Skip to content
GitmoapAPIBeta
Identity & platformoauth
GET/.well-known/oauth-authorization-server/oauth

Metadata for this deployment's OAuth authorization server

oauth_authorization_server_metadata
  • Public
    This operation declares no security requirement: it takes no token.

The authorization server metadata document (RFC 8414) an app reads to find where to send people and where to exchange codes: the authorization code flow with PKCE (S256), refresh tokens, public clients identified by a client ID metadata document, and every scope and bundle that can be asked for. Anyone may read it, without signing in.

Responses

200Authorization server metadataapplication/json
  • authorization_endpointstring
  • authorization_response_iss_parameter_supportedboolean
  • client_id_metadata_document_supportedboolean
  • code_challenge_methods_supportedarray of string
  • grant_types_supportedarray of string
  • issuerstring
  • response_types_supportedarray of string
  • scopes_supportedarray of string
  • token_endpointstring
  • token_endpoint_auth_methods_supportedarray of string
  • service_documentationstring or nulloptional
200 exampleSynthesized example
{
"authorization_endpoint": "authorization-endpoint-2016",
"authorization_response_iss_parameter_supported": false,
"client_id_metadata_document_supported": false,
"code_challenge_methods_supported": [
"code-challenge-methods-supported-1229"
],
"grant_types_supported": [
"grant-types-supported-360e",
"grant-types-supported-acd1"
],
"issuer": "issuer-c5d2",
"response_types_supported": [
"response-types-supported-86a1",
"response-types-supported-0b14"
],
"scopes_supported": [
"scopes-supported-235f",
"scopes-supported-7f41"
],
"token_endpoint": "token-endpoint-245a",
"token_endpoint_auth_methods_supported": [
"token-endpoint-auth-methods-supported-26ba",
"token-endpoint-auth-methods-supported-d834"
],
"service_documentation": "service-documentation-0b85"
}
501The authorization server is not configured on this deploymentapplication/json
Error codes
  • NOT_IMPLEMENTEDThis deployment has not configured the feature the operation needs; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
501 exampleSynthesized example
{
"error": {
"code": "code-8917",
"message": "Inline scalar newtypes but keep their brand"
}
}

CLI

gitmoap oauth oauth-authorization-server-metadata