Endpoints
Everything the server serves, apart from the admin API’s operations. {tenant} is the name of the tenant; every tenant has its own issuer, keys and clients under /tenants/{tenant}.
Endpoints
| Method | Path | Authentication | Purpose |
|---|---|---|---|
GET | /admin/openapi.json | None | The OpenAPI document of the admin API, readable from any origin. |
GET | /console | None | Redirects to /console/, the admin console. |
GET | /console/* | None | The admin console’s single-page app: its shell and static files. |
DELETE | /console/api/admin/* | Console session | Forwards an admin API call under /admin/ with the console’s own credentials for the signed-in user. |
GET | /console/api/admin/* | Console session | Forwards an admin API call under /admin/ with the console’s own credentials for the signed-in user. |
PATCH | /console/api/admin/* | Console session | Forwards an admin API call under /admin/ with the console’s own credentials for the signed-in user. |
POST | /console/api/admin/* | Console session | Forwards an admin API call under /admin/ with the console’s own credentials for the signed-in user. |
PUT | /console/api/admin/* | Console session | Forwards an admin API call under /admin/ with the console’s own credentials for the signed-in user. |
GET | /console/api/session | Console session | Says which tenant and user the console session belongs to. |
GET | /console/api/tenants/{tenant}/discovery | Console session | A tenant’s discovery document, with the issuer the public address gives. |
GET | /console/api/tenants/{tenant}/jwks | Console session | A tenant’s public signing keys. |
GET | /console/auth/callback | None | Receives the authorization response, redeems the code and starts a console session. |
GET | /console/auth/login | None | Starts the console’s sign-in for the tenant in the tenant query parameter, by sending the browser to that tenant’s authorization endpoint. |
POST | /console/auth/logout | Console session | Ends the console session, clears its cookie and answers where to send the browser to finish signing out. |
GET | /docs | None | Redirects to the form with the trailing slash, the documentation that ships with the server. |
GET | /docs/* | None | The documentation built into the image: its pages, search index and Markdown copies. Off with ODUDU_DOCS=false. |
GET | /favicon.ico | None | The favicon, for browsers that ask for it without a page linking one. |
GET | /health/live | None | Liveness: answers while the process is running. |
GET | /health/ready | None | Readiness: answers 200 while the database answers, and 503 when it does not. |
GET | /instrument/* | None | The stylesheet, mark, icons and fonts every server-rendered page links. |
GET | /tenants/{tenant}/.well-known/openid-configuration | None | The discovery document: the tenant’s issuer, endpoints and supported features. |
POST | /tenants/{tenant}/clients-registrations/openid-connect | Initial access token (optional) | Dynamic client registration (RFC 7591), when the tenant allows it. |
GET | /tenants/{tenant}/login-actions/action-token | Mailed link token | Redeems a mailed link: verify an email address, reset a password, or required actions. |
POST | /tenants/{tenant}/login-actions/action-token | Mailed link token | Submits a new password, or the required actions, against a mailed link. |
POST | /tenants/{tenant}/login-actions/authenticate | Sign-in session | Submits the sign-in form: one step of the tenant’s authentication flow. |
POST | /tenants/{tenant}/login-actions/consent | Sign-in session | Submits the consent screen: allow or deny. |
POST | /tenants/{tenant}/login-actions/passkey-challenge | None | Returns the options for a passkey sign-in that names no user. |
GET | /tenants/{tenant}/login-actions/registration | None | The self-registration form, when the tenant allows registration. |
POST | /tenants/{tenant}/login-actions/registration | None | Submits a self-registration. |
POST | /tenants/{tenant}/login-actions/required-action | Sign-in session | Completes an action sign-in requires first, such as changing a password. |
GET | /tenants/{tenant}/login-actions/reset-password | None | The form that asks for a password reset link. |
POST | /tenants/{tenant}/login-actions/reset-password | None | Requests a password reset link by mail. |
POST | /tenants/{tenant}/login-actions/select-account | Sign-in session | Submits the account chooser. |
GET | /tenants/{tenant}/protocol/openid-connect/auth | None | The authorization endpoint: starts an authorization code flow and sends the user to sign in. |
POST | /tenants/{tenant}/protocol/openid-connect/auth | None | The authorization endpoint, with the request sent as a form. |
GET | /tenants/{tenant}/protocol/openid-connect/certs | None | The JWKS: the tenant’s public signing keys. |
GET | /tenants/{tenant}/protocol/openid-connect/logout | Session cookie or ID token hint | RP-initiated logout: the end_session_endpoint, which ends the user’s session. |
POST | /tenants/{tenant}/protocol/openid-connect/logout | Session cookie or ID token hint | RP-initiated logout with the request sent as a form, and the confirmation form. |
POST | /tenants/{tenant}/protocol/openid-connect/revoke | Client authentication | Token revocation (RFC 7009). |
POST | /tenants/{tenant}/protocol/openid-connect/token | Client authentication | The token endpoint: exchanges a code, a refresh token, client credentials or a token (RFC 8693) for tokens. |
POST | /tenants/{tenant}/protocol/openid-connect/token/introspect | Client authentication | Token introspection (RFC 7662): says whether a token is active and what it carries. |
GET | /tenants/{tenant}/protocol/openid-connect/userinfo | Access token | The UserInfo endpoint: the claims of the user an access token names. |
POST | /tenants/{tenant}/protocol/openid-connect/userinfo | Access token | The UserInfo endpoint, with the access token sent as a form field. |
The admin API
The admin API has 114 operations, all under /admin. Each needs an access token for the admin audience and names the capability it requires; they are listed, with their parameters and bodies, in the admin API reference. A path under /console/auth or /console/api that is not listed answers 404.