Skip to content
GitmoapAPIBeta
Identity & platformoidc
GET/.well-known/openid-configuration

OIDC Discovery document for the gitmoap issuer.

oidc_discovery
  • Public
    This operation declares no security requirement: it takes no token.

The OpenID Connect discovery document for the identity tokens gitmoap issues to pipeline runs, so a cloud provider can register gitmoap as an identity provider and trust those tokens: the issuer, where its signing keys are published, RS256 signatures and the claims a token carries. Anyone may read it, without signing in, and it may be cached for five minutes.

Responses

200OIDC discovery documentapplication/json
  • claims_supportedarray of string
  • id_token_signing_alg_values_supportedarray of string
  • issuerstring
  • jwks_uristring
  • response_types_supportedarray of string
  • scopes_supportedarray of string
  • subject_types_supportedarray of string
200 exampleSynthesized example
{
"claims_supported": [
"claims-supported-ed2a"
],
"id_token_signing_alg_values_supported": [
"id-token-signing-alg-values-supported-641c"
],
"issuer": "issuer-c8bf",
"jwks_uri": "https://gitmoap.example/acme/97542570",
"response_types_supported": [
"response-types-supported-f808"
],
"scopes_supported": [
"scopes-supported-b13b"
],
"subject_types_supported": [
"subject-types-supported-4022",
"subject-types-supported-d874"
]
}
501The OIDC issuer is not configured on this deploymentapplication/json
Error codes
  • NOT_IMPLEMENTEDThis deployment has not configured the feature the operation needs; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
501 exampleSynthesized example
{
"error": {
"code": "code-670e",
"message": "Label every synthesized example"
}
}

CLI

gitmoap oidc oidc-discovery

Used in these guides