openapi: 3.0.0
info:
  title: Okta OpenID Connect & OAuth 2.0
  description: |-
    OAuth 2.0 Protocol APIs

    Contact Support:
     Name: Okta Developer Team
     Email: devex-public@okta.com
  version: 1.0.0
servers:
  - url: http://{{baseurl}}
components:
  securitySchemes:
    apikeyAuth:
      type: http
      scheme: apikey
    basicAuth:
      type: http
      scheme: basic
    oauth2Auth:
      type: http
      scheme: oauth2
security:
  - oauth2Auth: []
tags:
  - name: Dynamic Client Registration
    description: >-
      The Dynamic Client Registration API provides operations to register and
      manage client Applications for use with Okta's OAuth 2.0 and OpenID
      Connect endpoints. This API largely follows the contract defined in
      [RFC7591: OAuth 2.0 Dynamic Client Registration
      Protocol](https://tools.ietf.org/html/rfc7591) and [OpenID Connect Dynamic
      Client Registration
      1.0](https://openid.net/specs/openid-connect-registration-1_0.html).


      > **Note:** Clients managed through this API are modeled as Applications
      in Okta and appear in the Applications section of the Admin Console.
      Changes made through the API appear in the UI and vice versa. Tokens
      issued by these clients follow the rules for access tokens and ID tokens.
  - name: Custom Authorization Servers
    description: >-
      You use a Custom Authorization Server to create and apply authorization
      policies to secure your APIs. An access token that is minted by a Custom
      Authorization Server is consumed by your APIs.


      Okta allows you to [create multiple Custom Authorization
      Servers](https://developer.okta.com/docs/guides/customize-authz-server/main/#create-an-authorization-server)
      within a single Okta org that you can use to protect your own resource
      servers. Within each authorization server, you can define your own custom
      OAuth 2.0 scopes, claims, and access policies to support authorization for
      your APIs.
  - name: Org Authorization Server
    description: >-
      Every Okta org comes with a built-in authorization server called the Org
      Authorization Server. You use the Org Authorization Server to perform SSO
      with Okta for your OpenID Connect apps or to get an access token for the
      Okta APIs. You can't customize this authorization server with regards to
      audience, claims, policies, or scopes. Additionally, the resulting access
      token's issuer is `https://{yourOktaDomain}`, which indicates that only
      Okta can consume or validate it. The access token can't be used or
      validated by your own applications.
  - name: Role Assignment
    description: >-
      The Role Assignment API provides operations to assign, unassign, or list
      the roles for a client.
paths:
  /oauth2/v1/clients:
    get:
      tags:
        - Dynamic Client Registration
      summary: List all Client Applications
      description: Lists all the client applications with pagination
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: after
          in: query
          schema:
            type: string
          description: >-
            The cursor to use for pagination. It is an opaque string that
            specifies your current location in the list and is obtained from the
            `Link` response header. See [Pagination](/#pagination) for more
            information.


            > **Note:** The `after` cursor should be treated as an opaque value
            and obtained through the next link relation.
          example: Duis sint
        - name: limit
          in: query
          schema:
            type: integer
          description: A limit on the number of objects to return.
          example: '20'
        - name: q
          in: query
          schema:
            type: string
          description: >-
            Searches the `client_name` property of clients for matching value.


            > **Note:** Search currently performs a `startsWith` match, but this
            is an implementation detail and may change without notice.
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                - client_id: B6YnDUIpt6Oq354YYaNR
                  client_id_issued_at: 1495059435
                  client_secret_expires_at: 0
                  client_name: Native client
                  client_uri: null
                  logo_uri: null
                  redirect_uris:
                    - https://httpbin.org/get
                  response_types:
                    - id_token
                    - code
                    - token
                  grant_types:
                    - password
                    - refresh_token
                    - authorization_code
                    - implicit
                  token_endpoint_auth_method: client_secret_basic
                  application_type: native
                  frontchannel_logout_uri: https://example.com/logout
                  frontchannel_logout_session_required: false
                - client_id: etwquEhEjxqyA7HDB8lD
                  client_id_issued_at: 1495059868
                  client_secret_expires_at: 0
                  client_name: Service client
                  client_uri: null
                  logo_uri: null
                  redirect_uris: []
                  response_types:
                    - token
                  grant_types:
                    - client_credentials
                  token_endpoint_auth_method: client_secret_basic
                  application_type: service
                  frontchannel_logout_uri: https://example.com/logout
                  frontchannel_logout_session_required: false
                - client_id: l3O8MfR0eTVfLJ7jG2UB
                  client_id_issued_at: 1495059734
                  client_name: Browser client
                  client_uri: null
                  logo_uri: null
                  redirect_uris:
                    - https://httpbin.org/get
                  response_types:
                    - code
                  grant_types:
                    - authorization_code
                  token_endpoint_auth_method: none
                  application_type: browser
                - client_id: rHQoApjizqc4MGVlW5En
                  client_id_issued_at: 1495059117
                  client_secret_expires_at: 0
                  client_name: Web client
                  client_uri: null
                  logo_uri: null
                  redirect_uris:
                    - https://www.example.com/oauth2/redirectUri
                  response_types:
                    - code
                    - id_token
                    - token
                  grant_types:
                    - authorization_code
                    - refresh_token
                    - implicit
                  token_endpoint_auth_method: client_secret_basic
                  application_type: web
                  frontchannel_logout_uri: https://example.com/logout
                  frontchannel_logout_session_required: false
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    post:
      tags:
        - Dynamic Client Registration
      summary: Create a Client Application
      description: >-
        Creates a new client application.


        > **Note:** Apps can be created on the Apps endpoint (`/api/v1/apps`)
        and default to `consent_method=TRUSTED`, while those created with
        Dynamic Client Registration (`/oauth2/v1/clients`) default to
        `consent_method=REQUIRED`."


        > **Note:** If you want to specify the `client_id` or `client_secret`,
        you can use Apps API to create or update a client Application.


        Different Application types have different valid values for the
        corresponding grant type:


        | Application Type  | Valid Grant
        Type                                                           |
        Requirements                                   |

        | :---------------- |
        :-------------------------------------------------------------------------
        | :--------------------------------------------- |

        | `browser`         | `authorization_code`, `implicit`,
        `urn:ietf:params:oauth:grant-type:saml2-bearer`                                          
        |                                                |

        | `native`          | `authorization_code`, `implicit`, `password`,
        `refresh_token`,
        `urn:ietf:params:oauth:grant-type:saml2-bearer`              | Must have
        at least `authorization_code`        |

        | `service`         | `client_credentials`,
        `urn:ietf:params:oauth:grant-type:saml2-bearer`                                                      
        | Works with OAuth 2.0 flow (not OpenID Connect) |

        | `web`             | `authorization_code`, `implicit`, `refresh_token`,
        `client_credentials`(*), `urn:ietf:params:oauth:grant-type:saml2-bearer`
        | Must have at least `authorization_code`        |
      requestBody:
        content:
          application/json:
            schema:
              type: object
              example:
                client_name: Example OAuth Client
                client_uri: https://www.example.com
                logo_uri: https://www.example.com/logo.png
                application_type: web
                redirect_uris:
                  - https://www.example.com/oauth2/redirectUri
                post_logout_redirect_uris:
                  - https://www.example.com/oauth2/postLogoutRedirectUri
                response_types:
                  - code
                  - id_token
                grant_types:
                  - authorization_code
                  - refresh_token
                  - implicit
                token_endpoint_auth_method: client_secret_post
                initiate_login_uri: https://www.example.com/oauth2/login
      security:
        - apikeyAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '201':
          description: Created
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                client_id: 0jrabyQWm4B9zVJPbotY
                client_secret: 5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe
                client_id_issued_at: 1453913425
                client_secret_expires_at: 0
                client_name: Example OAuth Client
                client_uri: https://www.example.com
                logo_uri: https://www.example.com/logo.png
                application_type: web
                redirect_uris:
                  - https://www.example.com/oauth2/redirectUri
                post_logout_redirect_uris:
                  - https://www.example.com/oauth2/postLogoutRedirectUri
                response_types:
                  - id_token
                  - code
                grant_types:
                  - authorization_code
                token_endpoint_auth_method: client_secret_post
                initiate_login_uri: https://www.example.com/oauth2/login
                frontchannel_logout_uri: https://example.com/logout
                frontchannel_logout_session_required: false
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client_metadata
                error_description: 'client_name: The field cannot be left blank'
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/clients/{clientId}:
    get:
      tags:
        - Dynamic Client Registration
      summary: Retrieve a Client application
      description: Retrieves a Client application by `clientId`
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                client_id: 0jrabyQWm4B9zVJPbotY
                client_secret: 5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe
                client_id_issued_at: 1453913425
                client_secret_expires_at: 0
                client_name: Example OAuth Client
                client_uri: https://www.example.com
                logo_uri: https://www.example.com/logo.png
                application_type: web
                redirect_uris:
                  - https://www.example.com/oauth2/redirectUri
                post_logout_redirect_uris:
                  - https://www.example.com/oauth2/postLogoutRedirectUri
                response_types:
                  - id_token
                  - code
                grant_types:
                  - authorization_code
                token_endpoint_auth_method: client_secret_post
                initiate_login_uri: https://www.example.com/oauth2/login
                frontchannel_logout_uri: https://example.com/logout
                frontchannel_logout_session_required: false
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    put:
      tags:
        - Dynamic Client Registration
      summary: Replace a Client Application
      description: >-
        Replaces the settings for a client application.


        > **Note:** You must specifiy all settings when you update a client
        Application. Partial updates aren't supported. If any settings are
        missing when you update a client application, the update fails. The
        exceptions are that you can't include `client_secret_expires_at` or
        `client_id_issued_at` in the request, and you can omit the
        `client_secret`.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              example:
                client_id: 0jrabyQWm4B9zVJPbotY
                client_name: Updated OAuth Client
                client_uri: https://www.example.com
                logo_uri: https://www.example.com/logo.png
                application_type: web
                redirect_uris:
                  - https://www.example.com/oauth2/redirectUri
                post_logout_redirect_uris:
                  - https://www.example.com/oauth2/postLogoutRedirectUri
                response_types:
                  - id_token
                  - code
                grant_types:
                  - authorization_code
                token_endpoint_auth_method: client_secret_post
                initiate_login_uri: https://www.example.com/oauth2/login
      security:
        - apikeyAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                client_id: 0jrabyQWm4B9zVJPbotY
                client_secret: 5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe
                client_id_issued_at: 1453913425
                client_secret_expires_at: 0
                client_name: Updated OAuth Client
                client_uri: https://www.example.com
                logo_uri: https://www.example.com/logo.png
                application_type: web
                redirect_uris:
                  - https://www.example.com/oauth2/redirectUri
                post_logout_redirect_uris:
                  - https://www.example.com/oauth2/postLogoutRedirectUri
                response_types:
                  - id_token
                  - code
                grant_types:
                  - authorization_code
                token_endpoint_auth_method: client_secret_post
                initiate_login_uri: https://www.example.com/oauth2/login
                frontchannel_logout_uri: https://example.com/logout
                frontchannel_logout_session_required: false
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client_metadata
                error_description: 'client_name: The field cannot be left blank'
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    delete:
      tags:
        - Dynamic Client Registration
      summary: Delete a Client Application
      description: Deletes a client application
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/clients/{clientId}/lifecycle/newSecret:
    post:
      tags:
        - Dynamic Client Registration
      summary: Generate a new client secret
      description: >-
        Generates a new client secret for the specified client Application.


        > **Note:** This operation only applies to client Applications that use
        the `client_secret_post` or `client_secret_basic` method for token
        endpoint authorization.
      requestBody:
        content: {}
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                client_id: 0jrabyQWm4B9zVJPbotY
                client_secret: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
                client_id_issued_at: 1453913425
                client_secret_expires_at: 0
                client_name: Updated OAuth Client
                client_uri: https://www.example.com
                logo_uri: https://www.example.com/logo.png
                application_type: web
                redirect_uris:
                  - https://www.example.com/oauth2/redirectUri
                post_logout_redirect_uris:
                  - https://www.example.com/oauth2/postLogoutRedirectUri
                response_types:
                  - id_token
                  - code
                grant_types:
                  - authorization_code
                token_endpoint_auth_method: client_secret_post
                initiate_login_uri: https://www.example.com/oauth2/login
                frontchannel_logout_uri: https://example.com/logout
                frontchannel_logout_session_required: false
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/.well-known/oauth-authorization-server:
    get:
      tags:
        - Custom Authorization Servers
      summary: Retrieve the OAuth 2.0 metadata
      description: >-
        Returns OAuth 2.0 metadata for the specified Custom Authorization
        Server. This information can be used by clients to programmatically
        configure their interactions with Okta. Custom scopes are returned only
        when they are configured to be publicly discoverable. Custom claims are
        never returned.
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: client_id
          in: query
          schema:
            type: string
          description: >-
            Clients can be configured to format the issuer differently. Pass in
            the `client_id` to ensure the returned issuer format matches.
          example: Duis sint
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                issuer: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7
                authorization_endpoint: >-
                  https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize
                token_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token
                registration_endpoint: https://{yourOktaDomain}/oauth2/v1/clients
                jwks_uri: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys
                response_types_supported:
                  - code
                  - token
                  - id_token
                  - code id_token
                  - code token
                  - id_token token
                  - code id_token token
                response_modes_supported:
                  - query
                  - fragment
                  - form_post
                  - okta_post_message
                grant_types_supported:
                  - authorization_code
                  - implicit
                  - refresh_token
                  - password
                  - client_credentials
                  - urn:ietf:params:oauth:grant-type:device_code
                subject_types_supported:
                  - public
                scopes_supported:
                  - okta.myAccount.email.manage
                  - okta.myAccount.email.read
                  - okta.myAccount.manage
                  - okta.myAccount.phone.manage
                  - okta.myAccount.phone.read
                  - okta.myAccount.profile.manage
                  - okta.myAccount.profile.read
                  - okta.myAccount.read
                  - openid
                  - profile
                  - email
                  - address
                  - phone
                  - offline_access
                  - device_sso
                token_endpoint_auth_methods_supported:
                  - client_secret_basic
                  - client_secret_post
                  - client_secret_jwt
                  - private_key_jwt
                  - none
                claims_supported:
                  - ver
                  - jti
                  - iss
                  - aud
                  - iat
                  - exp
                  - cid
                  - uid
                  - scp
                  - sub
                code_challenge_methods_supported:
                  - S256
                introspection_endpoint: >-
                  https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect
                introspection_endpoint_auth_methods_supported:
                  - client_secret_basic
                  - client_secret_post
                  - client_secret_jwt
                  - private_key_jwt
                  - none
                revocation_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke
                revocation_endpoint_auth_methods_supported:
                  - client_secret_basic
                  - client_secret_post
                  - client_secret_jwt
                  - private_key_jwt
                  - none
                end_session_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout
                request_parameter_supported: true
                request_object_signing_alg_values_supported:
                  - HS256
                  - HS384
                  - HS512
                  - RS256
                  - RS384
                  - RS512
                  - ES256
                  - ES384
                  - ES512
                device_authorization_endpoint: >-
                  https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize
                pushed_authorization_request_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: invalid_client
                errorSummary: Invalid value for 'client_id' parameter.
                errorLink: invalid_client
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
  /oauth2/{authorizationServerId}/.well-known/openid-configuration:
    get:
      tags:
        - Custom Authorization Servers
      summary: Retrieve the OpenID Connect metadata
      description: >-
        Returns OpenID Connect metadata for the specified Custom Authorization
        Server. This information can be used by clients to programmatically
        configure their interactions with Okta. Custom scopes are returned only
        when they are configured to be publicly discoverable. Custom claims are
        never returned.
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: client_id
          in: query
          schema:
            type: string
          description: >-
            Clients can be configured to format the issuer differently. Pass in
            the `client_id` to ensure the returned issuer format matches.
          example: Duis sint
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                issuer: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7
                authorization_endpoint: >-
                  https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/authorize
                token_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/token
                userinfo_endpoint: >-
                  https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/userinfo
                registration_endpoint: https://{yourOktaDomain}/oauth2/v1/clients
                jwks_uri: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/keys
                response_types_supported:
                  - code
                  - id_token
                  - code id_token
                  - code token
                  - id_token token
                  - code id_token token
                response_modes_supported:
                  - query
                  - fragment
                  - form_post
                  - okta_post_message
                grant_types_supported:
                  - authorization_code
                  - implicit
                  - refresh_token
                  - password
                  - urn:ietf:params:oauth:grant-type:device_code
                subject_types_supported:
                  - public
                id_token_signing_alg_values_supported:
                  - RS256
                scopes_supported:
                  - okta.myAccount.email.manage
                  - okta.myAccount.email.read
                  - okta.myAccount.manage
                  - okta.myAccount.phone.manage
                  - okta.myAccount.phone.read
                  - okta.myAccount.profile.manage
                  - okta.myAccount.profile.read
                  - okta.myAccount.read
                  - openid
                  - profile
                  - email
                  - address
                  - phone
                  - offline_access
                  - device_sso
                token_endpoint_auth_methods_supported:
                  - client_secret_basic
                  - client_secret_post
                  - client_secret_jwt
                  - private_key_jwt
                  - none
                claims_supported:
                  - iss
                  - ver
                  - sub
                  - aud
                  - iat
                  - exp
                  - jti
                  - auth_time
                  - amr
                  - idp
                  - nonce
                  - name
                  - nickname
                  - preferred_username
                  - given_name
                  - middle_name
                  - family_name
                  - email
                  - email_verified
                  - profile
                  - zoneinfo
                  - locale
                  - address
                  - phone_number
                  - picture
                  - website
                  - gender
                  - birthdate
                  - updated_at
                  - at_hash
                  - c_hash
                code_challenge_methods_supported:
                  - S256
                introspection_endpoint: >-
                  https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/introspect
                introspection_endpoint_auth_methods_supported:
                  - client_secret_basic
                  - client_secret_post
                  - client_secret_jwt
                  - private_key_jwt
                  - none
                revocation_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/revoke
                revocation_endpoint_auth_methods_supported:
                  - client_secret_basic
                  - client_secret_post
                  - client_secret_jwt
                  - private_key_jwt
                  - none
                end_session_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/logout
                request_parameter_supported: true
                request_object_signing_alg_values_supported:
                  - HS256
                  - HS384
                  - HS512
                  - RS256
                  - RS384
                  - RS512
                  - ES256
                  - ES384
                  - ES512
                device_authorization_endpoint: >-
                  https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/device/authorize
                pushed_authorization_request_endpoint: https://{yourOktaDomain}/oauth2/aus59pz16qgMvHvBS0g7/v1/par
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: invalid_client
                errorSummary: Invalid value for 'client_id' parameter.
                errorLink: invalid_client
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/authorize:
    get:
      tags:
        - Custom Authorization Servers
      summary: /authorize
      description: >-
        This is a starting point for browser-based OpenID Connect flows such as
        the implicit and authorization code flows. This request authenticates
        the user and returns tokens along with an authorization grant to the
        client application as a part of the callback response.


        > **Note:** Requests to the `/authorize` endpoint should redirect the
        browser (user agent) to the endpoint. You can't use AJAX with this
        endpoint. Example responses are intentionally omitted, but include
        displaying a sign-in prompt, redirecting to the client application, or
        displaying an error.
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: acr_values
          in: query
          schema:
            type: string
          description: >-
            An optional parameter that can be included in the authentication
            request. This parameter increases the level of user assurance.


            > **Note:** Multiple space-delimited values may be provided. The
            authorization server will choose one and reflect the chosen value in
            any resulting tokens.
          example: urn:okta:loa:1fa:any
        - name: client_id
          in: query
          schema:
            type: string
          description: >-
            Obtained during either manual client registration or via the Dynamic
            Client Registration API. It identifies the client and must match the
            value preregistered in Okta.
          example: Duis sint
        - name: code_challenge
          in: query
          schema:
            type: string
          description: >-
            A challenge for
            [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/).
            The challenge is verified in the access token request.
          example: Duis sint
        - name: code_challenge_method
          in: query
          schema:
            type: string
          description: >-
            Method used to derive the code challenge for
            [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/).
          example: S256
        - name: display
          in: query
          schema:
            type: string
          description: >-
            The `display` parameter to be passed to the Social Identity Provider
            when performing Social Login.
          example: Duis sint
        - name: enroll_amr_values
          in: query
          schema:
            type: string
          description: >-
            <div class="x-lifecycle-container"><x-lifecycle
            class="lea"></x-lifecycle> <x-lifecycle
            class="oie"></x-lifecycle></div>A space-delimited list of values
            indicating which authenticators to enroll in.


            * If the `enroll_amr_values` parameter is specified, then the value
            for `prompt` must be `enroll_authenticator`.

            * The parameter value is space delimited, for example, `pwd sms
            okta_verify` is a valid request parameter value. You are prompted in
            the order of the amr values provided.
          example: tel
        - name: idp_scope
          in: query
          schema:
            type: string
          description: >-
            An Okta Extension to the OpenID Specification. A space delimited
            list of scopes to be provided to the external Identity Provider when
            performing [Social
            login](https://developer.okta.com/docs/concepts/identity-providers/).
            These scopes are used in addition to the scopes already configured
            on the Identity Provider.
          example: Duis sint
        - name: idp
          in: query
          schema:
            type: string
          description: >-
            An Okta Extension to the OpenID Specification. The ID of the
            Identity Provider to use if there's no Okta Session.
          example: Duis sint
        - name: login_hint
          in: query
          schema:
            type: string
          description: A username to prepopulate if prompting for authentication.
          example: Duis sint
        - name: max_age
          in: query
          schema:
            type: integer
          description: >-
            Allowable elapsed time, in seconds, since the last time the end user
            was actively authenticated by Okta.
          example: '57364751'
        - name: nonce
          in: query
          schema:
            type: string
          description: >-
            A value that is returned in the ID token. It is used to mitigate
            replay attacks. The value is required for Implicit and Hybrid flows,
            but optional for Auth Code flows. See [OIDC
            Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
          example: Duis sint
        - name: prompt
          in: query
          schema:
            type: string
          description: >-
            If no `prompt` parameter is specified, the standard behavior occurs:

            * If an Okta session already exists and meets the assurance
            requirements of the app, the user is silently authenticated.
            Otherwise, the user is prompted to authenticate.

            * If scopes are requested that require consent and consent isn't yet
            given by the authenticated user, the user is prompted to give
            consent.
          example: enroll_authenticator
        - name: redirect_uri
          in: query
          schema:
            type: string
          description: >-
            Callback location where the authorization code or tokens should be
            sent. It must match the value preregistered in Okta during client
            registration.
          example: Duis sint
        - name: response_type
          in: query
          schema:
            type: string
          description: >-
            Any combination of `code`, `token`, and `id_token`. The combination
            determines the
            [flow](https://developer.okta.com/docs/concepts/oauth-openid/#recommended-flow-by-application-type).
          example: id_token token
        - name: response_mode
          in: query
          schema:
            type: string
          description: >-
            How the authorization response should be returned. If `id_token` or
            `token` is specified in the `response_type`, then `query` isn't
            allowed as a response mode. Defaults to `fragment` in implicit and
            hybrid flows.
          example: form_post
        - name: request_uri
          in: query
          schema:
            type: string
          description: >-
            Location where the authorization request payload data is referenced
            in an authorization request to the `/authorize` endpoint. This is
            returned from a Pushed Authorization Request at the `/par` endpoint.
          example: Duis sint
        - name: request
          in: query
          schema:
            type: string
          description: >-
            A JWT created by the client that enables requests to be passed as a
            single, self-contained parameter. See [Parameter
            details](#parameter-details).


            * You must sign the JWT using either the app's client secret or a
            private key whose public key is registered on the app's JWKSet.

            * The JWT can't be encrypted.

            >  **Note:** See [Build a JWT for client
            authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/)
            for information on how to build a JWT.

            * Okta supports the
            [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2),
            [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and
            [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature
            algorithms. HMAC signatures require that the client has a
            `token_endpoint_auth_method` that uses a `client_secret`. RSA and
            ECDSA signatures requires that the client registers a public key.

            * We recommend that you don't duplicate any request parameters in
            both the JWT and the query URI itself. However, you can do so with
            `state`, `nonce`, `code_challenge`, and `code_challenge_method`. In
            those cases, the values in the JWT overrides the query URI values.

            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the Authorization Server issuer that mints the ID or access token. This value is published in the metadata for your Authorization Server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it has already been processed.
          example: Duis sint
        - name: scope
          in: query
          schema:
            type: string
          description: >-
            A space-delimited string of scopes requested. This includes:

            * The OpenID Connect and OAuth 2.0 reserved scopes: `openid`,
            `profile`, `email`, `address`, `phone`, `offline_access`, and
            `groups`

            * The Okta reserved scope `device_sso`

            * Any custom scopes defined in the matching Custom Authorization
            Server
          example: Duis sint
        - name: sessionToken
          in: query
          schema:
            type: string
          description: >-
            An Okta Extension to the OpenID Specification. Okta one-time session
            token. This allows an API-based user sign-in flow (rather than the
            Okta sign-in UI).
          example: Duis sint
        - name: state
          in: query
          schema:
            type: string
          description: >-
            A value to be returned with the token. The client application can
            use it to remember the state of its interaction with the end user at
            the time of the authentication call. It can contain alphanumeric,
            comma, period, underscore, and hyphen characters. 


            Okta requires the OAuth 2.0 `state` parameter on all requests to the
            `/authorize` endpoint to prevent cross-site request forgery (CSRF).

            The OAuth 2.0 specification
            [requires](https://tools.ietf.org/html/rfc6749#section-10.12) that
            clients protect their redirect URIs against CSRF by sending a value
            in the authorize request that binds the request to the user-agent's
            authenticated state.

            Using the `state` parameter is also a countermeasure to several
            other known attacks as outlined in [OAuth 2.0 Threat Model and
            Security Considerations](https://tools.ietf.org/html/rfc6819).
          example: Duis sint
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/bc/authorize:
    post:
      tags:
        - Custom Authorization Servers
      summary: /bc/authorize
      description: >-
        This endpoint returns a unique identifier (`auth_req_id`) that
        identifies the authentication flow while it tries to authenticate the
        user in the background. This `auth_req_id` value is used in subsequent
        token requests to the `/token` endpoint.


        > **Note:** The `/bc/authorize` endpoint requires client authentication.
        The method is configured per client application. See [Client
        authentication methods](/openapi/okta-oauth/guides/client-auth/) for
        more information.
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  example: 0jrabyQWm4B9zVJPbotY
                client_secret:
                  type: string
                  example: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
                scope:
                  type: string
                  description: >-
                    (Required) `openid` is required for authentication requests.
                    You can also include other scopes.
                  example: openid
                binding_message:
                  type: string
                  description: >-
                    A message that appears for the user to identify the
                    transaction.
                  example: Signing in from device
                login_hint:
                  type: string
                  description: >-
                    A hint to the OpenID Provider regarding the user for whom
                    authentication is being requested.


                    **Note:** You can specify either `login_hint` or
                    `id_token_hint` in the authentication request, not both.
                  example: john.doe@example.com
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                auth_req_id: ftJwF5ZwW2SGPPoTQEKtAr_U8_Ek3RvWyR
                expires_in: 300
                interval: 5
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_request
                error_description: >-
                  Cannot supply multiple client credentials. Use one of the
                  following: credentials in the Authorization header,
                  credentials in the post body, or a client_assertion in the
                  post body.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/challenge:
    post:
      tags:
        - Custom Authorization Servers
      summary: /challenge
      description: >-
        Initiates the challenge of subsequent factor(s) in a Direct
        Authentication flow after the token endpoint has responded with
        'mfa_required'. This endpoint is optional if the client is able to
        proceed without it, for example, the client knows it needs to follow up
        with an OTP and can prompt the end user for one.


        > **Note:** The `/challenge` endpoint requires client authentication.
        The method is configured per client application. See [Client
        authentication methods](/openapi/okta-oauth/guides/client-auth/).
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                mfa_token:
                  type: string
                  description: >-
                    (Required) The value returned from a previous token or
                    challenge request for identifying the multifactor
                    transaction across multiple requests
                  example: Qwk9va6QYgR3s7JMiWUm
                channel_hint:
                  type: string
                  description: >-
                    The out-of-band channel for use with authentication.
                    Required for all `/oob-authenticate` requests and any
                    `/challenge` request with an out-of-band authenticator.
                  example: push
                challenge_types_supported:
                  type: string
                  description: >-
                    List of direct authentication challenge types supported by
                    the client
                  example: http://auth0.com/oauth/grant-type/mfa-oob
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                challenge_type: http://auth0.com/oauth/grant-type/mfa-otp
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: access_denied
                error_description: >-
                  'foo' has expired. Use a new 'oob_code' or 'mfa_token' and try
                  again.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: >-
                  The client secret supplied for a confidential client is
                  invalid.
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: access_denied
                error_description: >-
                  'foo' has expired. Use a new 'oob_code' or 'mfa_token' and try
                  again.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_grant
                error_description: API call exceeded rate limit due to too many requests.
  /oauth2/{authorizationServerId}/v1/device/authorize:
    post:
      tags:
        - Custom Authorization Servers
      summary: /device/authorize
      description: >-
        Returns a user code, device code, activation link, and QR code
        activation link
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  description: >-
                    Obtained during either manual client registration or via the
                    Dynamic Client Registration API. It identifies the client
                    and must match the value preregistered in Okta.
                  example: et veniam non fugiat
                scope:
                  type: string
                  description: >-
                    A list of scopes that the client wants included in the
                    access token.
                  example: reprehenderit ut
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                user_code: RGTCFDTL
                device_code: 5cbeb234-7e00-4ff7-9aa2-b1a4558a75d2
                interval: 5
                verification_uri_complete: https://{yourOktaDomain}/activate?user_code=RGTCFDTL
                verification_uri: https://{yourOktaDomain}/activate
                expires_in: 600
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_scope
                error_description: No scopes were requested.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/introspect:
    post:
      tags:
        - Custom Authorization Servers
      summary: /introspect
      description: >-
        This endpoint takes an access token, ID token, refresh token, or device
        secret and returns a boolean that indicates whether it is active. If the
        token is active, additional data about the token is also returned. If
        the token is invalid, expired, or revoked, it is considered inactive.


        Be sure that you are using the `/introspect` endpoint of the same
        authorization server that you used to create the token.


        > **Note:** The `/introspect` endpoint requires client authentication.
        The method is configured per client application. See [Client
        authentication methods](/openapi/okta-oauth/guides/client-auth/) for
        more information. For public clients (such as single-page and mobile
        apps) that don't have a `client_secret`, you must include the
        `client_id` as a query parameter when calling the `/introspect`
        endpoint. Make sure that you aren't passing the Authorization header in
        the request.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              example:
                token: culpa consequat
                token_type_hint: refresh_token
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                active: true
                token_type: Bearer
                scope: openid profile
                client_id: a9VpZDRCeFh3Nkk2VdYa
                username: john.doe@example.com
                exp: 1451606400
                iat: 1451602800
                sub: john.doe@example.com
                aud: https://{yourOktaDomain}
                iss: https://{yourOktaDomain}/oauth2/orsmsg0aWLdnF3spV0g3
                jti: AT.7P4KlczBYVcWLkxduEuKeZfeiNYkZIC9uGJ28Cc-YaI
                uid: 00uid4BxXw6I6TV4m0g3
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_request
                error_description: The `token` parameter is required.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/keys:
    get:
      tags:
        - Custom Authorization Servers
      summary: /keys
      description: >-
        Returns a JSON Web Key Set (JWKS) that contains the public keys that can
        be used to verify the signatures of tokens that you receive from your
        authorization server.


        Any of the two or three keys listed are used to sign tokens. The order
        of keys in the result doesn't indicate which keys are used.


        These keys can be used to locally validate JWTs returned by Okta.
        Standard open-source libraries are available for every major language to
        perform [JWS](https://datatracker.ietf.org/doc/html/rfc7515) signature
        validation.


        > **Note:** The information returned from this endpoint could lag
        slightly, but will eventually be up-to-date.
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Cache-Control:
              schema:
                type: string
                example: max-age=3832304, must-revalidate
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                keys:
                  - alg: RS256
                    e: AQAB
                    'n': >-
                      iKqiD4cr7FZKm6f05K4r-GQOvjRqjOeFmOho9V7SAXYwCyJluaGBLVvDWO1XlduPLOrsG_Wgs67SOG5qeLPR8T1zDK4bfJAo1TvbwYeTwVSfd_0mzRq8WaVc_2JtEK7J-4Z0MdVm_dJmcMHVfDziCRohSZthN__WM2NwGnbewWnla0wpEsU3QMZ05_OxvbBdQZaDUsNSx46is29eCdYwhkAfFd_cFRq3DixLEYUsRwmOqwABwwDjBTNvgZOomrtD8BRFWSTlwsbrNZtJMYU33wuLO9ynFkZnY6qRKVHr3YToIrqNBXw0RWCheTouQ-snfAB6wcE2WDN3N5z760ejqQ
                    kid: U5R8cHbGw445Qbq8zVO1PcCpXL8yG6IcovVa3laCoxM
                    kty: RSA
                    use: sig
                  - alg: RS256
                    e: AQAB
                    'n': >-
                      l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK3HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37-XDIDb0XG-R8DOoOHLJPTpsgH-rJeM5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX-0TmG5yjSj7ek05txcpxIqYu-7FIGT0KKvXge_BOSEUlJpBhLKU28OtsOnmc3NLIGXB-GeDiUZiBYQdPR-myB4ZoQ
                    kid: Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo
                    kty: RSA
                    use: sig
                  - alg: RS256
                    e: AQAB
                    'n': >-
                      lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7UGLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap-CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvpdMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu-DYhT0hmyFcwn-tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ
                    kid: h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU
                    kty: RSA
                    use: sig
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/logout:
    get:
      tags:
        - Custom Authorization Servers
      summary: /logout
      description: >-
        Use this operation to sign a user out by removing their Okta browser
        session.


        This endpoint takes an ID token and logs the user out of Okta if the
        subject matches the current Okta session. A `post_logout_redirect_uri`
        may be specified to redirect the browser after the logout is performed.
        Otherwise, the browser is redirected to the Okta sign-in page. See [Sign
        users](https://developer.okta.com/docs/guides/sign-users-out/) out for
        more information.


        If no Okta session exists, this endpoint has no effect and the browser
        is redirected immediately to the Okta sign-in page or the
        `post_logout_redirect_uri` (if specified).


        > **Note:** Requests to the `/logout` endpoint should redirect the
        browser (user agent) to the endpoint. You can't use AJAX with this
        endpoint. We may load an interstitial to do client-side logic before
        finally redirecting to the `post_logout_redirect_uri` or sign-in page if
        no redirect is provided.
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: id_token_hint
          in: query
          schema:
            type: string
          description: >-
            (Required) A valid ID token with a subject that matches the current
            session
          example: Duis sint
        - name: post_logout_redirect_uri
          in: query
          schema:
            type: string
          description: >-
            Location to redirect to after the user signs out. It must match the
            value preregistered in Okta during client registration.
          example: Duis sint
        - name: state
          in: query
          schema:
            type: string
          description: >-
            An optional value that is returned as a query parameter during the
            redirect at the end of the flow
          example: Duis sint
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    post:
      tags:
        - Custom Authorization Servers
      summary: /logout
      description: >-
        Use this operation to sign a user out by removing their Okta browser
        session.


        This endpoint uses the ID token to verify that the subject matches the
        current Okta session, and then signs the user. You can specify a
        `post_logout_redirect_uri` to redirect the browser after the user is
        signs out. Otherwise, the browser is redirected to the Okta sign-in
        page. See [Sign users
        out](https://developer.okta.com/docs/guides/sign-users-out/).


        If no Okta session exists, this endpoint has no effect and the browser
        is redirected immediately to the Okta sign-in page or the
        `post_logout_redirect_uri` (if specified).


        > **Note:** When making requests to the `/logout` endpoint, the browser
        (user agent) should be redirected to the endpoint. You need to make a
        POST request from a form. A POST request to this endpoint from the
        backend doesn't completely terminate the session.
      requestBody:
        content: {}
      security:
        - basicAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: id_token_hint
          in: query
          schema:
            type: string
          description: >-
            (Required) A valid ID token with a subject that matches the current
            session
          example: Duis sint
        - name: post_logout_redirect_uri
          in: query
          schema:
            type: string
          description: >-
            Location to redirect to after the user signs out. It must match the
            value preregistered in Okta during client registration.
          example: Duis sint
        - name: state
          in: query
          schema:
            type: string
          description: >-
            An optional value that is returned as a query parameter during the
            redirect at the end of the flow
          example: Duis sint
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/oob-authenticate:
    post:
      tags:
        - Custom Authorization Servers
      summary: /oob-authenticate
      description: >-
        Initiates Direct Authentication with an out-of-band authenticator


        > **Note:** The `/oob-authenticate` endpoint requires client
        authentication. The method is configured per client application. See
        [Client authentication
        methods](/openapi/okta-oauth/guides/client-auth/).
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                login_hint:
                  type: string
                  description: >-
                    (Required) The user sign-in information for whom
                    authentication is being requested
                  example: testuser@example.com
                channel_hint:
                  type: string
                  description: >-
                    (Required) The out-of-band channel for use with
                    authentication. Required for all `/oob-authenticate`
                    requests and any `/challenge` request with an out-of-band
                    authenticator.
                  example: push
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
                channel: push
                binding_method: none
                expires_in: 300
                interval: 5
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_request
                error_description: >-
                  'foo' is not supported as a 'channel_hint'. Try again with
                  another value.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: >-
                  The client secret supplied for a confidential client is
                  invalid.
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: access_denied
                error_description: >-
                  The required authenticator cannot be used. Check if it is
                  required by policy and the user is enrolled in the
                  authenticator and try again.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_grant
                error_description: API call exceeded rate limit due to too many requests.
  /oauth2/{authorizationServerId}/v1/par:
    options:
      tags:
        - Custom Authorization Servers
      summary: /par
      description: >-
        Use this operation to request the permitted communication options for
        the `/par` operation.


        > **Note:** CORS is enforced on a per-client basis. This endpoint will
        always return CORS headers with the current Origin.
      requestBody:
        content: {}
      security:
        - basicAuth: []
      parameters:
        - name: Origin
          in: header
          schema:
            type: string
          example: example.okta.com
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
                example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
                example: POST
            Access-Control-Max-Age:
              schema:
                type: string
                example: occaecat
            Vary:
              schema:
                type: string
                example: Origin
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    post:
      tags:
        - Custom Authorization Servers
      summary: /par
      description: >-
        The pushed authorization request endpoint (`/par`) promotes OAuth
        security by allowing the authorization server to authenticate the client
        before any user interaction happens. The increased confidence in the
        client's identity during the authorization process means the
        authorization server can refuse illegitimate requests much earlier in
        the process. This process prevents attempts to spoof clients or
        otherwise tamper with or misuse an authorization request and provides a
        simple way to make a confidential and integrity-protected authorization
        request.


        The `/par` endpoint allows an OAuth 2.0 client to push the payload of an
        authorization request directly to the authorization server. The
        authorization server provides a `request_uri` value in the response that
        can be used as a reference to the authorization request payload data in
        a subsequent call to the `/authorize` endpoint through a user agent.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              example:
                client_id: exercitation cupidatat
                code_challenge: veniam elit dolor ad deserunt
                code_challenge_method: nostrud amet consequat ad
                display: ipsum dolor Duis ut
                idp: adipisicing minim dolor
                idp_scope: veniam ea ulla
                login_hint: voluptate nulla ex consectetur
                max_age: 39339404
                nonce: Duis laborum
                prompt: pariatur deserunt
                redirect_uri: aliquip fugiat aliqua exercitation pariatu
                request: pariatur
                response_mode: consequat ullamco aliquip ea
                response_type: do consectetur in voluptate pariatur
                scope: consectetur ut et
                sessionToken: minim in
                state: dolor amet
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                request_uri: >-
                  urn:okta:Y1hIQ3ZqYjFodEZMOVJ3TUF4ZHRPZjJuNFZRV2ZWQ044MmFoX2VIT2oyNDo
                expires_in: 3600
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_scope
                error_description: No scopes were requested.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: Invalid value for client_id' parameter.
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: access_denied
                error_description: >-
                  Requests for ID tokens or access tokens with OpenID scopes
                  require the 'openid' scope.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/revoke:
    post:
      tags:
        - Custom Authorization Servers
      summary: /revoke
      description: >-
        The API takes an access or refresh token and revokes it. Revoked tokens
        are considered inactive at the introspection endpoint. A client may only
        revoke its own tokens. See [Revoke
        tokens](https://developer.okta.com/docs/guides/revoke-tokens/) for more
        information.


        > **Note:** The `/revoke` endpoint requires client authentication. The
        method is configured per client application. See [Client authentication
        methods](/openapi/okta-oauth/guides/client-auth/) for more information.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              example:
                token: consectetur dolore commodo nulla
                token_type_hint: device_secret
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_request
                error_description: The `token` parameter is required.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/token:
    options:
      tags:
        - Custom Authorization Servers
      summary: /token
      description: >-
        Use this operation to request the permitted communication options for
        the `/token` operation.


        > **Note:** CORS is enforced on a per-client basis. This endpoint will
        always return CORS headers with the current Origin.
      requestBody:
        content: {}
      security:
        - basicAuth: []
      parameters:
        - name: Origin
          in: header
          schema:
            type: string
          example: example.okta.com
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
                example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
                example: POST
            Access-Control-Max-Age:
              schema:
                type: string
                example: occaecat
            Vary:
              schema:
                type: string
                example: Origin
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    post:
      tags:
        - Custom Authorization Servers
      summary: /token
      description: >-
        This endpoint returns access tokens, ID tokens, and refresh tokens
        depending on the request parameters. For password, client credentials,
        saml2 assertion, and refresh token flows, calling `/token` is the only
        step of the flow. For the authorization code flow, calling `/token` is
        the second step of the flow.


        > **Note:** The `/token` endpoint requires client authentication. The
        method is configured per client application. See [Client authentication
        methods](/openapi/okta-oauth/guides/client-auth/) for more information.
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  example: 0jrabyQWm4B9zVJPbotY
                client_secret:
                  type: string
                  example: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
                grant_type:
                  type: string
                  description: >-
                    Determines the mechanism Okta uses to authorize the creation
                    of the tokens.
                  example: authorization_code
                redirect_uri:
                  type: string
                  example: https://www.example.com/oauth2/redirectUri
                code:
                  type: string
                  example: QnowT-aeawtOJKp-MtkH&
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                access_token: >-
                  eyJhbGciOiJSUzI1NiJ9.eyJ2ZXIiOjEsImlzcyI6Imh0dHA6Ly9yYWluLm9rdGExLmNvbToxODAyIiwiaWF0IjoxNDQ5NjI0MDI2LCJleHAiOjE0NDk2Mjc2MjYsImp0aSI6IlVmU0lURzZCVVNfdHA3N21BTjJxIiwic2NvcGVzIjpbIm9wZW5pZCIsImVtYWlsIl0sImNsaWVudF9pZCI6InVBYXVub2ZXa2FESnh1a0NGZUJ4IiwidXNlcl9pZCI6IjAwdWlkNEJ4WHc2STZUVjRtMGczIn0.HaBu5oQxdVCIvea88HPgr2O5evqZlCT4UXH4UKhJnZ5px-ArNRqwhxXWhHJisslswjPpMkx1IgrudQIjzGYbtLFjrrg2ueiU5-YfmKuJuD6O2yPWGTsV7X6i7ABT6P-t8PRz_RNbk-U1GXWIEkNnEWbPqYDAm_Ofh7iW0Y8WDA5ez1jbtMvd-oXMvJLctRiACrTMLJQ2e5HkbUFxgXQ_rFPNHJbNSUBDLqdi2rg_ND64DLRlXRY7hupNsvWGo0gF4WEUk8IZeaLjKw8UoIs-ETEwJlAMcvkhoVVOsN5dPAaEKvbyvPC1hUGXb4uuThlwdD3ECJrtwgKqLqcWonNtiw
                token_type: Bearer
                expires_in: 3600
                scope: openid email offline_access
                refresh_token: a9VpZDRCeFh3Nkk2VdY
                id_token: >-
                  eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIwMHVpZDRCeFh3Nkk2VFY0bTBnMyIsImVtYWlsIjoid2VibWFzdGVyQGNsb3VkaXR1ZGUubmV0IiwiZW1haWxfdmVyaWZpZWQiOnRydWUsInZlciI6MSwiaXNzIjoiaHR0cDovL3JhaW4ub2t0YTEuY29tOjE4MDIiLCJsb2dpbiI6ImFkbWluaXN0cmF0b3IxQGNsb3VkaXR1ZGUubmV0IiwiYXVkIjoidUFhdW5vZldrYURKeHVrQ0ZlQngiLCJpYXQiOjE0NDk2MjQwMjYsImV4cCI6MTQ0OTYyNzYyNiwiYW1yIjpbInB3ZCJdLCJqdGkiOiI0ZUFXSk9DTUIzU1g4WGV3RGZWUiIsImF1dGhfdGltZSI6MTQ0OTYyNDAyNiwiYXRfaGFzaCI6ImNwcUtmZFFBNWVIODkxRmY1b0pyX1EifQ.Btw6bUbZhRa89DsBb8KmL9rfhku--_mbNC2pgC8yu8obJnwO12nFBepui9KzbpJhGM91PqJwi_AylE6rp-ehamfnUAO4JL14PkemF45Pn3u_6KKwxJnxcWxLvMuuisnvIs7NScKpOAab6ayZU0VL8W6XAijQmnYTtMWQfSuaaR8rYOaWHrffh3OypvDdrQuYacbkT0csxdrayXfBG3UF5-ZAlhfch1fhFT3yZFdWwzkSDc0BGygfiFyNhCezfyT454wbciSZgrA9ROeHkfPCaX7KCFO8GgQEkGRoQntFBNjluFhNLJIUkEFovEDlfuB4tv_M8BM75celdy3jkpOurg
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_grant
                error_description: The authorization code is invalid or has expired.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/{authorizationServerId}/v1/userinfo:
    get:
      tags:
        - Custom Authorization Servers
      summary: /userinfo
      description: >-
        Returns information about the user that is the subject of the access
        token. Many of these claims are also included in the [ID
        token](https://developer.okta.com/docs/reference/api/oidc/#id-token),
        but calling this endpoint always returns all of the user's claims. The
        ID token can be configured to include a subset of the user's claims. See
        [Scope-dependent
        claims](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned)
        for more information.
      security:
        - oauth2Auth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: authorizationServerId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the Authorization Server
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                sub: 00uid4BxXw6I6TV4m0g3
                name: John Doe
                nickname: Jimmy
                given_name: John
                middle_name: James
                family_name: Doe
                profile: https://example.com/john.doe
                zoneinfo: America/Los_Angeles
                locale: en-US
                updated_at: 1311280970
                email: john.doe@example.com
                email_verified: true
                address:
                  street_address: 123 Hollywood Blvd.
                  locality: Los Angeles
                  region: CA
                  postal_code: '90210'
                  country: US
                phone_number: +1 (425) 555-1212
        '401':
          description: Unauthorized
          headers:
            WWW-Authenticate:
              schema:
                type: string
                example: >-
                  Bearer error="invalid_token", error_description="The access
                  token is invalid"
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            WWW-Authenticate:
              schema:
                type: string
                example: >-
                  Bearer error="insufficient_scope", error_description="The
                  access token must provide access to at least one of these
                  scopes - profile, email, address or phone"
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /.well-known/openid-configuration:
    get:
      tags:
        - Org Authorization Server
      summary: Retrieve the OpenID Connect metadata
      description: >-
        Returns OpenID Connect metadata for the Org Authorization Server. This
        information can be used by clients to programmatically configure their
        interactions with Okta. Custom scopes are returned only when they are
        configured to be publicly discoverable. Custom claims are never
        returned.
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: client_id
          in: query
          schema:
            type: string
          description: >-
            Clients can be configured to format the issuer differently. Pass in
            the `client_id` to ensure the returned issuer format matches.
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                issuer: https://{yourOktaDomain}
                authorization_endpoint: https://{yourOktaDomain}/oauth2/v1/authorize
                token_endpoint: https://{yourOktaDomain}/oauth2/v1/token
                userinfo_endpoint: https://{yourOktaDomain}/oauth2/v1/userinfo
                registration_endpoint: https://{yourOktaDomain}/oauth2/v1/clients
                jwks_uri: https://{yourOktaDomain}/oauth2/v1/keys
                response_types_supported:
                  - code
                  - id_token
                  - code id_token
                  - code token
                  - id_token token
                  - code id_token token
                response_modes_supported:
                  - query
                  - fragment
                  - form_post
                  - okta_post_message
                grant_types_supported:
                  - authorization_code
                  - implicit
                  - refresh_token
                  - password
                  - urn:ietf:params:oauth:grant-type:device_code
                subject_types_supported:
                  - public
                id_token_signing_alg_values_supported:
                  - RS256
                scopes_supported:
                  - openid
                  - email
                  - profile
                  - address
                  - phone
                  - offline_access
                  - groups
                token_endpoint_auth_methods_supported:
                  - client_secret_basic
                  - client_secret_post
                  - client_secret_jwt
                  - private_key_jwt
                  - none
                claims_supported:
                  - iss
                  - ver
                  - sub
                  - aud
                  - iat
                  - exp
                  - jti
                  - auth_time
                  - amr
                  - idp
                  - nonce
                  - name
                  - nickname
                  - preferred_username
                  - given_name
                  - middle_name
                  - family_name
                  - email
                  - email_verified
                  - profile
                  - zoneinfo
                  - locale
                  - address
                  - phone_number
                  - picture
                  - website
                  - gender
                  - birthdate
                  - updated_at
                  - at_hash
                  - c_hash
                code_challenge_methods_supported:
                  - S256
                introspection_endpoint: https://{yourOktaDomain}/oauth2/v1/introspect
                introspection_endpoint_auth_methods_supported:
                  - client_secret_basic
                  - client_secret_post
                  - client_secret_jwt
                  - private_key_jwt
                  - none
                revocation_endpoint: https://{yourOktaDomain}/oauth2/v1/revoke
                revocation_endpoint_auth_methods_supported:
                  - client_secret_basic
                  - client_secret_post
                  - client_secret_jwt
                  - private_key_jwt
                  - none
                end_session_endpoint: https://{yourOktaDomain}/oauth2/v1/logout
                request_parameter_supported: true
                request_object_signing_alg_values_supported:
                  - HS256
                  - HS384
                  - HS512
                  - RS256
                  - RS384
                  - RS512
                  - ES256
                  - ES384
                  - ES512
                device_authorization_endpoint: https://{yourOktaDomain}/oauth2/v1/device/authorize
                pushed_authorization_request_endpoint: https://{yourOktaDomain}/oauth2/v1/par
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: invalid_client
                errorSummary: Invalid value for 'client_id' parameter.
                errorLink: invalid_client
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
  /oauth2/v1/authorize:
    get:
      tags:
        - Org Authorization Server
      summary: /authorize
      description: >-
        This is a starting point for browser-based OpenID Connect flows such as
        the implicit and authorization code flows. This request authenticates
        the user and returns tokens along with an authorization grant to the
        client application as a part of the callback response.


        > **Note:** Requests to the `/authorize` endpoint should redirect the
        browser (user agent) to the endpoint. You can't use AJAX with this
        endpoint. Example responses are intentionally omitted, but include
        displaying a sign-in prompt, redirecting to the client application, or
        displaying an error.
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: acr_values
          in: query
          schema:
            type: string
          description: >-
            An optional parameter that can be included in the authentication
            request. This parameter increases the level of user assurance.


            > **Note:** Multiple space-delimited values may be provided. The
            authorization server will choose one and reflect the chosen value in
            any resulting tokens.
          example: urn:okta:loa:1fa:any
        - name: client_id
          in: query
          schema:
            type: string
          description: >-
            Obtained during either manual client registration or via the Dynamic
            Client Registration API. It identifies the client and must match the
            value preregistered in Okta.
          example: Duis sint
        - name: code_challenge
          in: query
          schema:
            type: string
          description: >-
            A challenge for
            [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/).
            The challenge is verified in the access token request.
          example: Duis sint
        - name: code_challenge_method
          in: query
          schema:
            type: string
          description: >-
            Method used to derive the code challenge for
            [PKCE](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/).
          example: S256
        - name: display
          in: query
          schema:
            type: string
          description: >-
            The `display` parameter to be passed to the Social Identity Provider
            when performing Social Login.
          example: Duis sint
        - name: enroll_amr_values
          in: query
          schema:
            type: string
          description: >-
            <div class="x-lifecycle-container"><x-lifecycle
            class="lea"></x-lifecycle> <x-lifecycle
            class="oie"></x-lifecycle></div>A space-delimited list of values
            indicating which authenticators to enroll in.


            * If the `enroll_amr_values` parameter is specified, then the value
            for `prompt` must be `enroll_authenticator`.

            * The parameter value is space delimited, for example, `pwd sms
            okta_verify` is a valid request parameter value. You are prompted in
            the order of the amr values provided.
          example: tel
        - name: idp_scope
          in: query
          schema:
            type: string
          description: >-
            An Okta Extension to the OpenID Specification. A space delimited
            list of scopes to be provided to the external Identity Provider when
            performing [Social
            login](https://developer.okta.com/docs/concepts/identity-providers/).
            These scopes are used in addition to the scopes already configured
            on the Identity Provider.
          example: Duis sint
        - name: idp
          in: query
          schema:
            type: string
          description: >-
            An Okta Extension to the OpenID Specification. The ID of the
            Identity Provider to use if there's no Okta Session.
          example: Duis sint
        - name: login_hint
          in: query
          schema:
            type: string
          description: A username to prepopulate if prompting for authentication.
          example: Duis sint
        - name: max_age
          in: query
          schema:
            type: integer
          description: >-
            Allowable elapsed time, in seconds, since the last time the end user
            was actively authenticated by Okta.
          example: '57364751'
        - name: nonce
          in: query
          schema:
            type: string
          description: >-
            A value that is returned in the ID token. It is used to mitigate
            replay attacks. The value is required for Implicit and Hybrid flows,
            but optional for Auth Code flows. See [OIDC
            Specs](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
          example: Duis sint
        - name: prompt
          in: query
          schema:
            type: string
          description: >-
            If no `prompt` parameter is specified, the standard behavior occurs:

            * If an Okta session already exists and meets the assurance
            requirements of the app, the user is silently authenticated.
            Otherwise, the user is prompted to authenticate.

            * If scopes are requested that require consent and consent isn't yet
            given by the authenticated user, the user is prompted to give
            consent.
          example: enroll_authenticator
        - name: redirect_uri
          in: query
          schema:
            type: string
          description: >-
            Callback location where the authorization code or tokens should be
            sent. It must match the value preregistered in Okta during client
            registration.
          example: Duis sint
        - name: response_type
          in: query
          schema:
            type: string
          description: >-
            Any combination of `code`, `token`, and `id_token`. The combination
            determines the
            [flow](https://developer.okta.com/docs/concepts/oauth-openid/#recommended-flow-by-application-type).
          example: id_token token
        - name: response_mode
          in: query
          schema:
            type: string
          description: >-
            How the authorization response should be returned. If `id_token` or
            `token` is specified in the `response_type`, then `query` isn't
            allowed as a response mode. Defaults to `fragment` in implicit and
            hybrid flows.
          example: form_post
        - name: request_uri
          in: query
          schema:
            type: string
          description: >-
            Location where the authorization request payload data is referenced
            in an authorization request to the `/authorize` endpoint. This is
            returned from a Pushed Authorization Request at the `/par` endpoint.
          example: Duis sint
        - name: request
          in: query
          schema:
            type: string
          description: >-
            A JWT created by the client that enables requests to be passed as a
            single, self-contained parameter. See [Parameter
            details](#parameter-details).


            * You must sign the JWT using either the app's client secret or a
            private key whose public key is registered on the app's JWKSet.

            * The JWT can't be encrypted.

            >  **Note:** See [Build a JWT for client
            authentication](https://developer.okta.com/docs/guides/build-self-signed-jwt/)
            for information on how to build a JWT.

            * Okta supports the
            [HMAC](https://tools.ietf.org/html/rfc7518#section-3.2),
            [RSA](https://tools.ietf.org/html/rfc7518#section-3.3) and
            [ECDSA](https://tools.ietf.org/html/rfc7518#section-3.4) signature
            algorithms. HMAC signatures require that the client has a
            `token_endpoint_auth_method` that uses a `client_secret`. RSA and
            ECDSA signatures requires that the client registers a public key.

            * We recommend that you don't duplicate any request parameters in
            both the JWT and the query URI itself. However, you can do so with
            `state`, `nonce`, `code_challenge`, and `code_challenge_method`. In
            those cases, the values in the JWT overrides the query URI values.

            * Okta validates the `request` parameter in the following ways:
              1. `iss` is required and must be the `client_id`.
              2. `aud` is required and must be the same value as the Authorization Server issuer that mints the ID or access token. This value is published in the metadata for your Authorization Server.
              3. JWT lifetime is evaluated using the `iat` and `exp` claims, if present. If the JWT is expired or not yet valid, Okta returns an `invalid_request_object` error. Okta rejects JWTs that expire more than one hour in the future.
              4. Okta rejects the JWT if the `jti` claim is present and it has already been processed.
          example: Duis sint
        - name: scope
          in: query
          schema:
            type: string
          description: >-
            A space-delimited string of scopes requested. This includes:

            * The OpenID Connect and OAuth 2.0 reserved scopes: `openid`,
            `profile`, `email`, `address`, `phone`, `offline_access`, and
            `groups`

            * The Okta reserved scope `device_sso`

            * Any custom scopes defined in the matching Custom Authorization
            Server
          example: Duis sint
        - name: sessionToken
          in: query
          schema:
            type: string
          description: >-
            An Okta Extension to the OpenID Specification. Okta one-time session
            token. This allows an API-based user sign-in flow (rather than the
            Okta sign-in UI).
          example: Duis sint
        - name: state
          in: query
          schema:
            type: string
          description: >-
            A value to be returned with the token. The client application can
            use it to remember the state of its interaction with the end user at
            the time of the authentication call. It can contain alphanumeric,
            comma, period, underscore, and hyphen characters. 


            Okta requires the OAuth 2.0 `state` parameter on all requests to the
            `/authorize` endpoint to prevent cross-site request forgery (CSRF).

            The OAuth 2.0 specification
            [requires](https://tools.ietf.org/html/rfc6749#section-10.12) that
            clients protect their redirect URIs against CSRF by sending a value
            in the authorize request that binds the request to the user-agent's
            authenticated state.

            Using the `state` parameter is also a countermeasure to several
            other known attacks as outlined in [OAuth 2.0 Threat Model and
            Security Considerations](https://tools.ietf.org/html/rfc6819).
          example: Duis sint
      responses:
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/bc/authorize:
    post:
      tags:
        - Org Authorization Server
      summary: /bc/authorize
      description: >-
        This endpoint returns a unique identifier (`auth_req_id`) that
        identifies the authentication flow while it tries to authenticate the
        user in the background. This `auth_req_id` value is used in subsequent
        token requests to the `/token` endpoint.


        > **Note:** The `/bc/authorize` endpoint requires client authentication.
        The method is configured per client application. See [Client
        authentication methods](/openapi/okta-oauth/guides/client-auth/) for
        more information.
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  example: 0jrabyQWm4B9zVJPbotY
                client_secret:
                  type: string
                  example: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
                scope:
                  type: string
                  description: >-
                    (Required) `openid` is required for authentication requests.
                    You can also include other scopes.
                  example: openid
                binding_message:
                  type: string
                  description: >-
                    A message that appears for the user to identify the
                    transaction.
                  example: Signing in from device
                login_hint:
                  type: string
                  description: >-
                    A hint to the OpenID Provider regarding the user for whom
                    authentication is being requested.


                    **Note:** You can specify either `login_hint` or
                    `id_token_hint` in the authentication request, not both.
                  example: john.doe@example.com
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                auth_req_id: ftJwF5ZwW2SGPPoTQEKtAr_U8_Ek3RvWyR
                expires_in: 300
                interval: 5
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_request
                error_description: >-
                  Cannot supply multiple client credentials. Use one of the
                  following: credentials in the Authorization header,
                  credentials in the post body, or a client_assertion in the
                  post body.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/challenge:
    post:
      tags:
        - Org Authorization Server
      summary: /challenge
      description: >-
        Initiates the challenge of subsequent factor(s) in a Direct
        Authentication flow after the token endpoint has responded with
        'mfa_required'. This endpoint is optional if the client is able to
        proceed without it, for example, when the client knows it needs to
        follow up with an OTP and can prompt the end user for one.


        > **Note:** The `/challenge` endpoint requires client authentication.
        The method is configured per client application. See [Client
        authentication methods](/openapi/okta-oauth/guides/client-auth/).
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                mfa_token:
                  type: string
                  description: >-
                    (Required) The value returned from a previous token or
                    challenge request for identifying the multifactor
                    transaction across multiple requests
                  example: Qwk9va6QYgR3s7JMiWUm
                channel_hint:
                  type: string
                  description: >-
                    The out-of-band channel for use with authentication.
                    Required for all `/oob-authenticate` requests and any
                    `/challenge` request with an out-of-band authenticator.
                  example: push
                challenge_types_supported:
                  type: string
                  description: >-
                    List of direct authentication challenge types supported by
                    the client
                  example: http://auth0.com/oauth/grant-type/mfa-oob
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                challenge_type: http://auth0.com/oauth/grant-type/mfa-otp
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: access_denied
                error_description: >-
                  'foo' has expired. Use a new 'oob_code' or 'mfa_token' and try
                  again.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: >-
                  The client secret supplied for a confidential client is
                  invalid.
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: access_denied
                error_description: >-
                  'foo' has expired. Use a new 'oob_code' or 'mfa_token' and try
                  again.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_grant
                error_description: API call exceeded rate limit due to too many requests.
  /oauth2/v1/device/authorize:
    post:
      tags:
        - Org Authorization Server
      summary: /device/authorize
      description: >-
        Returns a user code, device code, activation link, and QR code
        activation link
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  description: >-
                    Obtained during either manual client registration or via the
                    Dynamic Client Registration API. It identifies the client
                    and must match the value preregistered in Okta.
                  example: et veniam non fugiat
                scope:
                  type: string
                  description: >-
                    A list of scopes that the client wants included in the
                    access token.
                  example: reprehenderit ut
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                user_code: RGTCFDTL
                device_code: 5cbeb234-7e00-4ff7-9aa2-b1a4558a75d2
                interval: 5
                verification_uri_complete: https://{yourOktaDomain}/activate?user_code=RGTCFDTL
                verification_uri: https://{yourOktaDomain}/activate
                expires_in: 600
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_scope
                error_description: No scopes were requested.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/introspect:
    post:
      tags:
        - Org Authorization Server
      summary: /introspect
      description: >-
        This endpoint takes an access token, ID token, refresh token, or device
        secret and returns a boolean that indicates whether it is active. If the
        token is active, additional data about the token is also returned. If
        the token is invalid, expired, or revoked, it is considered inactive.


        Be sure that you are using the `/introspect` endpoint of the same
        authorization server that you used to create the token.


        > **Note:** The `/introspect` endpoint requires client authentication.
        The method is configured per client application. See [Client
        authentication methods] for more information. For public clients (such
        as single-page and mobile apps) that don't have a `client_secret`, you
        must include the `client_id` as a query parameter when calling the
        `/introspect` endpoint. Make sure that you aren't passing the
        Authorization header in the request.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              example:
                token: culpa consequat
                token_type_hint: refresh_token
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                active: true
                token_type: Bearer
                scope: openid profile
                client_id: a9VpZDRCeFh3Nkk2VdYa
                username: john.doe@example.com
                exp: 1451606400
                iat: 1451602800
                sub: john.doe@example.com
                aud: https://{yourOktaDomain}
                iss: https://{yourOktaDomain}/oauth2/orsmsg0aWLdnF3spV0g3
                jti: AT.7P4KlczBYVcWLkxduEuKeZfeiNYkZIC9uGJ28Cc-YaI
                uid: 00uid4BxXw6I6TV4m0g3
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_request
                error_description: The `token` parameter is required.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/keys:
    get:
      tags:
        - Org Authorization Server
      summary: /keys
      description: >-
        Returns a JSON Web Key Set (JWKS) that contains the public keys that can
        be used to verify the signatures of tokens that you receive from your
        authorization server.


        Any of the two or three keys listed are used to sign tokens. The order
        of keys in the result doesn't indicate which keys are used.


        These keys can be used to locally validate JWTs returned by Okta.
        Standard open-source libraries are available for every major language to
        perform [JWS](https://datatracker.ietf.org/doc/html/rfc7515) signature
        validation.


        > **Note:** The information returned from this endpoint could lag
        slightly, but will eventually be up-to-date.
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: client_id
          in: query
          schema:
            type: string
          description: >-
            The `client_id` of a Client application. Providing this optional
            parameter will include any public keys associated with the signing
            keys of the application.
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Cache-Control:
              schema:
                type: string
                example: max-age=3832304, must-revalidate
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                keys:
                  - alg: RS256
                    e: AQAB
                    'n': >-
                      iKqiD4cr7FZKm6f05K4r-GQOvjRqjOeFmOho9V7SAXYwCyJluaGBLVvDWO1XlduPLOrsG_Wgs67SOG5qeLPR8T1zDK4bfJAo1TvbwYeTwVSfd_0mzRq8WaVc_2JtEK7J-4Z0MdVm_dJmcMHVfDziCRohSZthN__WM2NwGnbewWnla0wpEsU3QMZ05_OxvbBdQZaDUsNSx46is29eCdYwhkAfFd_cFRq3DixLEYUsRwmOqwABwwDjBTNvgZOomrtD8BRFWSTlwsbrNZtJMYU33wuLO9ynFkZnY6qRKVHr3YToIrqNBXw0RWCheTouQ-snfAB6wcE2WDN3N5z760ejqQ
                    kid: U5R8cHbGw445Qbq8zVO1PcCpXL8yG6IcovVa3laCoxM
                    kty: RSA
                    use: sig
                  - alg: RS256
                    e: AQAB
                    'n': >-
                      l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK3HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37-XDIDb0XG-R8DOoOHLJPTpsgH-rJeM5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX-0TmG5yjSj7ek05txcpxIqYu-7FIGT0KKvXge_BOSEUlJpBhLKU28OtsOnmc3NLIGXB-GeDiUZiBYQdPR-myB4ZoQ
                    kid: Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo
                    kty: RSA
                    use: sig
                  - alg: RS256
                    e: AQAB
                    'n': >-
                      lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7UGLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap-CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvpdMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu-DYhT0hmyFcwn-tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ
                    kid: h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU
                    kty: RSA
                    use: sig
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/logout:
    get:
      tags:
        - Org Authorization Server
      summary: /logout
      description: >-
        Use this operation to sign a user out by removing their Okta browser
        session.


        This endpoint takes an ID token and logs the user out of Okta if the
        subject matches the current Okta session. A `post_logout_redirect_uri`
        may be specified to redirect the browser after the logout is performed.
        Otherwise, the browser is redirected to the Okta sign-in page. See [Sign
        users](https://developer.okta.com/docs/guides/sign-users-out/) out for
        more information.


        If no Okta session exists, this endpoint has no effect and the browser
        is redirected immediately to the Okta sign-in page or the
        `post_logout_redirect_uri` (if specified).


        > **Note:** When making requests to the `/logout` endpoint, the browser
        (user agent) should be redirected to the endpoint. You can't use AJAX
        with this endpoint. We may load an interstitial to do client-side logic
        before redirecting to the `post_logout_redirect_uri`, or login page if
        no redirect is provided.
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: id_token_hint
          in: query
          schema:
            type: string
          description: >-
            (Required) A valid ID token with a subject that matches the current
            session.
          example: Duis sint
        - name: post_logout_redirect_uri
          in: query
          schema:
            type: string
          description: >-
            Location to redirect to after the logout is performed. It must match
            the value preregistered in Okta during client registration.
          example: Duis sint
        - name: state
          in: query
          schema:
            type: string
          description: >-
            An optional value that is returned as a query parameter during the
            redirect at the end of the flow
          example: Duis sint
      responses:
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    post:
      tags:
        - Org Authorization Server
      summary: /logout
      description: >-
        Use this operation to sign a user out by removing their Okta browser
        session.


        This endpoint uses the ID token to verify that the subject matches the
        current Okta session, and then signs the user out. You can specify a
        `post_logout_redirect_uri` to redirect the browser after the user signs
        out. Otherwise, the browser is redirected to the Okta sign-in page. See
        [Sign users
        out](https://developer.okta.com/docs/guides/sign-users-out/).


        If no Okta session exists, this endpoint has no effect and the browser
        is redirected immediately to the Okta sign-in page or the
        `post_logout_redirect_uri` (if specified).


        > **Note:** When making requests to the `/logout` endpoint, the browser
        (user agent) should be redirected to the endpoint. You need to make a
        POST request from a form. A POST request to this endpoint from the
        backend doesn't completely terminate the session.
      requestBody:
        content: {}
      security:
        - basicAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: id_token_hint
          in: query
          schema:
            type: string
          description: >-
            (Required) A valid ID token with a subject that matches the current
            session
          example: Duis sint
        - name: post_logout_redirect_uri
          in: query
          schema:
            type: string
          description: >-
            Location to redirect to after the user signs out. It must match the
            value preregistered in Okta during client registration.
          example: Duis sint
        - name: state
          in: query
          schema:
            type: string
          description: >-
            An optional value that is returned as a query parameter during the
            redirect at the end of the flow
          example: Duis sint
      responses:
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/oob-authenticate:
    post:
      tags:
        - Org Authorization Server
      summary: /oob-authenticate
      description: >-
        Initiates direct authentication with an out-of-band authenticator


        > **Note:** The `/oob-authenticate` endpoint requires client
        authentication. The method is configured per client application. See
        [Client authentication
        methods](/openapi/okta-oauth/guides/client-auth/).
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                login_hint:
                  type: string
                  description: >-
                    (Required) The user sign-in information for whom
                    authentication is being requested
                  example: testuser@example.com
                channel_hint:
                  type: string
                  description: >-
                    (Required) The out-of-band channel for use with
                    authentication. Required for all `/oob-authenticate`
                    requests and any `/challenge` request with an out-of-band
                    authenticator.
                  example: push
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                oob_code: ftOpMH6ohWMGWoH1vgrX-lNX6tnXE6JNd9
                channel: push
                binding_method: none
                expires_in: 300
                interval: 5
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_request
                error_description: >-
                  'foo' is not supported as a 'channel_hint'. Try again with
                  another value.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: >-
                  The client secret supplied for a confidential client is
                  invalid.
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: access_denied
                error_description: >-
                  The required authenticator cannot be used. Check if it is
                  required by policy and the user is enrolled in the
                  authenticator and try again.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_grant
                error_description: API call exceeded rate limit due to too many requests.
  /oauth2/v1/par:
    options:
      tags:
        - Org Authorization Server
      summary: /par
      description: >-
        Use this operation to request the permitted communication options for
        the `/par` operation.


        > **Note:** CORS is enforced on a per-client basis. This endpoint always
        returns CORS headers with the current Origin.
      requestBody:
        content: {}
      security:
        - basicAuth: []
      parameters:
        - name: Origin
          in: header
          schema:
            type: string
          example: example.okta.com
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '204':
          description: No Content
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
                example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
                example: POST
            Access-Control-Max-Age:
              schema:
                type: string
                example: occaecat
            Vary:
              schema:
                type: string
                example: Origin
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    post:
      tags:
        - Org Authorization Server
      summary: /par
      description: >-
        The pushed authorization request endpoint (`/par`) promotes OAuth
        security by allowing the authorization server to authenticate the client
        before any user interaction happens. The increased confidence in the
        client's identity during the authorization process means the
        authorization server can refuse illegitimate requests much earlier in
        the process. This process prevents attempts to spoof clients or
        otherwise tamper with or misuse an authorization request and provides a
        simple way to make a confidential and integrity-protected authorization
        request.


        The `/par` endpoint allows an OAuth 2.0 client to push the payload of an
        authorization request directly to the authorization server. The
        authorization server provides a request URI value in the response. The
        request URI is a reference to the authorization request payload data in
        a subsequent call to the `/authorize` endpoint through a user agent.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              example:
                client_id: exercitation cupidatat
                code_challenge: veniam elit dolor ad deserunt
                code_challenge_method: nostrud amet consequat ad
                display: ipsum dolor Duis ut
                idp: adipisicing minim dolor
                idp_scope: veniam ea ulla
                login_hint: voluptate nulla ex consectetur
                max_age: 39339404
                nonce: Duis laborum
                prompt: pariatur deserunt
                redirect_uri: aliquip fugiat aliqua exercitation pariatu
                request: pariatur
                response_mode: consequat ullamco aliquip ea
                response_type: do consectetur in voluptate pariatur
                scope: consectetur ut et
                sessionToken: minim in
                state: dolor amet
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                request_uri: >-
                  urn:okta:Y1hIQ3ZqYjFodEZMOVJ3TUF4ZHRPZjJuNFZRV2ZWQ044MmFoX2VIT2oyNDo
                expires_in: 3600
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_scope
                error_description: No scopes were requested.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: Invalid value for client_id' parameter.
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: access_denied
                error_description: >-
                  Requests for ID tokens or access tokens with OpenID scopes
                  require the 'openid' scope.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/revoke:
    post:
      tags:
        - Org Authorization Server
      summary: /revoke
      description: >-
        The API takes an access or refresh token and revokes it. Revoked tokens
        are considered inactive at the introspection endpoint. A client may only
        revoke its own tokens. See [Revoke
        tokens](https://developer.okta.com/docs/guides/revoke-tokens/) for more
        information.


        > **Note:** The `/revoke` endpoint requires client authentication. The
        method is configured per client application. See [Client authentication
        methods](/openapi/okta-oauth/guides/client-auth/) for more information.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              example:
                token: consectetur dolore commodo nulla
                token_type_hint: device_secret
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_request
                error_description: The `token` parameter is required.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/token:
    options:
      tags:
        - Org Authorization Server
      summary: /token
      description: >-
        Use this operation to request the permitted communication options for
        the `/token` operation.


        > **Note:** CORS is enforced on a per-client basis. This endpoint will
        always return CORS headers with the current Origin.
      requestBody:
        content: {}
      security:
        - basicAuth: []
      parameters:
        - name: Origin
          in: header
          schema:
            type: string
          example: example.okta.com
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '204':
          description: No Content
          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
                example: example.okta.com
            Access-Control-Allow-Methods:
              schema:
                type: string
                example: POST
            Access-Control-Max-Age:
              schema:
                type: string
                example: occaecat
            Vary:
              schema:
                type: string
                example: Origin
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    post:
      tags:
        - Org Authorization Server
      summary: /token
      description: >-
        This endpoint returns access tokens, ID tokens, and refresh tokens
        depending on the request parameters. For password, client credentials,
        saml2 assertion, and refresh token flows, calling `/token` is the only
        step of the flow. For the authorization code flow, calling `/token` is
        the second step of the flow.


        > **Note:** The `/token` endpoint requires client authentication. The
        method is configured per client application. See [Client authentication
        methods](/openapi/okta-oauth/guides/client-auth/) for more information.
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  example: 0jrabyQWm4B9zVJPbotY
                client_secret:
                  type: string
                  example: 6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc
                grant_type:
                  type: string
                  description: >-
                    Determines the mechanism Okta uses to authorize the creation
                    of the tokens.
                  example: authorization_code
                redirect_uri:
                  type: string
                  example: https://www.example.com/oauth2/redirectUri
                code:
                  type: string
                  example: QnowT-aeawtOJKp-MtkH&
      security:
        - basicAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                access_token: >-
                  eyJhbGciOiJSUzI1NiJ9.eyJ2ZXIiOjEsImlzcyI6Imh0dHA6Ly9yYWluLm9rdGExLmNvbToxODAyIiwiaWF0IjoxNDQ5NjI0MDI2LCJleHAiOjE0NDk2Mjc2MjYsImp0aSI6IlVmU0lURzZCVVNfdHA3N21BTjJxIiwic2NvcGVzIjpbIm9wZW5pZCIsImVtYWlsIl0sImNsaWVudF9pZCI6InVBYXVub2ZXa2FESnh1a0NGZUJ4IiwidXNlcl9pZCI6IjAwdWlkNEJ4WHc2STZUVjRtMGczIn0.HaBu5oQxdVCIvea88HPgr2O5evqZlCT4UXH4UKhJnZ5px-ArNRqwhxXWhHJisslswjPpMkx1IgrudQIjzGYbtLFjrrg2ueiU5-YfmKuJuD6O2yPWGTsV7X6i7ABT6P-t8PRz_RNbk-U1GXWIEkNnEWbPqYDAm_Ofh7iW0Y8WDA5ez1jbtMvd-oXMvJLctRiACrTMLJQ2e5HkbUFxgXQ_rFPNHJbNSUBDLqdi2rg_ND64DLRlXRY7hupNsvWGo0gF4WEUk8IZeaLjKw8UoIs-ETEwJlAMcvkhoVVOsN5dPAaEKvbyvPC1hUGXb4uuThlwdD3ECJrtwgKqLqcWonNtiw
                token_type: Bearer
                expires_in: 3600
                scope: openid email offline_access
                refresh_token: a9VpZDRCeFh3Nkk2VdY
                id_token: >-
                  eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIwMHVpZDRCeFh3Nkk2VFY0bTBnMyIsImVtYWlsIjoid2VibWFzdGVyQGNsb3VkaXR1ZGUubmV0IiwiZW1haWxfdmVyaWZpZWQiOnRydWUsInZlciI6MSwiaXNzIjoiaHR0cDovL3JhaW4ub2t0YTEuY29tOjE4MDIiLCJsb2dpbiI6ImFkbWluaXN0cmF0b3IxQGNsb3VkaXR1ZGUubmV0IiwiYXVkIjoidUFhdW5vZldrYURKeHVrQ0ZlQngiLCJpYXQiOjE0NDk2MjQwMjYsImV4cCI6MTQ0OTYyNzYyNiwiYW1yIjpbInB3ZCJdLCJqdGkiOiI0ZUFXSk9DTUIzU1g4WGV3RGZWUiIsImF1dGhfdGltZSI6MTQ0OTYyNDAyNiwiYXRfaGFzaCI6ImNwcUtmZFFBNWVIODkxRmY1b0pyX1EifQ.Btw6bUbZhRa89DsBb8KmL9rfhku--_mbNC2pgC8yu8obJnwO12nFBepui9KzbpJhGM91PqJwi_AylE6rp-ehamfnUAO4JL14PkemF45Pn3u_6KKwxJnxcWxLvMuuisnvIs7NScKpOAab6ayZU0VL8W6XAijQmnYTtMWQfSuaaR8rYOaWHrffh3OypvDdrQuYacbkT0csxdrayXfBG3UF5-ZAlhfch1fhFT3yZFdWwzkSDc0BGygfiFyNhCezfyT454wbciSZgrA9ROeHkfPCaX7KCFO8GgQEkGRoQntFBNjluFhNLJIUkEFovEDlfuB4tv_M8BM75celdy3jkpOurg
        '400':
          description: Bad Request
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_grant
                error_description: The authorization code is invalid or has expired.
        '401':
          description: Unauthorized
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: No client credentials found.
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/userinfo:
    get:
      tags:
        - Org Authorization Server
      summary: /userinfo
      description: >-
        Returns information about the user that is the subject of the access
        token. Many of these claims are also included in the [ID
        token](https://developer.okta.com/docs/reference/api/oidc/#id-token),
        but calling this endpoint always returns all of the user's claims. The
        ID token can be configured to include a subset of the user's claims. See
        [Scope-dependent
        claims](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned)
        for more information.
      security:
        - oauth2Auth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                sub: 00uid4BxXw6I6TV4m0g3
                name: John Doe
                nickname: Jimmy
                given_name: John
                middle_name: James
                family_name: Doe
                profile: https://example.com/john.doe
                zoneinfo: America/Los_Angeles
                locale: en-US
                updated_at: 1311280970
                email: john.doe@example.com
                email_verified: true
                address:
                  street_address: 123 Hollywood Blvd.
                  locality: Los Angeles
                  region: CA
                  postal_code: '90210'
                  country: US
                phone_number: +1 (425) 555-1212
        '401':
          description: Unauthorized
          headers:
            WWW-Authenticate:
              schema:
                type: string
                example: >-
                  Bearer error="invalid_token", error_description="The access
                  token is invalid"
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            WWW-Authenticate:
              schema:
                type: string
                example: >-
                  Bearer error="insufficient_scope", error_description="The
                  access token must provide access to at least one of these
                  scopes - profile, email, address or phone"
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/clients/{clientId}/roles:
    get:
      tags:
        - Role Assignment
      summary: List all Roles for a Client
      description: Lists all Roles by `clientId`
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                - id: JBCUYUC7IRCVGS27IFCE2SKO
                  label: Help Desk Administrator
                  type: HELP_DESK_ADMIN
                  status: ACTIVE
                  created: '2023-05-01T14:24:54.000Z'
                  lastUpdated: '2023-05-01T14:24:54.000Z'
                  assignmentType: CLIENT
                  _links:
                    assignee:
                      href: >-
                        https://{yourOktaDomain}/oauth2/v1/clients/0jrabyQWm4B9zVJPbotY/roles
                - id: irb4ey26fpFI3vQ8y0g7
                  label: view_minimal
                  type: CUSTOM
                  status: ACTIVE
                  created: '2023-05-01T15:16:47.000Z'
                  lastUpdated: '2023-05-01T15:16:47.000Z'
                  assignmentType: CLIENT
                  resource-set: iam4cxy6z7hhaZCSk0g7
                  role: cr04cxy6yzSCtNciD0g7
                  _links:
                    role:
                      href: >-
                        https://{yourOktaDomain}/api/v1/iam/roles/cr04cxy6yzSCtNciD0g7
                    resource-set:
                      href: >-
                        https://{yourOktaDomain}/api/v1/iam/resource-sets/iam4cxy6z7hhaZCSk0g7
                    permissions:
                      href: >-
                        https://{yourOktaDomain}/api/v1/iam/roles/cr04cxy6yzSCtNciD0g7/permissions
                    member:
                      href: >-
                        https://{yourOktaDomain}/api/v1/iam/resource-sets/iam4cxy6z7hhaZCSk0g7/bindings/cr04cxy6yzSCtNciD0g7/members/irb4ey26fpFI3vQ8y0g7
                    assignee:
                      href: >-
                        https://{yourOktaDomain}/oauth2/v1/clients/0oa4ee9vgbIuqTUvd0g7
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    post:
      tags:
        - Role Assignment
      summary: Assign Role to Client
      description: Assigns a Role to a Client
      requestBody:
        content:
          application/json:
            schema:
              type: object
              example:
                type: HELP_DESK_ADMIN,
      security:
        - apikeyAuth: []
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                id: JBCUYUC7IRCVGS27IFCE2SKO
                label: Help Desk Administrator
                type: HELP_DESK_ADMIN
                status: ACTIVE
                created: '2023-05-01T14:24:54.000Z'
                lastUpdated: '2023-05-01T14:24:54.000Z'
                assignmentType: CLIENT
                _links:
                  assignee:
                    href: >-
                      https://{yourOktaDomain}/oauth2/v1/clients/0jrabyQWm4B9zVJPbotY/roles
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/clients/{clientId}/roles/{roleId}:
    get:
      tags:
        - Role Assignment
      summary: Retrieve a Client Role
      description: Retrieves a Client Role
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                id: JBCUYUC7IRCVGS27IFCE2SKO
                label: Help Desk Administrator
                type: HELP_DESK_ADMIN
                status: ACTIVE
                created: '2023-05-01T14:24:54.000Z'
                lastUpdated: '2023-05-01T14:24:54.000Z'
                assignmentType: CLIENT
                _links:
                  assignee:
                    href: >-
                      https://{yourOktaDomain}/oauth2/v1/clients/0jrabyQWm4B9zVJPbotY/roles
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    delete:
      tags:
        - Role Assignment
      summary: Unassign a Role from a Client
      description: Unassigns a Role from a Client
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/clients/{clientId}/roles/{roleId}/targets/catalog/apps:
    get:
      tags:
        - Role Assignment
      summary: List App Targets
      description: Lists App Targets for Client and Role
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: after
          in: query
          schema:
            type: string
          description: >-
            The cursor to use for pagination. It is an opaque string that
            specifies your current location in the list and is obtained from the
            `Link` response header. See [Pagination](/#pagination) for more
            information.


            > **Note:** The `after` cursor should be treated as an opaque value
            and obtained through the next link relation.
          example: Duis sint
        - name: limit
          in: query
          schema:
            type: integer
          description: A limit on the number of objects to return.
          example: '20'
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                - name: google
                  displayName: Google Workspace
                  description: Gmail, Google Drive, Google Calendar, and Google Sites
                  status: ACTIVE
                  lastUpdated: '2021-06-23T22:23:29.000Z'
                  category: COLLABORATION
                  verificationStatus: OKTA_VERIFIED
                  website: http://www.example.com/google-apps.html
                  signOnModes:
                    - SAML_2_0
                  features:
                    - DOWNLOAD_USERS_FOR_ROGUE_REPORT
                    - EXCHANGE_ACTIVE_SYNC
                    - GROUP_PUSH
                    - IMPORT_NEW_USERS
                    - IMPORT_PROFILE_UPDATES
                    - IMPORT_USER_SCHEMA
                    - PROFILE_MASTERING
                    - PUSH_NEW_USERS
                    - PUSH_PASSWORD_UPDATES
                    - PUSH_PROFILE_UPDATES
                    - PUSH_USER_DEACTIVATION
                    - REACTIVATE_USERS
                  _links:
                    logo:
                      - name: medium,
                      - href: https://www.example.com/gfs3qpyglct9KMswo0g7
                    self:
                      href: https://{yourOktaDomain}/api/v1/catalog/apps/google
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/clients/{clientId}/roles/{roleId}/targets/catalog/apps/{appName}:
    put:
      tags:
        - Role Assignment
      summary: Assign an Application Target
      description: Assigns an Application Target to a Client
      requestBody:
        content: {}
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
        - name: appName
          in: path
          schema:
            type: string
          required: true
          description: (Required) `name` of the application
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    delete:
      tags:
        - Role Assignment
      summary: Remove an Application Target
      description: Removes an Application Target by `clientId`
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
        - name: appName
          in: path
          schema:
            type: string
          required: true
          description: (Required) `name` of the application
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/clients/{clientId}/roles/{roleId}/targets/catalog/apps/{appName}/{appInstanceId}:
    put:
      tags:
        - Role Assignment
      summary: Replace an App Target
      description: Replaces an App Instance Target by `clientId`
      requestBody:
        content: {}
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
        - name: appName
          in: path
          schema:
            type: string
          required: true
          description: (Required) `name` of the application
          example: Duis sint
        - name: appInstanceId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the application instance
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    delete:
      tags:
        - Role Assignment
      summary: Delete an App Instance Target
      description: Deletes an App Instance Target from a Client
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
        - name: appName
          in: path
          schema:
            type: string
          required: true
          description: (Required) `name` of the application
          example: Duis sint
        - name: appInstanceId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the application instance
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/clients/{clientId}/roles/{roleId}/targets/groups:
    get:
      tags:
        - Role Assignment
      summary: List all Group Targets
      description: Lists all Group Targets by `clientId` and `roleId`
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: after
          in: query
          schema:
            type: string
          description: >-
            The cursor to use for pagination. It is an opaque string that
            specifies your current location in the list and is obtained from the
            `Link` response header. See [Pagination](/#pagination) for more
            information.


            > **Note:** The `after` cursor should be treated as an opaque value
            and obtained through the next link relation.
          example: Duis sint
        - name: limit
          in: query
          schema:
            type: integer
          description: A limit on the number of objects to return.
          example: '20'
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
      responses:
        '200':
          description: OK
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                - id: 00g4cweckiXJaEqWl0g7
                  created: '2023-01-20T08:28:32.000Z'
                  lastUpdated: '2023-01-20T08:28:32.000Z'
                  lastMembershipUpdated: '2023-01-20T08:54:49.000Z'
                  objectClass:
                    - okta:user_group
                  type: OKTA_GROUP
                  profile:
                    name: nirav_group
                    description: null
                  _links:
                    logo:
                      - name: medium
                        href: https://www.example.com/okta-medium.png
                        type: image/png
                      - name: large
                        href: https://www.example.com/okta-large.png
                        type: image/png
                    users:
                      href: >-
                        https://{yourOktaDomain}/api/v1/groups/00g4cweckiXJaEqWl0g7/users
                    apps:
                      href: >-
                        https://{yourOktaDomain}/api/v1/groups/00g4cweckiXJaEqWl0g7/apps
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
  /oauth2/v1/clients/{clientId}/roles/{roleId}/targets/groups/{groupId}:
    put:
      tags:
        - Role Assignment
      summary: Replace a Group Target
      description: Replaces a Group Target on a Client
      requestBody:
        content: {}
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
        - name: groupId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the group
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
    delete:
      tags:
        - Role Assignment
      summary: Delete a Group Target
      description: Deletes a Group Target from a Client
      security:
        - apikeyAuth: []
      parameters:
        - name: Accept
          in: header
          schema:
            type: string
          example: application/json
        - name: clientId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `client_id` of the Client application
          example: Duis sint
        - name: roleId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `role_id` of the role
          example: Duis sint
        - name: groupId
          in: path
          schema:
            type: string
          required: true
          description: (Required) `id` of the group
          example: Duis sint
      responses:
        '204':
          description: No Content
          headers:
            Content-Type:
              schema:
                type: string
                example: text/plain
          content:
            text/plain:
              schema:
                type: string
              example: ''
        '403':
          description: Forbidden
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000006
                errorSummary: You do not have permission to perform the requested action
                errorLink: E0000006
                errorId: sampleNUSD_8fdkFd8fs8SDBK
                errorCauses: []
        '404':
          description: Not Found
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000007
                errorSummary: 'Not found: {0}'
                errorLink: E0000007
                errorId: sampleMlLvGUj_YD5v16vkYWY
                errorCauses: []
        '429':
          description: Too Many Requests
          headers:
            Content-Type:
              schema:
                type: string
                example: application/json
          content:
            application/json:
              schema:
                type: object
              example:
                errorCode: E0000047
                errorSummary: >-
                  You exceeded the maximum number of requests. Try again in a
                  while.
                errorLink: E0000047
                errorId: sampleQPivGUj_ND5v78vbYWW
                errorCauses: []
