API reference

Source-reviewed integration profile, not a certification of standards compliance or full live authenticated verification. No internal admin or native session routes. Closed source licensing is separate.

OpenAPI 3.1 JSON. Base URL: https://id.zorin.cloud. This page sends no requests. Required means required within the containing object or selected grant variant, not required in every alternative.

GET /.well-known/openid-configuration

OIDC discovery

Authentication: No security scheme declared; client/flow rules can still apply.

Responses

HTTP	Meaning
200	Successful response

Response fields 200: application/json

response.200

Field	Type	Required in parent	Constraints / description
`issuer`	string	Yes	format: “uri”
`authorization_endpoint`	string	Yes	format: “uri”
`pushed_authorization_request_endpoint`	string	Yes	format: “uri”
`token_endpoint`	string	Yes	format: “uri”
`device_authorization_endpoint`	string	Yes	format: “uri”
`userinfo_endpoint`	string	Yes	format: “uri”
`jwks_uri`	string	Yes	format: “uri”
`revocation_endpoint`	string	Yes	format: “uri”
`introspection_endpoint`	string	Yes	format: “uri”
`end_session_endpoint`	string	Yes	format: “uri”
`response_types_supported`	array	Yes
`grant_types_supported`	array	Yes
`subject_types_supported`	array	Yes
`id_token_signing_alg_values_supported`	array	Yes
`code_challenge_methods_supported`	array	Yes
`scopes_supported`	array	Yes
`token_endpoint_auth_methods_supported`	array	Yes

response.200.response_types_supported

response.200.response_types_supported[] (Array item)

Type: string.

response.200.grant_types_supported

response.200.grant_types_supported[] (Array item)

Type: string.

response.200.subject_types_supported

response.200.subject_types_supported[] (Array item)

Type: string.

response.200.id_token_signing_alg_values_supported

response.200.id_token_signing_alg_values_supported[] (Array item)

Type: string.

response.200.code_challenge_methods_supported

response.200.code_challenge_methods_supported[] (Array item)

Type: string.

response.200.scopes_supported

response.200.scopes_supported[] (Array item)

Type: string.

response.200.token_endpoint_auth_methods_supported

response.200.token_endpoint_auth_methods_supported[] (Array item)

Type: string.

GET /oauth2/jwks

Public signing keys

Authentication: No security scheme declared; client/flow rules can still apply.

Responses

HTTP	Meaning
200	Successful response

Response fields 200: application/json

response.200

Field	Type	Required in parent	Constraints / description
`keys`	array	Yes

response.200.keys

response.200.keys[] (Array item)

Type: object. Public JWK, no private key material.

GET /oauth2/authorize

Authorization Code + PKCE or a single-use PAR request_uri

Direct request requires AuthorizationRequest fields. PAR form requires client_id + request_uri. state/nonce are required by integration security guidance even though current handler stores missing values as null. Redirect URI must match registration; HTTPS except loopback.

Authentication: No security scheme declared; client/flow rules can still apply.

Parameters

Name	In	Type	Required	Constraints
`response_type`	query	“code”	No
`client_id`	query	string	No
`redirect_uri`	query	string	No	format: “uri”
`scope`	query	string	No	Requires openid; third-party clients are limited to openid/profile/email/offline_access.
`state`	query	string	No
`nonce`	query	string	No
`code_challenge`	query	string	No
`code_challenge_method`	query	“S256”	No
`request_uri`	query	string	No

Responses

HTTP	Meaning
302	Hosted interaction redirect
400	Invalid parameters
401	Invalid client, credentials, token or grant
429	Rate limit exceeded

Response fields 400: application/json

response.400

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.400.message

response.400.message — oneOf Variant 1

Type: string.

response.400.message — oneOf Variant 2

response.400.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 401: application/json

response.401

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.401.message

response.401.message — oneOf Variant 1

Type: string.

response.401.message — oneOf Variant 2

response.401.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 429: application/json

response.429

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.429.message

response.429.message — oneOf Variant 1

Type: string.

response.429.message — oneOf Variant 2

response.429.message — oneOf Variant 2[] (Array item)

Type: string.

POST /oauth2/par

Pushed Authorization Request

Public clients are accepted in this source profile; confidential clients authenticate. request_uri is single-use, bound to client, TTL 90 seconds. Current source uses Nest default HTTP 201 for successful POST. This is a compatibility finding, not a statement of OAuth compliance.

Authentication: Endpoint client rules / clientBasic

Request body: application/x-www-form-urlencoded

request

Field	Type	Required in parent	Constraints / description
`response_type`	“code”	Yes
`client_id`	string	Yes
`redirect_uri`	string	Yes	format: “uri”
`scope`	string	Yes	Requires openid; third-party clients are limited to openid/profile/email/offline_access.
`state`	string	No
`nonce`	string	No
`code_challenge`	string	Yes
`code_challenge_method`	“S256”	Yes
`client_secret`	string	No

Responses

HTTP	Meaning
201	Authorization request stored
400	Invalid parameters
401	Invalid client, credentials, token or grant
429	Rate limit exceeded

Response fields 201: application/json

response.201

Field	Type	Required in parent	Constraints / description
`request_uri`	string	Yes
`expires_in`	90	Yes

Response fields 400: application/json

response.400

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.400.message

response.400.message — oneOf Variant 1

Type: string.

response.400.message — oneOf Variant 2

response.400.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 401: application/json

response.401

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.401.message

response.401.message — oneOf Variant 1

Type: string.

response.401.message — oneOf Variant 2

response.401.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 429: application/json

response.429

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.429.message

response.429.message — oneOf Variant 1

Type: string.

response.429.message — oneOf Variant 2

response.429.message — oneOf Variant 2[] (Array item)

Type: string.

POST /oauth2/token

Token endpoint

Grant must be allowed for the client. THIRD_PARTY machine grants disabled. Refresh tokens rotate; reuse revokes family and session. id_token applies to user grants, refresh_token only offline_access. client_id body required unless derived from Basic auth. Current source uses Nest default HTTP 201 for successful POST. This is a compatibility finding, not a statement of OAuth compliance.

Authentication: Endpoint client rules / clientBasic

Request body: application/x-www-form-urlencoded

request

request — oneOf Variant 1

Field	Type	Required in parent	Constraints / description
`client_id`	string	No
`client_secret`	string	No
`grant_type`	“authorization_code”	Yes
`code`	string	Yes
`redirect_uri`	string	Yes	format: “uri”
`code_verifier`	string	Yes

request — oneOf Variant 2

Field	Type	Required in parent
`client_id`	string	No
`client_secret`	string	No
`grant_type`	“refresh_token”	Yes
`refresh_token`	string	Yes

request — oneOf Variant 3

Field	Type	Required in parent
`client_id`	string	No
`client_secret`	string	No
`grant_type`	“client_credentials”	Yes
`scope`	string	No

request — oneOf Variant 4

Field	Type	Required in parent
`client_id`	string	No
`client_secret`	string	No
`grant_type`	“urn:ietf:params:oauth:grant-type:device_code”	Yes
`device_code`	string	Yes

Responses

HTTP	Meaning
201	Token issued
400	Invalid parameters
401	Invalid client, credentials, token or grant
429	Rate limit exceeded

Response fields 201: application/json

response.201

Field	Type	Required in parent	Constraints / description
`access_token`	string	Yes
`token_type`	“Bearer”	Yes
`expires_in`	integer	Yes	minimum: 1
`scope`	string	Yes
`id_token`	string	No
`refresh_token`	string	No

Response fields 400: application/json

response.400

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.400.message

response.400.message — oneOf Variant 1

Type: string.

response.400.message — oneOf Variant 2

response.400.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 401: application/json

response.401

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.401.message

response.401.message — oneOf Variant 1

Type: string.

response.401.message — oneOf Variant 2

response.401.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 429: application/json

response.429

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.429.message

response.429.message — oneOf Variant 1

Type: string.

response.429.message — oneOf Variant 2

response.429.message — oneOf Variant 2[] (Array item)

Type: string.

POST /oauth2/device/authorize

Device Authorization

Restricted to FIRST_PARTY, MIX Account mode, and explicitly enabled device grant. Not available to general third-party apps. Current source uses Nest default HTTP 201 for successful POST. This is a compatibility finding, not a statement of OAuth compliance.

Authentication: Endpoint client rules / clientBasic

Request body: application/x-www-form-urlencoded

request

Field	Type	Required in parent
`client_id`	string	No
`client_secret`	string	No
`scope`	string	No

Responses

HTTP	Meaning
201	Device authorization created
400	Invalid parameters
401	Invalid client, credentials, token or grant
429	Rate limit exceeded

Response fields 201: application/json

response.201

Field	Type	Required in parent	Constraints / description
`device_code`	string	Yes
`user_code`	string	Yes
`verification_uri`	string	Yes	format: “uri”
`verification_uri_complete`	string	Yes	format: “uri”
`expires_in`	600	Yes
`interval`	5	Yes

Response fields 400: application/json

response.400

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.400.message

response.400.message — oneOf Variant 1

Type: string.

response.400.message — oneOf Variant 2

response.400.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 401: application/json

response.401

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.401.message

response.401.message — oneOf Variant 1

Type: string.

response.401.message — oneOf Variant 2

response.401.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 429: application/json

response.429

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.429.message

response.429.message — oneOf Variant 1

Type: string.

response.429.message — oneOf Variant 2

response.429.message — oneOf Variant 2[] (Array item)

Type: string.

GET /oauth2/userinfo

Profile from a user access token and its scopes

Authentication: bearer

Responses

HTTP	Meaning
200	Successful response
400	Invalid parameters
401	Invalid client, credentials, token or grant
429	Rate limit exceeded

Response fields 200: application/json

response.200

Field	Type	Required in parent
`sub`	string	Yes
`name`	string / null	No
`email`	string	No
`email_verified`	boolean	No

Response fields 400: application/json

response.400

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.400.message

response.400.message — oneOf Variant 1

Type: string.

response.400.message — oneOf Variant 2

response.400.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 401: application/json

response.401

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.401.message

response.401.message — oneOf Variant 1

Type: string.

response.401.message — oneOf Variant 2

response.401.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 429: application/json

response.429

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.429.message

response.429.message — oneOf Variant 1

Type: string.

response.429.message — oneOf Variant 2

response.429.message — oneOf Variant 2[] (Array item)

Type: string.

POST /oauth2/introspect

Introspection

Confidential client required. Non-first-party caller must match token audience. Invalid/expired/inactive token returns active:false. Current source uses Nest default HTTP 201 for successful POST. This is a compatibility finding, not a statement of OAuth compliance. client_secret_post is represented by client_id/client_secret form fields; HTTP Basic alternative is described by security scheme. The empty security alternative is valid only with authenticated client_id/client_secret form fields; anonymous requests are rejected.

Authentication: clientBasic / Endpoint client rules

Request body: application/x-www-form-urlencoded

request

Field	Type	Required in parent
`client_id`	string	No
`client_secret`	string	No
`token`	string	Yes

Responses

HTTP	Meaning
201	Token introspection result
400	Invalid parameters
401	Invalid client, credentials, token or grant
429	Rate limit exceeded

Response fields 201: application/json

response.201

Field	Type	Required in parent
`active`	boolean	Yes
`sub`	string	No
`aud`	See variants	No
`scope`	string	No
`exp`	integer	No
`iat`	integer	No
`token_type`	“Bearer”	No
`token_use`	string	No

response.201.aud

response.201.aud — oneOf Variant 1

Type: string.

response.201.aud — oneOf Variant 2

response.201.aud — oneOf Variant 2[] (Array item)

Type: string.

Response fields 400: application/json

response.400

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.400.message

response.400.message — oneOf Variant 1

Type: string.

response.400.message — oneOf Variant 2

response.400.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 401: application/json

response.401

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.401.message

response.401.message — oneOf Variant 1

Type: string.

response.401.message — oneOf Variant 2

response.401.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 429: application/json

response.429

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.429.message

response.429.message — oneOf Variant 1

Type: string.

response.429.message — oneOf Variant 2

response.429.message — oneOf Variant 2[] (Array item)

Type: string.

POST /oauth2/revoke

Token revocation

Confidential client required in current source. Unknown token is handled idempotently; this profile is not a generic revocation route for public clients. Current source uses Nest default HTTP 201 for successful POST. This is a compatibility finding, not a statement of OAuth compliance. client_secret_post is represented by client_id/client_secret form fields; HTTP Basic alternative is described by security scheme. The empty security alternative is valid only with authenticated client_id/client_secret form fields; anonymous requests are rejected.

Authentication: clientBasic / Endpoint client rules

Request body: application/x-www-form-urlencoded

request

Field	Type	Required in parent
`client_id`	string	No
`client_secret`	string	No
`token`	string	Yes

Responses

HTTP	Meaning
201	Token revoked
400	Invalid parameters
401	Invalid client, credentials, token or grant
429	Rate limit exceeded

Response fields 201: application/json

response.201

Type: object.

Response fields 400: application/json

response.400

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.400.message

response.400.message — oneOf Variant 1

Type: string.

response.400.message — oneOf Variant 2

response.400.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 401: application/json

response.401

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.401.message

response.401.message — oneOf Variant 1

Type: string.

response.401.message — oneOf Variant 2

response.401.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 429: application/json

response.429

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.429.message

response.429.message — oneOf Variant 1

Type: string.

response.429.message — oneOf Variant 2

response.429.message — oneOf Variant 2[] (Array item)

Type: string.

GET /oauth2/logout

Logout using an ID token hint

Authentication: No security scheme declared; client/flow rules can still apply.

Parameters

Name	In	Type	Required	Constraints
`id_token_hint`	query	string	Yes
`post_logout_redirect_uri`	query	string	No	format: “uri”

Responses

HTTP	Meaning
204	Session revoked without a redirect
302	Redirect to a registered URI
400	Invalid parameters
401	Invalid client, credentials, token or grant
429	Rate limit exceeded

Response fields 400: application/json

response.400

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.400.message

response.400.message — oneOf Variant 1

Type: string.

response.400.message — oneOf Variant 2

response.400.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 401: application/json

response.401

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.401.message

response.401.message — oneOf Variant 1

Type: string.

response.401.message — oneOf Variant 2

response.401.message — oneOf Variant 2[] (Array item)

Type: string.

Response fields 429: application/json

response.429

Field	Type	Required in parent
`statusCode`	integer	Yes
`message`	See variants	Yes
`error`	string	No

response.429.message

response.429.message — oneOf Variant 1

Type: string.

response.429.message — oneOf Variant 2

response.429.message — oneOf Variant 2[] (Array item)

Type: string.