oauth-minimal.yaml

openapi: 3.0.3
info:
  title: Okta OpenID Connect & OAuth 2.0
  version: 2026.07.3
  description: OAuth 2.0 Protocol APIs
  termsOfService: https://developer.okta.com/terms/
  contact:
    name: Okta Developer Team
    url: https://developer.okta.com/
    email: devex-public@okta.com
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  x-logo:
    url: logo.svg
    backgroundColor: transparent
    altText: Okta Developer
servers:
  - url: https://{yourOktaDomain}
    variables:
      yourOktaDomain:
        default: subdomain.okta.com
        description: The domain of your org. This can be a provided subdomain of an official okta domain (okta.com, oktapreview.com, and so on) or one of your configured custom domains.
tags:
  - name: Client
    x-displayName: Dynamic Client Registration
    description: |-
      The Dynamic Client Registration API provides operations to register and manage client apps for use with the Okta OAuth 2.0 and OpenID Connect endpoints. This API largely follows the contract defined in [RFC7591: OAuth 2.0 Dynamic Client Registration Protocol](https://tools.ietf.org/html/rfc7591) and [OpenID Connect Dynamic Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html).

      > **Note:** Clients managed through this API are modeled as apps in Okta and appear in the apps section of the Admin Console. Changes made through the API appear in the Admin Console and vice versa. Tokens issued by these clients follow the rules for access tokens and ID tokens.
  - name: CustomAS
    x-displayName: Custom Authorization Servers
    description: |-
      Use a custom authorization server to create and apply authorization policies to secure your APIs. An access token that's minted by a custom authorization server is consumed by your APIs.

      > **Note:** Okta has two types of authorization servers: the org authorization server and the custom authorization server. To learn more about each type of authorization server and when to use them, see [Authorization servers](https://developer.okta.com/docs/concepts/auth-servers/).

      You can [create multiple custom authorization servers](https://developer.okta.com/docs/guides/customize-authz-server/main/#create-an-authorization-server) within a single Okta org that you can use to protect your own resource servers. Within each authorization server, define your own custom OAuth 2.0 scopes, claims, and access policies to support authorization for your APIs.
  - name: GlobalTokenRevocation
    x-displayName: Global Token Revocation
    description: |-
      The Global Token Revocation API provides a comprehensive solution for managing security across multiple apps and services. This API extends beyond the standard OAuth 2.0 token revocation, enabling the revocation of SSWS tokens and facilitating identity provider (IdP)-initiated sign-out processes.

      When you use the API, you revoke all tokens and sessions for a specified user by sending the `sub_id` in the request body. Use the `opaque` format for Okta user IDs.

      <x-lifecycle class="ea"></x-lifecycle>For users authenticated through a SAML or OIDC IdP, use the `iss_sub` format to identify the user by issuer (`iss`) and subject (`sub`). See [Manage Early Access and Beta features](https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata) to enable the feature: Third-Party IdP Global Token Revocation.
  - name: OrgAS
    x-displayName: Org Authorization Server
    description: |-
      Every Okta org comes with a built-in authorization server called the org authorization server. Use the org authorization server to perform SSO with Okta for your OpenID Connect apps or to get an access token for the Okta APIs. You can't customize this authorization server with regards to audience, claims, policies, or scopes. Additionally, the resulting access token's issuer is `https://{yourOktaDomain}`, which indicates that only Okta can consume or validate it. Your apps can't use or validate the access token.

      > **Note:** Okta has two types of authorization servers: the org authorization server and the custom authorization server. To learn more about each type of authorization server and when to use them, see [Authorization servers](https://developer.okta.com/docs/concepts/auth-servers/).
externalDocs:
  description: Find more info here
  url: https://developer.okta.com
paths:
  /.well-known/openid-configuration:
    get:
      summary: Retrieve the OpenID Connect metadata
      description: Returns OpenID Connect metadata for the Okta org authorization server. Clients use this information to programmatically configure their interactions with Okta.
      operationId: getWellKnownOpenIDConfiguration
      parameters:
        - $ref: '#/components/parameters/queryClientId'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OidcMetadata'
              examples:
                OpenID Connect Metadata:
                  $ref: '#/components/examples/OrgASOidcMetadata'
        '400':
          $ref: '#/components/responses/Error400InvalidClientId'
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/authorize:
    get:
      summary: /authorize
      description: |-
        This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This request authenticates the user and returns tokens along with an authorization grant to the client app as a part of the callback response.

        > **Note:** Requests to the `/authorize` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error.
      operationId: authorize
      parameters:
        - name: acr_values
          in: query
          description: |-
            You can include an optional parameter in the authentication request. This parameter increases the level of user assurance.

            > **Note:** You can also provide multiple space-delimited values. The authorization server chooses one and reflects the chosen value in any resulting tokens.
          schema:
            $ref: '#/components/schemas/AcrValue'
        - name: client_id
          in: query
          required: true
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](/openapi/okta-oauth/oauth/client). It identifies the client and must match the value preregistered in Okta.
          schema:
            type: string
        - name: code_challenge
          in: query
          description: A challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/). The challenge is verified in the access token request.
          schema:
            type: string
        - name: code_challenge_method
          in: query
          description: Method used to derive the code challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/)
          schema:
            $ref: '#/components/schemas/CodeChallengeMethod'
        - name: display
          in: query
          description: The `display` parameter to be passed to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/)
          schema:
            type: string
        - name: enroll_amr_values
          in: query
          description: |-
            A space-delimited list of values indicating which authenticators to enroll in.

            * If the `enroll_amr_values` parameter is specified, then the value for `prompt` must be `enroll_authenticator`.
            * The parameter value is space-delimited, for example, `pwd sms okta_verify` is a valid request parameter value. You are prompted in the order of the amr values provided.
          schema:
            $ref: '#/components/schemas/AmrValue'
        - name: idp_scope
          in: query
          description: An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/). These scopes are used in addition to the scopes already configured for the identity provider.
          schema:
            type: string
        - name: idp
          in: query
          description: An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.
          schema:
            type: string
        - name: interclient_token
          x-okta-lifecycle:
            lifecycle: LIMITED_GA
            isGenerallyAvailable: false
            SKUs:
              - Okta Identity Engine
          in: query
          description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>A token used to SSO into the client app
          schema:
            type: string
        - name: login_hint
          in: query
          description: A username to pre-populate if prompting for authentication
          schema:
            type: string
        - name: max_age
          in: query
          description: Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta
          schema:
            type: integer
        - name: nonce
          in: query
          description: A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See [OIDC Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
          schema:
            type: string
        - name: prompt
          in: query
          description: |-
            If you don't specify the `prompt` parameter, the standard behavior occurs:
            * If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, the user is prompted to authenticate.
            * If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent.
          schema:
            $ref: '#/components/schemas/Prompt'
        - name: redirect_uri
          in: query
          required: true
          description: Callback location where the authorization code or tokens should be sent. It must match the value preregistered in Okta during client registration.
          schema:
            type: string
        - name: response_type
          in: query
          required: true
          description: Any combination of `code`, `token`, and `id_token`. The combination determines the [flow](https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow).
          schema:
            $ref: '#/components/schemas/ResponseTypesSupported'
        - name: response_mode
          in: query
          description: |-
            How the authorization response should be returned. If `id_token` or `token` is specified in the `response_type`, then `query` isn't allowed as a response mode. Defaults to `fragment` in implicit and hybrid flows.

            The `Referrer-Policy` header is automatically included in the response when either the fragment or query parameter values are used. The header is set to `Referrer-Policy: no-referrer`.
          schema:
            $ref: '#/components/schemas/ResponseMode'
        - name: request_uri
          in: query
          description: Location where the authorization request payload data is referenced in an authorization request to the `/authorize` endpoint. This is returned from a Pushed Authorization Request at the `/par` endpoint.
          schema:
            type: string
        - name: request
          in: query
          description: |-
            A JWT created by the client that enables requests to be passed as a single, self-contained parameter.

            * You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet.
            * You can't encrypt the JWT.
            >  **Note:** See [Build a JWT for client authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/) for information on how to build a JWT.
            * Okta supports the [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2), [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature algorithms. HMAC signatures require that the client have a `token_endpoint_auth_method` that uses a `client_secret`. RSA and ECDSA signatures require that the client registers a public key.
            * Okta recommends that you don't duplicate any request parameters in the JWT and the query URI. However, you can do so with `state`, `nonce`, `code_challenge`, and `code_challenge_method`. In those cases, the values in the JWT overrides the query URI values.
            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it has already been processed.
          schema:
            type: string
        - name: scope
          in: query
          required: true
          description: A space-delimited string of scopes requested
          schema:
            type: string
        - name: sessionToken
          in: query
          description: Okta one-time session token. This is an Okta extension to the OpenID specification. The `sessionToken` allows an API-based user sign-in flow.
          schema:
            type: string
        - name: state
          in: query
          required: true
          description: |-
            A value that is returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters.

            Okta requires the OAuth 2.0 `state` parameter on all requests to the `/authorize` endpoint to prevent cross-site request forgery (CSRF).
            The OAuth 2.0 specification [requires](https://tools.ietf.org/html/rfc6749#section-10.12) that clients protect their redirect URIs against CSRF by sending a value in the authorize request that binds the request to the user-agent's authenticated state.
            Using the `state` parameter is also a countermeasure to several other known attacks as outlined in [OAuth 2.0 Threat Model and Security Considerations](https://tools.ietf.org/html/rfc6819).
          schema:
            type: string
      responses:
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      summary: /authorize
      description: |-
        This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This endpoint method behaves the same as [`GET /oauth2/v1/authorize`](/openapi/okta-oauth/oauth/orgas/authorize), except that all parameters are specified in the request body and submitted through the form post. No query parameters are allowed.
        > **Note:** Requests to the `/authorize` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error.
      operationId: authorizeWithPost
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthorizeWithPost'
      responses:
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - OrgAS
  /oauth2/v1/bc/authorize:
    post:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      summary: /bc/authorize
      description: |-
        This endpoint returns a unique identifier (`auth_req_id`) that identifies the authentication flow while it tries to authenticate the user in the background. This `auth_req_id` value is used in subsequent token requests to the `/token` endpoint.

        > **Note:** The `/bc/authorize` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: bcAuthorize
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/BackchannelAuthorizeRequest'
            examples:
              Request with `login_hint`:
                $ref: '#/components/examples/BCAuthorizeRequestLoginHintExample'
              Request with `id_token_hint`:
                $ref: '#/components/examples/BCAuthorizeRequestIdTokenHintExample'
              Request with signed `request`:
                $ref: '#/components/examples/BCAuthorizeSignedRequestExample'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BackchannelAuthorizeResponse'
              examples:
                Back Response:
                  $ref: '#/components/examples/BackchannelAuthorizeResponseExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Multiple Client Credentials Provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
                Missing Scopes:
                  $ref: '#/components/examples/OAuthError400InvalidScope_MissingScopes'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
  /oauth2/v1/challenge:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    post:
      summary: /challenge
      description: |-
        Initiates the challenge of subsequent factor(s) in a direct authentication flow after the token endpoint has responded with `mfa_required`. This endpoint is optional if the client is able to proceed without it, for example, when the client knows it needs to follow up with an OTP and can prompt the end user for one.

        > **Note:** The `/challenge` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: challenge
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/ChallengeRequest'
            examples:
              challengeRequestOob:
                $ref: '#/components/examples/ChallengeRequestOobExample'
              challengeRequestSms:
                $ref: '#/components/examples/ChallengeRequestOobSmsExample'
              challengeRequestVoice:
                $ref: '#/components/examples/ChallengeRequestOobVoiceExample'
              challengeRequestOtp:
                $ref: '#/components/examples/ChallengeRequestOtpExample'
      responses:
        '200':
          description: The next factor type to challenge is returned and in the case of out-of-band factors, any information needed for the out-of-band transaction.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeResponse'
              examples:
                challengeResponseOtp:
                  $ref: '#/components/examples/ChallengeResponseMfaOtpExample'
                challengeResponseOob:
                  $ref: '#/components/examples/ChallengeResponseMfaOobExample'
                challengeResponseOvNmc:
                  $ref: '#/components/examples/ChallengeResponseOktaVerifyNumberMatchChallengeExample'
                challengeResponseSms:
                  $ref: '#/components/examples/ChallengeResponseSmsExample'
                challengeResponseVoice:
                  $ref: '#/components/examples/ChallengeResponseVoiceExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidMfaToken:
                  $ref: '#/components/examples/ChallengeErrorInvalidMfaToken'
                grantTypeDisabled:
                  $ref: '#/components/examples/OobAuthenticateErrorGrantTypeDisabled'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidClientSecret:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidClientSecret'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                authenticatorCannotBeUsed:
                  $ref: '#/components/examples/ChallengeErrorInvalidMfaToken'
                invalidChallengeType:
                  $ref: '#/components/examples/ChallengeErrorInvalidChallengeType'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                userRateLimit:
                  $ref: '#/components/examples/OobAuthenticateErrorRateLimit'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
  /oauth2/v1/clients:
    get:
      summary: List all client applications
      description: Lists all the client apps with pagination
      operationId: listClients
      parameters:
        - $ref: '#/components/parameters/queryAfter'
        - $ref: '#/components/parameters/queryLimit'
        - name: q
          in: query
          schema:
            type: string
          description: |-
            Searches the `client_name` property of clients for a matching value.

            > **Note:** Search currently performs a `startsWith` match, but this is an implementation detail and may change without notice.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Client'
              examples:
                All Clients:
                  $ref: '#/components/examples/ListClientsResponse'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.read
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: Register a client app
      description: |-
        Registers a new client app

        > **Note:** You can create apps on the Apps endpoint (`/api/v1/apps`) and default to `consent_method=TRUSTED`, while those created with Dynamic Client Registration (`/oauth2/v1/clients`) default to `consent_method=REQUIRED`.

        > **Note:** If you want to specify the `client_id` or `client_secret`, you can use the Applications API to create or update a client app.

        Different app types have different valid values for the corresponding grant type:

        | App Type  | Valid Grant Type                                                           | Requirements                                   |
        | :---------------- | :------------------------------------------------------------------------- | :--------------------------------------------- |
        | `browser`         | `authorization_code`, `implicit`, `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are <x-lifecycle class="oie"></x-lifecycle>only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`                                           |                                                |
        | `native`          | `authorization_code`, `implicit`, `password`, `refresh_token`, `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are <x-lifecycle class="oie"></x-lifecycle>only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`              | Must have at least `authorization_code`        |
        | `service`         | `client_credentials`, `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are <x-lifecycle class="oie"></x-lifecycle>only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`                                                       | Works with the OAuth 2.0 flow (not OpenID Connect) |
        | `web`             | `authorization_code`, `implicit`, `refresh_token`, `client_credentials`(*), `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are <x-lifecycle class="oie"></x-lifecycle>only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob` | Must have at least `authorization_code`        |

        > **Note:** The `client_credentials` grant with a web app type allows you to use one `client_id` for an app that needs to make user-specific calls and back-end calls for data.

        > **Note:** The `grant_types` and `response_types` values described above are partially orthogonal, as they refer to arguments passed to different endpoints in the [OAuth 2.0 protocol](https://tools.ietf.org/html/rfc6749). However, they are related in that the `grant_types` available to a client influence the `response_types` that the client is allowed to use and vice versa. For instance, a `grant_types` value that includes `authorization_code` implies a `response_types` value that includes `code`, as both values are defined as part of the OAuth 2.0 authorization code grant.
      operationId: createClient
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Client'
            examples:
              Web client:
                $ref: '#/components/examples/ClientRequestWeb'
              Service client with JWKS:
                $ref: '#/components/examples/ClientRequestServiceJwks'
              Service client with jwks_uri:
                $ref: '#/components/examples/ClientRequestServiceJwksUri'
              Web client with ID token encryption enabled:
                $ref: '#/components/examples/ClientRequestWebWithIdTokenEncryption'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Client'
              examples:
                Web client:
                  $ref: '#/components/examples/ClientResponseWeb'
                Service client with JWKS:
                  $ref: '#/components/examples/ClientResponseServiceJwks'
                Service client with jwks_uri:
                  $ref: '#/components/examples/ClientResponseServiceJwksUri'
                Web client with ID token encryption enabled:
                  $ref: '#/components/examples/ClientResponseWebWithIdTokenEncryption'
        '400':
          $ref: '#/components/responses/ErrorInvalidClientMetadata400'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.register
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/clients/{clientId}:
    parameters:
      - $ref: '#/components/parameters/OAuthPathClientId'
    get:
      summary: Retrieve a client app
      description: Retrieves a client app by `clientId`
      operationId: getClient
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Client'
              examples:
                Web client:
                  $ref: '#/components/examples/ClientResponseWeb'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound404'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.read
      tags:
        - Client
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace a client app
      description: |-
        Replaces the settings for a client app.

        > **Note:** You must specify all settings when you update a client app. Partial updates aren't supported. If any settings are missing when you update a client app, the update fails. The exceptions are that you can't include `client_secret_expires_at` or `client_id_issued_at` in the request, and you can omit the `client_secret`.
      operationId: replaceClient
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Client'
            examples:
              Web client:
                $ref: '#/components/examples/ClientRequestWebUpdate'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Client'
              examples:
                Web client:
                  $ref: '#/components/examples/ClientResponseWebUpdate'
        '400':
          $ref: '#/components/responses/ErrorInvalidClientMetadata400'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound404'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.manage
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    delete:
      summary: Delete a client app
      description: Deletes a client app
      operationId: deleteClient
      responses:
        '204':
          description: No Content
          content: {}
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound404'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.manage
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/clients/{clientId}/lifecycle/newSecret:
    parameters:
      - $ref: '#/components/parameters/OAuthPathClientId'
    post:
      summary: Generate a new client secret
      description: |-
        Generates a new client secret for the specified client app.

        > **Note:** This operation only applies to client apps that use the `client_secret_post` or `client_secret_basic` method for token endpoint authorization.
      operationId: generateNewClientSecret
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Client'
              examples:
                Web client:
                  $ref: '#/components/examples/ClientResponseWebUpdateNewSecret'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound404'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.manage
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/device/authorize:
    post:
      summary: /device/authorize
      description: Returns a user code, device code, activation link, and QR code activation link
      operationId: deviceAuthorize
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/DeviceAuthorizeRequest'
      responses:
        '200':
          description: Based on the type of token and whether it's active, the returned JSON contains a different set of information.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceAuthorizeResponse'
              examples:
                Device authorize:
                  $ref: '#/components/examples/DeviceAuthorizeResponseExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Scopes:
                  $ref: '#/components/examples/OAuthError400InvalidScope_MissingScopes'
                Multiple Client Credentials Provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/global-token-revocation:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    post:
      summary: Initiate the global revocation of all tokens and sessions
      description: Initiates the global revocation of all tokens and sessions for a specified user enabling external identity providers to trigger a comprehensive sign-out process. This includes executing IdP-initiated sign-out flows across all apps that are using global token revocation and requiring users to re-authenticate to access protected resources.
      operationId: globalTokenRevocation
      x-codegen-request-body-name: body
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GlobalTokenRevocationRequest'
            examples:
              Opaque format:
                $ref: '#/components/examples/GlobalTokenRevocationRequestOpaqueExample'
              ISS-SUB format (SAML):
                $ref: '#/components/examples/GlobalTokenRevocationRequestIssSubSamlExample'
              ISS-SUB format (OIDC):
                $ref: '#/components/examples/GlobalTokenRevocationRequestIssSubOidcExample'
        required: true
      responses:
        '204':
          description: No Content
          content: {}
        '400':
          description: Bad Request
          content: {}
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.universalLogout.manage
      tags:
        - GlobalTokenRevocation
  /oauth2/v1/introspect:
    post:
      summary: /introspect
      description: |-
        This endpoint takes an access token, ID token, refresh token, or device secret and returns a boolean that indicates whether it's active. If the token is active, additional data about the token is also returned. If the token is invalid, expired, or revoked, it's considered inactive.

        Be sure that you are using the `/introspect` endpoint of the same authorization server that you used to create the token.

        > **Note:** The `/introspect` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/). For public clients (such as single-page and mobile apps) that don't have a `client_secret`, include the `client_id` as a query parameter when calling the `/introspect` endpoint. Make sure that you aren't passing the Authorization header in the request.
      operationId: introspect
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/IntrospectionRequest'
      responses:
        '200':
          description: Based on the type of token and whether it's active, the returned JSON contains a different set of information.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntrospectionResponse'
              examples:
                Access token:
                  $ref: '#/components/examples/IntrospectionAccessToken'
                Refresh token:
                  $ref: '#/components/examples/IntrospectionRefreshToken'
                Inactive token:
                  $ref: '#/components/examples/IntrospectionInactiveToken'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing `token` parameter:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MissingToken'
                Client assertion type incorrect for JWT request:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_AssertionTypeInvalid'
                Multiple client credentials provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/keys:
    get:
      summary: /keys
      description: |-
        Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server.

        > **Note:** Looking for how to obtain the `jwks_uri` for your org authorization server? See the [well-known OpenID Connect metadata endpoint](/openapi/okta-oauth/oauth/customas/getwellknownopenidconfigurationcustomas).

        Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used.

        You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform [JWS](https://datatracker.ietf.org/doc/html/rfc7515) signature validation.

        > **Note:** The information returned from this endpoint could lag slightly, but eventually updates.

        > **Note:** Okta returns [standard HTTP Cache-Control headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control) for applicable JWKS endpoints. Ensure that you respect the cache header directives, as they are updated based on the time of the request.

        For more information on key rotation and best practices, see [JSON Web Key Set](/openapi/okta-oauth/guides/overview/#json-web-key-set).
      operationId: oauthKeys
      parameters:
        - name: client_id
          in: query
          description: The `client_id` of a client app. Providing this optional parameter includes any public keys associated with the signing keys of the app.
          schema:
            type: string
      responses:
        '200':
          description: Success
          headers:
            Cache-Control:
              schema:
                type: string
              example: max-age=3832304, must-revalidate
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthKeys'
              examples:
                User information:
                  $ref: '#/components/examples/OAuthKeysExample'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/logout:
    get:
      summary: /logout
      description: |-
        Use this operation to sign a user out by removing their Okta browser session.

        This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a `post_logout_redirect_uri` to redirect the browser after the sign-out action is performed. Otherwise, the browser is redirected to the Okta sign-in page. See [Sign users out](https://developer.okta.com/docs/guides/sign-users-out/).

        If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the `post_logout_redirect_uri` (if specified).

        If the ID token passed with the `id_token_hint` parameter is invalid, the browser is redirected to an error page.

        If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the `post_logout_redirect_uri`.

        > **Note:** When making requests to the `/logout` endpoint, the browser (user agent) should be redirected to the endpoint. You can't use AJAX with this endpoint. Okta may load an interstitial to do client-side logic before redirecting to the `post_logout_redirect_uri` or sign-in page if no redirect is provided.
      operationId: logout
      parameters:
        - name: id_token_hint
          in: query
          description: A valid ID token with a subject that matches the current session
          schema:
            type: string
          required: true
        - name: post_logout_redirect_uri
          in: query
          description: Location to redirect to after the logout is performed. It must match the value preregistered in Okta during client registration.
          schema:
            type: string
        - $ref: '#/components/parameters/queryState'
      responses:
        '200':
          description: Successful Logout
          content: {}
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: /logout
      description: |-
        Use this operation to sign a user out by removing their Okta browser session. This is the recommended method over GET as you can wrap the parameters in the request body.

        This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a `post_logout_redirect_uri` to redirect the browser after the user signs out. Otherwise, the browser is redirected to the Okta sign-in page. See [Sign users out](https://developer.okta.com/docs/guides/sign-users-out/).

        If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the `post_logout_redirect_uri` (if specified).

        If the ID token passed with the `id_token_hint` parameter is invalid, the browser is redirected to an error page.

        If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the `post_logout_redirect_uri`.

        > **Note:** When making requests to the `/logout` endpoint, the browser (user agent) should be redirected to the endpoint. You need to make a POST request from a form. A POST request to this endpoint from the backend doesn't completely terminate the session.
      operationId: logoutWithPost
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/LogoutWithPost'
            examples:
              LogoutRequest:
                $ref: '#/components/examples/LogoutRequestExample'
      responses:
        '200':
          description: Successful Logout
          content: {}
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/oob-authenticate:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    post:
      deprecated: true
      summary: /oob-authenticate
      description: |-
        Initiates direct authentication with an out-of-band authenticator

        > **Note:** The `/oob-authenticate` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).

        > **Note:** This endpoint is deprecated. Use [/primary-authenticate](//openapi/okta-oauth/oauth/customas/primary-authenticate-custom-as) instead.
      operationId: oob-authenticate
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OobAuthenticateRequest'
            examples:
              oobRequest:
                $ref: '#/components/examples/OobAuthenticateRequestExample'
              oobSmsRequest:
                $ref: '#/components/examples/OobAuthenticateSmsRequestExample'
              oobVoiceRequest:
                $ref: '#/components/examples/OobAuthenticateVoiceRequestExample'
      responses:
        '200':
          description: Out-of-band authentication has successfully been initiated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OobAuthenticateResponse'
              examples:
                ovPushResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseExample'
                ovNmcResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseOktaVerifyNumberMatchChallengeExample'
                smsResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseSmsExample'
                voiceResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseVoiceExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidChannelHint:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidChannelHint'
                userNotAssigned:
                  $ref: '#/components/examples/OobAuthenticateErrorUserNotAssignedApp'
                grantTypeDisabled:
                  $ref: '#/components/examples/OobAuthenticateErrorGrantTypeDisabled'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidClientSecret:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidClientSecret'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                authenticatorCannotBeUsed:
                  $ref: '#/components/examples/OobAuthenticateErrorAuthenticatorCannotBeUsed'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                userRateLimit:
                  $ref: '#/components/examples/OobAuthenticateErrorRateLimit'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
  /oauth2/v1/par:
    options:
      summary: /par
      description: |-
        Use this operation to request the permitted communication options for the `/par` operation.

        > **Note:** CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin.
      operationId: parOptions
      parameters:
        - in: header
          name: Origin
          description: Indicates the origin of the client that's initiating the request
          schema:
            type: string
          example: example.okta.com
      responses:
        '204':
          description: Success
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
              example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
              example: POST
            Access-Control-Max-Age:
              schema:
                type: string
              example: 3600
            Vary:
              schema:
                type: string
              example: Origin
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    post:
      summary: /par
      description: |-
        The pushed authorization request endpoint (`/par`) promotes OAuth security by allowing the authorization server to authenticate the client before any user interaction happens. The increased confidence in the client's identity during the authorization process means the authorization server can refuse illegitimate requests much earlier in the process. This process prevents attempts to spoof clients or otherwise tamper with or misuse an authorization request and provides a simple way to make a confidential and integrity-protected request.

        The `/par` endpoint allows an OAuth 2.0 client to push the payload of an authorization request directly to the authorization server. The authorization server provides a request URI value in the response. The request URI is a reference to the authorization request payload data in a subsequent call to the `/authorize` endpoint through a user agent.
      operationId: par
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ParRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ParResponse'
              examples:
                Successful Request:
                  $ref: '#/components/examples/ParResponseExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Scopes:
                  $ref: '#/components/examples/OAuthError400InvalidScope_MissingScopes'
                Invalid `response_type`:
                  $ref: '#/components/examples/OAuthError400UnsupportedResponseType'
                Invalid `response_mode`:
                  $ref: '#/components/examples/OAuthError400UnsupportedResponseMode'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_InvalidClientId'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                ID Tokens require `openid` scope:
                  $ref: '#/components/examples/OAuthError403AccessDenied_NeedOpenidScope'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
  /oauth2/v1/primary-authenticate:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    post:
      summary: /primary-authenticate
      description: |-
        Initiates direct authentication with an out-of-band authenticator

        > **Note:** The `/primary-authenticate` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: primary-authenticate
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OobAuthenticateRequest'
            examples:
              oobRequest:
                $ref: '#/components/examples/OobAuthenticateRequestExample'
              oobSmsRequest:
                $ref: '#/components/examples/OobAuthenticateSmsRequestExample'
              oobVoiceRequest:
                $ref: '#/components/examples/OobAuthenticateVoiceRequestExample'
      responses:
        '200':
          description: Out-of-band authentication has successfully been initiated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OobAuthenticateResponse'
              examples:
                ovPushResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseExample'
                ovNmcResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseOktaVerifyNumberMatchChallengeExample'
                smsResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseSmsExample'
                voiceResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseVoiceExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidChannelHint:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidChannelHint'
                userNotAssigned:
                  $ref: '#/components/examples/OobAuthenticateErrorUserNotAssignedApp'
                grantTypeDisabled:
                  $ref: '#/components/examples/OobAuthenticateErrorGrantTypeDisabled'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidClientSecret:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidClientSecret'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                authenticatorCannotBeUsed:
                  $ref: '#/components/examples/OobAuthenticateErrorAuthenticatorCannotBeUsed'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                userRateLimit:
                  $ref: '#/components/examples/OobAuthenticateErrorRateLimit'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
  /oauth2/v1/revoke:
    post:
      summary: /revoke
      description: |-
        The API takes an access or refresh token and revokes it. Revoked tokens are considered inactive at the introspection endpoint. A client may only revoke its own tokens. See [Revoke tokens](https://developer.okta.com/docs/guides/revoke-tokens/).

        > **Note:** The `/revoke` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: revoke
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/RevokeRequestOrgAs'
      responses:
        '200':
          description: Successful Revocation. Note that revoking an invalid, expired, or revoked token is still considered a success so information isn't leaked.
          content: {}
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing `token` parameter:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MissingToken'
                Client assertion type incorrect for JWT request:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_AssertionTypeInvalid'
                Multiple client credentials provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing client credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/token:
    options:
      summary: /token
      description: |-
        Use this operation to request the permitted communication options for the `/token` operation.

        > **Note:** CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin.
      operationId: tokenOptions
      parameters:
        - in: header
          name: Origin
          description: Indicates the origin of the client that's initiating the request
          schema:
            type: string
          example: example.okta.com
      responses:
        '204':
          description: Success
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
              example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
              example: POST
            Access-Control-Max-Age:
              schema:
                type: string
              example: 3600
            Vary:
              schema:
                type: string
              example: Origin
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: /token
      description: |-
        This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For [password](https://developer.okta.com/docs/guides/implement-grant-type/ropassword/main/), [client credentials](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/), [SAML 2.0 assertion](https://developer.okta.com/docs/guides/implement-grant-type/saml2assert/main/), and [refresh token](https://developer.okta.com/docs/guides/refresh-tokens/main/) flows, calling `/token` is the only step of the flow. For the [authorization code](https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/) flow, calling `/token` is the second step of the flow.

        > **Note:** The `/token` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: token
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/TokenRequestOrgAs'
            examples:
              Authorization Code Flow w/ Client Credentials:
                $ref: '#/components/examples/TokenRequestAuthorizationCodeWithCredsExample'
              SAML Bearer:
                $ref: '#/components/examples/TokenRequestSamlBearerExample'
              Resource Owner Password Flow:
                $ref: '#/components/examples/TokenRequestPassword'
              Direct authentication with OTP (primary factor):
                $ref: '#/components/examples/TokenRequestDirectAuthOtpExample'
              Direct authentication with OTP (MFA):
                $ref: '#/components/examples/TokenRequestDirectAuthMfaOtpExample'
              Direct authentication with OOB (primary factor):
                $ref: '#/components/examples/TokenRequestDirectAuthOobExample'
              Direct authentication with OOB (MFA):
                $ref: '#/components/examples/TokenRequestDirectAuthMfaOobExample'
              TokenRequestAiAgentIdJagExample:
                $ref: '#/components/examples/TokenRequestAiAgentIdJagExample'
              TokenRequestAiAgentVaultedSecretExample:
                $ref: '#/components/examples/TokenRequestAiAgentVaultedSecretExample'
              TokenRequestAiAgentServiceAccountExample:
                $ref: '#/components/examples/TokenRequestAiAgentServiceAccountExample'
              TokenRequestAiAgentOAuthStsExample:
                $ref: '#/components/examples/TokenRequestAiAgentOAuthStsExample'
      responses:
        '200':
          description: Based on the scopes requested. The scopes specified in a request are included in the access token in the response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponseOrgAs'
              examples:
                Token response:
                  $ref: '#/components/examples/TokenResponseExample'
                TokenResponseAiAgentIdJagExample:
                  $ref: '#/components/examples/TokenResponseAiAgentIdJagExample'
                TokenResponseAiAgentVaultedSecretExample:
                  $ref: '#/components/examples/TokenResponseAiAgentVaultedSecretExample'
                TokenResponseAiAgentServiceAccountExample:
                  $ref: '#/components/examples/TokenResponseAiAgentServiceAccountExample'
                TokenResponseAiAgentOAuthStsExample:
                  $ref: '#/components/examples/TokenResponseAiAgentOAuthStsExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Invalid Authorization Code:
                  $ref: '#/components/examples/OAuthError400InvalidGrant_InvalidAuthCode'
                Mismatched Client:
                  $ref: '#/components/examples/OAuthError400InvalidGrant_MismatchedClient'
                Multiple Client Credentials Provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
                Missing Scopes:
                  $ref: '#/components/examples/OAuthError400InvalidScope_MissingScopes'
                Unsupported Grant Type:
                  $ref: '#/components/examples/OAuthError400UnsupportedGrantType'
                OAuth STS Interaction Required:
                  $ref: '#/components/examples/TokenResponseAiAgentOAuthStsInteractionRequiredExample'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '403':
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: true
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Invalid Network Zone:
                  $ref: '#/components/examples/OAuthError403AccessDenied_InvalidNetworkZone'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/userinfo:
    get:
      summary: /userinfo
      description: Returns information about the user that's the subject of the access token. Many of these claims are also included in the [ID token](https://developer.okta.com/docs/reference/api/oidc/#id-token), but calling this endpoint always returns all of the user's claims. You can configure the ID token to include a subset of the user's claims. See [Scope-dependent claims](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned).
      operationId: userinfo
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfo'
              examples:
                User information:
                  $ref: '#/components/examples/UserInfoExample'
        '401':
          description: Unauthorized
          headers:
            WWW-Authenticate:
              schema:
                type: string
              example: Bearer error="invalid_token", error_description="The access token is invalid"
        '403':
          description: Forbidden
          headers:
            WWW-Authenticate:
              schema:
                type: string
              example: Bearer error="insufficient_scope", error_description="The access token must provide access to at least one of these scopes - profile, email, address or phone"
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - oauth2:
            - openid
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/.well-known/oauth-authorization-server:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: Retrieve the OAuth 2.0 metadata
      description: Returns OAuth 2.0 metadata for the specified custom authorization server. Clients can use this information to programmatically configure their interactions with Okta. Custom scopes are returned only when they are configured to be publicly discoverable. Custom claims are never returned.
      operationId: getWellKnownOAuthConfigurationCustomAS
      parameters:
        - $ref: '#/components/parameters/queryClientId'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthMetadata'
              examples:
                OAuth 2.0 Metadata:
                  $ref: '#/components/examples/CustomASOAuthMetadata'
        '400':
          $ref: '#/components/responses/Error400InvalidClientId'
        '404':
          $ref: '#/components/responses/Error404AuthorizationServerNotFound'
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
  /oauth2/{authorizationServerId}/.well-known/openid-configuration:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: Retrieve the OpenID Connect metadata
      description: Returns OpenID Connect metadata for the specified custom authorization server. Clients can use this information to programmatically configure their interactions with Okta. Custom scopes are returned only when they are configured to be publicly discoverable. Custom claims are never returned.
      operationId: getWellKnownOpenIDConfigurationCustomAS
      parameters:
        - $ref: '#/components/parameters/queryClientId'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OidcMetadata'
              examples:
                OpenID Connect Metadata:
                  $ref: '#/components/examples/CustomASOidcMetadata'
        '400':
          $ref: '#/components/responses/Error400InvalidClientId'
        '404':
          $ref: '#/components/responses/Error404AuthorizationServerNotFound'
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
  /oauth2/{authorizationServerId}/v1/authorize:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: /authorize
      description: |-
        This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This request authenticates the user and returns tokens along with an authorization grant to the client app as a part of the callback response.

        > **Note:** Requests to the `/authorize` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error.
      operationId: authorizeCustomAS
      parameters:
        - name: acr_values
          in: query
          description: |-
            You can include an optional parameter in the authentication request. This parameter increases the level of user assurance.

            > **Note:** You can also provide multiple space-delimited values. The authorization server chooses one and reflects the chosen value in any resulting tokens.
          schema:
            $ref: '#/components/schemas/AcrValue'
        - name: client_id
          in: query
          required: true
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](/openapi/okta-oauth/oauth/client). It identifies the client and must match the value preregistered in Okta.
          schema:
            type: string
        - name: code_challenge
          in: query
          description: A challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/). The challenge is verified in the access token request.
          schema:
            type: string
        - name: code_challenge_method
          in: query
          description: Method used to derive the code challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/)
          schema:
            $ref: '#/components/schemas/CodeChallengeMethod'
        - name: display
          in: query
          description: The `display` parameter to be passed to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/)
          schema:
            type: string
        - name: enroll_amr_values
          in: query
          description: |-
            A space-delimited list of values indicating which authenticators to enroll in.

            * If the `enroll_amr_values` parameter is specified, then the value for `prompt` must be `enroll_authenticator`.
            * The parameter value is space-delimited, for example, `pwd sms okta_verify` is a valid request parameter value. You are prompted in the order of the amr values provided.
          schema:
            $ref: '#/components/schemas/AmrValue'
        - name: idp_scope
          in: query
          description: An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/). These scopes are used in addition to the scopes already configured for the identity provider.
          schema:
            type: string
        - name: idp
          in: query
          description: An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.
          schema:
            type: string
        - name: interclient_token
          x-okta-lifecycle:
            lifecycle: LIMITED_GA
            isGenerallyAvailable: false
            SKUs:
              - Okta Identity Engine
          in: query
          description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>A token used to SSO into the client app
          schema:
            type: string
        - name: login_hint
          in: query
          description: A username to pre-populate if prompting for authentication
          schema:
            type: string
        - name: max_age
          in: query
          description: Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta
          schema:
            type: integer
        - name: nonce
          in: query
          description: A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See [OIDC Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
          schema:
            type: string
        - name: prompt
          in: query
          description: |-
            If you don't specify the `prompt` parameter, the standard behavior occurs:
            * If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, the user is prompted to authenticate.
            * If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent.
          schema:
            $ref: '#/components/schemas/Prompt'
        - name: redirect_uri
          in: query
          required: true
          description: Callback location where the authorization code or tokens should be sent. It must match the value preregistered in Okta during client registration.
          schema:
            type: string
        - name: response_type
          in: query
          required: true
          description: Any combination of `code`, `token`, and `id_token`. The combination determines the [flow](https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow).
          schema:
            $ref: '#/components/schemas/ResponseTypesSupported'
        - name: response_mode
          in: query
          description: |-
            How the authorization response should be returned. If `id_token` or `token` is specified in the `response_type`, then `query` isn't allowed as a response mode. Defaults to `fragment` in implicit and hybrid flows.

            The `Referrer-Policy` header is automatically included in the response when either the fragment or query parameter values are used. The header is set to `Referrer-Policy: no-referrer`.
          schema:
            $ref: '#/components/schemas/ResponseMode'
        - name: request_uri
          in: query
          description: Location where the authorization request payload data is referenced in an authorization request to the `/authorize` endpoint. This is returned from a Pushed Authorization Request at the `/par` endpoint.
          schema:
            type: string
        - name: request
          in: query
          description: |-
            A JWT created by the client that enables requests to be passed as a single, self-contained parameter.

            * You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet.
            * You can't encrypt the JWT.
            >  **Note:** See [Build a JWT for client authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/) for information on how to build a JWT.
            * Okta supports the [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2), [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature algorithms. HMAC signatures require that the client have a `token_endpoint_auth_method` that uses a `client_secret`. RSA and ECDSA signatures require that the client registers a public key.
            * Okta recommends that you don't duplicate any request parameters in the JWT and the query URI. However, you can do so with `state`, `nonce`, `code_challenge`, and `code_challenge_method`. In those cases, the values in the JWT overrides the query URI values.
            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it has already been processed.
          schema:
            type: string
        - name: scope
          in: query
          required: true
          description: A space-delimited string of scopes requested
          schema:
            type: string
        - name: sessionToken
          in: query
          description: Okta one-time session token. This is an Okta extension to the OpenID specification. The `sessionToken` allows an API-based user sign-in flow.
          schema:
            type: string
        - name: state
          in: query
          required: true
          description: |-
            A value that is returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters.

            Okta requires the OAuth 2.0 `state` parameter on all requests to the `/authorize` endpoint to prevent cross-site request forgery (CSRF).
            The OAuth 2.0 specification [requires](https://tools.ietf.org/html/rfc6749#section-10.12) that clients protect their redirect URIs against CSRF by sending a value in the authorize request that binds the request to the user-agent's authenticated state.
            Using the `state` parameter is also a countermeasure to several other known attacks as outlined in [OAuth 2.0 Threat Model and Security Considerations](https://tools.ietf.org/html/rfc6819).
          schema:
            type: string
      responses:
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      summary: /authorize
      description: |-
        This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This endpoint method behaves the same as [`GET /oauth2/{authorizationServerId}/v1/authorize`](/openapi/okta-oauth/oauth/customas/authorizecustomas), except that all parameters are specified in the request body and submitted through the form post. No query parameters are allowed.
        > **Note:** Requests to the `/authorize` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error.
      operationId: authorizeCustomASWithPost
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthorizeWithPost'
      responses:
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/bc/authorize:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      summary: /bc/authorize
      description: |-
        This endpoint returns a unique identifier (`auth_req_id`) that identifies the authentication flow while it tries to authenticate the user in the background. This `auth_req_id` value is used in subsequent token requests to the `/token` endpoint.

        > **Note:** The `/bc/authorize` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: bcAuthorizeCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/BackchannelAuthorizeRequest'
            examples:
              Request with `login_hint`:
                $ref: '#/components/examples/BCAuthorizeRequestLoginHintExample'
              Request with `id_token_hint`:
                $ref: '#/components/examples/BCAuthorizeRequestIdTokenHintExample'
              Request with signed `request`:
                $ref: '#/components/examples/BCAuthorizeSignedRequestExample'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BackchannelAuthorizeResponse'
              examples:
                Back Response:
                  $ref: '#/components/examples/BackchannelAuthorizeResponseExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Multiple Client Credentials Provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
                Missing Scopes:
                  $ref: '#/components/examples/OAuthError400InvalidScope_MissingScopes'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/challenge:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /challenge
      description: |-
        Initiates the challenge of subsequent factor(s) in a direct authentication flow after the token endpoint has responded with `mfa_required`. This endpoint is optional if the client is able to proceed without it, for example, the client knows it needs to follow up with an OTP and can prompt the end user for one.

        > **Note:** The `/challenge` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: challenge-custom-as
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/ChallengeRequest'
            examples:
              challengeRequestOob:
                $ref: '#/components/examples/ChallengeRequestOobExample'
              challengeRequestSms:
                $ref: '#/components/examples/ChallengeRequestOobSmsExample'
              challengeRequestVoice:
                $ref: '#/components/examples/ChallengeRequestOobVoiceExample'
              challengeRequestOtp:
                $ref: '#/components/examples/ChallengeRequestOtpExample'
      responses:
        '200':
          description: The next factor type to challenge is returned and in the case of out-of-band factors, any information needed for the out-of-band transaction.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeResponse'
              examples:
                challengeResponseOtp:
                  $ref: '#/components/examples/ChallengeResponseMfaOtpExample'
                challengeResponseOob:
                  $ref: '#/components/examples/ChallengeResponseMfaOobExample'
                challengeResponseOvNmc:
                  $ref: '#/components/examples/ChallengeResponseOktaVerifyNumberMatchChallengeExample'
                challengeResponseSms:
                  $ref: '#/components/examples/ChallengeResponseSmsExample'
                challengeResponseVoice:
                  $ref: '#/components/examples/ChallengeResponseVoiceExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidMfaToken:
                  $ref: '#/components/examples/ChallengeErrorInvalidMfaToken'
                grantTypeDisabled:
                  $ref: '#/components/examples/OobAuthenticateErrorGrantTypeDisabled'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidClientSecret:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidClientSecret'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                authenticatorCannotBeUsed:
                  $ref: '#/components/examples/ChallengeErrorInvalidMfaToken'
                invalidChallengeType:
                  $ref: '#/components/examples/ChallengeErrorInvalidChallengeType'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                userRateLimit:
                  $ref: '#/components/examples/OobAuthenticateErrorRateLimit'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/device/authorize:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /device/authorize
      description: Returns a user code, device code, activation link, and QR code activation link
      operationId: deviceAuthorizeCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/DeviceAuthorizeRequest'
      responses:
        '200':
          description: Based on the type of token and whether it's active, the returned JSON contains a different set of information.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceAuthorizeResponse'
              examples:
                Device authorize:
                  $ref: '#/components/examples/DeviceAuthorizeResponseExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Scopes:
                  $ref: '#/components/examples/OAuthError400InvalidScope_MissingScopes'
                Multiple Client Credentials Provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/introspect:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /introspect
      description: |-
        This endpoint takes an access token, ID token, refresh token, or device secret and returns a boolean that indicates whether it's active. If the token is active, additional data about the token is also returned. If the token is invalid, expired, or revoked, it's considered inactive.

        Ensure that you are using the `/introspect` endpoint of the same authorization server that you used to create the token.

        > **Note:** The `/introspect` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/). For public clients (such as single-page and mobile apps) that don't have a `client_secret`, you must include the `client_id` as a query parameter when calling the `/introspect` endpoint. Make sure that you aren't passing the Authorization header in the request.
      operationId: introspectCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/IntrospectionRequest'
      responses:
        '200':
          description: Based on the type of token and whether it's active, the returned JSON contains a different set of information.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntrospectionResponse'
              examples:
                Access token:
                  $ref: '#/components/examples/IntrospectionAccessToken'
                Refresh token:
                  $ref: '#/components/examples/IntrospectionRefreshToken'
                Inactive token:
                  $ref: '#/components/examples/IntrospectionInactiveToken'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing `token` parameter:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MissingToken'
                Client assertion type incorrect for JWT request:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_AssertionTypeInvalid'
                Multiple client credentials provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/keys:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: /keys
      description: |-
        Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server.

        > **Note:** Looking for how to obtain the `jwks_uri` for your custom authorization server? See the [well-known OpenID Connect metadata endpoint](/openapi/okta-oauth/oauth/customas/getwellknownopenidconfigurationcustomas) and the [well-known OAuth 2.0 metadata endpoint](/openapi/okta-oauth/oauth/customas/getwellknownoauthconfigurationcustomas).

        Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used.

        You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform [JWS](https://datatracker.ietf.org/doc/html/rfc7515) signature validation.

        > **Note:** The information returned from this endpoint could lag slightly, but eventually updates.
      operationId: oauthKeysCustomAS
      responses:
        '200':
          description: Success
          headers:
            Cache-Control:
              schema:
                type: string
              example: max-age=3832304, must-revalidate
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthKeys'
              examples:
                User information:
                  $ref: '#/components/examples/OAuthKeysExample'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/logout:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: /logout
      description: |-
        Use this operation to sign a user out by removing their Okta browser session.

        This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a `post_logout_redirect_uri` to redirect the browser after the sign-out action is performed. Otherwise, the browser is redirected to the Okta sign-in page. See [Sign users out](https://developer.okta.com/docs/guides/sign-users-out/).

        If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the `post_logout_redirect_uri` (if specified).

        If the ID token passed with the `id_token_hint` parameter is invalid, the browser is redirected to an error page.

        If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the `post_logout_redirect_uri`.

        > **Note:** Requests to the `/logout` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. We may load an interstitial to do client-side logic before finally redirecting to the `post_logout_redirect_uri` or sign-in page if no redirect is provided.
      operationId: logoutCustomAS
      parameters:
        - name: id_token_hint
          in: query
          description: A valid ID token with a subject that matches the current session
          schema:
            type: string
          required: true
        - name: post_logout_redirect_uri
          in: query
          description: Location to redirect to after the logout is performed. It must match the value preregistered in Okta during client registration.
          schema:
            type: string
        - $ref: '#/components/parameters/queryState'
      responses:
        '200':
          description: Successful Logout
          content: {}
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: /logout
      description: |-
        Use this operation to sign a user out by removing their Okta browser session. This is the recommended method over GET as you can wrap the parameters in the request body.

        This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a `post_logout_redirect_uri` to redirect the browser after the user is signs out. Otherwise, the browser is redirected to the Okta sign-in page. See [Sign users out](https://developer.okta.com/docs/guides/sign-users-out/).

        If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the `post_logout_redirect_uri` (if specified).

        If the ID token passed with the `id_token_hint` parameter is invalid, the browser is redirected to an error page.

        If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the `post_logout_redirect_uri`.

        > **Note:** When making requests to the `/logout` endpoint, the browser (user agent) should be redirected to the endpoint. You need to make a POST request from a form. A POST request to this endpoint from the backend doesn't completely terminate the session.
      operationId: logoutCustomASWithPost
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/LogoutWithPost'
            examples:
              LogoutRequestCustom:
                $ref: '#/components/examples/LogoutRequestCustomExample'
      responses:
        '200':
          description: Successful Logout
          content: {}
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/oob-authenticate:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      deprecated: true
      summary: /oob-authenticate
      description: |-
        Initiates direct authentication with an out-of-band authenticator

        > **Note:** The `/oob-authenticate` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).

        > **Note:** This endpoint is deprecated. Use [/primary-authenticate](/openapi/okta-oauth/oauth/orgas/primary-authenticate) instead.
      operationId: oob-authenticate-custom-as
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OobAuthenticateRequest'
            examples:
              oobRequest:
                $ref: '#/components/examples/OobAuthenticateRequestExample'
              oobSmsRequest:
                $ref: '#/components/examples/OobAuthenticateSmsRequestExample'
              oobVoiceRequest:
                $ref: '#/components/examples/OobAuthenticateVoiceRequestExample'
      responses:
        '200':
          description: Out-of-band authentication has successfully been initiated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OobAuthenticateResponse'
              examples:
                ovPushResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseExample'
                ovNmcResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseOktaVerifyNumberMatchChallengeExample'
                smsResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseSmsExample'
                voiceResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseVoiceExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidChannelHint:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidChannelHint'
                userNotAssigned:
                  $ref: '#/components/examples/OobAuthenticateErrorUserNotAssignedApp'
                grantTypeDisabled:
                  $ref: '#/components/examples/OobAuthenticateErrorGrantTypeDisabled'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidClientSecret:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidClientSecret'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                authenticatorCannotBeUsed:
                  $ref: '#/components/examples/OobAuthenticateErrorAuthenticatorCannotBeUsed'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                userRateLimit:
                  $ref: '#/components/examples/OobAuthenticateErrorRateLimit'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/par:
    options:
      summary: /par
      description: |-
        Use this operation to request the permitted communication options for the `/par` operation.

        > **Note:** CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin.
      operationId: parOptionsCustomAS
      parameters:
        - in: header
          name: Origin
          description: Indicates the origin of the client that's initiating the request
          schema:
            type: string
          example: example.okta.com
      responses:
        '204':
          description: Success
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
              example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
              example: POST
            Access-Control-Max-Age:
              schema:
                type: string
              example: 3600
            Vary:
              schema:
                type: string
              example: Origin
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /par
      description: |-
        The pushed authorization request endpoint (`/par`) promotes OAuth security by allowing the authorization server to authenticate the client before any user interaction happens. The increased confidence in the client's identity during the authorization process means the authorization server can refuse illegitimate requests much earlier in the process. This process prevents attempts to spoof clients or otherwise tamper with or misuse an authorization request and provides a simple way to make a confidential and integrity-protected request.

        The `/par` endpoint allows an OAuth 2.0 client to push the payload of an authorization request directly to the authorization server. The authorization server provides a `request_uri` value in the response that you can use as a reference to the authorization request payload data in a subsequent call to the `/authorize` endpoint through a user agent.
      operationId: parCustomAS
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ParRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ParResponse'
              examples:
                Successful Request:
                  $ref: '#/components/examples/ParResponseExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Scopes:
                  $ref: '#/components/examples/OAuthError400InvalidScope_MissingScopes'
                Invalid `response_type`:
                  $ref: '#/components/examples/OAuthError400UnsupportedResponseType'
                Invalid `response_mode`:
                  $ref: '#/components/examples/OAuthError400UnsupportedResponseMode'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_InvalidClientId'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                ID Tokens require `openid` scope:
                  $ref: '#/components/examples/OAuthError403AccessDenied_NeedOpenidScope'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
  /oauth2/{authorizationServerId}/v1/primary-authenticate:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /primary-authenticate
      description: |-
        Initiates direct authentication with an out-of-band authenticator

        > **Note:** The `/primary-authenticate` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: primary-authenticate-custom-as
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OobAuthenticateRequest'
            examples:
              oobRequest:
                $ref: '#/components/examples/OobAuthenticateRequestExample'
              oobSmsRequest:
                $ref: '#/components/examples/OobAuthenticateSmsRequestExample'
              oobVoiceRequest:
                $ref: '#/components/examples/OobAuthenticateVoiceRequestExample'
      responses:
        '200':
          description: Out-of-band authentication has successfully been initiated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OobAuthenticateResponse'
              examples:
                ovPushResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseExample'
                ovNmcResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseOktaVerifyNumberMatchChallengeExample'
                smsResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseSmsExample'
                voiceResponse:
                  $ref: '#/components/examples/OobAuthenticateResponseVoiceExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidChannelHint:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidChannelHint'
                userNotAssigned:
                  $ref: '#/components/examples/OobAuthenticateErrorUserNotAssignedApp'
                grantTypeDisabled:
                  $ref: '#/components/examples/OobAuthenticateErrorGrantTypeDisabled'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                invalidClientSecret:
                  $ref: '#/components/examples/OobAuthenticateErrorInvalidClientSecret'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                authenticatorCannotBeUsed:
                  $ref: '#/components/examples/OobAuthenticateErrorAuthenticatorCannotBeUsed'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                userRateLimit:
                  $ref: '#/components/examples/OobAuthenticateErrorRateLimit'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/revoke:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /revoke
      description: |-
        The API takes an access or refresh token and revokes it. Revoked tokens are considered inactive at the introspection endpoint. A client may only revoke its own tokens. See [Revoke tokens](https://developer.okta.com/docs/guides/revoke-tokens/).

        > **Note:** The `/revoke` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: revokeCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/RevokeRequestCustomAs'
      responses:
        '200':
          description: Successful Revocation. Note that revoking an invalid, expired, or revoked token is still considered a success so information isn't leaked.
          content: {}
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing `token` parameter:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MissingToken'
                Client assertion type incorrect for JWT request:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_AssertionTypeInvalid'
                Multiple client credentials provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing client credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/token:
    options:
      summary: /token
      description: |-
        Use this operation to request the permitted communication options for the `/token` endpoint.

        > **Note:** CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin.
      operationId: tokenOptionsCustomAS
      parameters:
        - in: header
          name: Origin
          description: Indicates the origin of the client that's initiating the request
          schema:
            type: string
          example: example.okta.com
      responses:
        '204':
          description: Success
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
              example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
              example: POST
            Access-Control-Max-Age:
              schema:
                type: string
              example: 3600
            Vary:
              schema:
                type: string
              example: Origin
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /token
      description: |-
        This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For [password](https://developer.okta.com/docs/guides/implement-grant-type/ropassword/main/), [client credentials](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/), [SAML 2.0 assertion](https://developer.okta.com/docs/guides/implement-grant-type/saml2assert/main/), and [refresh token](https://developer.okta.com/docs/guides/refresh-tokens/main/) flows, calling `/token` is the only step of the flow. For the [authorization code](https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/) flow, calling `/token` is the second step of the flow.

        > **Note:** The `/token` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: tokenCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/TokenRequestCustomAs'
            examples:
              Authorization Code Flow w/ Client Credentials:
                $ref: '#/components/examples/TokenRequestAuthorizationCodeWithCredsExample'
              SAML Bearer:
                $ref: '#/components/examples/TokenRequestSamlBearerExample'
              JWT Bearer:
                $ref: '#/components/examples/TokenRequestJwtBearerExample'
              Resource Owner Password Flow:
                $ref: '#/components/examples/TokenRequestPassword'
              Direct authentication with OTP (primary factor):
                $ref: '#/components/examples/TokenRequestDirectAuthOtpExample'
              Direct authentication with OTP (MFA):
                $ref: '#/components/examples/TokenRequestDirectAuthMfaOtpExample'
              Direct authentication with OOB (primary factor):
                $ref: '#/components/examples/TokenRequestDirectAuthOobExample'
              Direct authentication with OOB (MFA):
                $ref: '#/components/examples/TokenRequestDirectAuthMfaOobExample'
      responses:
        '200':
          description: Based on the scopes requested. The scopes specified in a request are included in the access token in the response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponseCustomAs'
              examples:
                Token response:
                  $ref: '#/components/examples/TokenResponseExample'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Invalid Authorization Code:
                  $ref: '#/components/examples/OAuthError400InvalidGrant_InvalidAuthCode'
                Mismatched Client:
                  $ref: '#/components/examples/OAuthError400InvalidGrant_MismatchedClient'
                Multiple Client Credentials Provided:
                  $ref: '#/components/examples/OAuthError400InvalidRequest_MultipleClientCreds'
                Missing Scopes:
                  $ref: '#/components/examples/OAuthError400InvalidScope_MissingScopes'
                Unsupported Grant Type:
                  $ref: '#/components/examples/OAuthError400UnsupportedGrantType'
                OAuth STS Interaction Required:
                  $ref: '#/components/examples/TokenResponseAiAgentOAuthStsInteractionRequiredExample'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Missing Client Credentials:
                  $ref: '#/components/examples/OAuthError401InvalidClient_NoCreds'
        '403':
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: true
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
              examples:
                Invalid Network Zone:
                  $ref: '#/components/examples/OAuthError403AccessDenied_InvalidNetworkZone'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client_authentication_client_secret_basic: []
        - Client_authentication_client_secret_post: []
        - Client_authentication_client_secret_jwt: []
        - Client_authentication_private_key_jwt: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/userinfo:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: /userinfo
      description: Returns information about the user that's the subject of the access token. Many of these claims are also included in the [ID token](https://developer.okta.com/docs/reference/api/oidc/#id-token), but calling this endpoint always returns all of the user's claims. You can configure the ID token to include a subset of the user's claims. See [Scope-dependent claims](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned).
      operationId: userinfoCustomAS
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfo'
              examples:
                User information:
                  $ref: '#/components/examples/UserInfoExample'
        '401':
          description: Unauthorized
          headers:
            WWW-Authenticate:
              schema:
                type: string
              example: Bearer error="invalid_token", error_description="The access token is invalid"
        '403':
          description: Forbidden
          headers:
            WWW-Authenticate:
              schema:
                type: string
              example: Bearer error="insufficient_scope", error_description="The access token must provide access to at least one of these scopes - profile, email, address or phone"
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - oauth2:
            - openid
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
components:
  examples:
    BCAuthorizeRequestIdTokenHintExample:
      value:
        client_id: 0jrabyQWm4B9zVJPbotY
        client_secret: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
        scope: openid
        binding_message: Signing in from device
        id_token_hint: <id_token_hint_value>
    BCAuthorizeRequestLoginHintExample:
      value:
        client_id: 0jrabyQWm4B9zVJPbotY
        client_secret: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
        scope: openid
        binding_message: Signing in from device
        login_hint: john.doe@example.com
    BCAuthorizeSignedRequestExample:
      value:
        client_id: 0jrabyQWm4B9zVJPbotY
        client_secret: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
        request: <request_value>
    BackchannelAuthorizeResponseExample:
      value:
        auth_req_id: ftJwF5ZwW2SGPPoTQEKtAr_U8_Ek3RvWyR
        expires_in: 300
        interval: 5
    ChallengeErrorInvalidChallengeType:
      summary: Invalid Challenge Type
      value:
        error: access_denied
        error_description: '`foo` isn''t supported as a `challenge_type`. Try again with another value.'
    ChallengeErrorInvalidMfaToken:
      summary: Invalid MFA Token
      value:
        error: access_denied
        error_description: '`foo` has expired. Use a new `oob_code` or `mfa_token` and try again.'
    ChallengeRequestOobExample:
      summary: Initiate OOB challenge with Okta Verify
      value:
        mfa_token: Qwk9va6QYgR3s7JMiWUm
        channel_hint: push
        challenge_types_supported: http://auth0.com/oauth/grant-type/mfa-oob
    ChallengeRequestOobSmsExample:
      summary: Initiate OOB challenge with SMS
      value:
        mfa_token: Qwk9va6QYgR3s7JMiWUm
        channel_hint: sms
        challenge_types_supported: http://auth0.com/oauth/grant-type/mfa-oob
    ChallengeRequestOobVoiceExample:
      summary: Initiate OOB challenge with Voice
      value:
        mfa_token: Qwk9va6QYgR3s7JMiWUm
        channel_hint: voice
        challenge_types_supported: http://auth0.com/oauth/grant-type/mfa-oob
    ChallengeRequestOtpExample:
      summary: Initiate OTP challenge
      value:
        mfa_token: Qwk9va6QYgR3s7JMiWUm
        challenge_types_supported: http://auth0.com/oauth/grant-type/mfa-otp
    ChallengeResponseMfaOobExample:
      summary: Challenge response out-of-band authenticator with Okta Verify
      value:
        challenge_type: http://auth0.com/oauth/grant-type/mfa-oob
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
        channel: push
        binding_method: none
        expires_in: 300
        interval: 5
    ChallengeResponseMfaOtpExample:
      summary: Challenge response one-time passcode authenticator
      value:
        challenge_type: http://auth0.com/oauth/grant-type/mfa-otp
    ChallengeResponseOktaVerifyNumberMatchChallengeExample:
      summary: Challenge response out-of-band authenticator with Okta Verify number matching challenge
      value:
        challenge_type: http://auth0.com/oauth/grant-type/mfa-oob
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
        channel: push
        binding_method: transfer
        binding_code: 95
        expires_in: 300
        interval: 5
    ChallengeResponseSmsExample:
      summary: Challenge response out-of-band authenticator with SMS
      value:
        challenge_type: http://auth0.com/oauth/grant-type/mfa-oob
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
        channel: sms
        binding_method: prompt
        expires_in: 300
    ChallengeResponseVoiceExample:
      summary: Challenge response out-of-band authenticator with Voice
      value:
        challenge_type: http://auth0.com/oauth/grant-type/mfa-oob
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
        channel: voice
        binding_method: prompt
        expires_in: 300
    ClientRequestServiceJwks:
      value:
        client_name: Example Service Client
        response_types:
          - token
        grant_types:
          - client_credentials
        token_endpoint_auth_method: private_key_jwt
        application_type: service
        jwks:
          keys:
            - kty: RSA
              e: AQAB
              kid: key1
              'n': AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU=
    ClientRequestServiceJwksUri:
      value:
        client_name: Example service client
        response_types:
          - token
        grant_types:
          - client_credentials
        token_endpoint_auth_method: private_key_jwt
        application_type: service
        jwks_uri: https://www.example.com/oauth2/jwks-uri
    ClientRequestWeb:
      value:
        client_name: Example OAuth 2.0 client
        client_uri: https://www.example.com
        logo_uri: https://www.example.com/logo.png
        application_type: web
        redirect_uris:
          - https://www.example.com/oauth2/redirectUri
        post_logout_redirect_uris:
          - https://www.example.com/oauth2/postLogoutRedirectUri
        response_types:
          - code
          - id_token
        grant_types:
          - authorization_code
          - refresh_token
          - implicit
        token_endpoint_auth_method: client_secret_post
        initiate_login_uri: https://www.example.com/oauth2/login
    ClientRequestWebUpdate:
      value:
        client_id: 0jrabyQWm4B9zVJPbotY
        client_name: Updated OAuth 2.0 client
        client_uri: https://www.example.com
        logo_uri: https://www.example.com/logo.png
        application_type: web
        redirect_uris:
          - https://www.example.com/oauth2/redirectUri
        post_logout_redirect_uris:
          - https://www.example.com/oauth2/postLogoutRedirectUri
        response_types:
          - id_token
          - code
        grant_types:
          - authorization_code
        token_endpoint_auth_method: client_secret_post
        initiate_login_uri: https://www.example.com/oauth2/login
    ClientRequestWebWithIdTokenEncryption:
      value:
        client_name: Example web client with ID token encryption enabled
        response_types:
          - code
          - token
          - id_token
        grant_types:
          - authorization_code
        token_endpoint_auth_method: private_key_jwt
        application_type: web
        id_token_encrypted_response_alg: RSA-OAEP-256
        jwks:
          keys:
            - kty: RSA
              e: AQAB
              kid: signingKey
              use: sig
              'n': AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU=
            - kty: RSA
              e: AQAB
              use: enc
              kid: encryptionKey
              'n': zOrouIUCSMlRL0HU.....AJncrKuine49_CEVR4GPn=
    ClientResponseServiceJwks:
      value:
        client_id: 0oanq59zytBKVwQQ80h7
        client_id_issued_at: 1570131438
        client_name: Example service client
        client_uri: null
        logo_uri: null
        redirect_uris: []
        response_types:
          - token
        grant_types:
          - client_credentials
        token_endpoint_auth_method: private_key_jwt
        application_type: service
        jwks:
          keys:
            - kty: RSA
              kid: key1
              use: null
              e: AQAB
              'n': AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU=
    ClientResponseServiceJwksUri:
      value:
        client_id: 0oaft59zxtBKVwQP80h7
        client_id_issued_at: 1570131440
        client_name: Example service client
        client_uri: null
        logo_uri: null
        redirect_uris: []
        response_types:
          - token
        grant_types:
          - client_credentials
        token_endpoint_auth_method: private_key_jwt
        application_type: service
        jwks_uri: https://www.example.com/oauth2/jwks-uri
    ClientResponseWeb:
      value:
        client_id: 0jrabyQWm4B9zVJPbotY
        client_secret: 5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe
        client_id_issued_at: 1453913425
        client_secret_expires_at: 0
        client_name: Example OAuth 2.0 client
        client_uri: https://www.example.com
        logo_uri: https://www.example.com/logo.png
        application_type: web
        redirect_uris:
          - https://www.example.com/oauth2/redirectUri
        post_logout_redirect_uris:
          - https://www.example.com/oauth2/postLogoutRedirectUri
        response_types:
          - id_token
          - code
        grant_types:
          - authorization_code
        token_endpoint_auth_method: client_secret_post
        initiate_login_uri: https://www.example.com/oauth2/login
        frontchannel_logout_uri: https://example.com/logout
        frontchannel_logout_session_required: false
    ClientResponseWebUpdate:
      value:
        client_id: 0jrabyQWm4B9zVJPbotY
        client_secret: 5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe
        client_id_issued_at: 1453913425
        client_secret_expires_at: 0
        client_name: Updated OAuth Client
        client_uri: https://www.example.com
        logo_uri: https://www.example.com/logo.png
        application_type: web
        redirect_uris:
          - https://www.example.com/oauth2/redirectUri
        post_logout_redirect_uris:
          - https://www.example.com/oauth2/postLogoutRedirectUri
        response_types:
          - id_token
          - code
        grant_types:
          - authorization_code
        token_endpoint_auth_method: client_secret_post
        initiate_login_uri: https://www.example.com/oauth2/login
        frontchannel_logout_uri: https://example.com/logout
        frontchannel_logout_session_required: false
    ClientResponseWebUpdateNewSecret:
      value:
        client_id: 0jrabyQWm4B9zVJPbotY
        client_secret: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
        client_id_issued_at: 1453913425
        client_secret_expires_at: 0
        client_name: Updated OAuth Client
        client_uri: https://www.example.com
        logo_uri: https://www.example.com/logo.png
        application_type: web
        redirect_uris:
          - https://www.example.com/oauth2/redirectUri
        post_logout_redirect_uris:
          - https://www.example.com/oauth2/postLogoutRedirectUri
        response_types:
          - id_token
          - code
        grant_types:
          - authorization_code
        token_endpoint_auth_method: client_secret_post
        initiate_login_uri: https://www.example.com/oauth2/login
        frontchannel_logout_uri: https://example.com/logout
        frontchannel_logout_session_required: false
    ClientResponseWebWithIdTokenEncryption:
      value:
        client_id: 0oanq59zytBKVwQQ80h7
        client_id_issued_at: 1570131438
        client_name: Example web client with ID token encryption enabled
        client_uri: null
        logo_uri: null
        redirect_uris: []
        response_types:
          - code
          - token
          - id_token
        grant_types:
          - authorization_code
        token_endpoint_auth_method: private_key_jwt
        application_type: web
        id_token_encrypted_response_alg: RSA-OAEP-256
        jwks:
          keys:
            - kty: RSA
              e: AQAB
              kid: signingKey
              use: sig
              'n': AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU=
            - kty: RSA
              e: AQAB
              use: enc
              kid: encryptionKey
              'n': zOrouIUCSMlRL0HU.....AJncrKuine49_CEVR4GPn=
    CustomASOAuthMetadata:
      value:
        issuer: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7
        authorization_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize
        token_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token
        registration_endpoint: https://{yourOktaDomain}/oauth2/v1/clients
        jwks_uri: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys
        response_types_supported:
          - code
          - token
          - id_token
          - code id_token
          - code token
          - id_token token
          - code id_token token
        response_modes_supported:
          - query
          - fragment
          - form_post
          - okta_post_message
        grant_types_supported:
          - authorization_code
          - implicit
          - refresh_token
          - password
          - client_credentials
          - urn:ietf:params:oauth:grant-type:device_code
        subject_types_supported:
          - public
        scopes_supported:
          - okta.myAccount.email.manage
          - okta.myAccount.email.read
          - okta.myAccount.manage
          - okta.myAccount.phone.manage
          - okta.myAccount.phone.read
          - okta.myAccount.profile.manage
          - okta.myAccount.profile.read
          - okta.myAccount.read
          - openid
          - profile
          - email
          - address
          - phone
          - offline_access
          - device_sso
        token_endpoint_auth_methods_supported:
          - client_secret_basic
          - client_secret_post
          - client_secret_jwt
          - private_key_jwt
          - none
        claims_supported:
          - ver
          - jti
          - iss
          - aud
          - iat
          - exp
          - cid
          - uid
          - scp
          - sub
        code_challenge_methods_supported:
          - S256
        introspection_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect
        introspection_endpoint_auth_methods_supported:
          - client_secret_basic
          - client_secret_post
          - client_secret_jwt
          - private_key_jwt
          - none
        revocation_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke
        revocation_endpoint_auth_methods_supported:
          - client_secret_basic
          - client_secret_post
          - client_secret_jwt
          - private_key_jwt
          - none
        end_session_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout
        request_parameter_supported: true
        request_object_signing_alg_values_supported:
          - HS256
          - HS384
          - HS512
          - RS256
          - RS384
          - RS512
          - ES256
          - ES384
          - ES512
        device_authorization_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize
        pushed_authorization_request_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par
    CustomASOidcMetadata:
      value:
        issuer: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7
        authorization_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize
        token_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token
        userinfo_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/userinfo
        registration_endpoint: https://{yourOktaDomain}/oauth2/v1/clients
        jwks_uri: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys
        response_types_supported:
          - code
          - id_token
          - code id_token
          - code token
          - id_token token
          - code id_token token
        response_modes_supported:
          - query
          - fragment
          - form_post
          - okta_post_message
        grant_types_supported:
          - authorization_code
          - implicit
          - refresh_token
          - password
          - urn:ietf:params:oauth:grant-type:device_code
        subject_types_supported:
          - public
        id_token_signing_alg_values_supported:
          - RS256
        id_token_encryption_alg_values_supported:
          - RSA-OAEP-256
          - RSA-OAEP-384
          - RSA-OAEP-512
        id_token_encryption_enc_values_supported:
          - A256GCM
        scopes_supported:
          - okta.myAccount.email.manage
          - okta.myAccount.email.read
          - okta.myAccount.manage
          - okta.myAccount.phone.manage
          - okta.myAccount.phone.read
          - okta.myAccount.profile.manage
          - okta.myAccount.profile.read
          - okta.myAccount.read
          - openid
          - profile
          - email
          - address
          - phone
          - offline_access
          - device_sso
        token_endpoint_auth_methods_supported:
          - client_secret_basic
          - client_secret_post
          - client_secret_jwt
          - private_key_jwt
          - none
        claims_supported:
          - iss
          - ver
          - sub
          - aud
          - iat
          - exp
          - jti
          - auth_time
          - amr
          - idp
          - nonce
          - name
          - nickname
          - preferred_username
          - given_name
          - middle_name
          - family_name
          - email
          - email_verified
          - profile
          - zoneinfo
          - locale
          - address
          - phone_number
          - picture
          - website
          - gender
          - birthdate
          - updated_at
          - at_hash
          - c_hash
        code_challenge_methods_supported:
          - S256
        introspection_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect
        introspection_endpoint_auth_methods_supported:
          - client_secret_basic
          - client_secret_post
          - client_secret_jwt
          - private_key_jwt
          - none
        revocation_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke
        revocation_endpoint_auth_methods_supported:
          - client_secret_basic
          - client_secret_post
          - client_secret_jwt
          - private_key_jwt
          - none
        end_session_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout
        request_parameter_supported: true
        request_object_signing_alg_values_supported:
          - HS256
          - HS384
          - HS512
          - RS256
          - RS384
          - RS512
          - ES256
          - ES384
          - ES512
        device_authorization_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize
        pushed_authorization_request_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par
    DeviceAuthorizeResponseExample:
      value:
        user_code: RGTCFDTL
        device_code: 5cbeb234-7e00-4ff7-9aa2-b1a4558a75d2
        interval: 5
        verification_uri_complete: https://{yourOktaDomain}/activate?user_code=RGTCFDTL
        verification_uri: https://{yourOktaDomain}/activate
        expires_in: 600
    ErrorAccessDenied:
      value:
        errorCode: E0000006
        errorSummary: You don't have permission to perform the requested action.
        errorLink: E0000006
        errorId: sampleNUSD_8fdkFd8fs8SDBK
        errorCauses: []
    ErrorInvalidClientId:
      value:
        errorCode: invalid_client
        errorSummary: Invalid value for `client_id` parameter
        errorLink: invalid_client
        errorId: sampleMlLvGUj_YD5v16vkYWY
        errorCauses: []
    ErrorInvalidClientMetadata:
      value:
        error: invalid_client_metadata
        error_description: '`client_name`: The field can''t be left blank.'
    ErrorResourceNotFound:
      value:
        errorCode: E0000007
        errorSummary: 'Not found: {0}'
        errorLink: E0000007
        errorId: sampleMlLvGUj_YD5v16vkYWY
        errorCauses: []
    ErrorTooManyRequests:
      value:
        errorCode: E0000047
        errorSummary: You exceeded the maximum number of requests. Try again in a while.
        errorLink: E0000047
        errorId: sampleQPivGUj_ND5v78vbYWW
        errorCauses: []
    GlobalTokenRevocationRequestIssSubOidcExample:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      summary: Global token revocation request with iss_sub format (OIDC)
      value:
        sub_id:
          format: iss_sub
          sub: 00u5t60iloOHN9pBi0g7
          iss: https://idp.example.com
    GlobalTokenRevocationRequestIssSubSamlExample:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      summary: Global token revocation request with iss_sub format (SAML)
      value:
        sub_id:
          format: iss_sub
          sub: user@example.com
          iss: https://idp.example.com
    GlobalTokenRevocationRequestOpaqueExample:
      summary: Global token revocation request with opaque format
      value:
        sub_id:
          format: opaque
          id: 00u1dnq5S0CfjlkpABCD
    IntrospectionAccessToken:
      value:
        active: true
        token_type: Bearer
        scope: openid profile
        client_id: a9VpZDRCeFh3Nkk2VdYa
        username: john.doe@example.com
        exp: 1451606400
        iat: 1451602800
        sub: john.doe@example.com
        aud: https://{yourOktaDomain}
        iss: https://{yourOktaDomain}/oauth2/orsmsg0aWLdnF3spV0g3
        jti: AT.7P4KlczBYVcWLkxduEuKeZfeiNYkZIC9uGJ28Cc-YaI
        uid: 00uid4BxXw6I6TV4m0g3
    IntrospectionInactiveToken:
      value:
        active: false
    IntrospectionRefreshToken:
      value:
        active: true
        token_type: Bearer
        scope: openid profile email
        client_id: a9VpZDRCeFh3Nkk2VdYa
        username: john.doe@example.com
        exp: 1451606400
        sub: john.doe@example.com
        device_id: q4SZgrA9sOeHkfst5uaa
    ListClientsResponse:
      value:
        - client_id: B6YnDUIpt6Oq354YYaNR
          client_id_issued_at: 1495059435
          client_secret_expires_at: 0
          client_name: Native client
          client_uri: null
          logo_uri: null
          redirect_uris:
            - https://httpbin.org/get
          response_types:
            - id_token
            - code
            - token
          grant_types:
            - password
            - refresh_token
            - authorization_code
            - implicit
          token_endpoint_auth_method: client_secret_basic
          application_type: native
          frontchannel_logout_uri: https://example.com/logout
          frontchannel_logout_session_required: false
        - client_id: etwquEhEjxqyA7HDB8lD
          client_id_issued_at: 1495059868
          client_secret_expires_at: 0
          client_name: Service client
          client_uri: null
          logo_uri: null
          redirect_uris: []
          response_types:
            - token
          grant_types:
            - client_credentials
          token_endpoint_auth_method: client_secret_basic
          application_type: service
          frontchannel_logout_uri: https://example.com/logout
          frontchannel_logout_session_required: false
        - client_id: l3O8MfR0eTVfLJ7jG2UB
          client_id_issued_at: 1495059734
          client_name: Browser client
          client_uri: null
          logo_uri: null
          redirect_uris:
            - https://httpbin.org/get
          response_types:
            - code
          grant_types:
            - authorization_code
          token_endpoint_auth_method: none
          application_type: browser
        - client_id: rHQoApjizqc4MGVlW5En
          client_id_issued_at: 1495059117
          client_secret_expires_at: 0
          client_name: Web client
          client_uri: null
          logo_uri: null
          redirect_uris:
            - https://www.example.com/oauth2/redirectUri
          response_types:
            - code
            - id_token
            - token
          grant_types:
            - authorization_code
            - refresh_token
            - implicit
          token_endpoint_auth_method: client_secret_basic
          application_type: web
          frontchannel_logout_uri: https://example.com/logout
          frontchannel_logout_session_required: false
    LogoutRequestCustomExample:
      summary: Logout request custom authorization server example
      value:
        id_token_hint: <id_token_hint_value>
        post_logout_redirect_uri: https://www.example.com/oauth2/postLogoutRedirectUri
        state: 1230000
    LogoutRequestExample:
      summary: Logout request org authorization server example
      value:
        id_token_hint: <id_token_hint_value>
        post_logout_redirect_uri: https://www.example.com/oauth2/postLogoutRedirectUri
        state: 1230000
    OAuthError400InvalidGrant_InvalidAuthCode:
      value:
        error: invalid_grant
        error_description: The authorization code is invalid or has expired.
    OAuthError400InvalidGrant_MismatchedClient:
      value:
        error: invalid_grant
        error_description: The grant was issued to another client. Ensure that the `client_id` matches the one used at the authorize request.
    OAuthError400InvalidRequest_AssertionTypeInvalid:
      value:
        error: invalid_request
        error_description: The `client_assertion_type` is invalid.
    OAuthError400InvalidRequest_MissingToken:
      value:
        error: invalid_request
        error_description: The `token` parameter is required.
    OAuthError400InvalidRequest_MultipleClientCreds:
      value:
        error: invalid_request
        error_description: 'Can''t supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a `client_assertion` in the post body.'
    OAuthError400InvalidScope_MissingScopes:
      value:
        error: invalid_scope
        error_description: No scopes were requested.
    OAuthError400UnsupportedGrantType:
      value:
        error: unsupported_grant_type
        error_description: The grant type in the request isn't supported.
    OAuthError400UnsupportedResponseMode:
      value:
        error: unsupported_response_mode
        error_description: 'The response mode isn''t supported by the authorization server. Valid response modes: [`query`, `fragment`, `form_post`, `okta_post_message`].'
    OAuthError400UnsupportedResponseType:
      value:
        error: unsupported_response_type
        error_description: The response type contained in the request isn't supported.
    OAuthError401InvalidClient_InvalidClientId:
      value:
        error: invalid_client
        error_description: Invalid value for the `client_id` parameter
    OAuthError401InvalidClient_NoCreds:
      value:
        error: invalid_client
        error_description: No client credentials found
    OAuthError403AccessDenied_InvalidNetworkZone:
      value:
        error: access_denied
        error_description: The request is made from outside the client's permitted network zones.
    OAuthError403AccessDenied_NeedOpenidScope:
      value:
        error: access_denied
        error_description: Requests for ID tokens or access tokens with OpenID scopes require the `openid` scope.
    OAuthKeysExample:
      value:
        keys:
          - alg: RS256
            e: AQAB
            'n': iKqiD4cr7FZKm6f05K4r-GQOvjRqjOeFmOho9V7SAXYwCyJluaGBLVvDWO1XlduPLOrsG_Wgs67SOG5qeLPR8T1zDK4bfJAo1TvbwYeTwVSfd_0mzRq8WaVc_2JtEK7J-4Z0MdVm_dJmcMHVfDziCRohSZthN__WM2NwGnbewWnla0wpEsU3QMZ05_OxvbBdQZaDUsNSx46is29eCdYwhkAfFd_cFRq3DixLEYUsRwmOqwABwwDjBTNvgZOomrtD8BRFWSTlwsbrNZtJMYU33wuLO9ynFkZnY6qRKVHr3YToIrqNBXw0RWCheTouQ-snfAB6wcE2WDN3N5z760ejqQ
            kid: U5R8cHbGw445Qbq8zVO1PcCpXL8yG6IcovVa3laCoxM
            kty: RSA
            use: sig
          - alg: RS256
            e: AQAB
            'n': l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK3HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37-XDIDb0XG-R8DOoOHLJPTpsgH-rJeM5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX-0TmG5yjSj7ek05txcpxIqYu-7FIGT0KKvXge_BOSEUlJpBhLKU28OtsOnmc3NLIGXB-GeDiUZiBYQdPR-myB4ZoQ
            kid: Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo
            kty: RSA
            use: sig
          - alg: RS256
            e: AQAB
            'n': lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7UGLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap-CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvpdMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu-DYhT0hmyFcwn-tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ
            kid: h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU
            kty: RSA
            use: sig
    OobAuthenticateErrorAuthenticatorCannotBeUsed:
      summary: No Authenticator associated with the grant type can be used
      value:
        error: access_denied
        error_description: The required authenticator can't be used. Check if it's required by policy and the user is enrolled in the authenticator and try again.
    OobAuthenticateErrorGrantTypeDisabled:
      summary: Grant type not enabled for client
      value:
        error: unauthorized_client
        error_description: 'The client isn''t authorized to use the provided grant type. Configured grant types: [urn:okta:params:oauth:grant-type:otp, authorization_code].'
    OobAuthenticateErrorInvalidChannelHint:
      summary: Invalid channel hint
      value:
        error: invalid_request
        error_description: '`foo` isn''t supported as a `channel_hint`. Try again with another value.'
    OobAuthenticateErrorInvalidClientSecret:
      summary: Invalid client secret
      value:
        error: invalid_client
        error_description: The client secret supplied for a confidential client is invalid.
    OobAuthenticateErrorRateLimit:
      summary: Too Many Requests
      value:
        error: invalid_grant
        error_description: API call exceeded the rate limit due to too many requests.
    OobAuthenticateErrorUserNotAssignedApp:
      summary: User not assigned client app
      value:
        error: access_denied
        error_description: User isn't assigned to the client app.
    OobAuthenticateRequestExample:
      summary: Initiate out-of-band primary authentication Okta Verify
      value:
        login_hint: testuser@example.com
        channel_hint: push
        challenge_hint: urn:okta:params:oauth:grant-type:oob
    OobAuthenticateResponseExample:
      summary: Initiate out-of-band primary authentication response with Okta Verify
      value:
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
        channel: push
        binding_method: none
        expires_in: 300
        interval: 5
    OobAuthenticateResponseOktaVerifyNumberMatchChallengeExample:
      summary: Initiate out-of-band primary authentication response with Okta Verify number matching challenge
      value:
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
        channel: push
        binding_method: transfer
        binding_code: 95
        expires_in: 300
        interval: 5
    OobAuthenticateResponseSmsExample:
      summary: Initiate out-of-band primary authentication response with SMS
      value:
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
        channel: sms
        binding_method: prompt
        expires_in: 300
    OobAuthenticateResponseVoiceExample:
      summary: Initiate out-of-band primary authentication response with Voice
      value:
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
        channel: voice
        binding_method: prompt
        expires_in: 300
    OobAuthenticateSmsRequestExample:
      summary: Initiate out-of-band primary authentication with SMS
      value:
        login_hint: testuser@example.com
        channel_hint: sms
        challenge_hint: urn:okta:params:oauth:grant-type:oob
    OobAuthenticateVoiceRequestExample:
      summary: Initiate out-of-band primary authentication with Voice
      value:
        login_hint: testuser@example.com
        channel_hint: voice
        challenge_hint: urn:okta:params:oauth:grant-type:oob
    OrgASOidcMetadata:
      value:
        issuer: https://{yourOktaDomain}
        authorization_endpoint: https://{yourOktaDomain}/oauth2/v1/authorize
        token_endpoint: https://{yourOktaDomain}/oauth2/v1/token
        userinfo_endpoint: https://{yourOktaDomain}/oauth2/v1/userinfo
        registration_endpoint: https://{yourOktaDomain}/oauth2/v1/clients
        jwks_uri: https://{yourOktaDomain}/oauth2/v1/keys
        response_types_supported:
          - code
          - id_token
          - code id_token
          - code token
          - id_token token
          - code id_token token
        response_modes_supported:
          - query
          - fragment
          - form_post
          - okta_post_message
        grant_types_supported:
          - authorization_code
          - implicit
          - refresh_token
          - password
          - urn:ietf:params:oauth:grant-type:device_code
        subject_types_supported:
          - public
        id_token_signing_alg_values_supported:
          - RS256
        scopes_supported:
          - openid
          - email
          - profile
          - address
          - phone
          - offline_access
          - groups
        token_endpoint_auth_methods_supported:
          - client_secret_basic
          - client_secret_post
          - client_secret_jwt
          - private_key_jwt
          - none
        claims_supported:
          - iss
          - ver
          - sub
          - aud
          - iat
          - exp
          - jti
          - auth_time
          - amr
          - idp
          - nonce
          - name
          - nickname
          - preferred_username
          - given_name
          - middle_name
          - family_name
          - email
          - email_verified
          - profile
          - zoneinfo
          - locale
          - address
          - phone_number
          - picture
          - website
          - gender
          - birthdate
          - updated_at
          - at_hash
          - c_hash
        code_challenge_methods_supported:
          - S256
        introspection_endpoint: https://{yourOktaDomain}/oauth2/v1/introspect
        introspection_endpoint_auth_methods_supported:
          - client_secret_basic
          - client_secret_post
          - client_secret_jwt
          - private_key_jwt
          - none
        revocation_endpoint: https://{yourOktaDomain}/oauth2/v1/revoke
        revocation_endpoint_auth_methods_supported:
          - client_secret_basic
          - client_secret_post
          - client_secret_jwt
          - private_key_jwt
          - none
        end_session_endpoint: https://{yourOktaDomain}/oauth2/v1/logout
        request_parameter_supported: true
        request_object_signing_alg_values_supported:
          - HS256
          - HS384
          - HS512
          - RS256
          - RS384
          - RS512
          - ES256
          - ES384
          - ES512
        device_authorization_endpoint: https://{yourOktaDomain}/oauth2/v1/device/authorize
        pushed_authorization_request_endpoint: https://{yourOktaDomain}/oauth2/v1/par
    ParResponseExample:
      value:
        request_uri: urn:okta:Y1hIQ3ZqYjFodEZMOVJ3TUF4ZHRPZjJuNFZRV2ZWQ044MmFoX2VIT2oyNDo
        expires_in: 3600
    TokenRequestAiAgentIdJagExample:
      summary: Identity Assertion JWT Authorization Grant
      value:
        grant_type: urn:ietf:params:oauth:grant-type:token-exchange
        requested_token_type: urn:ietf:params:oauth:token-type:id-jag
        subject_token: <id_token_value>
        subject_token_type: urn:ietf:params:oauth:token-type:id_token
        client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
        client_assertion: <private_key_jwt_value>
        audience: https://{yourOktaDomain}/oauth2/aus5h1k6yB3Pr60AX0g5
        scope: scope1 scope2
    TokenRequestAiAgentOAuthStsExample:
      summary: OAuth STS for AI agent
      value:
        grant_type: urn:ietf:params:oauth:grant-type:token-exchange
        requested_token_type: urn:okta:params:oauth:token-type:oauth-sts
        subject_token: <id_token_value>
        subject_token_type: urn:ietf:params:oauth:token-type:id_token
        client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
        client_assertion: <private_key_jwt_value>
        resource: example:resource:value
    TokenRequestAiAgentServiceAccountExample:
      summary: OPA service account for AI agent
      value:
        grant_type: urn:ietf:params:oauth:grant-type:token-exchange
        requested_token_type: urn:okta:params:oauth:token-type:service-account
        subject_token: <id_token_value>
        subject_token_type: urn:ietf:params:oauth:token-type:id_token
        client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
        client_assertion: <private_key_jwt_value>
        resource: example:resource:value
    TokenRequestAiAgentVaultedSecretExample:
      summary: OPA vaulted secret for AI agent
      value:
        grant_type: urn:ietf:params:oauth:grant-type:token-exchange
        requested_token_type: urn:okta:params:oauth:token-type:vaulted-secret
        subject_token: <id_token_value>
        subject_token_type: urn:ietf:params:oauth:token-type:id_token
        client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
        client_assertion: <private_key_jwt_value>
        resource: example:resource:value
    TokenRequestAuthorizationCodeWithCredsExample:
      value:
        client_id: 0jrabyQWm4B9zVJPbotY
        client_secret: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
        grant_type: authorization_code
        redirect_uri: https://www.example.com/oauth2/redirectUri
        code: QnowT-aeawtOJKp-MtkH&
    TokenRequestDirectAuthMfaOobExample:
      summary: Direct authentication with OOB (MFA)
      value:
        grant_type: http://auth0.com/oauth/grant-type/mfa-oob
        scope: openid offline_access
        mfa_token: Qwk9va6QYgR3s7JMiWUm
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
    TokenRequestDirectAuthMfaOtpExample:
      summary: Direct authentication with OTP (MFA)
      value:
        grant_type: http://auth0.com/oauth/grant-type/mfa-otp
        scope: openid offline_access
        mfa_token: Qwk9va6QYgR3s7JMiWUm
        otp: 123456
        grant_types_supported: http://auth0.com/oauth/grant-type/mfa-otp urn:okta:params:oauth:grant-type:oob
    TokenRequestDirectAuthOobExample:
      summary: Direct authentication with OOB (primary factor)
      value:
        grant_type: urn:okta:params:oauth:grant-type:oob
        scope: openid offline_access
        oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
        grant_types_supported: http://auth0.com/oauth/grant-type/mfa-otp http://auth0.com/oauth/grant-type/mfa-oob
    TokenRequestDirectAuthOtpExample:
      summary: Direct authentication with OTP (primary factor)
      value:
        grant_type: urn:okta:params:oauth:grant-type:otp
        scope: openid offline_access
        login_hint: testuser@example.com
        otp: 123456
        grant_types_supported: http://auth0.com/oauth/grant-type/mfa-otp http://auth0.com/oauth/grant-type/mfa-oob
    TokenRequestJwtBearerExample:
      value:
        grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
        assertion: <json_web_token>
    TokenRequestPassword:
      value:
        grant_type: password
        scope: openid
        username: testuser@example.com
        password: N9d03jadk&@odA
    TokenRequestSamlBearerExample:
      value:
        grant_type: urn:ietf:params:oauth:grant-type:saml2-bearer
        scope: openid offline_access
        assertion: <base64 SAML>
    TokenResponseAiAgentIdJagExample:
      summary: Identity Assertion JWT Authorization Grant
      value:
        token_type: N_A
        expires_in: 300
        issued_token_type: urn:ietf:params:oauth:token-type:id-jag
        access_token: <id_jag_value>
    TokenResponseAiAgentOAuthStsExample:
      summary: OAuth STS for AI agent
      value:
        token_type: Bearer
        expires_in: 300
        issued_token_type: urn:okta:params:oauth:token-type:oauth-sts
        access_token: <oauth_sts_access_token_value>
        scope: chat.read chat.history
    TokenResponseAiAgentOAuthStsInteractionRequiredExample:
      summary: OAuth STS - Interaction Required
      value:
        error: interaction_required
        error_description: The user must authenticate with the authorization server for the request to proceed
        interaction_uri: https://example.com
    TokenResponseAiAgentServiceAccountExample:
      summary: OPA service account for AI agent
      value:
        token_type: N_A
        expires_in: 300
        issued_token_type: urn:okta:params:oauth:token-type:service-account
        service_account:
          username: exampleUsername
          password: examplePassword
    TokenResponseAiAgentVaultedSecretExample:
      summary: OPA vaulted secret for AI agent
      value:
        token_type: N_A
        expires_in: 300
        issued_token_type: urn:okta:params:oauth:token-type:vaulted-secret
        vaulted_secret:
          key1: value1
          key2: value2
    TokenResponseExample:
      value:
        access_token: <access_token_value>
        token_type: Bearer
        expires_in: 3600
        scope: openid email offline_access
        refresh_token: a9VpZDRCeFh3Nkk2VdY
        id_token: <id_token_example>
    UserInfoExample:
      value:
        sub: 00uid4BxXw6I6TV4m0g3
        name: John Doe
        nickname: Jimmy
        given_name: John
        middle_name: James
        family_name: Doe
        profile: https://example.com/john.doe
        zoneinfo: America/Los_Angeles
        locale: en-US
        updated_at: 1311280970
        email: john.doe@example.com
        email_verified: true
        address:
          street_address: 123 Hollywood Blvd.
          locality: Los Angeles
          region: CA
          postal_code: '90210'
          country: US
        phone_number: +1 (425) 555-1212
  parameters:
    OAuthPathClientId:
      name: clientId
      in: path
      schema:
        type: string
      description: '`client_id` of the client app'
      required: true
    pathAuthorizationServerId:
      name: authorizationServerId
      in: path
      required: true
      description: '`id` of the authorization server'
      schema:
        type: string
    queryAfter:
      name: after
      in: query
      schema:
        type: string
      description: |-
        The cursor to use for pagination. It's an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](/#pagination).

        > **Note:** The `after` cursor should be treated as an opaque value and obtained through the next link relation.
    queryClientId:
      name: client_id
      in: query
      description: You can configure clients to format the issuer differently. Pass in the `client_id` to ensure that the returned issuer format matches.
      schema:
        type: string
    queryLimit:
      name: limit
      in: query
      schema:
        type: integer
        minimum: 1
        maximum: 200
        default: 20
      description: A limit on the number of objects to return.
    queryState:
      name: state
      in: query
      description: An optional value that's returned as a query parameter during the redirect at the end of the flow
      schema:
        type: string
  responses:
    Error400InvalidClientId:
      description: Invalid Client ID
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            Invalid Client ID:
              $ref: '#/components/examples/ErrorInvalidClientId'
    Error404AuthorizationServerNotFound:
      description: Authorization Server Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            Invalid Client ID:
              $ref: '#/components/examples/ErrorResourceNotFound'
    ErrorInvalidClientMetadata400:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            API validation failed:
              $ref: '#/components/examples/ErrorInvalidClientMetadata'
    ErrorAccessDenied403:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            Access denied:
              $ref: '#/components/examples/ErrorAccessDenied'
    ErrorResourceNotFound404:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            Resource Not Found:
              $ref: '#/components/examples/ErrorResourceNotFound'
    ErrorTooManyRequests429:
      description: Too Many Requests
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            Resource Not Found:
              $ref: '#/components/examples/ErrorTooManyRequests'
  schemas:
    AcrValue:
      type: string
      enum:
        - phr
        - phrh
        - urn:okta:loa:1fa:any
        - urn:okta:loa:1fa:pwd
        - urn:okta:loa:2fa:any
        - urn:okta:loa:2fa:any:ifpossible
      x-enumDescriptions:
        phr: <x-lifecycle class="oie"></x-lifecycle> Phishing-Resistant. Requires users to provide possession factors that cryptographically verify the sign-in server (the origin). Currently, only the Passkey (FIDO2 WebAuthn) authenticator satisfies this requirement. Because phishing resistance implies [device binding](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-authenticators), that constraint is selected automatically when `phr` is specified.
        phrh: <x-lifecycle class="oie"></x-lifecycle> Phishing-Resistant Hardware-Protected. Requires that you store keys being used to authenticate in secure hardware (TPM, Secure Enclave) on the device. Currently, only Okta Verify meets this constraint. Because hardware protection implies [device binding](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-authenticators), that constraint is selected automatically when `phrh` is specified.
        urn:okta:loa:1fa:any: Any one factor. Allows one factor authentication with no requirements on which factor.
        urn:okta:loa:1fa:pwd: Password only. Allows one factor authentication that requires the user's password.
        urn:okta:loa:2fa:any: Any two factors. Allows two factor authentication with no requirements on which factors.
        urn:okta:loa:2fa:any:ifpossible: <x-lifecycle class="oie"></x-lifecycle> Any two factors, if possible. Allows two factor authentication with no requirements on which factors. Any two factors are presented only if the user is enrolled, otherwise any one factor is presented.
    AmrValue:
      type: string
      enum:
        - duo
        - email
        - fed
        - google_otp
        - kba
        - oath_otp
        - okta_verify
        - opt
        - pop
        - pwd
        - rsa
        - sms
        - symantec
        - tel
        - yubikey
    ApplicationType:
      description: The type of client app
      default: web
      type: string
      enum:
        - browser
        - native
        - service
        - web
    AuthorizeWithPost:
      type: object
      properties:
        acr_values:
          allOf:
            - $ref: '#/components/schemas/AcrValue'
            - type: string
              description: |-
                An optional parameter that you can include in the authentication request. This parameter increases the level of user assurance.

                > **Note:** You can provide multiple space-delimited values. The authorization server chooses one and reflects the chosen value in any resulting tokens.
        client_id:
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](/openapi/okta-oauth/oauth/client). It identifies the client and must match the value preregistered in Okta.
          type: string
        code_challenge:
          description: A challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/). The challenge is verified in the access token request.
          type: string
        code_challenge_method:
          allOf:
            - $ref: '#/components/schemas/CodeChallengeMethod'
            - type: string
              description: Method used to derive the code challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/).
        display:
          description: The `display` parameter to be passed to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/)
          type: string
        enroll_amr_values:
          allOf:
            - $ref: '#/components/schemas/AmrValue'
            - type: string
              description: |-
                A space-delimited list of values indicating which authenticators to enroll in.

                * If the `enroll_amr_values` parameter is specified, then the value for `prompt` must be `enroll_authenticator`.
                * The parameter value is space-delimited, for example, `pwd sms okta_verify` is a valid request parameter value. You are prompted in the order of the amr values provided.
        idp:
          description: An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.
          type: string
        idp_scope:
          description: An Okta extension to the OpenID specification. A space-delimited list of scopes you want to provide to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/). These scopes are used in addition to the scopes already configured for the identity provider.
          type: string
        login_hint:
          description: A username to pre-populate if prompting for authentication
          type: string
        max_age:
          description: Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta
          type: integer
        nonce:
          description: A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See [OIDC Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
          type: string
        prompt:
          allOf:
            - $ref: '#/components/schemas/Prompt'
            - type: string
              description: |-
                If no `prompt` parameter is specified, the standard behavior occurs:
                * If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, the user is prompted to authenticate.
                * If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent.
        redirect_uri:
          description: Callback location where the authorization code or tokens should be sent. It must match the value preregistered in Okta during client registration.
          type: string
        request:
          description: |-
            A JWT created by the client that enables requests to be passed as a single, self-contained parameter.

            * You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet.
            * You can't encrypt the JWT.
            >  **Note:** See [Build a JWT for client authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/).
            * Okta supports the [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2), [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature algorithms. HMAC signatures require that the client has a `token_endpoint_auth_method` that uses a `client_secret`. RSA and ECDSA signatures requires that the client registers a public key.
            * We recommend that you don't duplicate any request parameters in both the JWT and the query URI itself. However, you can do so with `state`, `nonce`, `code_challenge`, and `code_challenge_method`. In those cases, the values in the JWT overrides the query URI values.
            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it has already been processed.
          type: string
        request_uri:
          description: Location where the authorization request payload data is referenced in an authorization request to the `/authorize` endpoint. This is returned from a Pushed Authorization Request at the `/par` endpoint.
          type: string
        response_mode:
          allOf:
            - $ref: '#/components/schemas/ResponseMode'
            - type: string
              description: |-
                How the authorization response should be returned. If `id_token` or `token` is specified in the `response_type`, then `query` isn't allowed as a response mode. Defaults to `fragment` in implicit and hybrid flows.

                The `Referrer-Policy` header is automatically included in the response when either the fragment or query parameter values are used. The header is set to `Referrer-Policy: no-referrer`.
        response_type:
          allOf:
            - $ref: '#/components/schemas/ResponseTypesSupported'
            - type: string
              description: Any combination of `code`, `token`, and `id_token`. The combination determines the [flow](https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow).
        scope:
          description: A space-delimited string of scopes requested
          type: string
        sessionToken:
          description: Okta one-time session token. This is an Okta extension to the OpenID specification. The `sessionToken` allows an API-based user sign-in flow.
          type: string
        state:
          description: |-
            A value to be returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters.

            Okta requires the OAuth 2.0 `state` parameter on all requests to the `/authorize` endpoint to prevent cross-site request forgery (CSRF).
            The OAuth 2.0 specification [requires](https://tools.ietf.org/html/rfc6749#section-10.12) that clients protect their redirect URIs against CSRF by sending a value in the authorize request that binds the request to the user-agent's authenticated state.
            Using the `state` parameter is also a countermeasure to several other known attacks as outlined in [OAuth 2.0 Threat Model and Security Considerations](https://tools.ietf.org/html/rfc6819).
          type: string
      required:
        - client_id
        - redirect_uri
        - response_type
        - scope
        - state
    BackchannelAuthorizeRequest:
      additionalProperties: true
      type: object
      properties:
        binding_message:
          type: string
          description: A message that appears for the user to identify the transaction
        id_token_hint:
          type: string
          description: |-
            An ID token previously issued to the client as a hint to identify the user for whom authentication is being requested.

            **Note:** You can specify either `login_hint` or `id_token_hint` in the authentication request, not both.
        login_hint:
          type: string
          description: |-
            A hint to the OpenID Provider regarding the user for whom authentication is being requested.

            **Note:** You can specify either `login_hint` or `id_token_hint` in the authentication request, not both.
        request:
          type: string
          description: |-
            A JWT created by the client that enables requests to be passed as a single, self-contained parameter.

            >  **Note:** See [Build a JWT for client authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/).

            * You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet.
            * You can't encrypt the JWT.
            * Okta supports the [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2), [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature algorithms. HMAC signatures require the client to have a `token_endpoint_auth_method` that uses a `client_secret`. RSA and ECDSA signatures require the client to register a public key.
            * You must specify `backchannel_authentication_request_signing_alg` either during client registration or when updating the client to use the signed authentication requests.
            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it's already been processed.
        request_expiry:
          type: integer
          description: Allows the client to request the `expires_in` value in number of seconds for the `auth_req_id` that the server returns.
          minimum: 1
          maximum: 300
        scope:
          type: string
          description: '`openid` is required for authentication requests. You can also include other scopes.'
      required:
        - id_token_hint
        - login_hint
        - scope
    BackchannelAuthorizeResponse:
      type: object
      properties:
        auth_req_id:
          type: string
          description: A unique identifier to identify the authentication request made by the client
        expires_in:
          type: integer
          description: The expiration time of the `auth_req_id` in seconds
          minimum: 1
          maximum: 300
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint
    BindingMethod:
      description: The method used to bind the out-of-band channel with the primary channel.
      type: string
      enum:
        - none
        - prompt
        - transfer
    ChallengeHint:
      description: The type of challenge to prompt for in a `/primary-authenticate` request
      type: string
      enum:
        - urn:okta:params:oauth:grant-type:oob
    ChallengeRequest:
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
      type: object
      properties:
        challenge_types_supported:
          type: array
          description: List of direct authentication challenge types supported by the client
          items:
            $ref: '#/components/schemas/ChallengeType'
        channel_hint:
          $ref: '#/components/schemas/Channel'
        mfa_token:
          type: string
          description: The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests
      required:
        - mfa_token
    ChallengeResponse:
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
      type: object
      properties:
        binding_code:
          type: string
          description: The end-user verification code used to bind the authorization operation on the secondary channel with the primary channel. Present only if `binding_method=transfer`.
        binding_method:
          $ref: '#/components/schemas/BindingMethod'
        challenge_type:
          type: string
          description: The challenge type used for authentication
        channel:
          $ref: '#/components/schemas/Channel'
        expires_in:
          type: integer
          description: Number of seconds until the `oob_code` expires
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint
        oob_code:
          type: string
          description: A unique identifier for identifying the out-of-band transaction across multiple requests
    ChallengeType:
      type: string
      enum:
        - http://auth0.com/oauth/grant-type/mfa-oob
        - http://auth0.com/oauth/grant-type/mfa-otp
    Channel:
      description: The out-of-band channel for use with authentication. Required for all `/primary-authenticate` and `/challenge` requests with an out-of-band authenticator.
      type: string
      enum:
        - push
        - sms
        - voice
    Claim:
      type: string
    Client:
      type: object
      properties:
        application_type:
          $ref: '#/components/schemas/ApplicationType'
        client_id:
          type: string
          description: Unique key for the client app. The `client_id` is immutable. When you create a client app, you can't specify the `client_id` because Okta uses the app ID for the `client_id`.
          readOnly: true
        client_id_issued_at:
          type: integer
          readOnly: true
          description: Time at which the `client_id` was issued (measured in unix seconds)
        client_name:
          type: string
          description: Human-readable string name of the client app
        client_secret:
          type: string
          readOnly: true
          description: OAuth 2.0 client secret string (used for confidential clients). The `client_secret` is shown only on the response of the creation or update of a client app (and only if the `token_endpoint_auth_method` is one that requires a client secret). You can't specify the `client_secret`. If the `token_endpoint_auth_method` requires one, Okta generates a random `client_secret` for the client app.
          nullable: true
        client_secret_expires_at:
          type: integer
          readOnly: true
          description: Time at which the `client_secret` expires or 0 if it doesn't expire (measured in unix seconds)
          minimum: 0
          nullable: true
        frontchannel_logout_session_required:
          type: boolean
          description: Include user session details
        frontchannel_logout_uri:
          type: string
          description: URL where Okta sends the logout request
          nullable: true
        grant_types:
          type: array
          description: 'Array of OAuth 2.0 grant type strings. Default value: `[authorization_code]`'
          items:
            $ref: '#/components/schemas/GrantType'
        id_token_encrypted_response_alg:
          $ref: '#/components/schemas/OAuthIdTokenKeyEncryptionAlgorithm'
        initiate_login_uri:
          type: string
          description: URL that a third party can use to initiate a sign-in flow by the client
        jwks:
          type: object
          description: A [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client
          properties:
            keys:
              type: array
              items:
                oneOf:
                  - $ref: '#/components/schemas/JsonSigningWebKey'
                  - $ref: '#/components/schemas/JsonEncryptionWebKey'
        jwks_uri:
          type: string
          description: URL string that references a [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client
        logo_uri:
          type: string
          description: URL string that references a logo for the client consent dialog (not the sign-in dialog)
          nullable: true
        policy_uri:
          type: string
          description: URL string of a web page providing the client's policy document
          nullable: true
        post_logout_redirect_uris:
          type: string
          description: Array of redirection URI strings for use for relying party initiated logouts
          items:
            type: string
        redirect_uris:
          type: array
          description: 'Array of redirection URI strings for use in redirect-based flows. All redirect URIs must be absolute URIs and must not include a fragment component. At least one redirect URI and response type is required for all client types, with the following exceptions: If the client uses the Resource Owner Password flow (if `grant_type` contains the value `password`) or the Client Credentials flow (if `grant_type` contains the value `client_credentials`), then no redirect URI or response type is necessary. In these cases, you can pass either null or an empty array for these attributes.'
          items:
            type: string
        request_object_signing_alg:
          $ref: '#/components/schemas/SigningAlgorithm'
        response_types:
          type: array
          description: 'Array of OAuth 2.0 response type strings. Default value: `[code]`'
          items:
            $ref: '#/components/schemas/ResponseType'
        token_endpoint_auth_method:
          $ref: '#/components/schemas/EndpointAuthMethod'
        tos_uri:
          type: string
          description: URL string of a web page providing the client's terms of service document
          nullable: true
      required:
        - client_name
    CodeChallengeMethod:
      type: string
      enum:
        - S256
    ContentEncryptionAlgorithm:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      type: string
      enum:
        - A256GCM
    DeviceAuthorizeRequest:
      type: object
      properties:
        client_id:
          type: string
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](/openapi/okta-oauth/oauth/client). It identifies the client and must match the value preregistered in Okta.
        scope:
          type: string
          description: A list of scopes that the client wants to include in the access token
    DeviceAuthorizeResponse:
      type: object
      properties:
        device_code:
          type: string
          description: The device verification code
        expires_in:
          type: integer
          description: The expiration time of the `device_code` and `user_code` in seconds
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint
        user_code:
          type: string
          description: The verification code for the end user
        verification_uri:
          type: string
          description: The URI that the end user visits to verify
        verification_uri_complete:
          type: string
          description: The URI that includes the `user_code` that the end user alternatively visits to verify
    EndpointAuthMethod:
      description: Requested authentication method for OAuth 2.0 endpoints
      type: string
      enum:
        - client_secret_basic
        - client_secret_jwt
        - client_secret_post
        - none
        - private_key_jwt
    Error:
      title: Error
      type: object
      properties:
        errorCauses:
          type: array
          items:
            type: object
            properties:
              errorSummary:
                type: string
        errorCode:
          type: string
          description: An Okta code for this type of error
        errorId:
          type: string
          description: A unique identifier for this error. Okta Support can use this to help with troubleshooting.
        errorLink:
          type: string
          description: An Okta code for this type of error
        errorSummary:
          type: string
          description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.
    GlobalTokenRevocationRequest:
      nullable: false
      type: object
      properties:
        sub_id:
          $ref: '#/components/schemas/sub_id'
    GrantType:
      description: Determines the mechanism Okta uses to authorize the creation of the tokens
      type: string
      enum:
        - authorization_code
        - client_credentials
        - implicit
        - interaction_code
        - password
        - refresh_token
        - urn:ietf:params:oauth:grant-type:device_code
        - urn:ietf:params:oauth:grant-type:jwt-bearer
        - urn:ietf:params:oauth:grant-type:saml2-bearer
        - urn:ietf:params:oauth:grant-type:token-exchange
        - urn:openid:params:grant-type:ciba
        - urn:okta:params:oauth:grant-type:otp
        - urn:okta:params:oauth:grant-type:oob
        - http://auth0.com/oauth/grant-type/mfa-otp
        - http://auth0.com/oauth/grant-type/mfa-oob
        - urn:ietf:params:oauth:grant-type:jwt-bearer
    IntrospectionRequest:
      type: object
      properties:
        token:
          type: string
          description: |-
            An access token, ID token, refresh token, or a device secret.

            > **Note:** Although ID tokens can be sent to this endpoint, they are usually validated on the service provider or app side of a flow.
        token_type_hint:
          $ref: '#/components/schemas/TokenTypeHintIntrospect'
    IntrospectionResponse:
      additionalProperties: true
      type: object
      properties:
        active:
          type: boolean
          description: Indicates whether the token is active or not
        aud:
          type: string
          description: The audience of the token
        client_id:
          type: string
          description: The ID of the client associated with the token
        device_id:
          type: string
          description: The ID of the device associated with the token
        exp:
          type: integer
          description: The expiration time of the token in seconds since January 1, 1970 UTC
        iat:
          type: integer
          description: The issuing time of the token in seconds since January 1, 1970 UTC
        iss:
          type: string
          description: The issuer of the token
        jti:
          type: string
          description: The identifier of the token
        nbf:
          type: integer
          description: Identifies the time (a timestamp in seconds since January 1, 1970 UTC) before which the token must not be accepted for processing
        scope:
          type: string
          description: A space-delimited list of scopes
        sub:
          type: string
          description: The subject of the token
        token_type:
          type: string
          description: The type of token. The value is always `Bearer`.
        uid:
          type: string
          description: The user ID. This parameter is returned only if the token is an access token and the subject is an end user.
        username:
          type: string
          description: The username associated with the token.
    JsonEncryptionWebKey:
      title: Encryption key
      allOf:
        - $ref: '#/components/schemas/JsonWebKeyBase'
      description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses these keys to encrypt an ID token JWT minted by the org authorization server or custom authorization server. Okta supports only RSA keys for encrypting tokens.
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      type: object
      properties:
        e:
          type: string
          description: The key exponent of an RSA key
        kty:
          type: string
          description: The type of public key
          enum:
            - RSA
        'n':
          type: string
          description: The modulus of the RSA key
        use:
          description: The intended use of the public key
          type: string
          enum:
            - enc
    JsonSigningWebKey:
      title: Signing key
      allOf:
        - $ref: '#/components/schemas/JsonWebKeyBase'
      oneOf:
        - $ref: '#/components/schemas/JsonWebKeyEC'
        - $ref: '#/components/schemas/JsonWebKeyRsa'
      description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta can use these keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens.
      type: object
      properties:
        alg:
          $ref: '#/components/schemas/SigningAlgorithm'
        use:
          description: The intended use of the public key
          type: string
          enum:
            - sig
    JsonWebKey:
      description: |-
        A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses these keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens.
        Okta can also use these keys to encrypt an ID token JWT minted by the org authorization server or custom authorization server. Okta supports only RSA keys for encrypting tokens.
      type: object
      properties:
        alg:
          $ref: '#/components/schemas/SigningAlgorithm'
        kid:
          type: string
          description: The unique identifier of the key
        kty:
          $ref: '#/components/schemas/JsonWebKeyType'
        status:
          $ref: '#/components/schemas/JsonWebKeyStatus'
        use:
          $ref: '#/components/schemas/JsonWebKeyUse'
      discriminator:
        propertyName: kty
        mapping:
          sig: '#/components/schemas/JsonWebKeyEC'
          enc: '#/components/schemas/JsonWebKeyRsa'
    JsonWebKeyBase:
      type: object
      properties:
        kid:
          type: string
          description: The unique identifier of the key
    JsonWebKeyEC:
      title: EC signing key
      description: An EC signing key
      allOf:
        - $ref: '#/components/schemas/JsonSigningWebKey'
      type: object
      properties:
        kty:
          type: string
          description: The type of public key
          enum:
            - EC
        x:
          type: string
          description: The public x coordinate for the elliptic curve point
        'y':
          type: string
          description: The public y coordinate for the elliptic curve point
    JsonWebKeyRsa:
      title: RSA signing key
      description: An RSA signing key
      allOf:
        - $ref: '#/components/schemas/JsonSigningWebKey'
      type: object
      properties:
        e:
          type: string
          description: The key exponent of an RSA key
        kty:
          type: string
          description: The type of public key
          enum:
            - RSA
        'n':
          type: string
          description: The modulus of the RSA key
    JsonWebKeyStatus:
      description: The status of the public key
      type: string
      enum:
        - ACTIVE
        - INACTIVE
    JsonWebKeyType:
      description: The type of public key
      type: string
      enum:
        - EC
        - RSA
    JsonWebKeyUse:
      description: The intended use of the public key
      type: string
      enum:
        - enc
        - sig
    LogoutWithPost:
      type: object
      properties:
        id_token_hint:
          description: A valid ID token with a subject that matches the current session
          type: string
        post_logout_redirect_uri:
          description: Location to redirect to after the logout is performed. It must match the value preregistered in Okta during client registration.
          type: string
        state:
          description: An optional value that's returned as a query parameter during the redirect at the end of the flow
          type: string
      required:
        - id_token_hint
    OAuthError:
      type: object
      properties:
        error:
          type: string
          description: An error code defined in [RFC6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2) or other extension
        error_description:
          type: string
          description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.
    OAuthIdTokenKeyEncryptionAlgorithm:
      description: JWE alg algorithm for encrypting the ID token issued to this client. If this is requested, the response is signed, and then encrypted with the result being a nested JWT. The default, if omitted, is that no encryption is performed.
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      type: string
      enum:
        - RSA-OAEP-256
        - RSA-OAEP-384
        - RSA-OAEP-512
    OAuthKeys:
      type: object
      properties:
        keys:
          type: array
          items:
            $ref: '#/components/schemas/JsonWebKey'
    OAuthMetadata:
      type: object
      properties:
        authorization_endpoint:
          type: string
          description: URL of the authorization server's authorization endpoint
        backchannel_authentication_request_signing_alg_values_supported:
          description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>A list of signing algorithms that this authorization server supports for signed requests
          type: array
          items:
            $ref: '#/components/schemas/SigningAlgorithm'
          x-okta-lifecycle:
            lifecycle: LIMITED_GA
            isGenerallyAvailable: false
            SKUs:
              - Okta Identity Engine
        backchannel_token_delivery_modes_supported:
          description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>The delivery modes that this authorization server supports for Client-Initiated Backchannel Authentication
          type: array
          items:
            $ref: '#/components/schemas/TokenDeliveryMode'
          x-okta-lifecycle:
            lifecycle: LIMITED_GA
            isGenerallyAvailable: false
            SKUs:
              - Okta Identity Engine
        claims_supported:
          description: A list of the claims supported by this authorization server
          type: array
          items:
            $ref: '#/components/schemas/Claim'
        code_challenge_methods_supported:
          description: A list of PKCE code challenge methods supported by this authorization server
          type: array
          items:
            $ref: '#/components/schemas/CodeChallengeMethod'
        device_authorization_endpoint:
          type: string
        dpop_signing_alg_values_supported:
          description: A list of signing algorithms supported by this authorization server for Demonstrating Proof-of-Possession (DPoP) JWTs
          type: array
          items:
            type: string
            enum:
              - ES256
              - ES384
              - ES512
              - RS256
              - RS384
              - RS512
          x-okta-lifecycle:
            lifecycle: TOMBSTONE
            isGenerallyAvailable: false
            SKUs: []
        end_session_endpoint:
          description: URL of the authorization server's logout endpoint
          type: string
        grant_types_supported:
          description: A list of the grant type values that this authorization server supports
          type: array
          items:
            $ref: '#/components/schemas/GrantType'
        introspection_endpoint:
          description: URL of the authorization server's introspection endpoint
          type: string
        introspection_endpoint_auth_methods_supported:
          description: A list of client authentication methods supported by this introspection endpoint
          type: array
          items:
            $ref: '#/components/schemas/EndpointAuthMethod'
        issuer:
          type: string
          description: The authorization server's issuer identifier. In the context of this document, this is your authorization server's base URL. This becomes the `iss` claim in an access token.
        jwks_uri:
          description: URL of the authorization server's JSON Web Key Set document
          type: string
        pushed_authorization_request_endpoint:
          type: string
        registration_endpoint:
          description: URL of the authorization server's JSON Web Key Set document
          type: string
        request_object_signing_alg_values_supported:
          description: A list of signing algorithms that this authorization server supports for signed requests
          type: array
          items:
            $ref: '#/components/schemas/SigningAlgorithm'
        request_parameter_supported:
          description: Indicates if request parameters are supported by this authorization server
          type: boolean
        response_modes_supported:
          description: A list of the `response_mode` values that this authorization server supports
          type: array
          items:
            $ref: '#/components/schemas/ResponseMode'
        response_types_supported:
          description: A list of the `response_type` values that this authorization server supports. Can be a combination of `code`, `token`, and `id_token`.
          type: array
          items:
            $ref: '#/components/schemas/ResponseTypesSupported'
        revocation_endpoint:
          description: URL of the authorization server's revocation endpoint
          type: string
        revocation_endpoint_auth_methods_supported:
          description: A list of client authentication methods supported by this revocation endpoint
          type: array
          items:
            $ref: '#/components/schemas/EndpointAuthMethod'
        scopes_supported:
          description: A list of the scope values that this authorization server supports
          type: array
          items:
            $ref: '#/components/schemas/Scope'
        subject_types_supported:
          description: A list of the subject identifier types that this authorization server supports. Valid types include `pairwise` and `public`, but only `public` is currently supported. See the [Subject Identifier Types](https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes) section in the OpenID Connect specification.
          type: array
          items:
            $ref: '#/components/schemas/SubjectType'
        token_endpoint:
          description: URL of the authorization server's token endpoint
          type: string
        token_endpoint_auth_methods_supported:
          description: A list of client authentication methods supported by this token endpoint
          type: array
          items:
            $ref: '#/components/schemas/EndpointAuthMethod'
    OidcMetadata:
      allOf:
        - $ref: '#/components/schemas/OAuthMetadata'
        - type: object
          properties:
            id_token_encryption_alg_values_supported:
              description: JSON array that contains a list of the JWE encryption algorithms (alg values) supported for the ID token to encode the claims in a JWT
              type: array
              items:
                $ref: '#/components/schemas/OAuthIdTokenKeyEncryptionAlgorithm'
              x-okta-lifecycle:
                lifecycle: GA
                isGenerallyAvailable: true
            id_token_encryption_enc_values_supported:
              description: JSON array that contains a list of the JWE encryption algorithms (enc values) supported for the ID token to encode the claims in a JWT
              type: array
              items:
                $ref: '#/components/schemas/ContentEncryptionAlgorithm'
              x-okta-lifecycle:
                lifecycle: GA
                isGenerallyAvailable: true
            id_token_signing_alg_values_supported:
              description: A list of signing algorithms that this authorization server supports for signing ID tokens
              type: array
              items:
                $ref: '#/components/schemas/SigningAlgorithm'
            userinfo_endpoint:
              description: URL of the authorization server's userinfo endpoint
              type: string
    OobAuthenticateRequest:
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
      type: object
      properties:
        challenge_hint:
          $ref: '#/components/schemas/ChallengeHint'
        channel_hint:
          $ref: '#/components/schemas/Channel'
        login_hint:
          type: string
          description: The user sign-in information for whom authentication is being requested
      required:
        - login_hint
        - channel_hint
        - challenge_hint
    OobAuthenticateResponse:
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
      type: object
      properties:
        binding_code:
          type: string
          description: The end-user verification code used to bind the authorization operation on the secondary channel with the primary channel. Present only if `binding_method=transfer`.
        binding_method:
          $ref: '#/components/schemas/BindingMethod'
        channel:
          $ref: '#/components/schemas/Channel'
        expires_in:
          type: integer
          description: Number of seconds until the `oob_code` expires
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint
        oob_code:
          type: string
          description: A unique identifier for identifying the out-of-band transaction across multiple requests
    ParRequest:
      description: See `/authorize` query parameters for more information
      type: object
      properties:
        client_id:
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client)
          type: string
        code_challenge:
          description: A challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/). The challenge is verified in the access token request.
          type: string
        code_challenge_method:
          type: string
          description: Method used to derive the code challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/)
          items:
            $ref: '#/components/schemas/CodeChallengeMethod'
        display:
          type: string
          description: The `display` parameter to be passed to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/)
        idp:
          type: string
          description: An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.
        idp_scope:
          type: string
          description: An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/). These scopes are used in addition to the scopes already configured for the identity provider.
        login_hint:
          type: string
          description: A username to pre-populate if prompting for authentication
        max_age:
          type: integer
          description: Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta
        nonce:
          type: string
          description: A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See [OIDC Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
        prompt:
          type: string
          description: |-
            If you don't specify the `prompt` parameter, the standard behavior occurs:
            * If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, Okta prompts the user to authenticate.
            * If scopes are requested that require consent and consent isn't yet given by the authenticated user, Okta prompts the user to give consent.
          items:
            $ref: '#/components/schemas/Prompt'
        redirect_uri:
          type: string
          description: Callback location where you want the authorization code or tokens sent to. It must match the value preregistered in Okta during client registration.
        request:
          type: string
          description: Used to push a [Request Object JWT](https://datatracker.ietf.org/doc/html/rfc9126#name-the-request-request-paramet) to the authorization server
        response_mode:
          type: string
          description: |-
            How Okta should return the authorization response. If `id_token` or `token` is specified in the `response_type`, then `query` isn't allowed as a response mode. Defaults to `fragment` in implicit and hybrid flows.

            The `Referrer-Policy` header is automatically included in the response when either the `fragment` or `query` parameter values are used. The header is set to `Referrer-Policy: no-referrer`.
          items:
            $ref: '#/components/schemas/ResponseMode'
        response_type:
          type: string
          description: Any combination of `code`, `token`, and `id_token`. The combination determines the [flow](https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow).
          items:
            $ref: '#/components/schemas/ResponseTypesSupported'
        scope:
          type: string
          description: A space-delimited string of scopes requested
        sessionToken:
          type: string
          description: Okta one-time session token. This is an Okta extension to the OpenID specification. The `sessionToken` allows an API-based user sign-in flow.
        state:
          type: string
          description: A value returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters.
    ParResponse:
      type: object
      properties:
        expires_in:
          type: integer
          description: Number of seconds until the `request_uri` expires
        request_uri:
          type: string
          description: Location where the authorization request payload data is referenced in authorization requests to the `/authorize` endpoint
    Prompt:
      type: string
      enum:
        - consent
        - enroll_authenticator
        - login
        - login consent
        - none
      x-enumDescriptions:
        none: Don't prompt for authentication or consent. If an Okta session already exists, the user is silently authenticated. Otherwise, an error is returned.
        login: Always prompt the user for authentication, regardless of whether they have an Okta session.
        consent: Depending on the [values set for consent_method in the app and consent for the scope](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/createapplication), display the Okta consent dialog, even if the user has already given consent. User consent is available for custom authorization servers (requires the API Access Management feature and the User Consent feature enabled).
        login consent: Can also be `consent login` (order doesn't matter). The user is always prompted for authentication, and the user consent dialog appears depending on the [values set for consent_method in the app and consent on the scope](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/createapplication), even if the user has already given consent.
        enroll_authenticator: |-
          This indicates that the intent is to enroll the user with an authenticator. The following other parameters must be used together with this value for a valid request:

          * `enroll_amr_values`: Value must be specified and indicates which authenticator method you're allowing the user to enroll.
          * `response_type`: Value must be `none`, which means no tokens should be returned at the end of the flow.
          * `acr_values`: Value must be `urn:okta:loa:2fa:any:ifpossible`, which means the user is prompted for at least one factor before enrollment.
          * `max_age`: Value must be `0`, which means no existing session should be considered.
          * `scope` and `nonce` must not be specified, because no tokens are generated.
    ResponseMode:
      type: string
      enum:
        - form_post
        - fragment
        - okta_post_message
        - query
      x-enumDescriptions:
        fragment: Parameters are encoded in the URL fragment added to the `redirect_uri` when redirecting back to the client.
        query: Parameters are encoded in the query string added to the `redirect_uri` when redirecting back to the client.
        form_post: Parameters are encoded as HTML form values (`application/x-www-form-urlencoded` format) and are transmitted through the HTTP POST method to the client.
        okta_post_message: |-
          Uses [HTML5 Web Messaging](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage), for example, `window.postMessage()` instead of the redirect for the authorization response from the `/authorize` endpoint.

          `okta_post_message` is an adaptation of the [Web Message Response Mode](https://tools.ietf.org/html/draft-sakimura-oauth-wmrm-00#section-4.1).
          This value provides a secure way for a single-page app to perform a sign-in flow in a pop-up window or an iFrame and receive the ID token, access token, and/or authorization code back in the parent page without leaving the context of that page.

          Use the `postMessage()` data object to help you when working with the `okta_post_message` value of the `response_mode` request parameter.

          | Parameter         | Description                                                                | Data Type |
          |-------------------|----------------------------------------------------------------------------|-----------|
          | access_token      | An access token. This is returned if the `response_type` included `token`. | string    |
          | error             | The error code, if something went wrong                                    | string    |
          | error_description | Additional error information (if any)                                      | string    |
          | id_token          | An ID token. This is returned if the `response_type` includes `id_token`.  | string    |
          | state             | The unmodified `state` value from the request                              | string    |
    ResponseType:
      type: string
      enum:
        - code
        - id_token
        - none
        - token
    ResponseTypesSupported:
      type: string
      enum:
        - code
        - code id_token
        - code id_token token
        - code token
        - id_token
        - id_token token
        - token
    RevokeRequestCustomAs:
      type: object
      properties:
        token:
          type: string
          description: An access token, refresh token, or a device secret
          example: <access_token_value>
        token_type_hint:
          $ref: '#/components/schemas/TokenTypeHintRevokeCustomAs'
      required:
        - token
    RevokeRequestOrgAs:
      type: object
      properties:
        token:
          type: string
          description: The token to revoke
          example: <access_token_value>
        token_type_hint:
          $ref: '#/components/schemas/TokenTypeHintRevokeOrgAs'
      required:
        - token
    Scope:
      type: string
    SigningAlgorithm:
      description: The type of [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) algorithm that you must use for signing request objects. When you specify a value for the `request_object_signing_alg` property, all request objects from the client are rejected if not signed with the specified algorithm. You must use the algorithm when the request object is passed by value (using the request parameter). If a value for `request_object_signing_alg` isn't specified, the default is any algorithm that's supported by both the client and the server.
      type: string
      enum:
        - ES256
        - ES384
        - ES512
        - HS256
        - HS384
        - HS512
        - RS256
        - RS384
        - RS512
    SubIdIssSub:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      title: Issuer-Subject Identifier
      description: <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>Subject identifier using issuer and subject from third-party IdP
      type: object
      properties:
        format:
          type: string
          description: The subject identifier format that uses the issuer and subject from third-party IdPs. It determines how users are identified in revocation requests.
          nullable: false
          writeOnly: true
          enum:
            - iss_sub
        iss:
          type: string
          description: |-
            Issuer identifier from the IdP.
            * For SAML IdPs, the issuer identifier is the IdP issuer.
            * For OIDC IdPs, the issuer identifier is the issuer URL.
          writeOnly: true
          nullable: false
          example: https://idp.example.com
        sub:
          type: string
          description: |-
            Subject identifier from the IdP.
            * For SAML IdPs, the subject identifier is the NameID.
            * For OIDC IdPs, the subject identifier is the `sub` claim.
          writeOnly: true
          nullable: false
          example: user@example.com
      required:
        - format
        - sub
        - iss
    SubIdOpaque:
      title: Opaque subject identifier
      description: Subject identifier that uses Okta's opaque user ID format
      type: object
      properties:
        format:
          type: string
          description: The subject identifier format that uses Okta's opaque user ID format. It determines how users are identified in revocation requests.
          nullable: false
          writeOnly: true
          enum:
            - opaque
        id:
          type: string
          description: ID of an existing Okta user
          writeOnly: true
          nullable: false
          example: 00u1dnq5S0CfjlkpABCD
      required:
        - format
        - id
    SubjectType:
      type: string
      enum:
        - pairwise
        - public
    TokenDeliveryMode:
      type: string
      enum:
        - poll
    TokenRequest:
      type: object
      properties:
        grant_type:
          $ref: '#/components/schemas/GrantType'
    TokenRequestAuthorizationCode:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            code:
              type: string
              description: The value is what was returned from the authorization endpoint. The code has a lifetime of 300 seconds.
            code_verifier:
              type: string
              description: Required if the `code_challenge` was specified in the original `/authorize` request. This value is the code verifier for PKCE. Okta uses it to recompute the `code_challenge` and verify if it matches the original `code_challenge` in the authorization request.
            redirect_uri:
              type: string
              description: Specifies the callback location where the authorization was sent. This value must match the `redirect_uri` used to generate the original `authorization_code`.
          required:
            - code
    TokenRequestCiba:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            auth_req_id:
              type: string
              description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>The value is what was returned from `/bc/authorize`
              x-okta-lifecycle:
                lifecycle: LIMITED_GA
                isGenerallyAvailable: false
                SKUs:
                  - Okta Identity Engine
          required:
            - auth_req_id
    TokenRequestClientCredentials:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            scope:
              type: string
              description: The scopes requested
          required:
            - scope
    TokenRequestCustomAs:
      type: object
      properties:
        grant_type:
          $ref: '#/components/schemas/GrantType'
      discriminator:
        propertyName: grant_type
        mapping:
          authorization_code: '#/components/schemas/TokenRequestAuthorizationCode'
          client_credentials: '#/components/schemas/TokenRequestClientCredentials'
          password: '#/components/schemas/TokenRequestPassword'
          refresh_token: '#/components/schemas/TokenRequestRefreshToken'
          urn:ietf:params:oauth:grant-type:saml2-bearer: '#/components/schemas/TokenRequestSamlBearer'
          urn:ietf:params:oauth:grant-type:token-exchange: '#/components/schemas/TokenRequestTokenExchangeCustomAs'
          urn:openid:params:grant-type:ciba: '#/components/schemas/TokenRequestCiba'
          urn:okta:params:oauth:grant-type:otp: '#/components/schemas/TokenRequestDirectAuthenticationOtp'
          urn:okta:params:oauth:grant-type:oob: '#/components/schemas/TokenRequestDirectAuthenticationOob'
          http://auth0.com/oauth/grant-type/mfa-otp: '#/components/schemas/TokenRequestDirectAuthenticationMfaOtp'
          http://auth0.com/oauth/grant-type/mfa-oob: '#/components/schemas/TokenRequestDirectAuthenticationMfaOob'
          urn:ietf:params:oauth:grant-type:jwt-bearer: '#/components/schemas/TokenRequestJwtBearer'
    TokenRequestDirectAuthReferenceValue:
      allOf:
        - $ref: '#/components/schemas/TokenRequestDirectAuthenticationOtp'
        - $ref: '#/components/schemas/TokenRequestDirectAuthenticationMfaOtp'
        - $ref: '#/components/schemas/TokenRequestDirectAuthenticationOob'
        - $ref: '#/components/schemas/TokenRequestDirectAuthenticationMfaOob'
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestDirectAuthenticationMfaOob:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            grant_types_supported:
              description: A list of the grant type values that this authorization server supports
              type: array
              items:
                $ref: '#/components/schemas/GrantType'
            mfa_token:
              type: string
              description: The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests
            oob_code:
              type: string
              description: The value returned from a previous oob-authenticate or challenge request for identifying an out-of-band transaction across multiple requests
            scope:
              type: string
              description: The scopes requested
          required:
            - grant_type
            - mfa_token
            - oob_code
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestDirectAuthenticationMfaOtp:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            grant_types_supported:
              description: A list of the grant type values that this authorization server supports
              type: array
              items:
                $ref: '#/components/schemas/GrantType'
            mfa_token:
              type: string
              description: The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests
            otp:
              type: string
              description: The one-time passcode for an enrolled authenticator of the user for whom authentication is being requested
            scope:
              type: string
              description: The scopes requested
          required:
            - grant_type
            - mfa_token
            - otp
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestDirectAuthenticationOob:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            grant_types_supported:
              description: A list of the grant type values that this authorization server supports
              type: array
              items:
                $ref: '#/components/schemas/GrantType'
            oob_code:
              type: string
              description: The value returned from a previous oob-authenticate or challenge request for identifying an out-of-band transaction across multiple requests
            scope:
              type: string
              description: The scopes requested
          required:
            - grant_type
            - scope
            - oob_code
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestDirectAuthenticationOtp:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            grant_types_supported:
              description: A list of the grant type values that the client supports
              type: array
              items:
                $ref: '#/components/schemas/GrantType'
            login_hint:
              type: string
              description: The user sign-in information for whom authentication is being requested
            otp:
              type: string
              description: The one-time passcode for an enrolled authenticator of the user for whom authentication is being requested
            scope:
              type: string
              description: The scopes requested
          required:
            - grant_type
            - scope
            - login_hint
            - otp
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestJwtBearer:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            assertion:
              type: string
              description: The JSON Web Token (JWT) assertion
            scope:
              type: string
              description: The scopes requested
          required:
            - assertion
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs: []
    TokenRequestOrgAs:
      type: object
      properties:
        grant_type:
          $ref: '#/components/schemas/GrantType'
      discriminator:
        propertyName: grant_type
        mapping:
          authorization_code: '#/components/schemas/TokenRequestAuthorizationCode'
          client_credentials: '#/components/schemas/TokenRequestClientCredentials'
          password: '#/components/schemas/TokenRequestPassword'
          refresh_token: '#/components/schemas/TokenRequestRefreshToken'
          urn:ietf:params:oauth:grant-type:saml2-bearer: '#/components/schemas/TokenRequestSamlBearer'
          urn:ietf:params:oauth:grant-type:token-exchange: '#/components/schemas/TokenRequestTokenExchangeOrgAs'
          urn:openid:params:grant-type:ciba: '#/components/schemas/TokenRequestCiba'
          urn:okta:params:oauth:grant-type:otp: '#/components/schemas/TokenRequestDirectAuthenticationOtp'
          urn:okta:params:oauth:grant-type:oob: '#/components/schemas/TokenRequestDirectAuthenticationOob'
          http://auth0.com/oauth/grant-type/mfa-otp: '#/components/schemas/TokenRequestDirectAuthenticationMfaOtp'
          http://auth0.com/oauth/grant-type/mfa-oob: '#/components/schemas/TokenRequestDirectAuthenticationMfaOob'
    TokenRequestPassword:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            password:
              type: string
              description: The password of the matching user
            scope:
              type: string
              description: The scopes requested
            username:
              type: string
              description: The identifier for the user
          required:
            - password
            - scope
            - username
    TokenRequestRefreshToken:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            refresh_token:
              type: string
              description: The refresh token
            scope:
              type: string
              description: The scopes requested. They must be a subset of the original scopes associated with the refresh token.
          required:
            - refresh_token
    TokenRequestSamlBearer:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            assertion:
              type: string
              description: The base64-encoded SAML Assertion
              x-okta-lifecycle:
                lifecycle: GA
                isGenerallyAvailable: true
            scope:
              type: string
              description: The scopes requested
          required:
            - assertion
            - scope
    TokenRequestTokenExchange:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - description: '[RFC8693: OAuth 2.0 Token Exchange](https://tools.ietf.org/html/rfc8693)'
          type: object
          properties:
            actor_token:
              type: string
              description: A security token that represents the identity of the acting party
            audience:
              type: string
              description: The target audience for the requested token
            auth_req_id:
              type: string
              description: <x-lifecycle class="oie"></x-lifecycle> The value is what was returned from `/bc/authorize`.
            resource:
              type: string
              description: The target resource for the requested token
            scope:
              type: string
              description: The scopes requested
            subject_token:
              type: string
              description: A security token that represents the identity of the party on behalf of whom the request is being made
          required:
            - subject_token
    TokenRequestTokenExchangeCustomAs:
      allOf:
        - $ref: '#/components/schemas/TokenRequestTokenExchange'
        - type: object
          properties:
            actor_token_type:
              $ref: '#/components/schemas/TokenTypeCustomAs'
            requested_token_type:
              $ref: '#/components/schemas/TokenTypeCustomAs'
            subject_token_type:
              $ref: '#/components/schemas/TokenTypeCustomAs'
    TokenRequestTokenExchangeOrgAs:
      allOf:
        - $ref: '#/components/schemas/TokenRequestTokenExchange'
        - type: object
          properties:
            actor_token_type:
              $ref: '#/components/schemas/TokenTypeOrgAs'
            requested_token_type:
              $ref: '#/components/schemas/TokenTypeOrgAs'
            subject_token_type:
              $ref: '#/components/schemas/TokenTypeOrgAs'
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: An access token
        device_secret:
          type: string
          description: An opaque device secret. This is returned if the `device_sso` scope is granted.
        expires_in:
          type: integer
          description: The expiration time of the access token in seconds
        id_token:
          type: string
          description: An ID token. This is returned if the `openid` scope is granted.
        refresh_token:
          type: string
          description: An opaque refresh token. This is returned if the `offline_access` scope is granted.
        scope:
          type: string
          description: The scopes contained in the access token
        token_type:
          $ref: '#/components/schemas/TokenResponseTokenType'
    TokenResponseCustomAs:
      allOf:
        - $ref: '#/components/schemas/TokenResponse'
        - type: object
          properties:
            issued_token_type:
              $ref: '#/components/schemas/TokenTypeCustomAs'
    TokenResponseOrgAs:
      allOf:
        - $ref: '#/components/schemas/TokenResponse'
        - type: object
          properties:
            issued_token_type:
              $ref: '#/components/schemas/TokenTypeOrgAs'
            service_account:
              $ref: '#/components/schemas/TokenResponseServiceAccount'
            vaulted_secret:
              $ref: '#/components/schemas/TokenResponseVaultedSecret'
    TokenResponseServiceAccount:
      description: |-
        The service account credentials. 
        This is returned if the `issued_token_type` is `urn:okta:params:oauth:token-type:service-account`. 
        > **Note:** This is only available if you're subscribed to Okta for AI Agents. Contact Okta Support for more information.
      type: object
      properties:
        password:
          type: string
          description: The service account password
        username:
          type: string
          description: The service account username
    TokenResponseTokenType:
      description: The token type in a `/token` response. The value is generally `Bearer` except for a few instances of token exchange.
      type: string
      enum:
        - Bearer
        - N_A
    TokenResponseVaultedSecret:
      description: |-
        The vaulted secret containing key-value pairs. 
        This is returned if the `issued_token_type` is `urn:okta:params:oauth:token-type:vaulted-secret`. 
        > **Note:** This is only available if you're subscribed to Okta for AI Agents. Contact Okta Support for more information.
      additionalProperties:
        type: string
      type: object
    TokenTypeCustomAs:
      description: The type of token for token exchange
      type: string
      enum:
        - urn:ietf:params:oauth:token-type:access_token
        - urn:ietf:params:oauth:token-type:id_token
        - urn:ietf:params:oauth:token-type:jwt
        - urn:ietf:params:oauth:token-type:refresh_token
        - urn:ietf:params:oauth:token-type:saml1
        - urn:ietf:params:oauth:token-type:saml2
        - urn:okta:oauth:token-type:web_sso_token
        - urn:x-oath:params:oauth:token-type:device-secret
        - urn:okta:params:oauth:token-type:interclient_token
      x-enumDescriptions:
        urn:ietf:params:oauth:token-type:access_token: OAuth 2.0 access token
        urn:ietf:params:oauth:token-type:id_token: ID token
        urn:ietf:params:oauth:token-type:jwt: JSON Web Token (JWT)
        urn:ietf:params:oauth:token-type:refresh_token: OAuth 2.0 refresh token
        urn:ietf:params:oauth:token-type:saml1: SAML 1.1 assertion
        urn:ietf:params:oauth:token-type:saml2: SAML 2.0 assertion
        urn:okta:oauth:token-type:web_sso_token: Web SSO token
        urn:x-oath:params:oauth:token-type:device-secret: Device secret
        urn:okta:params:oauth:token-type:interclient_token: <x-lifecycle class="ea"></x-lifecycle> Interclient token
    TokenTypeHintIntrospect:
      description: Indicates the type of `token` being passed
      type: string
      enum:
        - access_token
        - device_secret
        - id_token
        - refresh_token
    TokenTypeHintRevokeCustomAs:
      description: Indicates the type of `token` being passed
      example: access_token
      type: string
      enum:
        - access_token
        - device_secret
        - refresh_token
      x-enumDescriptions:
        access_token: OAuth 2.0 access token
        device_secret: Device secret
        refresh_token: OAuth 2.0 refresh token
    TokenTypeHintRevokeOrgAs:
      description: Indicates the type of `token` being passed
      example: access_token
      type: string
      enum:
        - access_token
        - device_secret
        - refresh_token
        - oauth_sts
      x-enumDescriptions:
        access_token: OAuth 2.0 access token
        device_secret: Device secret
        refresh_token: OAuth 2.0 refresh token
        oauth_sts: OAuth Security Token Service (STS). This type is only available if you're subscribed to Okta for AI Agents.
    TokenTypeOrgAs:
      description: The type of token for token exchange
      type: string
      enum:
        - urn:ietf:params:oauth:token-type:access_token
        - urn:ietf:params:oauth:token-type:id_token
        - urn:ietf:params:oauth:token-type:jwt
        - urn:ietf:params:oauth:token-type:refresh_token
        - urn:ietf:params:oauth:token-type:saml1
        - urn:ietf:params:oauth:token-type:saml2
        - urn:okta:oauth:token-type:web_sso_token
        - urn:x-oath:params:oauth:token-type:device-secret
        - urn:okta:params:oauth:token-type:interclient_token
        - urn:ietf:params:oauth:token-type:id-jag
        - urn:okta:params:oauth:token-type:vaulted-secret
        - urn:okta:params:oauth:token-type:service-account
        - urn:okta:params:oauth:token-type:oauth-sts
      x-enumDescriptions:
        urn:ietf:params:oauth:token-type:access_token: OAuth 2.0 access token
        urn:ietf:params:oauth:token-type:id_token: ID token
        urn:ietf:params:oauth:token-type:jwt: JSON Web Token (JWT)
        urn:ietf:params:oauth:token-type:refresh_token: OAuth 2.0 refresh token
        urn:ietf:params:oauth:token-type:saml1: SAML 1.1 assertion
        urn:ietf:params:oauth:token-type:saml2: SAML 2.0 assertion
        urn:okta:oauth:token-type:web_sso_token: Web SSO token
        urn:x-oath:params:oauth:token-type:device-secret: Device secret
        urn:okta:params:oauth:token-type:interclient_token: <x-lifecycle class="ea"></x-lifecycle> Interclient token
        urn:ietf:params:oauth:token-type:id-jag: Identity Assertion JWT Authorization Grant (ID-JAG). This type is only available with Cross App Access or if you're subscribed to Okta for AI Agents.
        urn:okta:params:oauth:token-type:vaulted-secret: OPA vaulted secret. This type is only available if you're subscribed to Okta for AI Agents.
        urn:okta:params:oauth:token-type:service-account: OPA service account. This type is only available if you're subscribed to Okta for AI Agents.
        urn:okta:params:oauth:token-type:oauth-sts: OAuth Security Token Service (STS). This type is only available if you're subscribed to Okta for AI Agents.
    UserInfo:
      additionalProperties: true
      type: object
      properties:
        sub:
          type: string
          description: The subject identifier
    sub_id:
      nullable: false
      description: Subject identifier for the user whose tokens should be revoked
      oneOf:
        - $ref: '#/components/schemas/SubIdOpaque'
        - $ref: '#/components/schemas/SubIdIssSub'
      type: object
      discriminator:
        propertyName: format
        mapping:
          opaque: '#/components/schemas/SubIdOpaque'
          iss_sub: '#/components/schemas/SubIdIssSub'
  securitySchemes:
    apiToken:
      description: 'Pass the API token as the Authorization header value prefixed with SSWS: `Authorization: SSWS {API Token}`'
      name: Authorization
      type: apiKey
      in: header
    oauth2:
      type: oauth2
      description: 'Pass the access_token as the value of the Authorization header: `Authorization: Bearer {access_token}`'
      flows:
        authorizationCode:
          x-usePkce:
            disableManualConfiguration: false
            hideClientSecretInput: true
          authorizationUrl: /oauth2/v1/authorize
          tokenUrl: /oauth2/v1/token
          scopes:
            address: Requests access to the `address` claim
            device_sso: Requests a device secret used to obtain a new set of tokens without re-prompting the user for authentication. See [Native SSO](https://developer.okta.com/docs/guides/configure-native-sso/main/).
            email: Requests access to the `email` and `email_verified` claims
            groups: Requests access to the `groups` claim
            offline_access: Requests a refresh token used to obtain more access tokens without re-prompting the user for authentication
            okta.clients.manage: Allows the app to manage clients in your Okta org
            okta.clients.read: Allows the app to read information about clients in your Okta org
            okta.clients.register: Allows the app to register new clients in your Okta org
            okta.universalLogout.manage: Allows an admin or a service to initiate Universal Logout and revoke all tokens and sessions associated with a specific user
            okta.workflows.invoke.manage: Allows the app to trigger an OAuth 2.0 protected flow
            openid: Identifies the request as an OpenID Connect request
            phone: Requests access to the `phone_number` and `phone_number_verified` claims
            profile: Requests access to the end user's default profile claims
    Client_authentication_client_secret_basic:
      type: http
      scheme: basic
      description: |-
        Pass the client credentials concatenated with a `:` and base64-encoded as part of the Authorization header prefixed with `Basic`

        ```
        Authorization: Basic {base64(<client_id>:<client_secret>)}
        ```

        ```
        Authorization: Basic MGpyYWJ5UVdtNEI5elZKUGJvdFk6NVc3WFVMQ0VzNEJKS25XVVh3aDhsZ21lWFJoY0djZFZpRnA4NHBXZQ==
        ```
    Client_authentication_client_secret_post:
      type: http
      scheme: postBody
      description: |-
        Pass the client credentials as part of the request body.

        ```
        "client_id" : <client_id>
        "client_secret" : <client_secret>
        ```

        ```
        "client_id" : "0jrabyQWm4B9zVJPbotY"
        "client_secret" : "5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe"
        ```
    Client_authentication_client_secret_jwt:
      type: http
      scheme: postBody
      description: |-
        Pass the client credentials in the request body as a JWT `client_assertion` along with the `client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. Generate the assertion by signing the JWT with the `sub` and `iss` claims set to the `client_id` and signing the payload with the `client_secret` using an HMAC SHA algorithm (HS256, HS384, or HS512). See [Build a JWT for Client Authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/java/main/).

        ```
        "client_assertion" : "<client_assertion_value>"
        "client_assertion_type" : "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
        ```
    Client_authentication_private_key_jwt:
      type: http
      scheme: postBody
      description: |-
        Pass the client credentials in the request body as a JWT `client_assertion` along with the `client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. Generate the assertion by signing the JWT with the `sub` and `iss` claims set to the `client_id` and signing the payload with the corresponding private key using an RSA or ECDSA algorithm (RS256, RS384, RS512, ES256, ES384, ES512). The private key that you use to sign the JWT must have the corresponding public key registered in the client's JWK Set. See [Build a JWT for Client Authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/java/main/).

        ```
        "client_assertion" : "<client_assertion_value>"
        "client_assertion_type" : "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
        ```