---
title: "Endpoints | FoxAuth"
description: "Every protocol endpoint with the flag that serves it, its CORS class and its rate-limit class."
canonical: "https://foxauth.dev/docs/reference/endpoints/"
lastmod: "2026-10-15T16:13:12+03:00"
---
Endpoints

Documents unreleased changes made after v1.1.0 (commit 16f191bb)

This page is generated from the main branch. The published image
ghcr.io/redfox-soft/oauth-server-ts:latest is v1.1.0
and may not have everything listed here.

Always available
MethodPathCORSRate class
GET/healthnoneexempt
GET/readynonepublic
GET/.well-known/security.txtnonepublic
GET/.well-known/openid-configurationopenpublic
GET/.well-known/oauth-authorization-serveropenpublic
GET/jwksopenpublic
GET/authnonestrict
POST/authnonestrict
POST/tokenclient-basedstrict
GET/account/appsnoneordinary
POST/account/appsnoneordinary
GET/account/apps/callbacknoneordinary
Governed by a flag
A flag that is off means the route is not served: the response is indistinguishable from a path the server does not have.
MethodPathFlagCORSRate class
POST/parpar.enabledclient-basedstrict
POST/token/introspectintrospection.enablednoneordinary
POST/token/revocationrevocation.enabledclient-basedordinary
POST/regregistration.enablednonestrict
GET/reg/:clientIdregistration.enablednoneordinary
PUT/reg/:clientIdregistrationManagement.enablednoneordinary
DELETE/reg/:clientIdregistrationManagement.enablednoneordinary
GET/logoutrpInitiatedLogout.enablednoneordinary
POST/logoutrpInitiatedLogout.enablednoneordinary
POST/logout/confirmrpInitiatedLogout.enablednoneordinary
GET/userinfouserinfo.enabledclient-basedordinary
POST/userinfouserinfo.enabledclient-basedordinary
POST/device/authdeviceFlow.enabledclient-basedstrict
GET/devicedeviceFlow.enablednonestrict
POST/devicedeviceFlow.enablednonestrict
POST/backchannelciba.enablednonestrict
POST/mcpmcp.enablednoneordinary
GET/mcpmcp.enablednoneordinary
GET/.well-known/oauth-protected-resource/mcpmcp.enablednonepublic
GET/ui/:uid/federation/:providerId/startfederation.enablednoneordinary
GET/ui/:uid/federation/completefederation.enablednoneordinary
GET/federation/callbackfederation.enablednoneordinary
POST/federation/callbackfederation.enablednoneordinary
POST/global-token-revocationglobalTokenRevocation.enablednoneordinary
POST/federation/backchannel-logoutfederation.enablednoneordinary
GET/scim/v2/ServiceProviderConfigscim.enablednoneexempt
GET/scim/v2/ResourceTypesscim.enablednoneexempt
GET/scim/v2/ResourceTypes/:resourceTypeIdscim.enablednoneexempt
GET/scim/v2/Schemasscim.enablednoneexempt
GET/scim/v2/Schemas/:schemaIdscim.enablednoneexempt
GET/scim/v2/Usersscim.enablednoneexempt
POST/scim/v2/Usersscim.enablednoneexempt
GET/scim/v2/Users/:userIdscim.enablednoneexempt
PUT/scim/v2/Users/:userIdscim.enablednoneexempt
PATCH/scim/v2/Users/:userIdscim.enablednoneexempt
DELETE/scim/v2/Users/:userIdscim.enablednoneexempt
GET/scim/v2/Groupsscim.enablednoneexempt
POST/scim/v2/Groupsscim.enablednoneexempt
GET/scim/v2/Groups/:groupIdscim.enablednoneexempt
PUT/scim/v2/Groups/:groupIdscim.enablednoneexempt
PATCH/scim/v2/Groups/:groupIdscim.enablednoneexempt
DELETE/scim/v2/Groups/:groupIdscim.enablednoneexempt
GET/.well-known/oauth-protected-resource/scim/v2scim.enablednonepublic
Route families
Whole subtrees that are unconditional by design, reached by redirect or through the console:
/ui/…
/verify-email/…
/reset-password/…
/admin/…
/public/…
CORS and rate classes
CORS: open echoes any Origin; client-based echoes only an Origin listed on the calling application's own record; none is not readable cross-origin.
Rate: strict, ordinary and public are the three per-origin allowances (defaults 60, 300 and 1200 requests per minute); exempt is never counted.

PreviousSettingsNextAdmin API