomASOidcMetadata":{"id":"components/examples/CustomASOidcMetadata","value":{"issuer":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7","authorization_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize","token_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token","userinfo_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/userinfo","registration_endpoint":"https://{yourOktaDomain}/oauth2/v1/clients","jwks_uri":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys","response_types_supported":["code","id_token","code id_token","code token","id_token token","code id_token token"],"response_modes_supported":["query","fragment","form_post","okta_post_message"],"grant_types_supported":["authorization_code","implicit","refresh_token","password","urn:ietf:params:oauth:grant-type:device_code"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"],"id_token_encryption_alg_values_supported":["RSA-OAEP-256","RSA-OAEP-384","RSA-OAEP-512"],"id_token_encryption_enc_values_supported":["A256GCM"],"scopes_supported":["okta.myAccount.email.manage","okta.myAccount.email.read","okta.myAccount.manage","okta.myAccount.phone.manage","okta.myAccount.phone.read","okta.myAccount.profile.manage","okta.myAccount.profile.read","okta.myAccount.read","openid","profile","email","address","phone","offline_access","device_sso"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"claims_supported":["iss","ver","sub","aud","iat","exp","jti","auth_time","amr","idp","nonce","name","nickname","preferred_username","given_name","middle_name","family_name","email","email_verified","profile","zoneinfo","locale","address","phone_number","picture","website","gender","birthdate","updated_at","at_hash","c_hash"],"code_challenge_methods_supported":["S256"],"introspection_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect","introspection_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"revocation_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke","revocation_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"end_session_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout","request_parameter_supported":true,"request_object_signing_alg_values_supported":["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],"device_authorization_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize","pushed_authorization_request_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par"}},"components/examples/DeviceAuthorizeResponseExample":{"id":"components/examples/DeviceAuthorizeResponseExample","value":{"user_code":"RGTCFDTL","device_code":"5cbeb234-7e00-4ff7-9aa2-b1a4558a75d2","interval":5,"verification_uri_complete":"https://{yourOktaDomain}/activate?user_code=RGTCFDTL","verification_uri":"https://{yourOktaDomain}/activate","expires_in":600}},"components/examples/DirectAuthChallengeRequirementsRequestExample":{"id":"components/examples/DirectAuthChallengeRequirementsRequestExample","value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob http://auth0.com/oauth/grant-type/mfa-otp"},"summary":"Discover available MFA authenticators"},"components/examples/DirectAuthChallengeRequirementsResponseExample":{"id":"components/examples/DirectAuthChallengeRequirementsResponseExample","value":{"requirements":{"challenge":[{"enrollmentId":"ofs1234567890abcde","authenticatorName":"Okta Verify","challengeType":"http://auth0.com/oauth/grant-type/mfa-oob","channel":"push"},{"enrollmentId":"ofs0987654321fghij","authenticatorName":"Google Authenticator","challengeType":"http://auth0.com/oauth/grant-type/mfa-otp"}]}},"summary":"Available MFA authenticator enrollments"},"components/examples/DirectAuthPrimaryAuthRequirementsRequestExample":{"id":"components/examples/DirectAuthPrimaryAuthRequirementsRequestExample","value":{"login_hint":"testuser@example.com","intent":"sso","challenge_types_supported":"urn:okta:params:oauth:grant-type:otp urn:okta:params:oauth:grant-type:oob"},"summary":"Discover available primary authenticators"},"components/examples/DirectAuthenticationRequirementsResponseExample":{"id":"components/examples/DirectAuthenticationRequirementsResponseExample","value":{"requirements":{"challenge":[{"enrollmentId":"ofs1234567890abcde","authenticatorName":"Okta Verify","challengeType":"urn:okta:params:oauth:grant-type:oob","channel":"push"},{"enrollmentId":"ofs0987654321fghij","authenticatorName":"Google Authenticator","challengeType":"urn:okta:params:oauth:grant-type:otp"}]}},"summary":"Available authenticator enrollments"},"components/examples/ErrorAccessDenied":{"id":"components/examples/ErrorAccessDenied","value":{"errorCode":"E0000006","errorSummary":"You don't have permission to perform the requested action.","errorLink":"E0000006","errorId":"sampleNUSD_8fdkFd8fs8SDBK","errorCauses":[]}},"components/examples/ErrorInvalidClientId":{"id":"components/examples/ErrorInvalidClientId","value":{"errorCode":"invalid_client","errorSummary":"Invalid value for `client_id` parameter","errorLink":"invalid_client","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]}},"components/examples/ErrorInvalidClientMetadata":{"id":"components/examples/ErrorInvalidClientMetadata","value":{"error":"invalid_client_metadata","error_description":"`client_name`: The field can't be left blank."}},"components/examples/ErrorResourceNotFound":{"id":"components/examples/ErrorResourceNotFound","value":{"errorCode":"E0000007","errorSummary":"Not found: {0}","errorLink":"E0000007","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]}},"components/examples/ErrorTooManyRequests":{"id":"components/examples/ErrorTooManyRequests","value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]}},"components/examples/GlobalTokenRevocationRequestIssSubOidcExample":{"id":"components/examples/GlobalTokenRevocationRequestIssSubOidcExample","value":{"sub_id":{"format":"iss_sub","sub":"00u5t60iloOHN9pBi0g7","iss":"https://idp.example.com"}},"summary":"Global token revocation request with iss_sub format (OIDC)"},"components/examples/GlobalTokenRevocationRequestIssSubSamlExample":{"id":"components/examples/GlobalTokenRevocationRequestIssSubSamlExample","value":{"sub_id":{"format":"iss_sub","sub":"user@example.com","iss":"https://idp.example.com"}},"summary":"Global token revocation request with iss_sub format (SAML)"},"components/examples/GlobalTokenRevocationRequestOpaqueExample":{"id":"components/examples/GlobalTokenRevocationRequestOpaqueExample","value":{"sub_id":{"format":"opaque","id":"00u1dnq5S0CfjlkpABCD"}},"summary":"Global token revocation request with opaque format"},"components/examples/IntrospectionAccessToken":{"id":"components/examples/IntrospectionAccessToken","value":{"active":true,"token_type":"Bearer","scope":"openid profile","client_id":"a9VpZDRCeFh3Nkk2VdYa","username":"john.doe@example.com","exp":1451606400,"iat":1451602800,"sub":"john.doe@example.com","aud":"https://{yourOktaDomain}","iss":"https://{yourOktaDomain}/oauth2/orsmsg0aWLdnF3spV0g3","jti":"AT.7P4KlczBYVcWLkxduEuKeZfeiNYkZIC9uGJ28Cc-YaI","uid":"00uid4BxXw6I6TV4m0g3"}},"components/examples/IntrospectionInactiveToken":{"id":"components/examples/IntrospectionInactiveToken","value":{"active":false}},"components/examples/IntrospectionRefreshToken":{"id":"components/examples/IntrospectionRefreshToken","value":{"active":true,"token_type":"Bearer","scope":"openid profile email","client_id":"a9VpZDRCeFh3Nkk2VdYa","username":"john.doe@example.com","exp":1451606400,"sub":"john.doe@example.com","device_id":"q4SZgrA9sOeHkfst5uaa"}},"components/examples/ListClientsResponse":{"id":"components/examples/ListClientsResponse","value":[{"client_id":"B6YnDUIpt6Oq354YYaNR","client_id_issued_at":1495059435,"client_secret_expires_at":0,"client_name":"Native client","client_uri":null,"logo_uri":null,"redirect_uris":["https://httpbin.org/get"],"response_types":["id_token","code","token"],"grant_types":["password","refresh_token","authorization_code","implicit"],"token_endpoint_auth_method":"client_secret_basic","application_type":"native","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false},{"client_id":"etwquEhEjxqyA7HDB8lD","client_id_issued_at":1495059868,"client_secret_expires_at":0,"client_name":"Service client","client_uri":null,"logo_uri":null,"redirect_uris":[],"response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"client_secret_basic","application_type":"service","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false},{"client_id":"l3O8MfR0eTVfLJ7jG2UB","client_id_issued_at":1495059734,"client_name":"Browser client","client_uri":null,"logo_uri":null,"redirect_uris":["https://httpbin.org/get"],"response_types":["code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"none","application_type":"browser"},{"client_id":"rHQoApjizqc4MGVlW5En","client_id_issued_at":1495059117,"client_secret_expires_at":0,"client_name":"Web client","client_uri":null,"logo_uri":null,"redirect_uris":["https://www.example.com/oauth2/redirectUri"],"response_types":["code","id_token","token"],"grant_types":["authorization_code","refresh_token","implicit"],"token_endpoint_auth_method":"client_secret_basic","application_type":"web","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false}]},"components/examples/LogoutRequestCustomExample":{"id":"components/examples/LogoutRequestCustomExample","value":{"id_token_hint":"<id_token_hint_value>","post_logout_redirect_uri":"https://www.example.com/oauth2/postLogoutRedirectUri","state":1230000},"summary":"Logout request custom authorization server example"},"components/examples/LogoutRequestExample":{"id":"components/examples/LogoutRequestExample","value":{"id_token_hint":"<id_token_hint_value>","post_logout_redirect_uri":"https://www.example.com/oauth2/postLogoutRedirectUri","state":1230000},"summary":"Logout request org authorization server example"},"components/examples/OAuthError400InvalidGrant_InvalidAuthCode":{"id":"components/examples/OAuthError400InvalidGrant_InvalidAuthCode","value":{"error":"invalid_grant","error_description":"The authorization code is invalid or has expired."}},"components/examples/OAuthError400InvalidGrant_MismatchedClient":{"id":"components/examples/OAuthError400InvalidGrant_MismatchedClient","value":{"error":"invalid_grant","error_description":"The grant was issued to another client. Ensure that the `client_id` matches the one used at the authorize request."}},"components/examples/OAuthError400InvalidRequest_AssertionTypeInvalid":{"id":"components/examples/OAuthError400InvalidRequest_AssertionTypeInvalid","value":{"error":"invalid_request","error_description":"The `client_assertion_type` is invalid."}},"components/examples/OAuthError400InvalidRequest_MissingToken":{"id":"components/examples/OAuthError400InvalidRequest_MissingToken","value":{"error":"invalid_request","error_description":"The `token` parameter is required."}},"components/examples/OAuthError400InvalidRequest_MultipleClientCreds":{"id":"components/examples/OAuthError400InvalidRequest_MultipleClientCreds","value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."}},"components/examples/OAuthError400InvalidScope_MissingScopes":{"id":"components/examples/OAuthError400InvalidScope_MissingScopes","value":{"error":"invalid_scope","error_description":"No scopes were requested."}},"components/examples/OAuthError400UnsupportedGrantType":{"id":"components/examples/OAuthError400UnsupportedGrantType","value":{"error":"unsupported_grant_type","error_description":"The grant type in the request isn't supported."}},"components/examples/OAuthError400UnsupportedResponseMode":{"id":"components/examples/OAuthError400UnsupportedResponseMode","value":{"error":"unsupported_response_mode","error_description":"The response mode isn't supported by the authorization server. Valid response modes: [`query`, `fragment`, `form_post`, `okta_post_message`]."}},"components/examples/OAuthError400UnsupportedResponseType":{"id":"components/examples/OAuthError400UnsupportedResponseType","value":{"error":"unsupported_response_type","error_description":"The response type contained in the request isn't supported."}},"components/examples/OAuthError401InvalidClient_InvalidClientId":{"id":"components/examples/OAuthError401InvalidClient_InvalidClientId","value":{"error":"invalid_client","error_description":"Invalid value for the `client_id` parameter"}},"components/examples/OAuthError401InvalidClient_NoCreds":{"id":"components/examples/OAuthError401InvalidClient_NoCreds","value":{"error":"invalid_client","error_description":"No client credentials found"}},"components/examples/OAuthError403AccessDenied_InvalidNetworkZone":{"id":"components/examples/OAuthError403AccessDenied_InvalidNetworkZone","value":{"error":"access_denied","error_description":"The request is made from outside the client's permitted network zones."}},"components/examples/OAuthError403AccessDenied_NeedOpenidScope":{"id":"components/examples/OAuthError403AccessDenied_NeedOpenidScope","value":{"error":"access_denied","error_description":"Requests for ID tokens or access tokens with OpenID scopes require the `openid` scope."}},"components/examples/OAuthKeysExample":{"id":"components/examples/OAuthKeysExample","value":{"keys":[{"alg":"RS256","e":"AQAB","n":"iKqiD4cr7FZKm6f05K4r-GQOvjRqjOeFmOho9V7SAXYwCyJluaGBLVvDWO1XlduPLOrsG_Wgs67SOG5qeLPR8T1zDK4bfJAo1TvbwYeTwVSfd_0mzRq8WaVc_2JtEK7J-4Z0MdVm_dJmcMHVfDziCRohSZthN__WM2NwGnbewWnla0wpEsU3QMZ05_OxvbBdQZaDUsNSx46is29eCdYwhkAfFd_cFRq3DixLEYUsRwmOqwABwwDjBTNvgZOomrtD8BRFWSTlwsbrNZtJMYU33wuLO9ynFkZnY6qRKVHr3YToIrqNBXw0RWCheTouQ-snfAB6wcE2WDN3N5z760ejqQ","kid":"U5R8cHbGw445Qbq8zVO1PcCpXL8yG6IcovVa3laCoxM","kty":"RSA","use":"sig"},{"alg":"RS256","e":"AQAB","n":"l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK3HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37-XDIDb0XG-R8DOoOHLJPTpsgH-rJeM5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX-0TmG5yjSj7ek05txcpxIqYu-7FIGT0KKvXge_BOSEUlJpBhLKU28OtsOnmc3NLIGXB-GeDiUZiBYQdPR-myB4ZoQ","kid":"Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo","kty":"RSA","use":"sig"},{"alg":"RS256","e":"AQAB","n":"lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7UGLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap-CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvpdMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu-DYhT0hmyFcwn-tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ","kid":"h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU","kty":"RSA","use":"sig"}]}},"components/examples/OobAuthenticateErrorAuthenticatorCannotBeUsed":{"id":"components/examples/OobAuthenticateErrorAuthenticatorCannotBeUsed","value":{"error":"access_denied","error_description":"The required authenticator can't be used. Check if it's required by policy and the user is enrolled in the authenticator and try again."},"summary":"No Authenticator associated with the grant type can be used"},"components/examples/OobAuthenticateErrorGrantTypeDisabled":{"id":"components/examples/OobAuthenticateErrorGrantTypeDisabled","value":{"error":"unauthorized_client","error_description":"The client isn't authorized to use the provided grant type. Configured grant types: [urn:okta:params:oauth:grant-type:otp, authorization_code]."},"summary":"Grant type not enabled for client"},"components/examples/OobAuthenticateErrorInvalidChannelHint":{"id":"components/examples/OobAuthenticateErrorInvalidChannelHint","value":{"error":"invalid_request","error_description":"`foo` isn't supported as a `channel_hint`. Try again with another value."},"summary":"Invalid channel hint"},"components/examples/OobAuthenticateErrorInvalidClientSecret":{"id":"components/examples/OobAuthenticateErrorInvalidClientSecret","value":{"error":"invalid_client","error_description":"The client secret supplied for a confidential client is invalid."},"summary":"Invalid client secret"},"components/examples/OobAuthenticateErrorRateLimit":{"id":"components/examples/OobAuthenticateErrorRateLimit","value":{"error":"invalid_grant","error_description":"API call exceeded the rate limit due to too many requests."},"summary":"Too Many Requests"},"components/examples/OobAuthenticateErrorUserNotAssignedApp":{"id":"components/examples/OobAuthenticateErrorUserNotAssignedApp","value":{"error":"access_denied","error_description":"User isn't assigned to the client app."},"summary":"User not assigned client app"},"components/examples/OobAuthenticateRequestExample":{"id":"components/examples/OobAuthenticateRequestExample","value":{"login_hint":"testuser@example.com","channel_hint":"push","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"summary":"Initiate out-of-band primary authentication Okta Verify"},"components/examples/OobAuthenticateResponseExample":{"id":"components/examples/OobAuthenticateResponseExample","value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"none","expires_in":300,"interval":5},"summary":"Initiate out-of-band primary authentication response with Okta Verify"},"components/examples/OobAuthenticateResponseOktaVerifyNumberMatchChallengeExample":{"id":"components/examples/OobAuthenticateResponseOktaVerifyNumberMatchChallengeExample","value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"transfer","binding_code":95,"expires_in":300,"interval":5},"summary":"Initiate out-of-band primary authentication response with Okta Verify number matching challenge"},"components/examples/OobAuthenticateResponseSmsExample":{"id":"components/examples/OobAuthenticateResponseSmsExample","value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"sms","binding_method":"prompt","expires_in":300},"summary":"Initiate out-of-band primary authentication response with SMS"},"components/examples/OobAuthenticateResponseVoiceExample":{"id":"components/examples/OobAuthenticateResponseVoiceExample","value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"voice","binding_method":"prompt","expires_in":300},"summary":"Initiate out-of-band primary authentication response with Voice"},"components/examples/OobAuthenticateSmsRequestExample":{"id":"components/examples/OobAuthenticateSmsRequestExample","value":{"login_hint":"testuser@example.com","channel_hint":"sms","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"summary":"Initiate out-of-band primary authentication with SMS"},"components/examples/OobAuthenticateVoiceRequestExample":{"id":"components/examples/OobAuthenticateVoiceRequestExample","value":{"login_hint":"testuser@example.com","channel_hint":"voice","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"summary":"Initiate out-of-band primary authentication with Voice"},"components/examples/OrgASOidcMetadata":{"id":"components/examples/OrgASOidcMetadata","value":{"issuer":"https://{yourOktaDomain}","authorization_endpoint":"https://{yourOktaDomain}/oauth2/v1/authorize","token_endpoint":"https://{yourOktaDomain}/oauth2/v1/token","userinfo_endpoint":"https://{yourOktaDomain}/oauth2/v1/userinfo","registration_endpoint":"https://{yourOktaDomain}/oauth2/v1/clients","jwks_uri":"https://{yourOktaDomain}/oauth2/v1/keys","response_types_supported":["code","id_token","code id_token","code token","id_token token","code id_token token"],"response_modes_supported":["query","fragment","form_post","okta_post_message"],"grant_types_supported":["authorization_code","implicit","refresh_token","password","urn:ietf:params:oauth:grant-type:device_code"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"],"scopes_supported":["openid","email","profile","address","phone","offline_access","groups"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"claims_supported":["iss","ver","sub","aud","iat","exp","jti","auth_time","amr","idp","nonce","name","nickname","preferred_username","given_name","middle_name","family_name","email","email_verified","profile","zoneinfo","locale","address","phone_number","picture","website","gender","birthdate","updated_at","at_hash","c_hash"],"code_challenge_methods_supported":["S256"],"introspection_endpoint":"https://{yourOktaDomain}/oauth2/v1/introspect","introspection_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"revocation_endpoint":"https://{yourOktaDomain}/oauth2/v1/revoke","revocation_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"end_session_endpoint":"https://{yourOktaDomain}/oauth2/v1/logout","request_parameter_supported":true,"request_object_signing_alg_values_supported":["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],"device_authorization_endpoint":"https://{yourOktaDomain}/oauth2/v1/device/authorize","pushed_authorization_request_endpoint":"https://{yourOktaDomain}/oauth2/v1/par"}},"components/examples/ParResponseExample":{"id":"components/examples/ParResponseExample","value":{"request_uri":"urn:okta:Y1hIQ3ZqYjFodEZMOVJ3TUF4ZHRPZjJuNFZRV2ZWQ044MmFoX2VIT2oyNDo","expires_in":3600}},"components/examples/TokenRequestAiAgentIdJagExample":{"id":"components/examples/TokenRequestAiAgentIdJagExample","value":{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","requested_token_type":"urn:ietf:params:oauth:token-type:id-jag","subject_token":"<id_token_value>","subject_token_type":"urn:ietf:params:oauth:token-type:id_token","client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer","client_assertion":"<private_key_jwt_value>","audience":"https://{yourOktaDomain}/oauth2/aus5h1k6yB3Pr60AX0g5","scope":"scope1 scope2"},"summary":"Identity Assertion JWT Authorization Grant"},"components/examples/TokenRequestAiAgentOAuthStsExample":{"id":"components/examples/TokenRequestAiAgentOAuthStsExample","value":{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","requested_token_type":"urn:okta:params:oauth:token-type:oauth-sts","subject_token":"<id_token_value>","subject_token_type":"urn:ietf:params:oauth:token-type:id_token","client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer","client_assertion":"<private_key_jwt_value>","resource":"example:resource:value"},"summary":"OAuth STS for AI agent"},"components/examples/TokenRequestAiAgentServiceAccountExample":{"id":"components/examples/TokenRequestAiAgentServiceAccountExample","value":{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","requested_token_type":"urn:okta:params:oauth:token-type:service-account","subject_token":"<id_token_value>","subject_token_type":"urn:ietf:params:oauth:token-type:id_token","client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer","client_assertion":"<private_key_jwt_value>","resource":"example:resource:value"},"summary":"OPA service account for AI agent"},"components/examples/TokenRequestAiAgentVaultedSecretExample":{"id":"components/examples/TokenRequestAiAgentVaultedSecretExample","value":{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","requested_token_type":"urn:okta:params:oauth:token-type:vaulted-secret","subject_token":"<id_token_value>","subject_token_type":"urn:ietf:params:oauth:token-type:id_token","client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer","client_assertion":"<private_key_jwt_value>","resource":"example:resource:value"},"summary":"OPA vaulted secret for AI agent"},"components/examples/TokenRequestAuthorizationCodeWithCredsExample":{"id":"components/examples/TokenRequestAuthorizationCodeWithCredsExample","value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","grant_type":"authorization_code","redirect_uri":"https://www.example.com/oauth2/redirectUri","code":"QnowT-aeawtOJKp-MtkH&"}},"components/examples/TokenRequestDirectAuthMfaOobExample":{"id":"components/examples/TokenRequestDirectAuthMfaOobExample","value":{"grant_type":"http://auth0.com/oauth/grant-type/mfa-oob","scope":"openid offline_access","mfa_token":"Qwk9va6QYgR3s7JMiWUm","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9"},"summary":"Direct authentication with OOB (MFA)"},"components/examples/TokenRequestDirectAuthMfaOtpExample":{"id":"components/examples/TokenRequestDirectAuthMfaOtpExample","value":{"grant_type":"http://auth0.com/oauth/grant-type/mfa-otp","scope":"openid offline_access","mfa_token":"Qwk9va6QYgR3s7JMiWUm","otp":123456,"grant_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp urn:okta:params:oauth:grant-type:oob"},"summary":"Direct authentication with OTP (MFA)"},"components/examples/TokenRequestDirectAuthOobExample":{"id":"components/examples/TokenRequestDirectAuthOobExample","value":{"grant_type":"urn:okta:params:oauth:grant-type:oob","scope":"openid offline_access","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","grant_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp http://auth0.com/oauth/grant-type/mfa-oob"},"summary":"Direct authentication with OOB (primary factor)"},"components/examples/TokenRequestDirectAuthOtpExample":{"id":"components/examples/TokenRequestDirectAuthOtpExample","value":{"grant_type":"urn:okta:params:oauth:grant-type:otp","scope":"openid offline_access","login_hint":"testuser@example.com","otp":123456,"grant_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp http://auth0.com/oauth/grant-type/mfa-oob"},"summary":"Direct authentication with OTP (primary factor)"},"components/examples/TokenRequestJwtBearerExample":{"id":"components/examples/TokenRequestJwtBearerExample","value":{"grant_type":"urn:ietf:params:oauth:grant-type:jwt-bearer","assertion":"<json_web_token>"}},"components/examples/TokenRequestPassword":{"id":"components/examples/TokenRequestPassword","value":{"grant_type":"password","scope":"openid","username":"testuser@example.com","password":"N9d03jadk&@odA"}},"components/examples/TokenRequestSamlBearerExample":{"id":"components/examples/TokenRequestSamlBearerExample","value":{"grant_type":"urn:ietf:params:oauth:grant-type:saml2-bearer","scope":"openid offline_access","assertion":"<base64 SAML>"}},"components/examples/TokenResponseAiAgentIdJagExample":{"id":"components/examples/TokenResponseAiAgentIdJagExample","value":{"token_type":"N_A","expires_in":300,"issued_token_type":"urn:ietf:params:oauth:token-type:id-jag","access_token":"<id_jag_value>"},"summary":"Identity Assertion JWT Authorization Grant"},"components/examples/TokenResponseAiAgentOAuthStsExample":{"id":"components/examples/TokenResponseAiAgentOAuthStsExample","value":{"token_type":"Bearer","expires_in":300,"issued_token_type":"urn:okta:params:oauth:token-type:oauth-sts","access_token":"<oauth_sts_access_token_value>","scope":"chat.read chat.history"},"summary":"OAuth STS for AI agent"},"components/examples/TokenResponseAiAgentOAuthStsInteractionRequiredExample":{"id":"components/examples/TokenResponseAiAgentOAuthStsInteractionRequiredExample","value":{"error":"interaction_required","error_description":"The user must authenticate with the authorization server for the request to proceed","interaction_uri":"https://example.com"},"summary":"OAuth STS - Interaction Required"},"components/examples/TokenResponseAiAgentServiceAccountExample":{"id":"components/examples/TokenResponseAiAgentServiceAccountExample","value":{"token_type":"N_A","expires_in":300,"issued_token_type":"urn:okta:params:oauth:token-type:service-account","service_account":{"username":"exampleUsername","password":"examplePassword"}},"summary":"OPA service account for AI agent"},"components/examples/TokenResponseAiAgentVaultedSecretExample":{"id":"components/examples/TokenResponseAiAgentVaultedSecretExample","value":{"token_type":"N_A","expires_in":300,"issued_token_type":"urn:okta:params:oauth:token-type:vaulted-secret","vaulted_secret":{"key1":"value1","key2":"value2"}},"summary":"OPA vaulted secret for AI agent"},"components/examples/TokenResponseExample":{"id":"components/examples/TokenResponseExample","value":{"access_token":"<access_token_value>","token_type":"Bearer","expires_in":3600,"scope":"openid email offline_access","refresh_token":"a9VpZDRCeFh3Nkk2VdY","id_token":"<id_token_example>"}},"components/examples/UserInfoExample":{"id":"components/examples/UserInfoExample","value":{"sub":"00uid4BxXw6I6TV4m0g3","name":"John Doe","nickname":"Jimmy","given_name":"John","middle_name":"James","family_name":"Doe","profile":"https://example.com/john.doe","zoneinfo":"America/Los_Angeles","locale":"en-US","updated_at":1311280970,"email":"john.doe@example.com","email_verified":true,"address":{"street_address":"123 Hollywood Blvd.","locality":"Los Angeles","region":"CA","postal_code":"90210","country":"US"},"phone_number":"+1 (425) 555-1212"}},"paths/~1oauth2~1v1~1clients/get/responses/200/content/application~1json/examples/All Clients":{"value":[{"client_id":"B6YnDUIpt6Oq354YYaNR","client_id_issued_at":1495059435,"client_secret_expires_at":0,"client_name":"Native client","client_uri":null,"logo_uri":null,"redirect_uris":["https://httpbin.org/get"],"response_types":["id_token","code","token"],"grant_types":["password","refresh_token","authorization_code","implicit"],"token_endpoint_auth_method":"client_secret_basic","application_type":"native","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false},{"client_id":"etwquEhEjxqyA7HDB8lD","client_id_issued_at":1495059868,"client_secret_expires_at":0,"client_name":"Service client","client_uri":null,"logo_uri":null,"redirect_uris":[],"response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"client_secret_basic","application_type":"service","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false},{"client_id":"l3O8MfR0eTVfLJ7jG2UB","client_id_issued_at":1495059734,"client_name":"Browser client","client_uri":null,"logo_uri":null,"redirect_uris":["https://httpbin.org/get"],"response_types":["code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"none","application_type":"browser"},{"client_id":"rHQoApjizqc4MGVlW5En","client_id_issued_at":1495059117,"client_secret_expires_at":0,"client_name":"Web client","client_uri":null,"logo_uri":null,"redirect_uris":["https://www.example.com/oauth2/redirectUri"],"response_types":["code","id_token","token"],"grant_types":["authorization_code","refresh_token","implicit"],"token_endpoint_auth_method":"client_secret_basic","application_type":"web","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false}],"key":"All Clients","summary":"All Clients","id":"paths/~1oauth2~1v1~1clients/get/responses/200/content/application~1json/examples/All Clients"},"paths/~1oauth2~1v1~1clients/get/responses/403/content/application~1json/examples/Access denied":{"value":{"errorCode":"E0000006","errorSummary":"You don't have permission to perform the requested action.","errorLink":"E0000006","errorId":"sampleNUSD_8fdkFd8fs8SDBK","errorCauses":[]},"key":"Access denied","summary":"Access denied","id":"paths/~1oauth2~1v1~1clients/get/responses/403/content/application~1json/examples/Access denied"},"paths/~1oauth2~1v1~1clients/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client":{"value":{"client_name":"Example OAuth 2.0 client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["code","id_token"],"grant_types":["authorization_code","refresh_token","implicit"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login"},"key":"Web client","summary":"Web client","id":"paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client"},"paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with JWKS":{"value":{"client_name":"Example Service Client","response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"private_key_jwt","application_type":"service","jwks":{"keys":[{"kty":"RSA","e":"AQAB","kid":"key1","n":"AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU="}]}},"key":"Service client with JWKS","summary":"Service client with JWKS","id":"paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with JWKS"},"paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with jwks_uri":{"value":{"client_name":"Example service client","response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"private_key_jwt","application_type":"service","jwks_uri":"https://www.example.com/oauth2/jwks-uri"},"key":"Service client with jwks_uri","summary":"Service client with jwks_uri","id":"paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Service client with jwks_uri"},"paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client with ID token encryption enabled":{"value":{"client_name":"Example web client with ID token encryption enabled","response_types":["code","token","id_token"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"private_key_jwt","application_type":"web","id_token_encrypted_response_alg":"RSA-OAEP-256","jwks":{"keys":[{"kty":"RSA","e":"AQAB","kid":"signingKey","use":"sig","n":"AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU="},{"kty":"RSA","e":"AQAB","use":"enc","kid":"encryptionKey","n":"zOrouIUCSMlRL0HU.....AJncrKuine49_CEVR4GPn="}]}},"key":"Web client with ID token encryption enabled","summary":"Web client with ID token encryption enabled","id":"paths/~1oauth2~1v1~1clients/post/requestBody/content/application~1json/examples/Web client with ID token encryption enabled"},"paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe","client_id_issued_at":1453913425,"client_secret_expires_at":0,"client_name":"Example OAuth 2.0 client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["id_token","code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false},"key":"Web client","summary":"Web client","id":"paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client"},"paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with JWKS":{"value":{"client_id":"0oanq59zytBKVwQQ80h7","client_id_issued_at":1570131438,"client_name":"Example service client","client_uri":null,"logo_uri":null,"redirect_uris":[],"response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"private_key_jwt","application_type":"service","jwks":{"keys":[{"kty":"RSA","kid":"key1","use":null,"e":"AQAB","n":"AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU="}]}},"key":"Service client with JWKS","summary":"Service client with JWKS","id":"paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with JWKS"},"paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with jwks_uri":{"value":{"client_id":"0oaft59zxtBKVwQP80h7","client_id_issued_at":1570131440,"client_name":"Example service client","client_uri":null,"logo_uri":null,"redirect_uris":[],"response_types":["token"],"grant_types":["client_credentials"],"token_endpoint_auth_method":"private_key_jwt","application_type":"service","jwks_uri":"https://www.example.com/oauth2/jwks-uri"},"key":"Service client with jwks_uri","summary":"Service client with jwks_uri","id":"paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Service client with jwks_uri"},"paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client with ID token encryption enabled":{"value":{"client_id":"0oanq59zytBKVwQQ80h7","client_id_issued_at":1570131438,"client_name":"Example web client with ID token encryption enabled","client_uri":null,"logo_uri":null,"redirect_uris":[],"response_types":["code","token","id_token"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"private_key_jwt","application_type":"web","id_token_encrypted_response_alg":"RSA-OAEP-256","jwks":{"keys":[{"kty":"RSA","e":"AQAB","kid":"signingKey","use":"sig","n":"AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU="},{"kty":"RSA","e":"AQAB","use":"enc","kid":"encryptionKey","n":"zOrouIUCSMlRL0HU.....AJncrKuine49_CEVR4GPn="}]}},"key":"Web client with ID token encryption enabled","summary":"Web client with ID token encryption enabled","id":"paths/~1oauth2~1v1~1clients/post/responses/201/content/application~1json/examples/Web client with ID token encryption enabled"},"paths/~1oauth2~1v1~1clients/post/responses/400/content/application~1json/examples/API validation failed":{"value":{"error":"invalid_client_metadata","error_description":"`client_name`: The field can't be left blank."},"key":"API validation failed","summary":"API validation failed","id":"paths/~1oauth2~1v1~1clients/post/responses/400/content/application~1json/examples/API validation failed"},"paths/~1oauth2~1v1~1clients/post/responses/403/content/application~1json/examples/Access denied":{"value":{"errorCode":"E0000006","errorSummary":"You don't have permission to perform the requested action.","errorLink":"E0000006","errorId":"sampleNUSD_8fdkFd8fs8SDBK","errorCauses":[]},"key":"Access denied","summary":"Access denied","id":"paths/~1oauth2~1v1~1clients/post/responses/403/content/application~1json/examples/Access denied"},"paths/~1oauth2~1v1~1clients/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/200/content/application~1json/examples/Web client":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe","client_id_issued_at":1453913425,"client_secret_expires_at":0,"client_name":"Example OAuth 2.0 client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["id_token","code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false},"key":"Web client","summary":"Web client","id":"paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/200/content/application~1json/examples/Web client"},"paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/403/content/application~1json/examples/Access denied":{"value":{"errorCode":"E0000006","errorSummary":"You don't have permission to perform the requested action.","errorLink":"E0000006","errorId":"sampleNUSD_8fdkFd8fs8SDBK","errorCauses":[]},"key":"Access denied","summary":"Access denied","id":"paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/403/content/application~1json/examples/Access denied"},"paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/404/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000007","errorSummary":"Not found: {0}","errorLink":"E0000007","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/404/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients~1{clientId}/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1clients~1{clientId}/put/requestBody/content/application~1json/examples/Web client":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_name":"Updated OAuth 2.0 client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["id_token","code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login"},"key":"Web client","summary":"Web client","id":"paths/~1oauth2~1v1~1clients~1{clientId}/put/requestBody/content/application~1json/examples/Web client"},"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/200/content/application~1json/examples/Web client":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe","client_id_issued_at":1453913425,"client_secret_expires_at":0,"client_name":"Updated OAuth Client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["id_token","code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false},"key":"Web client","summary":"Web client","id":"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/200/content/application~1json/examples/Web client"},"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/400/content/application~1json/examples/API validation failed":{"value":{"error":"invalid_client_metadata","error_description":"`client_name`: The field can't be left blank."},"key":"API validation failed","summary":"API validation failed","id":"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/400/content/application~1json/examples/API validation failed"},"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/403/content/application~1json/examples/Access denied":{"value":{"errorCode":"E0000006","errorSummary":"You don't have permission to perform the requested action.","errorLink":"E0000006","errorId":"sampleNUSD_8fdkFd8fs8SDBK","errorCauses":[]},"key":"Access denied","summary":"Access denied","id":"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/403/content/application~1json/examples/Access denied"},"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/404/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000007","errorSummary":"Not found: {0}","errorLink":"E0000007","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/404/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients~1{clientId}/put/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/403/content/application~1json/examples/Access denied":{"value":{"errorCode":"E0000006","errorSummary":"You don't have permission to perform the requested action.","errorLink":"E0000006","errorId":"sampleNUSD_8fdkFd8fs8SDBK","errorCauses":[]},"key":"Access denied","summary":"Access denied","id":"paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/403/content/application~1json/examples/Access denied"},"paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/404/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000007","errorSummary":"Not found: {0}","errorLink":"E0000007","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/404/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients~1{clientId}/delete/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/200/content/application~1json/examples/Web client":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","client_id_issued_at":1453913425,"client_secret_expires_at":0,"client_name":"Updated OAuth Client","client_uri":"https://www.example.com","logo_uri":"https://www.example.com/logo.png","application_type":"web","redirect_uris":["https://www.example.com/oauth2/redirectUri"],"post_logout_redirect_uris":["https://www.example.com/oauth2/postLogoutRedirectUri"],"response_types":["id_token","code"],"grant_types":["authorization_code"],"token_endpoint_auth_method":"client_secret_post","initiate_login_uri":"https://www.example.com/oauth2/login","frontchannel_logout_uri":"https://example.com/logout","frontchannel_logout_session_required":false},"key":"Web client","summary":"Web client","id":"paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/200/content/application~1json/examples/Web client"},"paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/403/content/application~1json/examples/Access denied":{"value":{"errorCode":"E0000006","errorSummary":"You don't have permission to perform the requested action.","errorLink":"E0000006","errorId":"sampleNUSD_8fdkFd8fs8SDBK","errorCauses":[]},"key":"Access denied","summary":"Access denied","id":"paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/403/content/application~1json/examples/Access denied"},"paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/404/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000007","errorSummary":"Not found: {0}","errorLink":"E0000007","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/404/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1clients~1{clientId}~1lifecycle~1newSecret/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/200/content/application~1json/examples/OAuth 2.0 Metadata":{"value":{"issuer":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7","authorization_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize","token_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token","registration_endpoint":"https://{yourOktaDomain}/oauth2/v1/clients","jwks_uri":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys","response_types_supported":["code","token","id_token","code id_token","code token","id_token token","code id_token token"],"response_modes_supported":["query","fragment","form_post","okta_post_message"],"grant_types_supported":["authorization_code","implicit","refresh_token","password","client_credentials","urn:ietf:params:oauth:grant-type:device_code"],"subject_types_supported":["public"],"scopes_supported":["okta.myAccount.email.manage","okta.myAccount.email.read","okta.myAccount.manage","okta.myAccount.phone.manage","okta.myAccount.phone.read","okta.myAccount.profile.manage","okta.myAccount.profile.read","okta.myAccount.read","openid","profile","email","address","phone","offline_access","device_sso"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"claims_supported":["ver","jti","iss","aud","iat","exp","cid","uid","scp","sub"],"code_challenge_methods_supported":["S256"],"introspection_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect","introspection_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"revocation_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke","revocation_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"end_session_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout","request_parameter_supported":true,"request_object_signing_alg_values_supported":["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],"device_authorization_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize","pushed_authorization_request_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par"},"key":"OAuth 2.0 Metadata","summary":"OAuth 2.0 Metadata","id":"paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/200/content/application~1json/examples/OAuth 2.0 Metadata"},"paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/400/content/application~1json/examples/Invalid Client ID":{"value":{"errorCode":"invalid_client","errorSummary":"Invalid value for `client_id` parameter","errorLink":"invalid_client","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]},"key":"Invalid Client ID","summary":"Invalid Client ID","id":"paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/400/content/application~1json/examples/Invalid Client ID"},"paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/404/content/application~1json/examples/Invalid Client ID":{"value":{"errorCode":"E0000007","errorSummary":"Not found: {0}","errorLink":"E0000007","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]},"key":"Invalid Client ID","summary":"Invalid Client ID","id":"paths/~1.well-known~1oauth-authorization-server~1oauth2~1{authorizationServerId}/get/responses/404/content/application~1json/examples/Invalid Client ID"},"paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata":{"value":{"issuer":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7","authorization_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize","token_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token","userinfo_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/userinfo","registration_endpoint":"https://{yourOktaDomain}/oauth2/v1/clients","jwks_uri":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys","response_types_supported":["code","id_token","code id_token","code token","id_token token","code id_token token"],"response_modes_supported":["query","fragment","form_post","okta_post_message"],"grant_types_supported":["authorization_code","implicit","refresh_token","password","urn:ietf:params:oauth:grant-type:device_code"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"],"id_token_encryption_alg_values_supported":["RSA-OAEP-256","RSA-OAEP-384","RSA-OAEP-512"],"id_token_encryption_enc_values_supported":["A256GCM"],"scopes_supported":["okta.myAccount.email.manage","okta.myAccount.email.read","okta.myAccount.manage","okta.myAccount.phone.manage","okta.myAccount.phone.read","okta.myAccount.profile.manage","okta.myAccount.profile.read","okta.myAccount.read","openid","profile","email","address","phone","offline_access","device_sso"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"claims_supported":["iss","ver","sub","aud","iat","exp","jti","auth_time","amr","idp","nonce","name","nickname","preferred_username","given_name","middle_name","family_name","email","email_verified","profile","zoneinfo","locale","address","phone_number","picture","website","gender","birthdate","updated_at","at_hash","c_hash"],"code_challenge_methods_supported":["S256"],"introspection_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect","introspection_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"revocation_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke","revocation_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"end_session_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout","request_parameter_supported":true,"request_object_signing_alg_values_supported":["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],"device_authorization_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize","pushed_authorization_request_endpoint":"https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par"},"key":"OpenID Connect Metadata","summary":"OpenID Connect Metadata","id":"paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"},"paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID":{"value":{"errorCode":"invalid_client","errorSummary":"Invalid value for `client_id` parameter","errorLink":"invalid_client","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]},"key":"Invalid Client ID","summary":"Invalid Client ID","id":"paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"},"paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/404/content/application~1json/examples/Invalid Client ID":{"value":{"errorCode":"E0000007","errorSummary":"Not found: {0}","errorLink":"E0000007","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]},"key":"Invalid Client ID","summary":"Invalid Client ID","id":"paths/~1oauth2~1{authorizationServerId}~1.well-known~1openid-configuration/get/responses/404/content/application~1json/examples/Invalid Client ID"},"paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","scope":"openid","binding_message":"Signing in from device","login_hint":"john.doe@example.com"},"key":"Request with `login_hint`","summary":"Request with `login_hint`","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`"},"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","scope":"openid","binding_message":"Signing in from device","id_token_hint":"<id_token_hint_value>"},"key":"Request with `id_token_hint`","summary":"Request with `id_token_hint`","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`"},"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","request":"<request_value>"},"key":"Request with signed `request`","summary":"Request with signed `request`","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"},"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response":{"value":{"auth_req_id":"ftJwF5ZwW2SGPPoTQEKtAr_U8_Ek3RvWyR","expires_in":300,"interval":5},"key":"Back Response","summary":"Back Response","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"},"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple Client Credentials Provided","summary":"Multiple Client Credentials Provided","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"},"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes":{"value":{"error":"invalid_scope","error_description":"No scopes were requested."},"key":"Missing Scopes","summary":"Missing Scopes","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"},"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify":{"value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","channel_hint":"push","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Initiate OOB challenge with Okta Verify","summary":"Initiate OOB challenge with Okta Verify","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS":{"value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","channel_hint":"sms","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Initiate OOB challenge with SMS","summary":"Initiate OOB challenge with SMS","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice":{"value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","channel_hint":"voice","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Initiate OOB challenge with Voice","summary":"Initiate OOB challenge with Voice","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge":{"value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp"},"key":"Initiate OTP challenge","summary":"Initiate OTP challenge","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-otp"},"key":"Challenge response one-time passcode authenticator","summary":"Challenge response one-time passcode authenticator","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"none","expires_in":300,"interval":5},"key":"Challenge response out-of-band authenticator with Okta Verify","summary":"Challenge response out-of-band authenticator with Okta Verify","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"transfer","binding_code":95,"expires_in":300,"interval":5},"key":"Challenge response out-of-band authenticator with Okta Verify number matching challenge","summary":"Challenge response out-of-band authenticator with Okta Verify number matching challenge","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"sms","binding_method":"prompt","expires_in":300},"key":"Challenge response out-of-band authenticator with SMS","summary":"Challenge response out-of-band authenticator with SMS","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"voice","binding_method":"prompt","expires_in":300},"key":"Challenge response out-of-band authenticator with Voice","summary":"Challenge response out-of-band authenticator with Voice","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token":{"value":{"error":"access_denied","error_description":"`foo` has expired. Use a new `oob_code` or `mfa_token` and try again."},"key":"Invalid MFA Token","summary":"Invalid MFA Token","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client":{"value":{"error":"unauthorized_client","error_description":"The client isn't authorized to use the provided grant type. Configured grant types: [urn:okta:params:oauth:grant-type:otp, authorization_code]."},"key":"Grant type not enabled for client","summary":"Grant type not enabled for client","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret":{"value":{"error":"invalid_client","error_description":"The client secret supplied for a confidential client is invalid."},"key":"Invalid client secret","summary":"Invalid client secret","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token":{"value":{"error":"access_denied","error_description":"`foo` has expired. Use a new `oob_code` or `mfa_token` and try again."},"key":"Invalid MFA Token","summary":"Invalid MFA Token","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type":{"value":{"error":"access_denied","error_description":"`foo` isn't supported as a `challenge_type`. Try again with another value."},"key":"Invalid Challenge Type","summary":"Invalid Challenge Type","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"},"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests":{"value":{"error":"invalid_grant","error_description":"API call exceeded the rate limit due to too many requests."},"key":"Too Many Requests","summary":"Too Many Requests","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"},"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize":{"value":{"user_code":"RGTCFDTL","device_code":"5cbeb234-7e00-4ff7-9aa2-b1a4558a75d2","interval":5,"verification_uri_complete":"https://{yourOktaDomain}/activate?user_code=RGTCFDTL","verification_uri":"https://{yourOktaDomain}/activate","expires_in":600},"key":"Device authorize","summary":"Device authorize","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"},"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes":{"value":{"error":"invalid_scope","error_description":"No scopes were requested."},"key":"Missing Scopes","summary":"Missing Scopes","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"},"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple Client Credentials Provided","summary":"Multiple Client Credentials Provided","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"},"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token":{"value":{"active":true,"token_type":"Bearer","scope":"openid profile","client_id":"a9VpZDRCeFh3Nkk2VdYa","username":"john.doe@example.com","exp":1451606400,"iat":1451602800,"sub":"john.doe@example.com","aud":"https://{yourOktaDomain}","iss":"https://{yourOktaDomain}/oauth2/orsmsg0aWLdnF3spV0g3","jti":"AT.7P4KlczBYVcWLkxduEuKeZfeiNYkZIC9uGJ28Cc-YaI","uid":"00uid4BxXw6I6TV4m0g3"},"key":"Access token","summary":"Access token","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token"},"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token":{"value":{"active":true,"token_type":"Bearer","scope":"openid profile email","client_id":"a9VpZDRCeFh3Nkk2VdYa","username":"john.doe@example.com","exp":1451606400,"sub":"john.doe@example.com","device_id":"q4SZgrA9sOeHkfst5uaa"},"key":"Refresh token","summary":"Refresh token","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token"},"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token":{"value":{"active":false},"key":"Inactive token","summary":"Inactive token","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"},"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter":{"value":{"error":"invalid_request","error_description":"The `token` parameter is required."},"key":"Missing `token` parameter","summary":"Missing `token` parameter","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter"},"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request":{"value":{"error":"invalid_request","error_description":"The `client_assertion_type` is invalid."},"key":"Client assertion type incorrect for JWT request","summary":"Client assertion type incorrect for JWT request","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request"},"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple client credentials provided","summary":"Multiple client credentials provided","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"},"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/200/content/application~1json/examples/User information":{"value":{"keys":[{"alg":"RS256","e":"AQAB","n":"iKqiD4cr7FZKm6f05K4r-GQOvjRqjOeFmOho9V7SAXYwCyJluaGBLVvDWO1XlduPLOrsG_Wgs67SOG5qeLPR8T1zDK4bfJAo1TvbwYeTwVSfd_0mzRq8WaVc_2JtEK7J-4Z0MdVm_dJmcMHVfDziCRohSZthN__WM2NwGnbewWnla0wpEsU3QMZ05_OxvbBdQZaDUsNSx46is29eCdYwhkAfFd_cFRq3DixLEYUsRwmOqwABwwDjBTNvgZOomrtD8BRFWSTlwsbrNZtJMYU33wuLO9ynFkZnY6qRKVHr3YToIrqNBXw0RWCheTouQ-snfAB6wcE2WDN3N5z760ejqQ","kid":"U5R8cHbGw445Qbq8zVO1PcCpXL8yG6IcovVa3laCoxM","kty":"RSA","use":"sig"},{"alg":"RS256","e":"AQAB","n":"l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK3HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37-XDIDb0XG-R8DOoOHLJPTpsgH-rJeM5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX-0TmG5yjSj7ek05txcpxIqYu-7FIGT0KKvXge_BOSEUlJpBhLKU28OtsOnmc3NLIGXB-GeDiUZiBYQdPR-myB4ZoQ","kid":"Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo","kty":"RSA","use":"sig"},{"alg":"RS256","e":"AQAB","n":"lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7UGLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap-CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvpdMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu-DYhT0hmyFcwn-tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ","kid":"h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU","kty":"RSA","use":"sig"}]},"key":"User information","summary":"User information","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/200/content/application~1json/examples/User information"},"paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request custom authorization server example":{"value":{"id_token_hint":"<id_token_hint_value>","post_logout_redirect_uri":"https://www.example.com/oauth2/postLogoutRedirectUri","state":1230000},"key":"Logout request custom authorization server example","summary":"Logout request custom authorization server example","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request custom authorization server example"},"paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request":{"value":{"request_uri":"urn:okta:Y1hIQ3ZqYjFodEZMOVJ3TUF4ZHRPZjJuNFZRV2ZWQ044MmFoX2VIT2oyNDo","expires_in":3600},"key":"Successful Request","summary":"Successful Request","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"},"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes":{"value":{"error":"invalid_scope","error_description":"No scopes were requested."},"key":"Missing Scopes","summary":"Missing Scopes","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes"},"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`":{"value":{"error":"unsupported_response_type","error_description":"The response type contained in the request isn't supported."},"key":"Invalid `response_type`","summary":"Invalid `response_type`","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`"},"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`":{"value":{"error":"unsupported_response_mode","error_description":"The response mode isn't supported by the authorization server. Valid response modes: [`query`, `fragment`, `form_post`, `okta_post_message`]."},"key":"Invalid `response_mode`","summary":"Invalid `response_mode`","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"},"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"Invalid value for the `client_id` parameter"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope":{"value":{"error":"access_denied","error_description":"Requests for ID tokens or access tokens with OpenID scopes require the `openid` scope."},"key":"ID Tokens require `openid` scope","summary":"ID Tokens require `openid` scope","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"},"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify":{"value":{"login_hint":"testuser@example.com","channel_hint":"push","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication Okta Verify","summary":"Initiate out-of-band primary authentication Okta Verify","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS":{"value":{"login_hint":"testuser@example.com","channel_hint":"sms","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication with SMS","summary":"Initiate out-of-band primary authentication with SMS","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice":{"value":{"login_hint":"testuser@example.com","channel_hint":"voice","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication with Voice","summary":"Initiate out-of-band primary authentication with Voice","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"none","expires_in":300,"interval":5},"key":"Initiate out-of-band primary authentication response with Okta Verify","summary":"Initiate out-of-band primary authentication response with Okta Verify","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"transfer","binding_code":95,"expires_in":300,"interval":5},"key":"Initiate out-of-band primary authentication response with Okta Verify number matching challenge","summary":"Initiate out-of-band primary authentication response with Okta Verify number matching challenge","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"sms","binding_method":"prompt","expires_in":300},"key":"Initiate out-of-band primary authentication response with SMS","summary":"Initiate out-of-band primary authentication response with SMS","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"voice","binding_method":"prompt","expires_in":300},"key":"Initiate out-of-band primary authentication response with Voice","summary":"Initiate out-of-band primary authentication response with Voice","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint":{"value":{"error":"invalid_request","error_description":"`foo` isn't supported as a `channel_hint`. Try again with another value."},"key":"Invalid channel hint","summary":"Invalid channel hint","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app":{"value":{"error":"access_denied","error_description":"User isn't assigned to the client app."},"key":"User not assigned client app","summary":"User not assigned client app","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client":{"value":{"error":"unauthorized_client","error_description":"The client isn't authorized to use the provided grant type. Configured grant types: [urn:okta:params:oauth:grant-type:otp, authorization_code]."},"key":"Grant type not enabled for client","summary":"Grant type not enabled for client","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret":{"value":{"error":"invalid_client","error_description":"The client secret supplied for a confidential client is invalid."},"key":"Invalid client secret","summary":"Invalid client secret","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used":{"value":{"error":"access_denied","error_description":"The required authenticator can't be used. Check if it's required by policy and the user is enrolled in the authenticator and try again."},"key":"No Authenticator associated with the grant type can be used","summary":"No Authenticator associated with the grant type can be used","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"},"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests":{"value":{"error":"invalid_grant","error_description":"API call exceeded the rate limit due to too many requests."},"key":"Too Many Requests","summary":"Too Many Requests","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"},"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter":{"value":{"error":"invalid_request","error_description":"The `token` parameter is required."},"key":"Missing `token` parameter","summary":"Missing `token` parameter","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter"},"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request":{"value":{"error":"invalid_request","error_description":"The `client_assertion_type` is invalid."},"key":"Client assertion type incorrect for JWT request","summary":"Client assertion type incorrect for JWT request","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request"},"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple client credentials provided","summary":"Multiple client credentials provided","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"},"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing client credentials","summary":"Missing client credentials","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"},"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","grant_type":"authorization_code","redirect_uri":"https://www.example.com/oauth2/redirectUri","code":"QnowT-aeawtOJKp-MtkH&"},"key":"Authorization Code Flow w/ Client Credentials","summary":"Authorization Code Flow w/ Client Credentials","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer":{"value":{"grant_type":"urn:ietf:params:oauth:grant-type:saml2-bearer","scope":"openid offline_access","assertion":"<base64 SAML>"},"key":"SAML Bearer","summary":"SAML Bearer","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/JWT Bearer":{"value":{"grant_type":"urn:ietf:params:oauth:grant-type:jwt-bearer","assertion":"<json_web_token>"},"key":"JWT Bearer","summary":"JWT Bearer","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/JWT Bearer"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow":{"value":{"grant_type":"password","scope":"openid","username":"testuser@example.com","password":"N9d03jadk&@odA"},"key":"Resource Owner Password Flow","summary":"Resource Owner Password Flow","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)":{"value":{"grant_type":"urn:okta:params:oauth:grant-type:otp","scope":"openid offline_access","login_hint":"testuser@example.com","otp":123456,"grant_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Direct authentication with OTP (primary factor)","summary":"Direct authentication with OTP (primary factor)","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)":{"value":{"grant_type":"http://auth0.com/oauth/grant-type/mfa-otp","scope":"openid offline_access","mfa_token":"Qwk9va6QYgR3s7JMiWUm","otp":123456,"grant_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp urn:okta:params:oauth:grant-type:oob"},"key":"Direct authentication with OTP (MFA)","summary":"Direct authentication with OTP (MFA)","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)":{"value":{"grant_type":"urn:okta:params:oauth:grant-type:oob","scope":"openid offline_access","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","grant_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Direct authentication with OOB (primary factor)","summary":"Direct authentication with OOB (primary factor)","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)":{"value":{"grant_type":"http://auth0.com/oauth/grant-type/mfa-oob","scope":"openid offline_access","mfa_token":"Qwk9va6QYgR3s7JMiWUm","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9"},"key":"Direct authentication with OOB (MFA)","summary":"Direct authentication with OOB (MFA)","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/200/content/application~1json/examples/Token response":{"value":{"access_token":"<access_token_value>","token_type":"Bearer","expires_in":3600,"scope":"openid email offline_access","refresh_token":"a9VpZDRCeFh3Nkk2VdY","id_token":"<id_token_example>"},"key":"Token response","summary":"Token response","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/200/content/application~1json/examples/Token response"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code":{"value":{"error":"invalid_grant","error_description":"The authorization code is invalid or has expired."},"key":"Invalid Authorization Code","summary":"Invalid Authorization Code","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client":{"value":{"error":"invalid_grant","error_description":"The grant was issued to another client. Ensure that the `client_id` matches the one used at the authorize request."},"key":"Mismatched Client","summary":"Mismatched Client","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple Client Credentials Provided","summary":"Multiple Client Credentials Provided","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes":{"value":{"error":"invalid_scope","error_description":"No scopes were requested."},"key":"Missing Scopes","summary":"Missing Scopes","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type":{"value":{"error":"unsupported_grant_type","error_description":"The grant type in the request isn't supported."},"key":"Unsupported Grant Type","summary":"Unsupported Grant Type","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required":{"value":{"error":"interaction_required","error_description":"The user must authenticate with the authorization server for the request to proceed","interaction_uri":"https://example.com"},"key":"OAuth STS - Interaction Required","summary":"OAuth STS - Interaction Required","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone":{"value":{"error":"access_denied","error_description":"The request is made from outside the client's permitted network zones."},"key":"Invalid Network Zone","summary":"Invalid Network Zone","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"},"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information":{"value":{"sub":"00uid4BxXw6I6TV4m0g3","name":"John Doe","nickname":"Jimmy","given_name":"John","middle_name":"James","family_name":"Doe","profile":"https://example.com/john.doe","zoneinfo":"America/Los_Angeles","locale":"en-US","updated_at":1311280970,"email":"john.doe@example.com","email_verified":true,"address":{"street_address":"123 Hollywood Blvd.","locality":"Los Angeles","region":"CA","postal_code":"90210","country":"US"},"phone_number":"+1 (425) 555-1212"},"key":"User information","summary":"User information","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"},"paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify":{"value":{"login_hint":"testuser@example.com","channel_hint":"push","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication Okta Verify","summary":"Initiate out-of-band primary authentication Okta Verify","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS":{"value":{"login_hint":"testuser@example.com","channel_hint":"sms","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication with SMS","summary":"Initiate out-of-band primary authentication with SMS","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice":{"value":{"login_hint":"testuser@example.com","channel_hint":"voice","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication with Voice","summary":"Initiate out-of-band primary authentication with Voice","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"none","expires_in":300,"interval":5},"key":"Initiate out-of-band primary authentication response with Okta Verify","summary":"Initiate out-of-band primary authentication response with Okta Verify","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"transfer","binding_code":95,"expires_in":300,"interval":5},"key":"Initiate out-of-band primary authentication response with Okta Verify number matching challenge","summary":"Initiate out-of-band primary authentication response with Okta Verify number matching challenge","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"sms","binding_method":"prompt","expires_in":300},"key":"Initiate out-of-band primary authentication response with SMS","summary":"Initiate out-of-band primary authentication response with SMS","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"voice","binding_method":"prompt","expires_in":300},"key":"Initiate out-of-band primary authentication response with Voice","summary":"Initiate out-of-band primary authentication response with Voice","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint":{"value":{"error":"invalid_request","error_description":"`foo` isn't supported as a `channel_hint`. Try again with another value."},"key":"Invalid channel hint","summary":"Invalid channel hint","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app":{"value":{"error":"access_denied","error_description":"User isn't assigned to the client app."},"key":"User not assigned client app","summary":"User not assigned client app","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client":{"value":{"error":"unauthorized_client","error_description":"The client isn't authorized to use the provided grant type. Configured grant types: [urn:okta:params:oauth:grant-type:otp, authorization_code]."},"key":"Grant type not enabled for client","summary":"Grant type not enabled for client","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret":{"value":{"error":"invalid_client","error_description":"The client secret supplied for a confidential client is invalid."},"key":"Invalid client secret","summary":"Invalid client secret","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used":{"value":{"error":"access_denied","error_description":"The required authenticator can't be used. Check if it's required by policy and the user is enrolled in the authenticator and try again."},"key":"No Authenticator associated with the grant type can be used","summary":"No Authenticator associated with the grant type can be used","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"},"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests":{"value":{"error":"invalid_grant","error_description":"API call exceeded the rate limit due to too many requests."},"key":"Too Many Requests","summary":"Too Many Requests","id":"paths/~1oauth2~1{authorizationServerId}~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"},"paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with opaque format":{"value":{"sub_id":{"format":"opaque","id":"00u1dnq5S0CfjlkpABCD"}},"key":"Global token revocation request with opaque format","summary":"Global token revocation request with opaque format","id":"paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with opaque format"},"paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (SAML)":{"value":{"sub_id":{"format":"iss_sub","sub":"user@example.com","iss":"https://idp.example.com"}},"key":"Global token revocation request with iss_sub format (SAML)","summary":"Global token revocation request with iss_sub format (SAML)","id":"paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (SAML)"},"paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (OIDC)":{"value":{"sub_id":{"format":"iss_sub","sub":"00u5t60iloOHN9pBi0g7","iss":"https://idp.example.com"}},"key":"Global token revocation request with iss_sub format (OIDC)","summary":"Global token revocation request with iss_sub format (OIDC)","id":"paths/~1oauth2~1v1~1global-token-revocation/post/requestBody/content/application~1json/examples/Global token revocation request with iss_sub format (OIDC)"},"paths/~1oauth2~1v1~1global-token-revocation/post/responses/403/content/application~1json/examples/Access denied":{"value":{"errorCode":"E0000006","errorSummary":"You don't have permission to perform the requested action.","errorLink":"E0000006","errorId":"sampleNUSD_8fdkFd8fs8SDBK","errorCauses":[]},"key":"Access denied","summary":"Access denied","id":"paths/~1oauth2~1v1~1global-token-revocation/post/responses/403/content/application~1json/examples/Access denied"},"paths/~1oauth2~1v1~1global-token-revocation/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1global-token-revocation/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata":{"value":{"issuer":"https://{yourOktaDomain}","authorization_endpoint":"https://{yourOktaDomain}/oauth2/v1/authorize","token_endpoint":"https://{yourOktaDomain}/oauth2/v1/token","userinfo_endpoint":"https://{yourOktaDomain}/oauth2/v1/userinfo","registration_endpoint":"https://{yourOktaDomain}/oauth2/v1/clients","jwks_uri":"https://{yourOktaDomain}/oauth2/v1/keys","response_types_supported":["code","id_token","code id_token","code token","id_token token","code id_token token"],"response_modes_supported":["query","fragment","form_post","okta_post_message"],"grant_types_supported":["authorization_code","implicit","refresh_token","password","urn:ietf:params:oauth:grant-type:device_code"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"],"scopes_supported":["openid","email","profile","address","phone","offline_access","groups"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"claims_supported":["iss","ver","sub","aud","iat","exp","jti","auth_time","amr","idp","nonce","name","nickname","preferred_username","given_name","middle_name","family_name","email","email_verified","profile","zoneinfo","locale","address","phone_number","picture","website","gender","birthdate","updated_at","at_hash","c_hash"],"code_challenge_methods_supported":["S256"],"introspection_endpoint":"https://{yourOktaDomain}/oauth2/v1/introspect","introspection_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"revocation_endpoint":"https://{yourOktaDomain}/oauth2/v1/revoke","revocation_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"],"end_session_endpoint":"https://{yourOktaDomain}/oauth2/v1/logout","request_parameter_supported":true,"request_object_signing_alg_values_supported":["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],"device_authorization_endpoint":"https://{yourOktaDomain}/oauth2/v1/device/authorize","pushed_authorization_request_endpoint":"https://{yourOktaDomain}/oauth2/v1/par"},"key":"OpenID Connect Metadata","summary":"OpenID Connect Metadata","id":"paths/~1.well-known~1openid-configuration/get/responses/200/content/application~1json/examples/OpenID Connect Metadata"},"paths/~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID":{"value":{"errorCode":"invalid_client","errorSummary":"Invalid value for `client_id` parameter","errorLink":"invalid_client","errorId":"sampleMlLvGUj_YD5v16vkYWY","errorCauses":[]},"key":"Invalid Client ID","summary":"Invalid Client ID","id":"paths/~1.well-known~1openid-configuration/get/responses/400/content/application~1json/examples/Invalid Client ID"},"paths/~1oauth2~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1authorize/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","scope":"openid","binding_message":"Signing in from device","login_hint":"john.doe@example.com"},"key":"Request with `login_hint`","summary":"Request with `login_hint`","id":"paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `login_hint`"},"paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","scope":"openid","binding_message":"Signing in from device","id_token_hint":"<id_token_hint_value>"},"key":"Request with `id_token_hint`","summary":"Request with `id_token_hint`","id":"paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with `id_token_hint`"},"paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","request":"<request_value>"},"key":"Request with signed `request`","summary":"Request with signed `request`","id":"paths/~1oauth2~1v1~1bc~1authorize/post/requestBody/content/application~1x-www-form-urlencoded/examples/Request with signed `request`"},"paths/~1oauth2~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response":{"value":{"auth_req_id":"ftJwF5ZwW2SGPPoTQEKtAr_U8_Ek3RvWyR","expires_in":300,"interval":5},"key":"Back Response","summary":"Back Response","id":"paths/~1oauth2~1v1~1bc~1authorize/post/responses/200/content/application~1json/examples/Back Response"},"paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple Client Credentials Provided","summary":"Multiple Client Credentials Provided","id":"paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"},"paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes":{"value":{"error":"invalid_scope","error_description":"No scopes were requested."},"key":"Missing Scopes","summary":"Missing Scopes","id":"paths/~1oauth2~1v1~1bc~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"},"paths/~1oauth2~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1v1~1bc~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1bc~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify":{"value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","channel_hint":"push","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Initiate OOB challenge with Okta Verify","summary":"Initiate OOB challenge with Okta Verify","id":"paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Okta Verify"},"paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS":{"value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","channel_hint":"sms","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Initiate OOB challenge with SMS","summary":"Initiate OOB challenge with SMS","id":"paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with SMS"},"paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice":{"value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","channel_hint":"voice","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Initiate OOB challenge with Voice","summary":"Initiate OOB challenge with Voice","id":"paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OOB challenge with Voice"},"paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge":{"value":{"mfa_token":"Qwk9va6QYgR3s7JMiWUm","challenge_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp"},"key":"Initiate OTP challenge","summary":"Initiate OTP challenge","id":"paths/~1oauth2~1v1~1challenge/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate OTP challenge"},"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-otp"},"key":"Challenge response one-time passcode authenticator","summary":"Challenge response one-time passcode authenticator","id":"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response one-time passcode authenticator"},"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"none","expires_in":300,"interval":5},"key":"Challenge response out-of-band authenticator with Okta Verify","summary":"Challenge response out-of-band authenticator with Okta Verify","id":"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify"},"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"transfer","binding_code":95,"expires_in":300,"interval":5},"key":"Challenge response out-of-band authenticator with Okta Verify number matching challenge","summary":"Challenge response out-of-band authenticator with Okta Verify number matching challenge","id":"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Okta Verify number matching challenge"},"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"sms","binding_method":"prompt","expires_in":300},"key":"Challenge response out-of-band authenticator with SMS","summary":"Challenge response out-of-band authenticator with SMS","id":"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with SMS"},"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice":{"value":{"challenge_type":"http://auth0.com/oauth/grant-type/mfa-oob","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"voice","binding_method":"prompt","expires_in":300},"key":"Challenge response out-of-band authenticator with Voice","summary":"Challenge response out-of-band authenticator with Voice","id":"paths/~1oauth2~1v1~1challenge/post/responses/200/content/application~1json/examples/Challenge response out-of-band authenticator with Voice"},"paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token":{"value":{"error":"access_denied","error_description":"`foo` has expired. Use a new `oob_code` or `mfa_token` and try again."},"key":"Invalid MFA Token","summary":"Invalid MFA Token","id":"paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Invalid MFA Token"},"paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client":{"value":{"error":"unauthorized_client","error_description":"The client isn't authorized to use the provided grant type. Configured grant types: [urn:okta:params:oauth:grant-type:otp, authorization_code]."},"key":"Grant type not enabled for client","summary":"Grant type not enabled for client","id":"paths/~1oauth2~1v1~1challenge/post/responses/400/content/application~1json/examples/Grant type not enabled for client"},"paths/~1oauth2~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret":{"value":{"error":"invalid_client","error_description":"The client secret supplied for a confidential client is invalid."},"key":"Invalid client secret","summary":"Invalid client secret","id":"paths/~1oauth2~1v1~1challenge/post/responses/401/content/application~1json/examples/Invalid client secret"},"paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token":{"value":{"error":"access_denied","error_description":"`foo` has expired. Use a new `oob_code` or `mfa_token` and try again."},"key":"Invalid MFA Token","summary":"Invalid MFA Token","id":"paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid MFA Token"},"paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type":{"value":{"error":"access_denied","error_description":"`foo` isn't supported as a `challenge_type`. Try again with another value."},"key":"Invalid Challenge Type","summary":"Invalid Challenge Type","id":"paths/~1oauth2~1v1~1challenge/post/responses/403/content/application~1json/examples/Invalid Challenge Type"},"paths/~1oauth2~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests":{"value":{"error":"invalid_grant","error_description":"API call exceeded the rate limit due to too many requests."},"key":"Too Many Requests","summary":"Too Many Requests","id":"paths/~1oauth2~1v1~1challenge/post/responses/429/content/application~1json/examples/Too Many Requests"},"paths/~1oauth2~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize":{"value":{"user_code":"RGTCFDTL","device_code":"5cbeb234-7e00-4ff7-9aa2-b1a4558a75d2","interval":5,"verification_uri_complete":"https://{yourOktaDomain}/activate?user_code=RGTCFDTL","verification_uri":"https://{yourOktaDomain}/activate","expires_in":600},"key":"Device authorize","summary":"Device authorize","id":"paths/~1oauth2~1v1~1device~1authorize/post/responses/200/content/application~1json/examples/Device authorize"},"paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes":{"value":{"error":"invalid_scope","error_description":"No scopes were requested."},"key":"Missing Scopes","summary":"Missing Scopes","id":"paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Missing Scopes"},"paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple Client Credentials Provided","summary":"Multiple Client Credentials Provided","id":"paths/~1oauth2~1v1~1device~1authorize/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"},"paths/~1oauth2~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1v1~1device~1authorize/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1device~1authorize/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token":{"value":{"active":true,"token_type":"Bearer","scope":"openid profile","client_id":"a9VpZDRCeFh3Nkk2VdYa","username":"john.doe@example.com","exp":1451606400,"iat":1451602800,"sub":"john.doe@example.com","aud":"https://{yourOktaDomain}","iss":"https://{yourOktaDomain}/oauth2/orsmsg0aWLdnF3spV0g3","jti":"AT.7P4KlczBYVcWLkxduEuKeZfeiNYkZIC9uGJ28Cc-YaI","uid":"00uid4BxXw6I6TV4m0g3"},"key":"Access token","summary":"Access token","id":"paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Access token"},"paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token":{"value":{"active":true,"token_type":"Bearer","scope":"openid profile email","client_id":"a9VpZDRCeFh3Nkk2VdYa","username":"john.doe@example.com","exp":1451606400,"sub":"john.doe@example.com","device_id":"q4SZgrA9sOeHkfst5uaa"},"key":"Refresh token","summary":"Refresh token","id":"paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Refresh token"},"paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token":{"value":{"active":false},"key":"Inactive token","summary":"Inactive token","id":"paths/~1oauth2~1v1~1introspect/post/responses/200/content/application~1json/examples/Inactive token"},"paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter":{"value":{"error":"invalid_request","error_description":"The `token` parameter is required."},"key":"Missing `token` parameter","summary":"Missing `token` parameter","id":"paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Missing `token` parameter"},"paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request":{"value":{"error":"invalid_request","error_description":"The `client_assertion_type` is invalid."},"key":"Client assertion type incorrect for JWT request","summary":"Client assertion type incorrect for JWT request","id":"paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request"},"paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple client credentials provided","summary":"Multiple client credentials provided","id":"paths/~1oauth2~1v1~1introspect/post/responses/400/content/application~1json/examples/Multiple client credentials provided"},"paths/~1oauth2~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1v1~1introspect/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1introspect/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1keys/get/responses/200/content/application~1json/examples/User information":{"value":{"keys":[{"alg":"RS256","e":"AQAB","n":"iKqiD4cr7FZKm6f05K4r-GQOvjRqjOeFmOho9V7SAXYwCyJluaGBLVvDWO1XlduPLOrsG_Wgs67SOG5qeLPR8T1zDK4bfJAo1TvbwYeTwVSfd_0mzRq8WaVc_2JtEK7J-4Z0MdVm_dJmcMHVfDziCRohSZthN__WM2NwGnbewWnla0wpEsU3QMZ05_OxvbBdQZaDUsNSx46is29eCdYwhkAfFd_cFRq3DixLEYUsRwmOqwABwwDjBTNvgZOomrtD8BRFWSTlwsbrNZtJMYU33wuLO9ynFkZnY6qRKVHr3YToIrqNBXw0RWCheTouQ-snfAB6wcE2WDN3N5z760ejqQ","kid":"U5R8cHbGw445Qbq8zVO1PcCpXL8yG6IcovVa3laCoxM","kty":"RSA","use":"sig"},{"alg":"RS256","e":"AQAB","n":"l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK3HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37-XDIDb0XG-R8DOoOHLJPTpsgH-rJeM5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX-0TmG5yjSj7ek05txcpxIqYu-7FIGT0KKvXge_BOSEUlJpBhLKU28OtsOnmc3NLIGXB-GeDiUZiBYQdPR-myB4ZoQ","kid":"Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo","kty":"RSA","use":"sig"},{"alg":"RS256","e":"AQAB","n":"lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7UGLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap-CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvpdMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu-DYhT0hmyFcwn-tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ","kid":"h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU","kty":"RSA","use":"sig"}]},"key":"User information","summary":"User information","id":"paths/~1oauth2~1v1~1keys/get/responses/200/content/application~1json/examples/User information"},"paths/~1oauth2~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1keys/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1logout/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request org authorization server example":{"value":{"id_token_hint":"<id_token_hint_value>","post_logout_redirect_uri":"https://www.example.com/oauth2/postLogoutRedirectUri","state":1230000},"key":"Logout request org authorization server example","summary":"Logout request org authorization server example","id":"paths/~1oauth2~1v1~1logout/post/requestBody/content/application~1x-www-form-urlencoded/examples/Logout request org authorization server example"},"paths/~1oauth2~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1logout/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1par/options/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request":{"value":{"request_uri":"urn:okta:Y1hIQ3ZqYjFodEZMOVJ3TUF4ZHRPZjJuNFZRV2ZWQ044MmFoX2VIT2oyNDo","expires_in":3600},"key":"Successful Request","summary":"Successful Request","id":"paths/~1oauth2~1v1~1par/post/responses/200/content/application~1json/examples/Successful Request"},"paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes":{"value":{"error":"invalid_scope","error_description":"No scopes were requested."},"key":"Missing Scopes","summary":"Missing Scopes","id":"paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Missing Scopes"},"paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`":{"value":{"error":"unsupported_response_type","error_description":"The response type contained in the request isn't supported."},"key":"Invalid `response_type`","summary":"Invalid `response_type`","id":"paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_type`"},"paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`":{"value":{"error":"unsupported_response_mode","error_description":"The response mode isn't supported by the authorization server. Valid response modes: [`query`, `fragment`, `form_post`, `okta_post_message`]."},"key":"Invalid `response_mode`","summary":"Invalid `response_mode`","id":"paths/~1oauth2~1v1~1par/post/responses/400/content/application~1json/examples/Invalid `response_mode`"},"paths/~1oauth2~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"Invalid value for the `client_id` parameter"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1v1~1par/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope":{"value":{"error":"access_denied","error_description":"Requests for ID tokens or access tokens with OpenID scopes require the `openid` scope."},"key":"ID Tokens require `openid` scope","summary":"ID Tokens require `openid` scope","id":"paths/~1oauth2~1v1~1par/post/responses/403/content/application~1json/examples/ID Tokens require `openid` scope"},"paths/~1oauth2~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1par/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify":{"value":{"login_hint":"testuser@example.com","channel_hint":"push","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication Okta Verify","summary":"Initiate out-of-band primary authentication Okta Verify","id":"paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify"},"paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS":{"value":{"login_hint":"testuser@example.com","channel_hint":"sms","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication with SMS","summary":"Initiate out-of-band primary authentication with SMS","id":"paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS"},"paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice":{"value":{"login_hint":"testuser@example.com","channel_hint":"voice","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication with Voice","summary":"Initiate out-of-band primary authentication with Voice","id":"paths/~1oauth2~1v1~1primary-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"none","expires_in":300,"interval":5},"key":"Initiate out-of-band primary authentication response with Okta Verify","summary":"Initiate out-of-band primary authentication response with Okta Verify","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"transfer","binding_code":95,"expires_in":300,"interval":5},"key":"Initiate out-of-band primary authentication response with Okta Verify number matching challenge","summary":"Initiate out-of-band primary authentication response with Okta Verify number matching challenge","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"sms","binding_method":"prompt","expires_in":300},"key":"Initiate out-of-band primary authentication response with SMS","summary":"Initiate out-of-band primary authentication response with SMS","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"voice","binding_method":"prompt","expires_in":300},"key":"Initiate out-of-band primary authentication response with Voice","summary":"Initiate out-of-band primary authentication response with Voice","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint":{"value":{"error":"invalid_request","error_description":"`foo` isn't supported as a `channel_hint`. Try again with another value."},"key":"Invalid channel hint","summary":"Invalid channel hint","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app":{"value":{"error":"access_denied","error_description":"User isn't assigned to the client app."},"key":"User not assigned client app","summary":"User not assigned client app","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client":{"value":{"error":"unauthorized_client","error_description":"The client isn't authorized to use the provided grant type. Configured grant types: [urn:okta:params:oauth:grant-type:otp, authorization_code]."},"key":"Grant type not enabled for client","summary":"Grant type not enabled for client","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret":{"value":{"error":"invalid_client","error_description":"The client secret supplied for a confidential client is invalid."},"key":"Invalid client secret","summary":"Invalid client secret","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used":{"value":{"error":"access_denied","error_description":"The required authenticator can't be used. Check if it's required by policy and the user is enrolled in the authenticator and try again."},"key":"No Authenticator associated with the grant type can be used","summary":"No Authenticator associated with the grant type can be used","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"},"paths/~1oauth2~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests":{"value":{"error":"invalid_grant","error_description":"API call exceeded the rate limit due to too many requests."},"key":"Too Many Requests","summary":"Too Many Requests","id":"paths/~1oauth2~1v1~1primary-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"},"paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter":{"value":{"error":"invalid_request","error_description":"The `token` parameter is required."},"key":"Missing `token` parameter","summary":"Missing `token` parameter","id":"paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Missing `token` parameter"},"paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request":{"value":{"error":"invalid_request","error_description":"The `client_assertion_type` is invalid."},"key":"Client assertion type incorrect for JWT request","summary":"Client assertion type incorrect for JWT request","id":"paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Client assertion type incorrect for JWT request"},"paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple client credentials provided","summary":"Multiple client credentials provided","id":"paths/~1oauth2~1v1~1revoke/post/responses/400/content/application~1json/examples/Multiple client credentials provided"},"paths/~1oauth2~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing client credentials","summary":"Missing client credentials","id":"paths/~1oauth2~1v1~1revoke/post/responses/401/content/application~1json/examples/Missing client credentials"},"paths/~1oauth2~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1revoke/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1token/options/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials":{"value":{"client_id":"0jrabyQWm4B9zVJPbotY","client_secret":"6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc","grant_type":"authorization_code","redirect_uri":"https://www.example.com/oauth2/redirectUri","code":"QnowT-aeawtOJKp-MtkH&"},"key":"Authorization Code Flow w/ Client Credentials","summary":"Authorization Code Flow w/ Client Credentials","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Authorization Code Flow w~1 Client Credentials"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer":{"value":{"grant_type":"urn:ietf:params:oauth:grant-type:saml2-bearer","scope":"openid offline_access","assertion":"<base64 SAML>"},"key":"SAML Bearer","summary":"SAML Bearer","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/SAML Bearer"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow":{"value":{"grant_type":"password","scope":"openid","username":"testuser@example.com","password":"N9d03jadk&@odA"},"key":"Resource Owner Password Flow","summary":"Resource Owner Password Flow","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Resource Owner Password Flow"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)":{"value":{"grant_type":"urn:okta:params:oauth:grant-type:otp","scope":"openid offline_access","login_hint":"testuser@example.com","otp":123456,"grant_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Direct authentication with OTP (primary factor)","summary":"Direct authentication with OTP (primary factor)","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (primary factor)"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)":{"value":{"grant_type":"http://auth0.com/oauth/grant-type/mfa-otp","scope":"openid offline_access","mfa_token":"Qwk9va6QYgR3s7JMiWUm","otp":123456,"grant_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp urn:okta:params:oauth:grant-type:oob"},"key":"Direct authentication with OTP (MFA)","summary":"Direct authentication with OTP (MFA)","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OTP (MFA)"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)":{"value":{"grant_type":"urn:okta:params:oauth:grant-type:oob","scope":"openid offline_access","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","grant_types_supported":"http://auth0.com/oauth/grant-type/mfa-otp http://auth0.com/oauth/grant-type/mfa-oob"},"key":"Direct authentication with OOB (primary factor)","summary":"Direct authentication with OOB (primary factor)","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (primary factor)"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)":{"value":{"grant_type":"http://auth0.com/oauth/grant-type/mfa-oob","scope":"openid offline_access","mfa_token":"Qwk9va6QYgR3s7JMiWUm","oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9"},"key":"Direct authentication with OOB (MFA)","summary":"Direct authentication with OOB (MFA)","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Direct authentication with OOB (MFA)"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Identity Assertion JWT Authorization Grant":{"value":{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","requested_token_type":"urn:ietf:params:oauth:token-type:id-jag","subject_token":"<id_token_value>","subject_token_type":"urn:ietf:params:oauth:token-type:id_token","client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer","client_assertion":"<private_key_jwt_value>","audience":"https://{yourOktaDomain}/oauth2/aus5h1k6yB3Pr60AX0g5","scope":"scope1 scope2"},"key":"Identity Assertion JWT Authorization Grant","summary":"Identity Assertion JWT Authorization Grant","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/Identity Assertion JWT Authorization Grant"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA vaulted secret for AI agent":{"value":{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","requested_token_type":"urn:okta:params:oauth:token-type:vaulted-secret","subject_token":"<id_token_value>","subject_token_type":"urn:ietf:params:oauth:token-type:id_token","client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer","client_assertion":"<private_key_jwt_value>","resource":"example:resource:value"},"key":"OPA vaulted secret for AI agent","summary":"OPA vaulted secret for AI agent","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA vaulted secret for AI agent"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA service account for AI agent":{"value":{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","requested_token_type":"urn:okta:params:oauth:token-type:service-account","subject_token":"<id_token_value>","subject_token_type":"urn:ietf:params:oauth:token-type:id_token","client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer","client_assertion":"<private_key_jwt_value>","resource":"example:resource:value"},"key":"OPA service account for AI agent","summary":"OPA service account for AI agent","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OPA service account for AI agent"},"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OAuth STS for AI agent":{"value":{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","requested_token_type":"urn:okta:params:oauth:token-type:oauth-sts","subject_token":"<id_token_value>","subject_token_type":"urn:ietf:params:oauth:token-type:id_token","client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer","client_assertion":"<private_key_jwt_value>","resource":"example:resource:value"},"key":"OAuth STS for AI agent","summary":"OAuth STS for AI agent","id":"paths/~1oauth2~1v1~1token/post/requestBody/content/application~1x-www-form-urlencoded/examples/OAuth STS for AI agent"},"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Token response":{"value":{"access_token":"<access_token_value>","token_type":"Bearer","expires_in":3600,"scope":"openid email offline_access","refresh_token":"a9VpZDRCeFh3Nkk2VdY","id_token":"<id_token_example>"},"key":"Token response","summary":"Token response","id":"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Token response"},"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Identity Assertion JWT Authorization Grant":{"value":{"token_type":"N_A","expires_in":300,"issued_token_type":"urn:ietf:params:oauth:token-type:id-jag","access_token":"<id_jag_value>"},"key":"Identity Assertion JWT Authorization Grant","summary":"Identity Assertion JWT Authorization Grant","id":"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/Identity Assertion JWT Authorization Grant"},"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA vaulted secret for AI agent":{"value":{"token_type":"N_A","expires_in":300,"issued_token_type":"urn:okta:params:oauth:token-type:vaulted-secret","vaulted_secret":{"key1":"value1","key2":"value2"}},"key":"OPA vaulted secret for AI agent","summary":"OPA vaulted secret for AI agent","id":"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA vaulted secret for AI agent"},"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA service account for AI agent":{"value":{"token_type":"N_A","expires_in":300,"issued_token_type":"urn:okta:params:oauth:token-type:service-account","service_account":{"username":"exampleUsername","password":"examplePassword"}},"key":"OPA service account for AI agent","summary":"OPA service account for AI agent","id":"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OPA service account for AI agent"},"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OAuth STS for AI agent":{"value":{"token_type":"Bearer","expires_in":300,"issued_token_type":"urn:okta:params:oauth:token-type:oauth-sts","access_token":"<oauth_sts_access_token_value>","scope":"chat.read chat.history"},"key":"OAuth STS for AI agent","summary":"OAuth STS for AI agent","id":"paths/~1oauth2~1v1~1token/post/responses/200/content/application~1json/examples/OAuth STS for AI agent"},"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code":{"value":{"error":"invalid_grant","error_description":"The authorization code is invalid or has expired."},"key":"Invalid Authorization Code","summary":"Invalid Authorization Code","id":"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Invalid Authorization Code"},"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client":{"value":{"error":"invalid_grant","error_description":"The grant was issued to another client. Ensure that the `client_id` matches the one used at the authorize request."},"key":"Mismatched Client","summary":"Mismatched Client","id":"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Mismatched Client"},"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided":{"value":{"error":"invalid_request","error_description":"Can't supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body."},"key":"Multiple Client Credentials Provided","summary":"Multiple Client Credentials Provided","id":"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Multiple Client Credentials Provided"},"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes":{"value":{"error":"invalid_scope","error_description":"No scopes were requested."},"key":"Missing Scopes","summary":"Missing Scopes","id":"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Missing Scopes"},"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type":{"value":{"error":"unsupported_grant_type","error_description":"The grant type in the request isn't supported."},"key":"Unsupported Grant Type","summary":"Unsupported Grant Type","id":"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/Unsupported Grant Type"},"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required":{"value":{"error":"interaction_required","error_description":"The user must authenticate with the authorization server for the request to proceed","interaction_uri":"https://example.com"},"key":"OAuth STS - Interaction Required","summary":"OAuth STS - Interaction Required","id":"paths/~1oauth2~1v1~1token/post/responses/400/content/application~1json/examples/OAuth STS - Interaction Required"},"paths/~1oauth2~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials":{"value":{"error":"invalid_client","error_description":"No client credentials found"},"key":"Missing Client Credentials","summary":"Missing Client Credentials","id":"paths/~1oauth2~1v1~1token/post/responses/401/content/application~1json/examples/Missing Client Credentials"},"paths/~1oauth2~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone":{"value":{"error":"access_denied","error_description":"The request is made from outside the client's permitted network zones."},"key":"Invalid Network Zone","summary":"Invalid Network Zone","id":"paths/~1oauth2~1v1~1token/post/responses/403/content/application~1json/examples/Invalid Network Zone"},"paths/~1oauth2~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1token/post/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information":{"value":{"sub":"00uid4BxXw6I6TV4m0g3","name":"John Doe","nickname":"Jimmy","given_name":"John","middle_name":"James","family_name":"Doe","profile":"https://example.com/john.doe","zoneinfo":"America/Los_Angeles","locale":"en-US","updated_at":1311280970,"email":"john.doe@example.com","email_verified":true,"address":{"street_address":"123 Hollywood Blvd.","locality":"Los Angeles","region":"CA","postal_code":"90210","country":"US"},"phone_number":"+1 (425) 555-1212"},"key":"User information","summary":"User information","id":"paths/~1oauth2~1v1~1userinfo/get/responses/200/content/application~1json/examples/User information"},"paths/~1oauth2~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found":{"value":{"errorCode":"E0000047","errorSummary":"You exceeded the maximum number of requests. Try again in a while.","errorLink":"E0000047","errorId":"sampleQPivGUj_ND5v78vbYWW","errorCauses":[]},"key":"Resource Not Found","summary":"Resource Not Found","id":"paths/~1oauth2~1v1~1userinfo/get/responses/429/content/application~1json/examples/Resource Not Found"},"paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify":{"value":{"login_hint":"testuser@example.com","channel_hint":"push","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication Okta Verify","summary":"Initiate out-of-band primary authentication Okta Verify","id":"paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication Okta Verify"},"paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS":{"value":{"login_hint":"testuser@example.com","channel_hint":"sms","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication with SMS","summary":"Initiate out-of-band primary authentication with SMS","id":"paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with SMS"},"paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice":{"value":{"login_hint":"testuser@example.com","channel_hint":"voice","challenge_hint":"urn:okta:params:oauth:grant-type:oob"},"key":"Initiate out-of-band primary authentication with Voice","summary":"Initiate out-of-band primary authentication with Voice","id":"paths/~1oauth2~1v1~1oob-authenticate/post/requestBody/content/application~1x-www-form-urlencoded/examples/Initiate out-of-band primary authentication with Voice"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"none","expires_in":300,"interval":5},"key":"Initiate out-of-band primary authentication response with Okta Verify","summary":"Initiate out-of-band primary authentication response with Okta Verify","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"push","binding_method":"transfer","binding_code":95,"expires_in":300,"interval":5},"key":"Initiate out-of-band primary authentication response with Okta Verify number matching challenge","summary":"Initiate out-of-band primary authentication response with Okta Verify number matching challenge","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Okta Verify number matching challenge"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"sms","binding_method":"prompt","expires_in":300},"key":"Initiate out-of-band primary authentication response with SMS","summary":"Initiate out-of-band primary authentication response with SMS","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with SMS"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice":{"value":{"oob_code":"ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9","channel":"voice","binding_method":"prompt","expires_in":300},"key":"Initiate out-of-band primary authentication response with Voice","summary":"Initiate out-of-band primary authentication response with Voice","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/200/content/application~1json/examples/Initiate out-of-band primary authentication response with Voice"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint":{"value":{"error":"invalid_request","error_description":"`foo` isn't supported as a `channel_hint`. Try again with another value."},"key":"Invalid channel hint","summary":"Invalid channel hint","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Invalid channel hint"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app":{"value":{"error":"access_denied","error_description":"User isn't assigned to the client app."},"key":"User not assigned client app","summary":"User not assigned client app","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/User not assigned client app"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client":{"value":{"error":"unauthorized_client","error_description":"The client isn't authorized to use the provided grant type. Configured grant types: [urn:okta:params:oauth:grant-type:otp, authorization_code]."},"key":"Grant type not enabled for client","summary":"Grant type not enabled for client","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/400/content/application~1json/examples/Grant type not enabled for client"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret":{"value":{"error":"invalid_client","error_description":"The client secret supplied for a confidential client is invalid."},"key":"Invalid client secret","summary":"Invalid client secret","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/401/content/application~1json/examples/Invalid client secret"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used":{"value":{"error":"access_denied","error_description":"The required authenticator can't be used. Check if it's required by policy and the user is enrolled in the authenticator and try again."},"key":"No Authenticator associated with the grant type can be used","summary":"No Authenticator associated with the grant type can be used","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/403/content/application~1json/examples/No Authenticator associated with the grant type can be used"},"paths/~1oauth2~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests":{"value":{"error":"invalid_grant","error_description":"API call exceeded the rate limit due to too many requests."},"key":"Too Many Requests","summary":"Too Many Requests","id":"paths/~1oauth2~1v1~1oob-authenticate/post/responses/429/content/application~1json/examples/Too Many Requests"}},"securitySchemeStore":{"apiToken":{"id":"apiToken","type":"apiKey","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Pass the API token as the Authorization header value prefixed with SSWS: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Authorization: SSWS {API Token}"},"children":[]}]}]}],"in":"header","paramName":"Authorization"},"oauth2":{"id":"oauth2","type":"oauth2","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Pass the access_token as the value of the Authorization header: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Authorization: Bearer {access_token}"},"children":[]}]}]}],"flows":{"authorizationCode":{"x-usePkce":{"disableManualConfiguration":false,"hideClientSecretInput":true},"authorizationUrl":"/oauth2/v1/authorize","tokenUrl":"/oauth2/v1/token","scopes":{"address":"Requests access to the `address` claim","device_sso":"Requests a device secret used to obtain a new set of tokens without re-prompting the user for authentication. See [Native SSO](https://developer.okta.com/docs/guides/configure-native-sso/main/).","email":"Requests access to the `email` and `email_verified` claims","groups":"Requests access to the `groups` claim","offline_access":"Requests a refresh token used to obtain more access tokens without re-prompting the user for authentication","okta.clients.manage":"Allows the app to manage clients in your Okta org","okta.clients.read":"Allows the app to read information about clients in your Okta org","okta.clients.register":"Allows the app to register new clients in your Okta org","okta.universalLogout.manage":"Allows an admin or a service to initiate Universal Logout and revoke all tokens and sessions associated with a specific user","okta.workflows.invoke.manage":"Allows the app to trigger an OAuth 2.0 protected flow","openid":"Identifies the request as an OpenID Connect request","phone":"Requests access to the `phone_number` and `phone_number_verified` claims","profile":"Requests access to the end user's default profile claims"}}}},"Client authentication `client_secret_basic`":{"id":"Client authentication `client_secret_basic`","type":"http","scheme":"basic","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Pass the client credentials concatenated with a "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":":"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and base64-encoded as part of the Authorization header prefixed with "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"Basic"},"children":[]}]}]},{"$$mdtype":"Node","type":"fence","attributes":{"content":"Authorization: Basic {base64(<client_id>:<client_secret>)}\n"},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"Authorization: Basic {base64(<client_id>:<client_secret>)}\n"},"children":[]}]},{"$$mdtype":"Node","type":"fence","attributes":{"content":"Authorization: Basic MGpyYWJ5UVdtNEI5elZKUGJvdFk6NVc3WFVMQ0VzNEJKS25XVVh3aDhsZ21lWFJoY0djZFZpRnA4NHBXZQ==\n"},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"Authorization: Basic MGpyYWJ5UVdtNEI5elZKUGJvdFk6NVc3WFVMQ0VzNEJKS25XVVh3aDhsZ21lWFJoY0djZFZpRnA4NHBXZQ==\n"},"children":[]}]}]},"Client authentication `client_secret_post`":{"id":"Client authentication `client_secret_post`","type":"http","scheme":"postBody","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Pass the client credentials as part of the request body."},"children":[]}]}]},{"$$mdtype":"Node","type":"fence","attributes":{"content":"\"client_id\" : <client_id>\n\"client_secret\" : <client_secret>\n"},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"\"client_id\" : <client_id>\n\"client_secret\" : <client_secret>\n"},"children":[]}]},{"$$mdtype":"Node","type":"fence","attributes":{"content":"\"client_id\" : \"0jrabyQWm4B9zVJPbotY\"\n\"client_secret\" : \"5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe\"\n"},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"\"client_id\" : \"0jrabyQWm4B9zVJPbotY\"\n\"client_secret\" : \"5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe\"\n"},"children":[]}]}]},"Client authentication `client_secret_jwt`":{"id":"Client authentication `client_secret_jwt`","type":"http","scheme":"postBody","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Pass the client credentials in the request body as a JWT "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_assertion"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" along with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". Generate the assertion by signing the JWT with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"sub"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iss"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claims set to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and signing the payload with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_secret"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" using an HMAC SHA algorithm (HS256, HS384, or HS512). See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/build-self-signed-jwt/java/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Build a JWT for Client Authentication"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"fence","attributes":{"content":"\"client_assertion\" : \"<client_assertion_value>\"\n\"client_assertion_type\" : \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\"\n"},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"\"client_assertion\" : \"<client_assertion_value>\"\n\"client_assertion_type\" : \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\"\n"},"children":[]}]}]},"Client authentication `private_key_jwt`":{"id":"Client authentication `private_key_jwt`","type":"http","scheme":"postBody","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Pass the client credentials in the request body as a JWT "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_assertion"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" along with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". Generate the assertion by signing the JWT with the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"sub"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"iss"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" claims set to the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"client_id"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" and signing the payload with the corresponding private key using an RSA or ECDSA algorithm (RS256, RS384, RS512, ES256, ES384, ES512). The private key that you use to sign the JWT must have the corresponding public key registered in the client's JWK Set. See "},"children":[]},{"$$mdtype":"Node","type":"link","inline":true,"attributes":{"href":"https://developer.okta.com/docs/guides/build-self-signed-jwt/java/main/"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Build a JWT for Client Authentication"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]},{"$$mdtype":"Node","type":"fence","attributes":{"content":"\"client_assertion\" : \"<client_assertion_value>\"\n\"client_assertion_type\" : \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\"\n"},"children":[{"$$mdtype":"Node","type":"text","attributes":{"content":"\"client_assertion\" : \"<client_assertion_value>\"\n\"client_assertion_type\" : \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\"\n"},"children":[]}]}]}},"servers":[{"url":"https://{yourOktaDomain}","variables":{"yourOktaDomain":{"default":"subdomain.okta.com","description":"The domain of your org. This can be a provided subdomain of an official okta domain (okta.com, oktapreview.com, and so on) or one of your configured custom domains."}}}]},"options":{"hideInfoMetadata":true,"hideDownloadButtons":true,"hideReplay":true,"layout":"three-panel","sanitize":true,"codeSamples":{"languages":[{"lang":"curl"},{"lang":"C#"},{"lang":"Java"},{"lang":"JavaScript"},{"lang":"Node.js"},{"lang":"Python"},{"lang":"Go"},{"lang":"PHP"},{"lang":"Ruby"},{"lang":"Payload"}]},"feedback":{"hide":true,"settings":{"label":""}},"hideSidebar":true,"mockServer":{"off":true},"disableRouter":true,"downloadUrls":[{"url":"/docs/api/_bundle/openapi/okta-oauth/oauth.json?download"},{"url":"/docs/api/_bundle/openapi/okta-oauth/oauth.yaml?download"}],"excludeFromSearch":false,"specType":"openapi","markdocOptions":{"tags":{},"nodes":{},"components":{}},"metadata":{"title":"Okta OpenID Connect & OAuth 2.0","description":"OAuth 2.0 Protocol APIs"}},"baseSlug":"/openapi/okta-oauth/oauth","routesMapping":{}}