oauth-noEnums-oneOfInheritance-noExamples.yaml

openapi: 3.0.3
info:
  title: Okta OpenID Connect & OAuth 2.0
  version: 2026.07.3
  description: OAuth 2.0 Protocol APIs
  termsOfService: https://developer.okta.com/terms/
  contact:
    name: Okta Developer Team
    url: https://developer.okta.com/
    email: devex-public@okta.com
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  x-logo:
    url: logo.svg
    backgroundColor: transparent
    altText: Okta Developer
servers:
  - url: https://{yourOktaDomain}
    variables:
      yourOktaDomain:
        default: subdomain.okta.com
        description: The domain of your org. This can be a provided subdomain of an official okta domain (okta.com, oktapreview.com, and so on) or one of your configured custom domains.
tags:
  - name: Client
    x-displayName: Dynamic Client Registration
    description: |-
      The Dynamic Client Registration API provides operations to register and manage client apps for use with the Okta OAuth 2.0 and OpenID Connect endpoints. This API largely follows the contract defined in [RFC7591: OAuth 2.0 Dynamic Client Registration Protocol](https://tools.ietf.org/html/rfc7591) and [OpenID Connect Dynamic Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html).

      > **Note:** Clients managed through this API are modeled as apps in Okta and appear in the apps section of the Admin Console. Changes made through the API appear in the Admin Console and vice versa. Tokens issued by these clients follow the rules for access tokens and ID tokens.
  - name: CustomAS
    x-displayName: Custom Authorization Servers
    description: |-
      Use a custom authorization server to create and apply authorization policies to secure your APIs. An access token that's minted by a custom authorization server is consumed by your APIs.

      > **Note:** Okta has two types of authorization servers: the org authorization server and the custom authorization server. To learn more about each type of authorization server and when to use them, see [Authorization servers](https://developer.okta.com/docs/concepts/auth-servers/).

      You can [create multiple custom authorization servers](https://developer.okta.com/docs/guides/customize-authz-server/main/#create-an-authorization-server) within a single Okta org that you can use to protect your own resource servers. Within each authorization server, define your own custom OAuth 2.0 scopes, claims, and access policies to support authorization for your APIs.
  - name: GlobalTokenRevocation
    x-displayName: Global Token Revocation
    description: |-
      The Global Token Revocation API provides a comprehensive solution for managing security across multiple apps and services. This API extends beyond the standard OAuth 2.0 token revocation, enabling the revocation of SSWS tokens and facilitating identity provider (IdP)-initiated sign-out processes.

      When you use the API, you revoke all tokens and sessions for a specified user by sending the `sub_id` in the request body. Use the `opaque` format for Okta user IDs.

      <x-lifecycle class="ea"></x-lifecycle>For users authenticated through a SAML or OIDC IdP, use the `iss_sub` format to identify the user by issuer (`iss`) and subject (`sub`). See [Manage Early Access and Beta features](https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata) to enable the feature: Third-Party IdP Global Token Revocation.
  - name: OrgAS
    x-displayName: Org Authorization Server
    description: |-
      Every Okta org comes with a built-in authorization server called the org authorization server. Use the org authorization server to perform SSO with Okta for your OpenID Connect apps or to get an access token for the Okta APIs. You can't customize this authorization server with regards to audience, claims, policies, or scopes. Additionally, the resulting access token's issuer is `https://{yourOktaDomain}`, which indicates that only Okta can consume or validate it. Your apps can't use or validate the access token.

      > **Note:** Okta has two types of authorization servers: the org authorization server and the custom authorization server. To learn more about each type of authorization server and when to use them, see [Authorization servers](https://developer.okta.com/docs/concepts/auth-servers/).
externalDocs:
  description: Find more info here
  url: https://developer.okta.com
paths:
  /.well-known/openid-configuration:
    get:
      summary: Retrieve the OpenID Connect metadata
      description: Returns OpenID Connect metadata for the Okta org authorization server. Clients use this information to programmatically configure their interactions with Okta.
      operationId: getWellKnownOpenIDConfiguration
      parameters:
        - $ref: '#/components/parameters/queryClientId'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OidcMetadata'
        '400':
          $ref: '#/components/responses/Error400InvalidClientId'
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/authorize:
    get:
      summary: /authorize
      description: |-
        This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This request authenticates the user and returns tokens along with an authorization grant to the client app as a part of the callback response.

        > **Note:** Requests to the `/authorize` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error.
      operationId: authorize
      parameters:
        - name: acr_values
          in: query
          description: |-
            You can include an optional parameter in the authentication request. This parameter increases the level of user assurance.

            > **Note:** You can also provide multiple space-delimited values. The authorization server chooses one and reflects the chosen value in any resulting tokens.
          schema:
            $ref: '#/components/schemas/AcrValue'
        - name: client_id
          in: query
          required: true
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](/openapi/okta-oauth/oauth/client). It identifies the client and must match the value preregistered in Okta.
          schema:
            type: string
        - name: code_challenge
          in: query
          description: A challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/). The challenge is verified in the access token request.
          schema:
            type: string
        - name: code_challenge_method
          in: query
          description: Method used to derive the code challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/)
          schema:
            $ref: '#/components/schemas/CodeChallengeMethod'
        - name: display
          in: query
          description: The `display` parameter to be passed to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/)
          schema:
            type: string
        - name: enroll_amr_values
          in: query
          description: |-
            A space-delimited list of values indicating which authenticators to enroll in.

            * If the `enroll_amr_values` parameter is specified, then the value for `prompt` must be `enroll_authenticator`.
            * The parameter value is space-delimited, for example, `pwd sms okta_verify` is a valid request parameter value. You are prompted in the order of the amr values provided.
          schema:
            $ref: '#/components/schemas/AmrValue'
        - name: idp_scope
          in: query
          description: An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/). These scopes are used in addition to the scopes already configured for the identity provider.
          schema:
            type: string
        - name: idp
          in: query
          description: An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.
          schema:
            type: string
        - name: interclient_token
          x-okta-lifecycle:
            lifecycle: LIMITED_GA
            isGenerallyAvailable: false
            SKUs:
              - Okta Identity Engine
          in: query
          description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>A token used to SSO into the client app
          schema:
            type: string
        - name: login_hint
          in: query
          description: A username to pre-populate if prompting for authentication
          schema:
            type: string
        - name: max_age
          in: query
          description: Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta
          schema:
            type: integer
        - name: nonce
          in: query
          description: A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See [OIDC Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
          schema:
            type: string
        - name: prompt
          in: query
          description: |-
            If you don't specify the `prompt` parameter, the standard behavior occurs:
            * If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, the user is prompted to authenticate.
            * If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent.
          schema:
            $ref: '#/components/schemas/Prompt'
        - name: redirect_uri
          in: query
          required: true
          description: Callback location where the authorization code or tokens should be sent. It must match the value preregistered in Okta during client registration.
          schema:
            type: string
        - name: response_type
          in: query
          required: true
          description: Any combination of `code`, `token`, and `id_token`. The combination determines the [flow](https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow).
          schema:
            $ref: '#/components/schemas/ResponseTypesSupported'
        - name: response_mode
          in: query
          description: |-
            How the authorization response should be returned. If `id_token` or `token` is specified in the `response_type`, then `query` isn't allowed as a response mode. Defaults to `fragment` in implicit and hybrid flows.

            The `Referrer-Policy` header is automatically included in the response when either the fragment or query parameter values are used. The header is set to `Referrer-Policy: no-referrer`.
          schema:
            $ref: '#/components/schemas/ResponseMode'
        - name: request_uri
          in: query
          description: Location where the authorization request payload data is referenced in an authorization request to the `/authorize` endpoint. This is returned from a Pushed Authorization Request at the `/par` endpoint.
          schema:
            type: string
        - name: request
          in: query
          description: |-
            A JWT created by the client that enables requests to be passed as a single, self-contained parameter.

            * You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet.
            * You can't encrypt the JWT.
            >  **Note:** See [Build a JWT for client authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/) for information on how to build a JWT.
            * Okta supports the [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2), [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature algorithms. HMAC signatures require that the client have a `token_endpoint_auth_method` that uses a `client_secret`. RSA and ECDSA signatures require that the client registers a public key.
            * Okta recommends that you don't duplicate any request parameters in the JWT and the query URI. However, you can do so with `state`, `nonce`, `code_challenge`, and `code_challenge_method`. In those cases, the values in the JWT overrides the query URI values.
            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it has already been processed.
          schema:
            type: string
        - name: scope
          in: query
          required: true
          description: A space-delimited string of scopes requested
          schema:
            type: string
        - name: sessionToken
          in: query
          description: Okta one-time session token. This is an Okta extension to the OpenID specification. The `sessionToken` allows an API-based user sign-in flow.
          schema:
            type: string
        - name: state
          in: query
          required: true
          description: |-
            A value that is returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters.

            Okta requires the OAuth 2.0 `state` parameter on all requests to the `/authorize` endpoint to prevent cross-site request forgery (CSRF).
            The OAuth 2.0 specification [requires](https://tools.ietf.org/html/rfc6749#section-10.12) that clients protect their redirect URIs against CSRF by sending a value in the authorize request that binds the request to the user-agent's authenticated state.
            Using the `state` parameter is also a countermeasure to several other known attacks as outlined in [OAuth 2.0 Threat Model and Security Considerations](https://tools.ietf.org/html/rfc6819).
          schema:
            type: string
      responses:
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      summary: /authorize
      description: |-
        This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This endpoint method behaves the same as [`GET /oauth2/v1/authorize`](/openapi/okta-oauth/oauth/orgas/authorize), except that all parameters are specified in the request body and submitted through the form post. No query parameters are allowed.
        > **Note:** Requests to the `/authorize` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error.
      operationId: authorizeWithPost
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthorizeWithPost'
      responses:
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - OrgAS
  /oauth2/v1/bc/authorize:
    post:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      summary: /bc/authorize
      description: |-
        This endpoint returns a unique identifier (`auth_req_id`) that identifies the authentication flow while it tries to authenticate the user in the background. This `auth_req_id` value is used in subsequent token requests to the `/token` endpoint.

        > **Note:** The `/bc/authorize` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: bcAuthorize
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/BackchannelAuthorizeRequest'
            examples:
              Request with `login_hint`:
                $ref: '#/components/examples/BCAuthorizeRequestLoginHintExample'
              Request with `id_token_hint`:
                $ref: '#/components/examples/BCAuthorizeRequestIdTokenHintExample'
              Request with signed `request`:
                $ref: '#/components/examples/BCAuthorizeSignedRequestExample'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BackchannelAuthorizeResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
  /oauth2/v1/challenge:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    post:
      summary: /challenge
      description: |-
        Initiates the challenge of subsequent factor(s) in a direct authentication flow after the token endpoint has responded with `mfa_required`. This endpoint is optional if the client is able to proceed without it, for example, when the client knows it needs to follow up with an OTP and can prompt the end user for one.

        > **Note:** The `/challenge` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: challenge
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/ChallengeRequest'
            examples:
              challengeRequestOob:
                $ref: '#/components/examples/ChallengeRequestOobExample'
              challengeRequestSms:
                $ref: '#/components/examples/ChallengeRequestOobSmsExample'
              challengeRequestVoice:
                $ref: '#/components/examples/ChallengeRequestOobVoiceExample'
              challengeRequestOtp:
                $ref: '#/components/examples/ChallengeRequestOtpExample'
      responses:
        '200':
          description: The next factor type to challenge is returned and in the case of out-of-band factors, any information needed for the out-of-band transaction.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
  /oauth2/v1/clients:
    get:
      summary: List all client applications
      description: Lists all the client apps with pagination
      operationId: listClients
      parameters:
        - $ref: '#/components/parameters/queryAfter'
        - $ref: '#/components/parameters/queryLimit'
        - name: q
          in: query
          schema:
            type: string
          description: |-
            Searches the `client_name` property of clients for a matching value.

            > **Note:** Search currently performs a `startsWith` match, but this is an implementation detail and may change without notice.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Client'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.read
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: Register a client app
      description: |-
        Registers a new client app

        > **Note:** You can create apps on the Apps endpoint (`/api/v1/apps`) and default to `consent_method=TRUSTED`, while those created with Dynamic Client Registration (`/oauth2/v1/clients`) default to `consent_method=REQUIRED`.

        > **Note:** If you want to specify the `client_id` or `client_secret`, you can use the Applications API to create or update a client app.

        Different app types have different valid values for the corresponding grant type:

        | App Type  | Valid Grant Type                                                           | Requirements                                   |
        | :---------------- | :------------------------------------------------------------------------- | :--------------------------------------------- |
        | `browser`         | `authorization_code`, `implicit`, `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are <x-lifecycle class="oie"></x-lifecycle>only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`                                           |                                                |
        | `native`          | `authorization_code`, `implicit`, `password`, `refresh_token`, `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are <x-lifecycle class="oie"></x-lifecycle>only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`              | Must have at least `authorization_code`        |
        | `service`         | `client_credentials`, `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are <x-lifecycle class="oie"></x-lifecycle>only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`                                                       | Works with the OAuth 2.0 flow (not OpenID Connect) |
        | `web`             | `authorization_code`, `implicit`, `refresh_token`, `client_credentials`(*), `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are <x-lifecycle class="oie"></x-lifecycle>only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob` | Must have at least `authorization_code`        |

        > **Note:** The `client_credentials` grant with a web app type allows you to use one `client_id` for an app that needs to make user-specific calls and back-end calls for data.

        > **Note:** The `grant_types` and `response_types` values described above are partially orthogonal, as they refer to arguments passed to different endpoints in the [OAuth 2.0 protocol](https://tools.ietf.org/html/rfc6749). However, they are related in that the `grant_types` available to a client influence the `response_types` that the client is allowed to use and vice versa. For instance, a `grant_types` value that includes `authorization_code` implies a `response_types` value that includes `code`, as both values are defined as part of the OAuth 2.0 authorization code grant.
      operationId: createClient
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Client'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Client'
        '400':
          $ref: '#/components/responses/ErrorInvalidClientMetadata400'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.register
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/clients/{clientId}:
    parameters:
      - $ref: '#/components/parameters/OAuthPathClientId'
    get:
      summary: Retrieve a client app
      description: Retrieves a client app by `clientId`
      operationId: getClient
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Client'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound404'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.read
      tags:
        - Client
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace a client app
      description: |-
        Replaces the settings for a client app.

        > **Note:** You must specify all settings when you update a client app. Partial updates aren't supported. If any settings are missing when you update a client app, the update fails. The exceptions are that you can't include `client_secret_expires_at` or `client_id_issued_at` in the request, and you can omit the `client_secret`.
      operationId: replaceClient
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Client'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Client'
        '400':
          $ref: '#/components/responses/ErrorInvalidClientMetadata400'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound404'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.manage
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    delete:
      summary: Delete a client app
      description: Deletes a client app
      operationId: deleteClient
      responses:
        '204':
          description: No Content
          content: {}
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound404'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.manage
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/clients/{clientId}/lifecycle/newSecret:
    parameters:
      - $ref: '#/components/parameters/OAuthPathClientId'
    post:
      summary: Generate a new client secret
      description: |-
        Generates a new client secret for the specified client app.

        > **Note:** This operation only applies to client apps that use the `client_secret_post` or `client_secret_basic` method for token endpoint authorization.
      operationId: generateNewClientSecret
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Client'
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound404'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.clients.manage
      tags:
        - Client
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/device/authorize:
    post:
      summary: /device/authorize
      description: Returns a user code, device code, activation link, and QR code activation link
      operationId: deviceAuthorize
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/DeviceAuthorizeRequest'
      responses:
        '200':
          description: Based on the type of token and whether it's active, the returned JSON contains a different set of information.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceAuthorizeResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/global-token-revocation:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    post:
      summary: Initiate the global revocation of all tokens and sessions
      description: Initiates the global revocation of all tokens and sessions for a specified user enabling external identity providers to trigger a comprehensive sign-out process. This includes executing IdP-initiated sign-out flows across all apps that are using global token revocation and requiring users to re-authenticate to access protected resources.
      operationId: globalTokenRevocation
      x-codegen-request-body-name: body
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GlobalTokenRevocationRequest'
        required: true
      responses:
        '204':
          description: No Content
          content: {}
        '400':
          description: Bad Request
          content: {}
        '403':
          $ref: '#/components/responses/ErrorAccessDenied403'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - apiToken: []
        - oauth2:
            - okta.universalLogout.manage
      tags:
        - GlobalTokenRevocation
  /oauth2/v1/introspect:
    post:
      summary: /introspect
      description: |-
        This endpoint takes an access token, ID token, refresh token, or device secret and returns a boolean that indicates whether it's active. If the token is active, additional data about the token is also returned. If the token is invalid, expired, or revoked, it's considered inactive.

        Be sure that you are using the `/introspect` endpoint of the same authorization server that you used to create the token.

        > **Note:** The `/introspect` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/). For public clients (such as single-page and mobile apps) that don't have a `client_secret`, include the `client_id` as a query parameter when calling the `/introspect` endpoint. Make sure that you aren't passing the Authorization header in the request.
      operationId: introspect
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/IntrospectionRequest'
      responses:
        '200':
          description: Based on the type of token and whether it's active, the returned JSON contains a different set of information.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntrospectionResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/keys:
    get:
      summary: /keys
      description: |-
        Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server.

        > **Note:** Looking for how to obtain the `jwks_uri` for your org authorization server? See the [well-known OpenID Connect metadata endpoint](/openapi/okta-oauth/oauth/customas/getwellknownopenidconfigurationcustomas).

        Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used.

        You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform [JWS](https://datatracker.ietf.org/doc/html/rfc7515) signature validation.

        > **Note:** The information returned from this endpoint could lag slightly, but eventually updates.

        > **Note:** Okta returns [standard HTTP Cache-Control headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control) for applicable JWKS endpoints. Ensure that you respect the cache header directives, as they are updated based on the time of the request.

        For more information on key rotation and best practices, see [JSON Web Key Set](/openapi/okta-oauth/guides/overview/#json-web-key-set).
      operationId: oauthKeys
      parameters:
        - name: client_id
          in: query
          description: The `client_id` of a client app. Providing this optional parameter includes any public keys associated with the signing keys of the app.
          schema:
            type: string
      responses:
        '200':
          description: Success
          headers:
            Cache-Control:
              schema:
                type: string
              example: max-age=3832304, must-revalidate
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthKeys'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/logout:
    get:
      summary: /logout
      description: |-
        Use this operation to sign a user out by removing their Okta browser session.

        This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a `post_logout_redirect_uri` to redirect the browser after the sign-out action is performed. Otherwise, the browser is redirected to the Okta sign-in page. See [Sign users out](https://developer.okta.com/docs/guides/sign-users-out/).

        If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the `post_logout_redirect_uri` (if specified).

        If the ID token passed with the `id_token_hint` parameter is invalid, the browser is redirected to an error page.

        If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the `post_logout_redirect_uri`.

        > **Note:** When making requests to the `/logout` endpoint, the browser (user agent) should be redirected to the endpoint. You can't use AJAX with this endpoint. Okta may load an interstitial to do client-side logic before redirecting to the `post_logout_redirect_uri` or sign-in page if no redirect is provided.
      operationId: logout
      parameters:
        - name: id_token_hint
          in: query
          description: A valid ID token with a subject that matches the current session
          schema:
            type: string
          required: true
        - name: post_logout_redirect_uri
          in: query
          description: Location to redirect to after the logout is performed. It must match the value preregistered in Okta during client registration.
          schema:
            type: string
        - $ref: '#/components/parameters/queryState'
      responses:
        '200':
          description: Successful Logout
          content: {}
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: /logout
      description: |-
        Use this operation to sign a user out by removing their Okta browser session. This is the recommended method over GET as you can wrap the parameters in the request body.

        This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a `post_logout_redirect_uri` to redirect the browser after the user signs out. Otherwise, the browser is redirected to the Okta sign-in page. See [Sign users out](https://developer.okta.com/docs/guides/sign-users-out/).

        If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the `post_logout_redirect_uri` (if specified).

        If the ID token passed with the `id_token_hint` parameter is invalid, the browser is redirected to an error page.

        If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the `post_logout_redirect_uri`.

        > **Note:** When making requests to the `/logout` endpoint, the browser (user agent) should be redirected to the endpoint. You need to make a POST request from a form. A POST request to this endpoint from the backend doesn't completely terminate the session.
      operationId: logoutWithPost
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/LogoutWithPost'
            examples:
              LogoutRequest:
                $ref: '#/components/examples/LogoutRequestExample'
      responses:
        '200':
          description: Successful Logout
          content: {}
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/oob-authenticate:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    post:
      deprecated: true
      summary: /oob-authenticate
      description: |-
        Initiates direct authentication with an out-of-band authenticator

        > **Note:** The `/oob-authenticate` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).

        > **Note:** This endpoint is deprecated. Use [/primary-authenticate](//openapi/okta-oauth/oauth/customas/primary-authenticate-custom-as) instead.
      operationId: oob-authenticate
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OobAuthenticateRequest'
            examples:
              oobRequest:
                $ref: '#/components/examples/OobAuthenticateRequestExample'
              oobSmsRequest:
                $ref: '#/components/examples/OobAuthenticateSmsRequestExample'
              oobVoiceRequest:
                $ref: '#/components/examples/OobAuthenticateVoiceRequestExample'
      responses:
        '200':
          description: Out-of-band authentication has successfully been initiated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OobAuthenticateResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
  /oauth2/v1/par:
    options:
      summary: /par
      description: |-
        Use this operation to request the permitted communication options for the `/par` operation.

        > **Note:** CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin.
      operationId: parOptions
      parameters:
        - in: header
          name: Origin
          description: Indicates the origin of the client that's initiating the request
          schema:
            type: string
          example: example.okta.com
      responses:
        '204':
          description: Success
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
              example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
              example: POST
            Access-Control-Max-Age:
              schema:
                type: string
              example: 3600
            Vary:
              schema:
                type: string
              example: Origin
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    post:
      summary: /par
      description: |-
        The pushed authorization request endpoint (`/par`) promotes OAuth security by allowing the authorization server to authenticate the client before any user interaction happens. The increased confidence in the client's identity during the authorization process means the authorization server can refuse illegitimate requests much earlier in the process. This process prevents attempts to spoof clients or otherwise tamper with or misuse an authorization request and provides a simple way to make a confidential and integrity-protected request.

        The `/par` endpoint allows an OAuth 2.0 client to push the payload of an authorization request directly to the authorization server. The authorization server provides a request URI value in the response. The request URI is a reference to the authorization request payload data in a subsequent call to the `/authorize` endpoint through a user agent.
      operationId: par
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ParRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ParResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
  /oauth2/v1/primary-authenticate:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    post:
      summary: /primary-authenticate
      description: |-
        Initiates direct authentication with an out-of-band authenticator

        > **Note:** The `/primary-authenticate` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: primary-authenticate
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OobAuthenticateRequest'
            examples:
              oobRequest:
                $ref: '#/components/examples/OobAuthenticateRequestExample'
              oobSmsRequest:
                $ref: '#/components/examples/OobAuthenticateSmsRequestExample'
              oobVoiceRequest:
                $ref: '#/components/examples/OobAuthenticateVoiceRequestExample'
      responses:
        '200':
          description: Out-of-band authentication has successfully been initiated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OobAuthenticateResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
  /oauth2/v1/revoke:
    post:
      summary: /revoke
      description: |-
        The API takes an access or refresh token and revokes it. Revoked tokens are considered inactive at the introspection endpoint. A client may only revoke its own tokens. See [Revoke tokens](https://developer.okta.com/docs/guides/revoke-tokens/).

        > **Note:** The `/revoke` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: revoke
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/RevokeRequestOrgAs'
      responses:
        '200':
          description: Successful Revocation. Note that revoking an invalid, expired, or revoked token is still considered a success so information isn't leaked.
          content: {}
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/token:
    options:
      summary: /token
      description: |-
        Use this operation to request the permitted communication options for the `/token` operation.

        > **Note:** CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin.
      operationId: tokenOptions
      parameters:
        - in: header
          name: Origin
          description: Indicates the origin of the client that's initiating the request
          schema:
            type: string
          example: example.okta.com
      responses:
        '204':
          description: Success
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
              example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
              example: POST
            Access-Control-Max-Age:
              schema:
                type: string
              example: 3600
            Vary:
              schema:
                type: string
              example: Origin
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: /token
      description: |-
        This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For [password](https://developer.okta.com/docs/guides/implement-grant-type/ropassword/main/), [client credentials](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/), [SAML 2.0 assertion](https://developer.okta.com/docs/guides/implement-grant-type/saml2assert/main/), and [refresh token](https://developer.okta.com/docs/guides/refresh-tokens/main/) flows, calling `/token` is the only step of the flow. For the [authorization code](https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/) flow, calling `/token` is the second step of the flow.

        > **Note:** The `/token` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: token
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/TokenRequestOrgAs'
            examples:
              Authorization Code Flow w/ Client Credentials:
                $ref: '#/components/examples/TokenRequestAuthorizationCodeWithCredsExample'
              SAML Bearer:
                $ref: '#/components/examples/TokenRequestSamlBearerExample'
              Resource Owner Password Flow:
                $ref: '#/components/examples/TokenRequestPassword'
              Direct authentication with OTP (primary factor):
                $ref: '#/components/examples/TokenRequestDirectAuthOtpExample'
              Direct authentication with OTP (MFA):
                $ref: '#/components/examples/TokenRequestDirectAuthMfaOtpExample'
              Direct authentication with OOB (primary factor):
                $ref: '#/components/examples/TokenRequestDirectAuthOobExample'
              Direct authentication with OOB (MFA):
                $ref: '#/components/examples/TokenRequestDirectAuthMfaOobExample'
              TokenRequestAiAgentIdJagExample:
                $ref: '#/components/examples/TokenRequestAiAgentIdJagExample'
              TokenRequestAiAgentVaultedSecretExample:
                $ref: '#/components/examples/TokenRequestAiAgentVaultedSecretExample'
              TokenRequestAiAgentServiceAccountExample:
                $ref: '#/components/examples/TokenRequestAiAgentServiceAccountExample'
              TokenRequestAiAgentOAuthStsExample:
                $ref: '#/components/examples/TokenRequestAiAgentOAuthStsExample'
      responses:
        '200':
          description: Based on the scopes requested. The scopes specified in a request are included in the access token in the response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponseOrgAs'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: true
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - OrgAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/v1/userinfo:
    get:
      summary: /userinfo
      description: Returns information about the user that's the subject of the access token. Many of these claims are also included in the [ID token](https://developer.okta.com/docs/reference/api/oidc/#id-token), but calling this endpoint always returns all of the user's claims. You can configure the ID token to include a subset of the user's claims. See [Scope-dependent claims](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned).
      operationId: userinfo
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfo'
        '401':
          description: Unauthorized
          headers:
            WWW-Authenticate:
              schema:
                type: string
              example: Bearer error="invalid_token", error_description="The access token is invalid"
        '403':
          description: Forbidden
          headers:
            WWW-Authenticate:
              schema:
                type: string
              example: Bearer error="insufficient_scope", error_description="The access token must provide access to at least one of these scopes - profile, email, address or phone"
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - oauth2:
            - openid
      tags:
        - OrgAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/.well-known/oauth-authorization-server:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: Retrieve the OAuth 2.0 metadata
      description: Returns OAuth 2.0 metadata for the specified custom authorization server. Clients can use this information to programmatically configure their interactions with Okta. Custom scopes are returned only when they are configured to be publicly discoverable. Custom claims are never returned.
      operationId: getWellKnownOAuthConfigurationCustomAS
      parameters:
        - $ref: '#/components/parameters/queryClientId'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthMetadata'
        '400':
          $ref: '#/components/responses/Error400InvalidClientId'
        '404':
          $ref: '#/components/responses/Error404AuthorizationServerNotFound'
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
  /oauth2/{authorizationServerId}/.well-known/openid-configuration:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: Retrieve the OpenID Connect metadata
      description: Returns OpenID Connect metadata for the specified custom authorization server. Clients can use this information to programmatically configure their interactions with Okta. Custom scopes are returned only when they are configured to be publicly discoverable. Custom claims are never returned.
      operationId: getWellKnownOpenIDConfigurationCustomAS
      parameters:
        - $ref: '#/components/parameters/queryClientId'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OidcMetadata'
        '400':
          $ref: '#/components/responses/Error400InvalidClientId'
        '404':
          $ref: '#/components/responses/Error404AuthorizationServerNotFound'
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
  /oauth2/{authorizationServerId}/v1/authorize:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: /authorize
      description: |-
        This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This request authenticates the user and returns tokens along with an authorization grant to the client app as a part of the callback response.

        > **Note:** Requests to the `/authorize` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error.
      operationId: authorizeCustomAS
      parameters:
        - name: acr_values
          in: query
          description: |-
            You can include an optional parameter in the authentication request. This parameter increases the level of user assurance.

            > **Note:** You can also provide multiple space-delimited values. The authorization server chooses one and reflects the chosen value in any resulting tokens.
          schema:
            $ref: '#/components/schemas/AcrValue'
        - name: client_id
          in: query
          required: true
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](/openapi/okta-oauth/oauth/client). It identifies the client and must match the value preregistered in Okta.
          schema:
            type: string
        - name: code_challenge
          in: query
          description: A challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/). The challenge is verified in the access token request.
          schema:
            type: string
        - name: code_challenge_method
          in: query
          description: Method used to derive the code challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/)
          schema:
            $ref: '#/components/schemas/CodeChallengeMethod'
        - name: display
          in: query
          description: The `display` parameter to be passed to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/)
          schema:
            type: string
        - name: enroll_amr_values
          in: query
          description: |-
            A space-delimited list of values indicating which authenticators to enroll in.

            * If the `enroll_amr_values` parameter is specified, then the value for `prompt` must be `enroll_authenticator`.
            * The parameter value is space-delimited, for example, `pwd sms okta_verify` is a valid request parameter value. You are prompted in the order of the amr values provided.
          schema:
            $ref: '#/components/schemas/AmrValue'
        - name: idp_scope
          in: query
          description: An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/). These scopes are used in addition to the scopes already configured for the identity provider.
          schema:
            type: string
        - name: idp
          in: query
          description: An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.
          schema:
            type: string
        - name: interclient_token
          x-okta-lifecycle:
            lifecycle: LIMITED_GA
            isGenerallyAvailable: false
            SKUs:
              - Okta Identity Engine
          in: query
          description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>A token used to SSO into the client app
          schema:
            type: string
        - name: login_hint
          in: query
          description: A username to pre-populate if prompting for authentication
          schema:
            type: string
        - name: max_age
          in: query
          description: Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta
          schema:
            type: integer
        - name: nonce
          in: query
          description: A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See [OIDC Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
          schema:
            type: string
        - name: prompt
          in: query
          description: |-
            If you don't specify the `prompt` parameter, the standard behavior occurs:
            * If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, the user is prompted to authenticate.
            * If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent.
          schema:
            $ref: '#/components/schemas/Prompt'
        - name: redirect_uri
          in: query
          required: true
          description: Callback location where the authorization code or tokens should be sent. It must match the value preregistered in Okta during client registration.
          schema:
            type: string
        - name: response_type
          in: query
          required: true
          description: Any combination of `code`, `token`, and `id_token`. The combination determines the [flow](https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow).
          schema:
            $ref: '#/components/schemas/ResponseTypesSupported'
        - name: response_mode
          in: query
          description: |-
            How the authorization response should be returned. If `id_token` or `token` is specified in the `response_type`, then `query` isn't allowed as a response mode. Defaults to `fragment` in implicit and hybrid flows.

            The `Referrer-Policy` header is automatically included in the response when either the fragment or query parameter values are used. The header is set to `Referrer-Policy: no-referrer`.
          schema:
            $ref: '#/components/schemas/ResponseMode'
        - name: request_uri
          in: query
          description: Location where the authorization request payload data is referenced in an authorization request to the `/authorize` endpoint. This is returned from a Pushed Authorization Request at the `/par` endpoint.
          schema:
            type: string
        - name: request
          in: query
          description: |-
            A JWT created by the client that enables requests to be passed as a single, self-contained parameter.

            * You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet.
            * You can't encrypt the JWT.
            >  **Note:** See [Build a JWT for client authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/) for information on how to build a JWT.
            * Okta supports the [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2), [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature algorithms. HMAC signatures require that the client have a `token_endpoint_auth_method` that uses a `client_secret`. RSA and ECDSA signatures require that the client registers a public key.
            * Okta recommends that you don't duplicate any request parameters in the JWT and the query URI. However, you can do so with `state`, `nonce`, `code_challenge`, and `code_challenge_method`. In those cases, the values in the JWT overrides the query URI values.
            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it has already been processed.
          schema:
            type: string
        - name: scope
          in: query
          required: true
          description: A space-delimited string of scopes requested
          schema:
            type: string
        - name: sessionToken
          in: query
          description: Okta one-time session token. This is an Okta extension to the OpenID specification. The `sessionToken` allows an API-based user sign-in flow.
          schema:
            type: string
        - name: state
          in: query
          required: true
          description: |-
            A value that is returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters.

            Okta requires the OAuth 2.0 `state` parameter on all requests to the `/authorize` endpoint to prevent cross-site request forgery (CSRF).
            The OAuth 2.0 specification [requires](https://tools.ietf.org/html/rfc6749#section-10.12) that clients protect their redirect URIs against CSRF by sending a value in the authorize request that binds the request to the user-agent's authenticated state.
            Using the `state` parameter is also a countermeasure to several other known attacks as outlined in [OAuth 2.0 Threat Model and Security Considerations](https://tools.ietf.org/html/rfc6819).
          schema:
            type: string
      responses:
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      summary: /authorize
      description: |-
        This is a starting point for browser-based OpenID Connect flows such as the implicit and authorization code flows. This endpoint method behaves the same as [`GET /oauth2/{authorizationServerId}/v1/authorize`](/openapi/okta-oauth/oauth/customas/authorizecustomas), except that all parameters are specified in the request body and submitted through the form post. No query parameters are allowed.
        > **Note:** Requests to the `/authorize` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. Example responses are intentionally omitted, but include displaying a sign-in prompt, redirecting to the client app, or displaying an error.
      operationId: authorizeCustomASWithPost
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthorizeWithPost'
      responses:
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/bc/authorize:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      summary: /bc/authorize
      description: |-
        This endpoint returns a unique identifier (`auth_req_id`) that identifies the authentication flow while it tries to authenticate the user in the background. This `auth_req_id` value is used in subsequent token requests to the `/token` endpoint.

        > **Note:** The `/bc/authorize` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: bcAuthorizeCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/BackchannelAuthorizeRequest'
            examples:
              Request with `login_hint`:
                $ref: '#/components/examples/BCAuthorizeRequestLoginHintExample'
              Request with `id_token_hint`:
                $ref: '#/components/examples/BCAuthorizeRequestIdTokenHintExample'
              Request with signed `request`:
                $ref: '#/components/examples/BCAuthorizeSignedRequestExample'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BackchannelAuthorizeResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/challenge:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /challenge
      description: |-
        Initiates the challenge of subsequent factor(s) in a direct authentication flow after the token endpoint has responded with `mfa_required`. This endpoint is optional if the client is able to proceed without it, for example, the client knows it needs to follow up with an OTP and can prompt the end user for one.

        > **Note:** The `/challenge` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: challenge-custom-as
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/ChallengeRequest'
            examples:
              challengeRequestOob:
                $ref: '#/components/examples/ChallengeRequestOobExample'
              challengeRequestSms:
                $ref: '#/components/examples/ChallengeRequestOobSmsExample'
              challengeRequestVoice:
                $ref: '#/components/examples/ChallengeRequestOobVoiceExample'
              challengeRequestOtp:
                $ref: '#/components/examples/ChallengeRequestOtpExample'
      responses:
        '200':
          description: The next factor type to challenge is returned and in the case of out-of-band factors, any information needed for the out-of-band transaction.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/device/authorize:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /device/authorize
      description: Returns a user code, device code, activation link, and QR code activation link
      operationId: deviceAuthorizeCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/DeviceAuthorizeRequest'
      responses:
        '200':
          description: Based on the type of token and whether it's active, the returned JSON contains a different set of information.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceAuthorizeResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/introspect:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /introspect
      description: |-
        This endpoint takes an access token, ID token, refresh token, or device secret and returns a boolean that indicates whether it's active. If the token is active, additional data about the token is also returned. If the token is invalid, expired, or revoked, it's considered inactive.

        Ensure that you are using the `/introspect` endpoint of the same authorization server that you used to create the token.

        > **Note:** The `/introspect` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/). For public clients (such as single-page and mobile apps) that don't have a `client_secret`, you must include the `client_id` as a query parameter when calling the `/introspect` endpoint. Make sure that you aren't passing the Authorization header in the request.
      operationId: introspectCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/IntrospectionRequest'
      responses:
        '200':
          description: Based on the type of token and whether it's active, the returned JSON contains a different set of information.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntrospectionResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/keys:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: /keys
      description: |-
        Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server.

        > **Note:** Looking for how to obtain the `jwks_uri` for your custom authorization server? See the [well-known OpenID Connect metadata endpoint](/openapi/okta-oauth/oauth/customas/getwellknownopenidconfigurationcustomas) and the [well-known OAuth 2.0 metadata endpoint](/openapi/okta-oauth/oauth/customas/getwellknownoauthconfigurationcustomas).

        Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used.

        You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform [JWS](https://datatracker.ietf.org/doc/html/rfc7515) signature validation.

        > **Note:** The information returned from this endpoint could lag slightly, but eventually updates.
      operationId: oauthKeysCustomAS
      responses:
        '200':
          description: Success
          headers:
            Cache-Control:
              schema:
                type: string
              example: max-age=3832304, must-revalidate
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthKeys'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/logout:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: /logout
      description: |-
        Use this operation to sign a user out by removing their Okta browser session.

        This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a `post_logout_redirect_uri` to redirect the browser after the sign-out action is performed. Otherwise, the browser is redirected to the Okta sign-in page. See [Sign users out](https://developer.okta.com/docs/guides/sign-users-out/).

        If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the `post_logout_redirect_uri` (if specified).

        If the ID token passed with the `id_token_hint` parameter is invalid, the browser is redirected to an error page.

        If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the `post_logout_redirect_uri`.

        > **Note:** Requests to the `/logout` endpoint should redirect the browser (user agent) to the endpoint. You can't use AJAX with this endpoint. We may load an interstitial to do client-side logic before finally redirecting to the `post_logout_redirect_uri` or sign-in page if no redirect is provided.
      operationId: logoutCustomAS
      parameters:
        - name: id_token_hint
          in: query
          description: A valid ID token with a subject that matches the current session
          schema:
            type: string
          required: true
        - name: post_logout_redirect_uri
          in: query
          description: Location to redirect to after the logout is performed. It must match the value preregistered in Okta during client registration.
          schema:
            type: string
        - $ref: '#/components/parameters/queryState'
      responses:
        '200':
          description: Successful Logout
          content: {}
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: /logout
      description: |-
        Use this operation to sign a user out by removing their Okta browser session. This is the recommended method over GET as you can wrap the parameters in the request body.

        This endpoint takes an ID token and signs the user out of Okta if the subject matches the current Okta session. Specify a `post_logout_redirect_uri` to redirect the browser after the user is signs out. Otherwise, the browser is redirected to the Okta sign-in page. See [Sign users out](https://developer.okta.com/docs/guides/sign-users-out/).

        If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the Okta sign-in page or the `post_logout_redirect_uri` (if specified).

        If the ID token passed with the `id_token_hint` parameter is invalid, the browser is redirected to an error page.

        If the ID token is valid, but expired, and the subject matches the current Okta session, a logout request signs the user out and redirects the browser to the `post_logout_redirect_uri`.

        > **Note:** When making requests to the `/logout` endpoint, the browser (user agent) should be redirected to the endpoint. You need to make a POST request from a form. A POST request to this endpoint from the backend doesn't completely terminate the session.
      operationId: logoutCustomASWithPost
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/LogoutWithPost'
            examples:
              LogoutRequestCustom:
                $ref: '#/components/examples/LogoutRequestCustomExample'
      responses:
        '200':
          description: Successful Logout
          content: {}
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/oob-authenticate:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      deprecated: true
      summary: /oob-authenticate
      description: |-
        Initiates direct authentication with an out-of-band authenticator

        > **Note:** The `/oob-authenticate` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).

        > **Note:** This endpoint is deprecated. Use [/primary-authenticate](/openapi/okta-oauth/oauth/orgas/primary-authenticate) instead.
      operationId: oob-authenticate-custom-as
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OobAuthenticateRequest'
            examples:
              oobRequest:
                $ref: '#/components/examples/OobAuthenticateRequestExample'
              oobSmsRequest:
                $ref: '#/components/examples/OobAuthenticateSmsRequestExample'
              oobVoiceRequest:
                $ref: '#/components/examples/OobAuthenticateVoiceRequestExample'
      responses:
        '200':
          description: Out-of-band authentication has successfully been initiated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OobAuthenticateResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/par:
    options:
      summary: /par
      description: |-
        Use this operation to request the permitted communication options for the `/par` operation.

        > **Note:** CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin.
      operationId: parOptionsCustomAS
      parameters:
        - in: header
          name: Origin
          description: Indicates the origin of the client that's initiating the request
          schema:
            type: string
          example: example.okta.com
      responses:
        '204':
          description: Success
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
              example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
              example: POST
            Access-Control-Max-Age:
              schema:
                type: string
              example: 3600
            Vary:
              schema:
                type: string
              example: Origin
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /par
      description: |-
        The pushed authorization request endpoint (`/par`) promotes OAuth security by allowing the authorization server to authenticate the client before any user interaction happens. The increased confidence in the client's identity during the authorization process means the authorization server can refuse illegitimate requests much earlier in the process. This process prevents attempts to spoof clients or otherwise tamper with or misuse an authorization request and provides a simple way to make a confidential and integrity-protected request.

        The `/par` endpoint allows an OAuth 2.0 client to push the payload of an authorization request directly to the authorization server. The authorization server provides a `request_uri` value in the response that you can use as a reference to the authorization request payload data in a subsequent call to the `/authorize` endpoint through a user agent.
      operationId: parCustomAS
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ParRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ParResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
  /oauth2/{authorizationServerId}/v1/primary-authenticate:
    x-okta-lifecycle:
      lifecycle: LIMITED_GA
      isGenerallyAvailable: false
      SKUs:
        - Okta Identity Engine
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /primary-authenticate
      description: |-
        Initiates direct authentication with an out-of-band authenticator

        > **Note:** The `/primary-authenticate` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: primary-authenticate-custom-as
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OobAuthenticateRequest'
            examples:
              oobRequest:
                $ref: '#/components/examples/OobAuthenticateRequestExample'
              oobSmsRequest:
                $ref: '#/components/examples/OobAuthenticateSmsRequestExample'
              oobVoiceRequest:
                $ref: '#/components/examples/OobAuthenticateVoiceRequestExample'
      responses:
        '200':
          description: Out-of-band authentication has successfully been initiated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OobAuthenticateResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
  /oauth2/{authorizationServerId}/v1/revoke:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /revoke
      description: |-
        The API takes an access or refresh token and revokes it. Revoked tokens are considered inactive at the introspection endpoint. A client may only revoke its own tokens. See [Revoke tokens](https://developer.okta.com/docs/guides/revoke-tokens/).

        > **Note:** The `/revoke` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: revokeCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/RevokeRequestCustomAs'
      responses:
        '200':
          description: Successful Revocation. Note that revoking an invalid, expired, or revoked token is still considered a success so information isn't leaked.
          content: {}
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/token:
    options:
      summary: /token
      description: |-
        Use this operation to request the permitted communication options for the `/token` endpoint.

        > **Note:** CORS is enforced on a per-client basis. This endpoint always returns CORS headers with the current origin.
      operationId: tokenOptionsCustomAS
      parameters:
        - in: header
          name: Origin
          description: Indicates the origin of the client that's initiating the request
          schema:
            type: string
          example: example.okta.com
      responses:
        '204':
          description: Success
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
              example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
              example: POST
            Access-Control-Max-Age:
              schema:
                type: string
              example: 3600
            Vary:
              schema:
                type: string
              example: Origin
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    post:
      summary: /token
      description: |-
        This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For [password](https://developer.okta.com/docs/guides/implement-grant-type/ropassword/main/), [client credentials](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/), [SAML 2.0 assertion](https://developer.okta.com/docs/guides/implement-grant-type/saml2assert/main/), and [refresh token](https://developer.okta.com/docs/guides/refresh-tokens/main/) flows, calling `/token` is the only step of the flow. For the [authorization code](https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/) flow, calling `/token` is the second step of the flow.

        > **Note:** The `/token` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
      operationId: tokenCustomAS
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/TokenRequestCustomAs'
            examples:
              Authorization Code Flow w/ Client Credentials:
                $ref: '#/components/examples/TokenRequestAuthorizationCodeWithCredsExample'
              SAML Bearer:
                $ref: '#/components/examples/TokenRequestSamlBearerExample'
              JWT Bearer:
                $ref: '#/components/examples/TokenRequestJwtBearerExample'
              Resource Owner Password Flow:
                $ref: '#/components/examples/TokenRequestPassword'
              Direct authentication with OTP (primary factor):
                $ref: '#/components/examples/TokenRequestDirectAuthOtpExample'
              Direct authentication with OTP (MFA):
                $ref: '#/components/examples/TokenRequestDirectAuthMfaOtpExample'
              Direct authentication with OOB (primary factor):
                $ref: '#/components/examples/TokenRequestDirectAuthOobExample'
              Direct authentication with OOB (MFA):
                $ref: '#/components/examples/TokenRequestDirectAuthMfaOobExample'
      responses:
        '200':
          description: Based on the scopes requested. The scopes specified in a request are included in the access token in the response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponseCustomAs'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '403':
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: true
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - Client authentication `client_secret_basic`: []
        - Client authentication `client_secret_post`: []
        - Client authentication `client_secret_jwt`: []
        - Client authentication `private_key_jwt`: []
      tags:
        - CustomAS
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /oauth2/{authorizationServerId}/v1/userinfo:
    parameters:
      - $ref: '#/components/parameters/pathAuthorizationServerId'
    get:
      summary: /userinfo
      description: Returns information about the user that's the subject of the access token. Many of these claims are also included in the [ID token](https://developer.okta.com/docs/reference/api/oidc/#id-token), but calling this endpoint always returns all of the user's claims. You can configure the ID token to include a subset of the user's claims. See [Scope-dependent claims](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned).
      operationId: userinfoCustomAS
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfo'
        '401':
          description: Unauthorized
          headers:
            WWW-Authenticate:
              schema:
                type: string
              example: Bearer error="invalid_token", error_description="The access token is invalid"
        '403':
          description: Forbidden
          headers:
            WWW-Authenticate:
              schema:
                type: string
              example: Bearer error="insufficient_scope", error_description="The access token must provide access to at least one of these scopes - profile, email, address or phone"
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests429'
      security:
        - oauth2:
            - openid
      tags:
        - CustomAS
      x-okta-lifecycle:
        isCorsEnabled: true
        lifecycle: GA
        isGenerallyAvailable: true
components:
  parameters:
    OAuthPathClientId:
      name: clientId
      in: path
      schema:
        type: string
      description: '`client_id` of the client app'
      required: true
    pathAuthorizationServerId:
      name: authorizationServerId
      in: path
      required: true
      description: '`id` of the authorization server'
      schema:
        type: string
    queryAfter:
      name: after
      in: query
      schema:
        type: string
      description: |-
        The cursor to use for pagination. It's an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](/#pagination).

        > **Note:** The `after` cursor should be treated as an opaque value and obtained through the next link relation.
    queryClientId:
      name: client_id
      in: query
      description: You can configure clients to format the issuer differently. Pass in the `client_id` to ensure that the returned issuer format matches.
      schema:
        type: string
    queryLimit:
      name: limit
      in: query
      schema:
        type: integer
        minimum: 1
        maximum: 200
        default: 20
      description: A limit on the number of objects to return.
    queryState:
      name: state
      in: query
      description: An optional value that's returned as a query parameter during the redirect at the end of the flow
      schema:
        type: string
  responses:
    Error400InvalidClientId:
      description: Invalid Client ID
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Error404AuthorizationServerNotFound:
      description: Authorization Server Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ErrorInvalidClientMetadata400:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ErrorAccessDenied403:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ErrorResourceNotFound404:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ErrorTooManyRequests429:
      description: Too Many Requests
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    AcrValue:
      type: string
      x-enumDescriptions:
        phr: <x-lifecycle class="oie"></x-lifecycle> Phishing-Resistant. Requires users to provide possession factors that cryptographically verify the sign-in server (the origin). Currently, only the Passkey (FIDO2 WebAuthn) authenticator satisfies this requirement. Because phishing resistance implies [device binding](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-authenticators), that constraint is selected automatically when `phr` is specified.
        phrh: <x-lifecycle class="oie"></x-lifecycle> Phishing-Resistant Hardware-Protected. Requires that you store keys being used to authenticate in secure hardware (TPM, Secure Enclave) on the device. Currently, only Okta Verify meets this constraint. Because hardware protection implies [device binding](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-authenticators), that constraint is selected automatically when `phrh` is specified.
        urn:okta:loa:1fa:any: Any one factor. Allows one factor authentication with no requirements on which factor.
        urn:okta:loa:1fa:pwd: Password only. Allows one factor authentication that requires the user's password.
        urn:okta:loa:2fa:any: Any two factors. Allows two factor authentication with no requirements on which factors.
        urn:okta:loa:2fa:any:ifpossible: <x-lifecycle class="oie"></x-lifecycle> Any two factors, if possible. Allows two factor authentication with no requirements on which factors. Any two factors are presented only if the user is enrolled, otherwise any one factor is presented.
      x-okta-known-values:
        - phr
        - phrh
        - urn:okta:loa:1fa:any
        - urn:okta:loa:1fa:pwd
        - urn:okta:loa:2fa:any
        - urn:okta:loa:2fa:any:ifpossible
    AmrValue:
      type: string
      x-okta-known-values:
        - duo
        - email
        - fed
        - google_otp
        - kba
        - oath_otp
        - okta_verify
        - opt
        - pop
        - pwd
        - rsa
        - sms
        - symantec
        - tel
        - yubikey
    ApplicationType:
      description: The type of client app
      default: web
      type: string
      x-okta-known-values:
        - browser
        - native
        - service
        - web
    AuthorizeWithPost:
      type: object
      properties:
        acr_values:
          allOf:
            - $ref: '#/components/schemas/AcrValue'
            - type: string
              description: |-
                An optional parameter that you can include in the authentication request. This parameter increases the level of user assurance.

                > **Note:** You can provide multiple space-delimited values. The authorization server chooses one and reflects the chosen value in any resulting tokens.
        client_id:
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](/openapi/okta-oauth/oauth/client). It identifies the client and must match the value preregistered in Okta.
          type: string
        code_challenge:
          description: A challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/). The challenge is verified in the access token request.
          type: string
        code_challenge_method:
          allOf:
            - $ref: '#/components/schemas/CodeChallengeMethod'
            - type: string
              description: Method used to derive the code challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/).
        display:
          description: The `display` parameter to be passed to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/)
          type: string
        enroll_amr_values:
          allOf:
            - $ref: '#/components/schemas/AmrValue'
            - type: string
              description: |-
                A space-delimited list of values indicating which authenticators to enroll in.

                * If the `enroll_amr_values` parameter is specified, then the value for `prompt` must be `enroll_authenticator`.
                * The parameter value is space-delimited, for example, `pwd sms okta_verify` is a valid request parameter value. You are prompted in the order of the amr values provided.
        idp:
          description: An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.
          type: string
        idp_scope:
          description: An Okta extension to the OpenID specification. A space-delimited list of scopes you want to provide to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/). These scopes are used in addition to the scopes already configured for the identity provider.
          type: string
        login_hint:
          description: A username to pre-populate if prompting for authentication
          type: string
        max_age:
          description: Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta
          type: integer
        nonce:
          description: A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See [OIDC Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
          type: string
        prompt:
          allOf:
            - $ref: '#/components/schemas/Prompt'
            - type: string
              description: |-
                If no `prompt` parameter is specified, the standard behavior occurs:
                * If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, the user is prompted to authenticate.
                * If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent.
        redirect_uri:
          description: Callback location where the authorization code or tokens should be sent. It must match the value preregistered in Okta during client registration.
          type: string
        request:
          description: |-
            A JWT created by the client that enables requests to be passed as a single, self-contained parameter.

            * You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet.
            * You can't encrypt the JWT.
            >  **Note:** See [Build a JWT for client authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/).
            * Okta supports the [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2), [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature algorithms. HMAC signatures require that the client has a `token_endpoint_auth_method` that uses a `client_secret`. RSA and ECDSA signatures requires that the client registers a public key.
            * We recommend that you don't duplicate any request parameters in both the JWT and the query URI itself. However, you can do so with `state`, `nonce`, `code_challenge`, and `code_challenge_method`. In those cases, the values in the JWT overrides the query URI values.
            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it has already been processed.
          type: string
        request_uri:
          description: Location where the authorization request payload data is referenced in an authorization request to the `/authorize` endpoint. This is returned from a Pushed Authorization Request at the `/par` endpoint.
          type: string
        response_mode:
          allOf:
            - $ref: '#/components/schemas/ResponseMode'
            - type: string
              description: |-
                How the authorization response should be returned. If `id_token` or `token` is specified in the `response_type`, then `query` isn't allowed as a response mode. Defaults to `fragment` in implicit and hybrid flows.

                The `Referrer-Policy` header is automatically included in the response when either the fragment or query parameter values are used. The header is set to `Referrer-Policy: no-referrer`.
        response_type:
          allOf:
            - $ref: '#/components/schemas/ResponseTypesSupported'
            - type: string
              description: Any combination of `code`, `token`, and `id_token`. The combination determines the [flow](https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow).
        scope:
          description: A space-delimited string of scopes requested
          type: string
        sessionToken:
          description: Okta one-time session token. This is an Okta extension to the OpenID specification. The `sessionToken` allows an API-based user sign-in flow.
          type: string
        state:
          description: |-
            A value to be returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters.

            Okta requires the OAuth 2.0 `state` parameter on all requests to the `/authorize` endpoint to prevent cross-site request forgery (CSRF).
            The OAuth 2.0 specification [requires](https://tools.ietf.org/html/rfc6749#section-10.12) that clients protect their redirect URIs against CSRF by sending a value in the authorize request that binds the request to the user-agent's authenticated state.
            Using the `state` parameter is also a countermeasure to several other known attacks as outlined in [OAuth 2.0 Threat Model and Security Considerations](https://tools.ietf.org/html/rfc6819).
          type: string
      required:
        - client_id
        - redirect_uri
        - response_type
        - scope
        - state
    BackchannelAuthorizeRequest:
      additionalProperties: true
      type: object
      properties:
        binding_message:
          type: string
          description: A message that appears for the user to identify the transaction
        id_token_hint:
          type: string
          description: |-
            An ID token previously issued to the client as a hint to identify the user for whom authentication is being requested.

            **Note:** You can specify either `login_hint` or `id_token_hint` in the authentication request, not both.
        login_hint:
          type: string
          description: |-
            A hint to the OpenID Provider regarding the user for whom authentication is being requested.

            **Note:** You can specify either `login_hint` or `id_token_hint` in the authentication request, not both.
        request:
          type: string
          description: |-
            A JWT created by the client that enables requests to be passed as a single, self-contained parameter.

            >  **Note:** See [Build a JWT for client authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/).

            * You must sign the JWT using either the app's client secret or a private key whose public key is registered on the app's JWKSet.
            * You can't encrypt the JWT.
            * Okta supports the [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2), [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature algorithms. HMAC signatures require the client to have a `token_endpoint_auth_method` that uses a `client_secret`. RSA and ECDSA signatures require the client to register a public key.
            * You must specify `backchannel_authentication_request_signing_alg` either during client registration or when updating the client to use the signed authentication requests.
            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the authorization server issuer that mints the ID or access token. This value is published in the metadata for your authorization server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it's already been processed.
        request_expiry:
          type: integer
          description: Allows the client to request the `expires_in` value in number of seconds for the `auth_req_id` that the server returns.
          minimum: 1
          maximum: 300
        scope:
          type: string
          description: '`openid` is required for authentication requests. You can also include other scopes.'
      required:
        - id_token_hint
        - login_hint
        - scope
    BackchannelAuthorizeResponse:
      type: object
      properties:
        auth_req_id:
          type: string
          description: A unique identifier to identify the authentication request made by the client
        expires_in:
          type: integer
          description: The expiration time of the `auth_req_id` in seconds
          minimum: 1
          maximum: 300
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint
    BindingMethod:
      description: The method used to bind the out-of-band channel with the primary channel.
      type: string
      x-okta-known-values:
        - none
        - prompt
        - transfer
    ChallengeHint:
      description: The type of challenge to prompt for in a `/primary-authenticate` request
      type: string
      x-okta-known-values:
        - urn:okta:params:oauth:grant-type:oob
    ChallengeRequest:
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
      type: object
      properties:
        challenge_types_supported:
          type: array
          description: List of direct authentication challenge types supported by the client
          items:
            $ref: '#/components/schemas/ChallengeType'
        channel_hint:
          $ref: '#/components/schemas/Channel'
        mfa_token:
          type: string
          description: The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests
      required:
        - mfa_token
    ChallengeResponse:
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
      type: object
      properties:
        binding_code:
          type: string
          description: The end-user verification code used to bind the authorization operation on the secondary channel with the primary channel. Present only if `binding_method=transfer`.
        binding_method:
          $ref: '#/components/schemas/BindingMethod'
        challenge_type:
          type: string
          description: The challenge type used for authentication
        channel:
          $ref: '#/components/schemas/Channel'
        expires_in:
          type: integer
          description: Number of seconds until the `oob_code` expires
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint
        oob_code:
          type: string
          description: A unique identifier for identifying the out-of-band transaction across multiple requests
    ChallengeType:
      type: string
      x-okta-known-values:
        - http://auth0.com/oauth/grant-type/mfa-oob
        - http://auth0.com/oauth/grant-type/mfa-otp
    Channel:
      description: The out-of-band channel for use with authentication. Required for all `/primary-authenticate` and `/challenge` requests with an out-of-band authenticator.
      type: string
      x-okta-known-values:
        - push
        - sms
        - voice
    Claim:
      type: string
    Client:
      type: object
      properties:
        application_type:
          $ref: '#/components/schemas/ApplicationType'
        client_id:
          type: string
          description: Unique key for the client app. The `client_id` is immutable. When you create a client app, you can't specify the `client_id` because Okta uses the app ID for the `client_id`.
          readOnly: true
        client_id_issued_at:
          type: integer
          readOnly: true
          description: Time at which the `client_id` was issued (measured in unix seconds)
        client_name:
          type: string
          description: Human-readable string name of the client app
        client_secret:
          type: string
          readOnly: true
          description: OAuth 2.0 client secret string (used for confidential clients). The `client_secret` is shown only on the response of the creation or update of a client app (and only if the `token_endpoint_auth_method` is one that requires a client secret). You can't specify the `client_secret`. If the `token_endpoint_auth_method` requires one, Okta generates a random `client_secret` for the client app.
          nullable: true
        client_secret_expires_at:
          type: integer
          readOnly: true
          description: Time at which the `client_secret` expires or 0 if it doesn't expire (measured in unix seconds)
          minimum: 0
          nullable: true
        frontchannel_logout_session_required:
          type: boolean
          description: Include user session details
        frontchannel_logout_uri:
          type: string
          description: URL where Okta sends the logout request
          nullable: true
        grant_types:
          type: array
          description: 'Array of OAuth 2.0 grant type strings. Default value: `[authorization_code]`'
          items:
            $ref: '#/components/schemas/GrantType'
        id_token_encrypted_response_alg:
          $ref: '#/components/schemas/OAuthIdTokenKeyEncryptionAlgorithm'
        initiate_login_uri:
          type: string
          description: URL that a third party can use to initiate a sign-in flow by the client
        jwks:
          type: object
          description: A [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client
          properties:
            keys:
              type: array
              items:
                oneOf:
                  - $ref: '#/components/schemas/JsonSigningWebKey'
                  - $ref: '#/components/schemas/JsonEncryptionWebKey'
        jwks_uri:
          type: string
          description: URL string that references a [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client
        logo_uri:
          type: string
          description: URL string that references a logo for the client consent dialog (not the sign-in dialog)
          nullable: true
        policy_uri:
          type: string
          description: URL string of a web page providing the client's policy document
          nullable: true
        post_logout_redirect_uris:
          type: string
          description: Array of redirection URI strings for use for relying party initiated logouts
          items:
            type: string
        redirect_uris:
          type: array
          description: 'Array of redirection URI strings for use in redirect-based flows. All redirect URIs must be absolute URIs and must not include a fragment component. At least one redirect URI and response type is required for all client types, with the following exceptions: If the client uses the Resource Owner Password flow (if `grant_type` contains the value `password`) or the Client Credentials flow (if `grant_type` contains the value `client_credentials`), then no redirect URI or response type is necessary. In these cases, you can pass either null or an empty array for these attributes.'
          items:
            type: string
        request_object_signing_alg:
          $ref: '#/components/schemas/SigningAlgorithm'
        response_types:
          type: array
          description: 'Array of OAuth 2.0 response type strings. Default value: `[code]`'
          items:
            $ref: '#/components/schemas/ResponseType'
        token_endpoint_auth_method:
          $ref: '#/components/schemas/EndpointAuthMethod'
        tos_uri:
          type: string
          description: URL string of a web page providing the client's terms of service document
          nullable: true
      required:
        - client_name
    CodeChallengeMethod:
      type: string
      x-okta-known-values:
        - S256
    ContentEncryptionAlgorithm:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      type: string
      x-okta-known-values:
        - A256GCM
    DeviceAuthorizeRequest:
      type: object
      properties:
        client_id:
          type: string
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](/openapi/okta-oauth/oauth/client). It identifies the client and must match the value preregistered in Okta.
        scope:
          type: string
          description: A list of scopes that the client wants to include in the access token
    DeviceAuthorizeResponse:
      type: object
      properties:
        device_code:
          type: string
          description: The device verification code
        expires_in:
          type: integer
          description: The expiration time of the `device_code` and `user_code` in seconds
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint
        user_code:
          type: string
          description: The verification code for the end user
        verification_uri:
          type: string
          description: The URI that the end user visits to verify
        verification_uri_complete:
          type: string
          description: The URI that includes the `user_code` that the end user alternatively visits to verify
    EndpointAuthMethod:
      description: Requested authentication method for OAuth 2.0 endpoints
      type: string
      x-okta-known-values:
        - client_secret_basic
        - client_secret_jwt
        - client_secret_post
        - none
        - private_key_jwt
    Error:
      title: Error
      type: object
      properties:
        errorCauses:
          type: array
          items:
            type: object
            properties:
              errorSummary:
                type: string
        errorCode:
          type: string
          description: An Okta code for this type of error
        errorId:
          type: string
          description: A unique identifier for this error. Okta Support can use this to help with troubleshooting.
        errorLink:
          type: string
          description: An Okta code for this type of error
        errorSummary:
          type: string
          description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.
    GlobalTokenRevocationRequest:
      nullable: false
      type: object
      properties:
        sub_id:
          $ref: '#/components/schemas/sub_id'
    GrantType:
      description: Determines the mechanism Okta uses to authorize the creation of the tokens
      type: string
      x-okta-known-values:
        - authorization_code
        - client_credentials
        - implicit
        - interaction_code
        - password
        - refresh_token
        - urn:ietf:params:oauth:grant-type:device_code
        - urn:ietf:params:oauth:grant-type:jwt-bearer
        - urn:ietf:params:oauth:grant-type:saml2-bearer
        - urn:ietf:params:oauth:grant-type:token-exchange
        - urn:openid:params:grant-type:ciba
        - urn:okta:params:oauth:grant-type:otp
        - urn:okta:params:oauth:grant-type:oob
        - http://auth0.com/oauth/grant-type/mfa-otp
        - http://auth0.com/oauth/grant-type/mfa-oob
        - urn:ietf:params:oauth:grant-type:jwt-bearer
    IntrospectionRequest:
      type: object
      properties:
        token:
          type: string
          description: |-
            An access token, ID token, refresh token, or a device secret.

            > **Note:** Although ID tokens can be sent to this endpoint, they are usually validated on the service provider or app side of a flow.
        token_type_hint:
          $ref: '#/components/schemas/TokenTypeHintIntrospect'
    IntrospectionResponse:
      additionalProperties: true
      type: object
      properties:
        active:
          type: boolean
          description: Indicates whether the token is active or not
        aud:
          type: string
          description: The audience of the token
        client_id:
          type: string
          description: The ID of the client associated with the token
        device_id:
          type: string
          description: The ID of the device associated with the token
        exp:
          type: integer
          description: The expiration time of the token in seconds since January 1, 1970 UTC
        iat:
          type: integer
          description: The issuing time of the token in seconds since January 1, 1970 UTC
        iss:
          type: string
          description: The issuer of the token
        jti:
          type: string
          description: The identifier of the token
        nbf:
          type: integer
          description: Identifies the time (a timestamp in seconds since January 1, 1970 UTC) before which the token must not be accepted for processing
        scope:
          type: string
          description: A space-delimited list of scopes
        sub:
          type: string
          description: The subject of the token
        token_type:
          type: string
          description: The type of token. The value is always `Bearer`.
        uid:
          type: string
          description: The user ID. This parameter is returned only if the token is an access token and the subject is an end user.
        username:
          type: string
          description: The username associated with the token.
    JsonEncryptionWebKey:
      title: Encryption key
      allOf:
        - $ref: '#/components/schemas/JsonWebKeyBase'
      description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses these keys to encrypt an ID token JWT minted by the org authorization server or custom authorization server. Okta supports only RSA keys for encrypting tokens.
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      type: object
      properties:
        e:
          type: string
          description: The key exponent of an RSA key
        kty:
          type: string
          description: The type of public key
          enum:
            - RSA
        'n':
          type: string
          description: The modulus of the RSA key
        use:
          description: The intended use of the public key
          type: string
          enum:
            - enc
    JsonSigningWebKey:
      title: Signing key
      allOf:
        - $ref: '#/components/schemas/JsonWebKeyBase'
      oneOf:
        - $ref: '#/components/schemas/JsonWebKeyEC'
        - $ref: '#/components/schemas/JsonWebKeyRsa'
      description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta can use these keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens.
      type: object
      properties:
        alg:
          $ref: '#/components/schemas/SigningAlgorithm'
        use:
          description: The intended use of the public key
          type: string
          enum:
            - sig
    JsonWebKey:
      description: |-
        A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses these keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens.
        Okta can also use these keys to encrypt an ID token JWT minted by the org authorization server or custom authorization server. Okta supports only RSA keys for encrypting tokens.
      type: object
      properties:
        alg:
          $ref: '#/components/schemas/SigningAlgorithm'
        kid:
          type: string
          description: The unique identifier of the key
        kty:
          $ref: '#/components/schemas/JsonWebKeyType'
        status:
          $ref: '#/components/schemas/JsonWebKeyStatus'
        use:
          $ref: '#/components/schemas/JsonWebKeyUse'
      discriminator:
        propertyName: kty
        mapping:
          sig: '#/components/schemas/JsonWebKeyEC'
          enc: '#/components/schemas/JsonWebKeyRsa'
    JsonWebKeyBase:
      type: object
      properties:
        kid:
          type: string
          description: The unique identifier of the key
    JsonWebKeyEC:
      title: EC signing key
      description: An EC signing key
      allOf:
        - $ref: '#/components/schemas/JsonSigningWebKey'
      type: object
      properties:
        kty:
          type: string
          description: The type of public key
          enum:
            - EC
        x:
          type: string
          description: The public x coordinate for the elliptic curve point
        'y':
          type: string
          description: The public y coordinate for the elliptic curve point
    JsonWebKeyRsa:
      title: RSA signing key
      description: An RSA signing key
      allOf:
        - $ref: '#/components/schemas/JsonSigningWebKey'
      type: object
      properties:
        e:
          type: string
          description: The key exponent of an RSA key
        kty:
          type: string
          description: The type of public key
          enum:
            - RSA
        'n':
          type: string
          description: The modulus of the RSA key
    JsonWebKeyStatus:
      description: The status of the public key
      type: string
      x-okta-known-values:
        - ACTIVE
        - INACTIVE
    JsonWebKeyType:
      description: The type of public key
      type: string
      x-okta-known-values:
        - EC
        - RSA
    JsonWebKeyUse:
      description: The intended use of the public key
      type: string
      x-okta-known-values:
        - enc
        - sig
    LogoutWithPost:
      type: object
      properties:
        id_token_hint:
          description: A valid ID token with a subject that matches the current session
          type: string
        post_logout_redirect_uri:
          description: Location to redirect to after the logout is performed. It must match the value preregistered in Okta during client registration.
          type: string
        state:
          description: An optional value that's returned as a query parameter during the redirect at the end of the flow
          type: string
      required:
        - id_token_hint
    OAuthError:
      type: object
      properties:
        error:
          type: string
          description: An error code defined in [RFC6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2) or other extension
        error_description:
          type: string
          description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.
    OAuthIdTokenKeyEncryptionAlgorithm:
      description: JWE alg algorithm for encrypting the ID token issued to this client. If this is requested, the response is signed, and then encrypted with the result being a nested JWT. The default, if omitted, is that no encryption is performed.
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
      type: string
      x-okta-known-values:
        - RSA-OAEP-256
        - RSA-OAEP-384
        - RSA-OAEP-512
    OAuthKeys:
      type: object
      properties:
        keys:
          type: array
          items:
            $ref: '#/components/schemas/JsonWebKey'
    OAuthMetadata:
      type: object
      properties:
        authorization_endpoint:
          type: string
          description: URL of the authorization server's authorization endpoint
        backchannel_authentication_request_signing_alg_values_supported:
          description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>A list of signing algorithms that this authorization server supports for signed requests
          type: array
          items:
            $ref: '#/components/schemas/SigningAlgorithm'
          x-okta-lifecycle:
            lifecycle: LIMITED_GA
            isGenerallyAvailable: false
            SKUs:
              - Okta Identity Engine
        backchannel_token_delivery_modes_supported:
          description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>The delivery modes that this authorization server supports for Client-Initiated Backchannel Authentication
          type: array
          items:
            $ref: '#/components/schemas/TokenDeliveryMode'
          x-okta-lifecycle:
            lifecycle: LIMITED_GA
            isGenerallyAvailable: false
            SKUs:
              - Okta Identity Engine
        claims_supported:
          description: A list of the claims supported by this authorization server
          type: array
          items:
            $ref: '#/components/schemas/Claim'
        code_challenge_methods_supported:
          description: A list of PKCE code challenge methods supported by this authorization server
          type: array
          items:
            $ref: '#/components/schemas/CodeChallengeMethod'
        device_authorization_endpoint:
          type: string
        dpop_signing_alg_values_supported:
          description: A list of signing algorithms supported by this authorization server for Demonstrating Proof-of-Possession (DPoP) JWTs
          type: array
          items:
            type: string
            enum:
              - ES256
              - ES384
              - ES512
              - RS256
              - RS384
              - RS512
          x-okta-lifecycle:
            lifecycle: TOMBSTONE
            isGenerallyAvailable: false
            SKUs: []
        end_session_endpoint:
          description: URL of the authorization server's logout endpoint
          type: string
        grant_types_supported:
          description: A list of the grant type values that this authorization server supports
          type: array
          items:
            $ref: '#/components/schemas/GrantType'
        introspection_endpoint:
          description: URL of the authorization server's introspection endpoint
          type: string
        introspection_endpoint_auth_methods_supported:
          description: A list of client authentication methods supported by this introspection endpoint
          type: array
          items:
            $ref: '#/components/schemas/EndpointAuthMethod'
        issuer:
          type: string
          description: The authorization server's issuer identifier. In the context of this document, this is your authorization server's base URL. This becomes the `iss` claim in an access token.
        jwks_uri:
          description: URL of the authorization server's JSON Web Key Set document
          type: string
        pushed_authorization_request_endpoint:
          type: string
        registration_endpoint:
          description: URL of the authorization server's JSON Web Key Set document
          type: string
        request_object_signing_alg_values_supported:
          description: A list of signing algorithms that this authorization server supports for signed requests
          type: array
          items:
            $ref: '#/components/schemas/SigningAlgorithm'
        request_parameter_supported:
          description: Indicates if request parameters are supported by this authorization server
          type: boolean
        response_modes_supported:
          description: A list of the `response_mode` values that this authorization server supports
          type: array
          items:
            $ref: '#/components/schemas/ResponseMode'
        response_types_supported:
          description: A list of the `response_type` values that this authorization server supports. Can be a combination of `code`, `token`, and `id_token`.
          type: array
          items:
            $ref: '#/components/schemas/ResponseTypesSupported'
        revocation_endpoint:
          description: URL of the authorization server's revocation endpoint
          type: string
        revocation_endpoint_auth_methods_supported:
          description: A list of client authentication methods supported by this revocation endpoint
          type: array
          items:
            $ref: '#/components/schemas/EndpointAuthMethod'
        scopes_supported:
          description: A list of the scope values that this authorization server supports
          type: array
          items:
            $ref: '#/components/schemas/Scope'
        subject_types_supported:
          description: A list of the subject identifier types that this authorization server supports. Valid types include `pairwise` and `public`, but only `public` is currently supported. See the [Subject Identifier Types](https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes) section in the OpenID Connect specification.
          type: array
          items:
            $ref: '#/components/schemas/SubjectType'
        token_endpoint:
          description: URL of the authorization server's token endpoint
          type: string
        token_endpoint_auth_methods_supported:
          description: A list of client authentication methods supported by this token endpoint
          type: array
          items:
            $ref: '#/components/schemas/EndpointAuthMethod'
    OidcMetadata:
      allOf:
        - $ref: '#/components/schemas/OAuthMetadata'
        - type: object
          properties:
            id_token_encryption_alg_values_supported:
              description: JSON array that contains a list of the JWE encryption algorithms (alg values) supported for the ID token to encode the claims in a JWT
              type: array
              items:
                $ref: '#/components/schemas/OAuthIdTokenKeyEncryptionAlgorithm'
              x-okta-lifecycle:
                lifecycle: GA
                isGenerallyAvailable: true
            id_token_encryption_enc_values_supported:
              description: JSON array that contains a list of the JWE encryption algorithms (enc values) supported for the ID token to encode the claims in a JWT
              type: array
              items:
                $ref: '#/components/schemas/ContentEncryptionAlgorithm'
              x-okta-lifecycle:
                lifecycle: GA
                isGenerallyAvailable: true
            id_token_signing_alg_values_supported:
              description: A list of signing algorithms that this authorization server supports for signing ID tokens
              type: array
              items:
                $ref: '#/components/schemas/SigningAlgorithm'
            userinfo_endpoint:
              description: URL of the authorization server's userinfo endpoint
              type: string
    OobAuthenticateRequest:
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
      type: object
      properties:
        challenge_hint:
          $ref: '#/components/schemas/ChallengeHint'
        channel_hint:
          $ref: '#/components/schemas/Channel'
        login_hint:
          type: string
          description: The user sign-in information for whom authentication is being requested
      required:
        - login_hint
        - channel_hint
        - challenge_hint
    OobAuthenticateResponse:
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
      type: object
      properties:
        binding_code:
          type: string
          description: The end-user verification code used to bind the authorization operation on the secondary channel with the primary channel. Present only if `binding_method=transfer`.
        binding_method:
          $ref: '#/components/schemas/BindingMethod'
        channel:
          $ref: '#/components/schemas/Channel'
        expires_in:
          type: integer
          description: Number of seconds until the `oob_code` expires
        interval:
          type: integer
          description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint
        oob_code:
          type: string
          description: A unique identifier for identifying the out-of-band transaction across multiple requests
    ParRequest:
      description: See `/authorize` query parameters for more information
      type: object
      properties:
        client_id:
          description: Obtained during either manual client registration or through the [Dynamic Client Registration API](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client)
          type: string
        code_challenge:
          description: A challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/). The challenge is verified in the access token request.
          type: string
        code_challenge_method:
          type: string
          description: Method used to derive the code challenge for [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/)
          items:
            $ref: '#/components/schemas/CodeChallengeMethod'
        display:
          type: string
          description: The `display` parameter to be passed to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/)
        idp:
          type: string
          description: An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.
        idp_scope:
          type: string
          description: An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing [social login](https://developer.okta.com/docs/concepts/identity-providers/). These scopes are used in addition to the scopes already configured for the identity provider.
        login_hint:
          type: string
          description: A username to pre-populate if prompting for authentication
        max_age:
          type: integer
          description: Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta
        nonce:
          type: string
          description: A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See [OIDC Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
        prompt:
          type: string
          description: |-
            If you don't specify the `prompt` parameter, the standard behavior occurs:
            * If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, Okta prompts the user to authenticate.
            * If scopes are requested that require consent and consent isn't yet given by the authenticated user, Okta prompts the user to give consent.
          items:
            $ref: '#/components/schemas/Prompt'
        redirect_uri:
          type: string
          description: Callback location where you want the authorization code or tokens sent to. It must match the value preregistered in Okta during client registration.
        request:
          type: string
          description: Used to push a [Request Object JWT](https://datatracker.ietf.org/doc/html/rfc9126#name-the-request-request-paramet) to the authorization server
        response_mode:
          type: string
          description: |-
            How Okta should return the authorization response. If `id_token` or `token` is specified in the `response_type`, then `query` isn't allowed as a response mode. Defaults to `fragment` in implicit and hybrid flows.

            The `Referrer-Policy` header is automatically included in the response when either the `fragment` or `query` parameter values are used. The header is set to `Referrer-Policy: no-referrer`.
          items:
            $ref: '#/components/schemas/ResponseMode'
        response_type:
          type: string
          description: Any combination of `code`, `token`, and `id_token`. The combination determines the [flow](https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-2-0-flow).
          items:
            $ref: '#/components/schemas/ResponseTypesSupported'
        scope:
          type: string
          description: A space-delimited string of scopes requested
        sessionToken:
          type: string
          description: Okta one-time session token. This is an Okta extension to the OpenID specification. The `sessionToken` allows an API-based user sign-in flow.
        state:
          type: string
          description: A value returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters.
    ParResponse:
      type: object
      properties:
        expires_in:
          type: integer
          description: Number of seconds until the `request_uri` expires
        request_uri:
          type: string
          description: Location where the authorization request payload data is referenced in authorization requests to the `/authorize` endpoint
    Prompt:
      type: string
      x-enumDescriptions:
        none: Don't prompt for authentication or consent. If an Okta session already exists, the user is silently authenticated. Otherwise, an error is returned.
        login: Always prompt the user for authentication, regardless of whether they have an Okta session.
        consent: Depending on the [values set for consent_method in the app and consent for the scope](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/createapplication), display the Okta consent dialog, even if the user has already given consent. User consent is available for custom authorization servers (requires the API Access Management feature and the User Consent feature enabled).
        login consent: Can also be `consent login` (order doesn't matter). The user is always prompted for authentication, and the user consent dialog appears depending on the [values set for consent_method in the app and consent on the scope](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/createapplication), even if the user has already given consent.
        enroll_authenticator: |-
          This indicates that the intent is to enroll the user with an authenticator. The following other parameters must be used together with this value for a valid request:

          * `enroll_amr_values`: Value must be specified and indicates which authenticator method you're allowing the user to enroll.
          * `response_type`: Value must be `none`, which means no tokens should be returned at the end of the flow.
          * `acr_values`: Value must be `urn:okta:loa:2fa:any:ifpossible`, which means the user is prompted for at least one factor before enrollment.
          * `max_age`: Value must be `0`, which means no existing session should be considered.
          * `scope` and `nonce` must not be specified, because no tokens are generated.
      x-okta-known-values:
        - consent
        - enroll_authenticator
        - login
        - login consent
        - none
    ResponseMode:
      type: string
      x-enumDescriptions:
        fragment: Parameters are encoded in the URL fragment added to the `redirect_uri` when redirecting back to the client.
        query: Parameters are encoded in the query string added to the `redirect_uri` when redirecting back to the client.
        form_post: Parameters are encoded as HTML form values (`application/x-www-form-urlencoded` format) and are transmitted through the HTTP POST method to the client.
        okta_post_message: |-
          Uses [HTML5 Web Messaging](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage), for example, `window.postMessage()` instead of the redirect for the authorization response from the `/authorize` endpoint.

          `okta_post_message` is an adaptation of the [Web Message Response Mode](https://tools.ietf.org/html/draft-sakimura-oauth-wmrm-00#section-4.1).
          This value provides a secure way for a single-page app to perform a sign-in flow in a pop-up window or an iFrame and receive the ID token, access token, and/or authorization code back in the parent page without leaving the context of that page.

          Use the `postMessage()` data object to help you when working with the `okta_post_message` value of the `response_mode` request parameter.

          | Parameter         | Description                                                                | Data Type |
          |-------------------|----------------------------------------------------------------------------|-----------|
          | access_token      | An access token. This is returned if the `response_type` included `token`. | string    |
          | error             | The error code, if something went wrong                                    | string    |
          | error_description | Additional error information (if any)                                      | string    |
          | id_token          | An ID token. This is returned if the `response_type` includes `id_token`.  | string    |
          | state             | The unmodified `state` value from the request                              | string    |
      x-okta-known-values:
        - form_post
        - fragment
        - okta_post_message
        - query
    ResponseType:
      type: string
      x-okta-known-values:
        - code
        - id_token
        - none
        - token
    ResponseTypesSupported:
      type: string
      x-okta-known-values:
        - code
        - code id_token
        - code id_token token
        - code token
        - id_token
        - id_token token
        - token
    RevokeRequestCustomAs:
      type: object
      properties:
        token:
          type: string
          description: An access token, refresh token, or a device secret
          example: <access_token_value>
        token_type_hint:
          $ref: '#/components/schemas/TokenTypeHintRevokeCustomAs'
      required:
        - token
    RevokeRequestOrgAs:
      type: object
      properties:
        token:
          type: string
          description: The token to revoke
          example: <access_token_value>
        token_type_hint:
          $ref: '#/components/schemas/TokenTypeHintRevokeOrgAs'
      required:
        - token
    Scope:
      type: string
    SigningAlgorithm:
      description: The type of [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) algorithm that you must use for signing request objects. When you specify a value for the `request_object_signing_alg` property, all request objects from the client are rejected if not signed with the specified algorithm. You must use the algorithm when the request object is passed by value (using the request parameter). If a value for `request_object_signing_alg` isn't specified, the default is any algorithm that's supported by both the client and the server.
      type: string
      x-okta-known-values:
        - ES256
        - ES384
        - ES512
        - HS256
        - HS384
        - HS512
        - RS256
        - RS384
        - RS512
    SubIdIssSub:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      title: Issuer-Subject Identifier
      description: <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>Subject identifier using issuer and subject from third-party IdP
      type: object
      properties:
        format:
          type: string
          description: The subject identifier format that uses the issuer and subject from third-party IdPs. It determines how users are identified in revocation requests.
          nullable: false
          writeOnly: true
          enum:
            - iss_sub
        iss:
          type: string
          description: |-
            Issuer identifier from the IdP.
            * For SAML IdPs, the issuer identifier is the IdP issuer.
            * For OIDC IdPs, the issuer identifier is the issuer URL.
          writeOnly: true
          nullable: false
          example: https://idp.example.com
        sub:
          type: string
          description: |-
            Subject identifier from the IdP.
            * For SAML IdPs, the subject identifier is the NameID.
            * For OIDC IdPs, the subject identifier is the `sub` claim.
          writeOnly: true
          nullable: false
          example: user@example.com
      required:
        - format
        - sub
        - iss
    SubIdOpaque:
      title: Opaque subject identifier
      description: Subject identifier that uses Okta's opaque user ID format
      type: object
      properties:
        format:
          type: string
          description: The subject identifier format that uses Okta's opaque user ID format. It determines how users are identified in revocation requests.
          nullable: false
          writeOnly: true
          enum:
            - opaque
        id:
          type: string
          description: ID of an existing Okta user
          writeOnly: true
          nullable: false
          example: 00u1dnq5S0CfjlkpABCD
      required:
        - format
        - id
    SubjectType:
      type: string
      x-okta-known-values:
        - pairwise
        - public
    TokenDeliveryMode:
      type: string
      x-okta-known-values:
        - poll
    TokenRequest:
      type: object
      properties:
        grant_type:
          $ref: '#/components/schemas/GrantType'
    TokenRequestAuthorizationCode:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            code:
              type: string
              description: The value is what was returned from the authorization endpoint. The code has a lifetime of 300 seconds.
            code_verifier:
              type: string
              description: Required if the `code_challenge` was specified in the original `/authorize` request. This value is the code verifier for PKCE. Okta uses it to recompute the `code_challenge` and verify if it matches the original `code_challenge` in the authorization request.
            redirect_uri:
              type: string
              description: Specifies the callback location where the authorization was sent. This value must match the `redirect_uri` used to generate the original `authorization_code`.
          required:
            - code
    TokenRequestCiba:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            auth_req_id:
              type: string
              description: <x-lifecycle-container><x-lifecycle class="oie"></x-lifecycle></x-lifecycle-container>The value is what was returned from `/bc/authorize`
              x-okta-lifecycle:
                lifecycle: LIMITED_GA
                isGenerallyAvailable: false
                SKUs:
                  - Okta Identity Engine
          required:
            - auth_req_id
    TokenRequestClientCredentials:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            scope:
              type: string
              description: The scopes requested
          required:
            - scope
    TokenRequestCustomAs:
      type: object
      properties:
        grant_type:
          $ref: '#/components/schemas/GrantType'
      discriminator:
        propertyName: grant_type
        mapping:
          authorization_code: '#/components/schemas/TokenRequestAuthorizationCode'
          client_credentials: '#/components/schemas/TokenRequestClientCredentials'
          password: '#/components/schemas/TokenRequestPassword'
          refresh_token: '#/components/schemas/TokenRequestRefreshToken'
          urn:ietf:params:oauth:grant-type:saml2-bearer: '#/components/schemas/TokenRequestSamlBearer'
          urn:ietf:params:oauth:grant-type:token-exchange: '#/components/schemas/TokenRequestTokenExchangeCustomAs'
          urn:openid:params:grant-type:ciba: '#/components/schemas/TokenRequestCiba'
          urn:okta:params:oauth:grant-type:otp: '#/components/schemas/TokenRequestDirectAuthenticationOtp'
          urn:okta:params:oauth:grant-type:oob: '#/components/schemas/TokenRequestDirectAuthenticationOob'
          http://auth0.com/oauth/grant-type/mfa-otp: '#/components/schemas/TokenRequestDirectAuthenticationMfaOtp'
          http://auth0.com/oauth/grant-type/mfa-oob: '#/components/schemas/TokenRequestDirectAuthenticationMfaOob'
          urn:ietf:params:oauth:grant-type:jwt-bearer: '#/components/schemas/TokenRequestJwtBearer'
    TokenRequestDirectAuthReferenceValue:
      allOf:
        - $ref: '#/components/schemas/TokenRequestDirectAuthenticationOtp'
        - $ref: '#/components/schemas/TokenRequestDirectAuthenticationMfaOtp'
        - $ref: '#/components/schemas/TokenRequestDirectAuthenticationOob'
        - $ref: '#/components/schemas/TokenRequestDirectAuthenticationMfaOob'
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestDirectAuthenticationMfaOob:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            grant_types_supported:
              description: A list of the grant type values that this authorization server supports
              type: array
              items:
                $ref: '#/components/schemas/GrantType'
            mfa_token:
              type: string
              description: The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests
            oob_code:
              type: string
              description: The value returned from a previous oob-authenticate or challenge request for identifying an out-of-band transaction across multiple requests
            scope:
              type: string
              description: The scopes requested
          required:
            - grant_type
            - mfa_token
            - oob_code
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestDirectAuthenticationMfaOtp:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            grant_types_supported:
              description: A list of the grant type values that this authorization server supports
              type: array
              items:
                $ref: '#/components/schemas/GrantType'
            mfa_token:
              type: string
              description: The value returned from a previous token or challenge request for identifying the multifactor transaction across multiple requests
            otp:
              type: string
              description: The one-time passcode for an enrolled authenticator of the user for whom authentication is being requested
            scope:
              type: string
              description: The scopes requested
          required:
            - grant_type
            - mfa_token
            - otp
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestDirectAuthenticationOob:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            grant_types_supported:
              description: A list of the grant type values that this authorization server supports
              type: array
              items:
                $ref: '#/components/schemas/GrantType'
            oob_code:
              type: string
              description: The value returned from a previous oob-authenticate or challenge request for identifying an out-of-band transaction across multiple requests
            scope:
              type: string
              description: The scopes requested
          required:
            - grant_type
            - scope
            - oob_code
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestDirectAuthenticationOtp:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            grant_types_supported:
              description: A list of the grant type values that the client supports
              type: array
              items:
                $ref: '#/components/schemas/GrantType'
            login_hint:
              type: string
              description: The user sign-in information for whom authentication is being requested
            otp:
              type: string
              description: The one-time passcode for an enrolled authenticator of the user for whom authentication is being requested
            scope:
              type: string
              description: The scopes requested
          required:
            - grant_type
            - scope
            - login_hint
            - otp
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs:
          - Okta Identity Engine
    TokenRequestJwtBearer:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            assertion:
              type: string
              description: The JSON Web Token (JWT) assertion
            scope:
              type: string
              description: The scopes requested
          required:
            - assertion
      x-okta-lifecycle:
        lifecycle: LIMITED_GA
        isGenerallyAvailable: false
        SKUs: []
    TokenRequestOrgAs:
      type: object
      properties:
        grant_type:
          $ref: '#/components/schemas/GrantType'
      discriminator:
        propertyName: grant_type
        mapping:
          authorization_code: '#/components/schemas/TokenRequestAuthorizationCode'
          client_credentials: '#/components/schemas/TokenRequestClientCredentials'
          password: '#/components/schemas/TokenRequestPassword'
          refresh_token: '#/components/schemas/TokenRequestRefreshToken'
          urn:ietf:params:oauth:grant-type:saml2-bearer: '#/components/schemas/TokenRequestSamlBearer'
          urn:ietf:params:oauth:grant-type:token-exchange: '#/components/schemas/TokenRequestTokenExchangeOrgAs'
          urn:openid:params:grant-type:ciba: '#/components/schemas/TokenRequestCiba'
          urn:okta:params:oauth:grant-type:otp: '#/components/schemas/TokenRequestDirectAuthenticationOtp'
          urn:okta:params:oauth:grant-type:oob: '#/components/schemas/TokenRequestDirectAuthenticationOob'
          http://auth0.com/oauth/grant-type/mfa-otp: '#/components/schemas/TokenRequestDirectAuthenticationMfaOtp'
          http://auth0.com/oauth/grant-type/mfa-oob: '#/components/schemas/TokenRequestDirectAuthenticationMfaOob'
    TokenRequestPassword:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            password:
              type: string
              description: The password of the matching user
            scope:
              type: string
              description: The scopes requested
            username:
              type: string
              description: The identifier for the user
          required:
            - password
            - scope
            - username
    TokenRequestRefreshToken:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            refresh_token:
              type: string
              description: The refresh token
            scope:
              type: string
              description: The scopes requested. They must be a subset of the original scopes associated with the refresh token.
          required:
            - refresh_token
    TokenRequestSamlBearer:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - type: object
          properties:
            assertion:
              type: string
              description: The base64-encoded SAML Assertion
              x-okta-lifecycle:
                lifecycle: GA
                isGenerallyAvailable: true
            scope:
              type: string
              description: The scopes requested
          required:
            - assertion
            - scope
    TokenRequestTokenExchange:
      allOf:
        - $ref: '#/components/schemas/TokenRequest'
        - description: '[RFC8693: OAuth 2.0 Token Exchange](https://tools.ietf.org/html/rfc8693)'
          type: object
          properties:
            actor_token:
              type: string
              description: A security token that represents the identity of the acting party
            audience:
              type: string
              description: The target audience for the requested token
            auth_req_id:
              type: string
              description: <x-lifecycle class="oie"></x-lifecycle> The value is what was returned from `/bc/authorize`.
            resource:
              type: string
              description: The target resource for the requested token
            scope:
              type: string
              description: The scopes requested
            subject_token:
              type: string
              description: A security token that represents the identity of the party on behalf of whom the request is being made
          required:
            - subject_token
    TokenRequestTokenExchangeCustomAs:
      allOf:
        - $ref: '#/components/schemas/TokenRequestTokenExchange'
        - type: object
          properties:
            actor_token_type:
              $ref: '#/components/schemas/TokenTypeCustomAs'
            requested_token_type:
              $ref: '#/components/schemas/TokenTypeCustomAs'
            subject_token_type:
              $ref: '#/components/schemas/TokenTypeCustomAs'
    TokenRequestTokenExchangeOrgAs:
      allOf:
        - $ref: '#/components/schemas/TokenRequestTokenExchange'
        - type: object
          properties:
            actor_token_type:
              $ref: '#/components/schemas/TokenTypeOrgAs'
            requested_token_type:
              $ref: '#/components/schemas/TokenTypeOrgAs'
            subject_token_type:
              $ref: '#/components/schemas/TokenTypeOrgAs'
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: An access token
        device_secret:
          type: string
          description: An opaque device secret. This is returned if the `device_sso` scope is granted.
        expires_in:
          type: integer
          description: The expiration time of the access token in seconds
        id_token:
          type: string
          description: An ID token. This is returned if the `openid` scope is granted.
        refresh_token:
          type: string
          description: An opaque refresh token. This is returned if the `offline_access` scope is granted.
        scope:
          type: string
          description: The scopes contained in the access token
        token_type:
          $ref: '#/components/schemas/TokenResponseTokenType'
    TokenResponseCustomAs:
      allOf:
        - $ref: '#/components/schemas/TokenResponse'
        - type: object
          properties:
            issued_token_type:
              $ref: '#/components/schemas/TokenTypeCustomAs'
    TokenResponseOrgAs:
      allOf:
        - $ref: '#/components/schemas/TokenResponse'
        - type: object
          properties:
            issued_token_type:
              $ref: '#/components/schemas/TokenTypeOrgAs'
            service_account:
              $ref: '#/components/schemas/TokenResponseServiceAccount'
            vaulted_secret:
              $ref: '#/components/schemas/TokenResponseVaultedSecret'
    TokenResponseServiceAccount:
      description: |-
        The service account credentials. 
        This is returned if the `issued_token_type` is `urn:okta:params:oauth:token-type:service-account`. 
        > **Note:** This is only available if you're subscribed to Okta for AI Agents. Contact Okta Support for more information.
      type: object
      properties:
        password:
          type: string
          description: The service account password
        username:
          type: string
          description: The service account username
    TokenResponseTokenType:
      description: The token type in a `/token` response. The value is generally `Bearer` except for a few instances of token exchange.
      type: string
      x-okta-known-values:
        - Bearer
        - N_A
    TokenResponseVaultedSecret:
      description: |-
        The vaulted secret containing key-value pairs. 
        This is returned if the `issued_token_type` is `urn:okta:params:oauth:token-type:vaulted-secret`. 
        > **Note:** This is only available if you're subscribed to Okta for AI Agents. Contact Okta Support for more information.
      additionalProperties:
        type: string
      type: object
    TokenTypeCustomAs:
      description: The type of token for token exchange
      type: string
      x-enumDescriptions:
        urn:ietf:params:oauth:token-type:access_token: OAuth 2.0 access token
        urn:ietf:params:oauth:token-type:id_token: ID token
        urn:ietf:params:oauth:token-type:jwt: JSON Web Token (JWT)
        urn:ietf:params:oauth:token-type:refresh_token: OAuth 2.0 refresh token
        urn:ietf:params:oauth:token-type:saml1: SAML 1.1 assertion
        urn:ietf:params:oauth:token-type:saml2: SAML 2.0 assertion
        urn:okta:oauth:token-type:web_sso_token: Web SSO token
        urn:x-oath:params:oauth:token-type:device-secret: Device secret
        urn:okta:params:oauth:token-type:interclient_token: <x-lifecycle class="ea"></x-lifecycle> Interclient token
      x-okta-known-values:
        - urn:ietf:params:oauth:token-type:access_token
        - urn:ietf:params:oauth:token-type:id_token
        - urn:ietf:params:oauth:token-type:jwt
        - urn:ietf:params:oauth:token-type:refresh_token
        - urn:ietf:params:oauth:token-type:saml1
        - urn:ietf:params:oauth:token-type:saml2
        - urn:okta:oauth:token-type:web_sso_token
        - urn:x-oath:params:oauth:token-type:device-secret
        - urn:okta:params:oauth:token-type:interclient_token
    TokenTypeHintIntrospect:
      description: Indicates the type of `token` being passed
      type: string
      x-okta-known-values:
        - access_token
        - device_secret
        - id_token
        - refresh_token
    TokenTypeHintRevokeCustomAs:
      description: Indicates the type of `token` being passed
      example: access_token
      type: string
      x-enumDescriptions:
        access_token: OAuth 2.0 access token
        device_secret: Device secret
        refresh_token: OAuth 2.0 refresh token
      x-okta-known-values:
        - access_token
        - device_secret
        - refresh_token
    TokenTypeHintRevokeOrgAs:
      description: Indicates the type of `token` being passed
      example: access_token
      type: string
      x-enumDescriptions:
        access_token: OAuth 2.0 access token
        device_secret: Device secret
        refresh_token: OAuth 2.0 refresh token
        oauth_sts: OAuth Security Token Service (STS). This type is only available if you're subscribed to Okta for AI Agents.
      x-okta-known-values:
        - access_token
        - device_secret
        - refresh_token
        - oauth_sts
    TokenTypeOrgAs:
      description: The type of token for token exchange
      type: string
      x-enumDescriptions:
        urn:ietf:params:oauth:token-type:access_token: OAuth 2.0 access token
        urn:ietf:params:oauth:token-type:id_token: ID token
        urn:ietf:params:oauth:token-type:jwt: JSON Web Token (JWT)
        urn:ietf:params:oauth:token-type:refresh_token: OAuth 2.0 refresh token
        urn:ietf:params:oauth:token-type:saml1: SAML 1.1 assertion
        urn:ietf:params:oauth:token-type:saml2: SAML 2.0 assertion
        urn:okta:oauth:token-type:web_sso_token: Web SSO token
        urn:x-oath:params:oauth:token-type:device-secret: Device secret
        urn:okta:params:oauth:token-type:interclient_token: <x-lifecycle class="ea"></x-lifecycle> Interclient token
        urn:ietf:params:oauth:token-type:id-jag: Identity Assertion JWT Authorization Grant (ID-JAG). This type is only available with Cross App Access or if you're subscribed to Okta for AI Agents.
        urn:okta:params:oauth:token-type:vaulted-secret: OPA vaulted secret. This type is only available if you're subscribed to Okta for AI Agents.
        urn:okta:params:oauth:token-type:service-account: OPA service account. This type is only available if you're subscribed to Okta for AI Agents.
        urn:okta:params:oauth:token-type:oauth-sts: OAuth Security Token Service (STS). This type is only available if you're subscribed to Okta for AI Agents.
      x-okta-known-values:
        - urn:ietf:params:oauth:token-type:access_token
        - urn:ietf:params:oauth:token-type:id_token
        - urn:ietf:params:oauth:token-type:jwt
        - urn:ietf:params:oauth:token-type:refresh_token
        - urn:ietf:params:oauth:token-type:saml1
        - urn:ietf:params:oauth:token-type:saml2
        - urn:okta:oauth:token-type:web_sso_token
        - urn:x-oath:params:oauth:token-type:device-secret
        - urn:okta:params:oauth:token-type:interclient_token
        - urn:ietf:params:oauth:token-type:id-jag
        - urn:okta:params:oauth:token-type:vaulted-secret
        - urn:okta:params:oauth:token-type:service-account
        - urn:okta:params:oauth:token-type:oauth-sts
    UserInfo:
      additionalProperties: true
      type: object
      properties:
        sub:
          type: string
          description: The subject identifier
    sub_id:
      nullable: false
      description: Subject identifier for the user whose tokens should be revoked
      oneOf:
        - $ref: '#/components/schemas/SubIdOpaque'
        - $ref: '#/components/schemas/SubIdIssSub'
      type: object
      discriminator:
        propertyName: format
        mapping:
          opaque: '#/components/schemas/SubIdOpaque'
          iss_sub: '#/components/schemas/SubIdIssSub'
  securitySchemes:
    apiToken:
      description: 'Pass the API token as the Authorization header value prefixed with SSWS: `Authorization: SSWS {API Token}`'
      name: Authorization
      type: apiKey
      in: header
    oauth2:
      type: oauth2
      description: 'Pass the access_token as the value of the Authorization header: `Authorization: Bearer {access_token}`'
      flows:
        authorizationCode:
          x-usePkce:
            disableManualConfiguration: false
            hideClientSecretInput: true
          authorizationUrl: /oauth2/v1/authorize
          tokenUrl: /oauth2/v1/token
          scopes:
            address: Requests access to the `address` claim
            device_sso: Requests a device secret used to obtain a new set of tokens without re-prompting the user for authentication. See [Native SSO](https://developer.okta.com/docs/guides/configure-native-sso/main/).
            email: Requests access to the `email` and `email_verified` claims
            groups: Requests access to the `groups` claim
            offline_access: Requests a refresh token used to obtain more access tokens without re-prompting the user for authentication
            okta.clients.manage: Allows the app to manage clients in your Okta org
            okta.clients.read: Allows the app to read information about clients in your Okta org
            okta.clients.register: Allows the app to register new clients in your Okta org
            okta.universalLogout.manage: Allows an admin or a service to initiate Universal Logout and revoke all tokens and sessions associated with a specific user
            okta.workflows.invoke.manage: Allows the app to trigger an OAuth 2.0 protected flow
            openid: Identifies the request as an OpenID Connect request
            phone: Requests access to the `phone_number` and `phone_number_verified` claims
            profile: Requests access to the end user's default profile claims
    Client authentication `client_secret_basic`:
      type: http
      scheme: basic
      description: |-
        Pass the client credentials concatenated with a `:` and base64-encoded as part of the Authorization header prefixed with `Basic`

        ```
        Authorization: Basic {base64(<client_id>:<client_secret>)}
        ```

        ```
        Authorization: Basic MGpyYWJ5UVdtNEI5elZKUGJvdFk6NVc3WFVMQ0VzNEJKS25XVVh3aDhsZ21lWFJoY0djZFZpRnA4NHBXZQ==
        ```
    Client authentication `client_secret_post`:
      type: http
      scheme: postBody
      description: |-
        Pass the client credentials as part of the request body.

        ```
        "client_id" : <client_id>
        "client_secret" : <client_secret>
        ```

        ```
        "client_id" : "0jrabyQWm4B9zVJPbotY"
        "client_secret" : "5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe"
        ```
    Client authentication `client_secret_jwt`:
      type: http
      scheme: postBody
      description: |-
        Pass the client credentials in the request body as a JWT `client_assertion` along with the `client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. Generate the assertion by signing the JWT with the `sub` and `iss` claims set to the `client_id` and signing the payload with the `client_secret` using an HMAC SHA algorithm (HS256, HS384, or HS512). See [Build a JWT for Client Authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/java/main/).

        ```
        "client_assertion" : "<client_assertion_value>"
        "client_assertion_type" : "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
        ```
    Client authentication `private_key_jwt`:
      type: http
      scheme: postBody
      description: |-
        Pass the client credentials in the request body as a JWT `client_assertion` along with the `client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. Generate the assertion by signing the JWT with the `sub` and `iss` claims set to the `client_id` and signing the payload with the corresponding private key using an RSA or ECDSA algorithm (RS256, RS384, RS512, ES256, ES384, ES512). The private key that you use to sign the JWT must have the corresponding public key registered in the client's JWK Set. See [Build a JWT for Client Authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/java/main/).

        ```
        "client_assertion" : "<client_assertion_value>"
        "client_assertion_type" : "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
        ```