Endpoints
Always available
| Method | Path | CORS | Rate class |
|---|---|---|---|
GET | /health | none | exempt |
GET | /ready | none | public |
GET | /.well-known/security.txt | none | public |
GET | /.well-known/openid-configuration | open | public |
GET | /.well-known/oauth-authorization-server | open | public |
GET | /jwks | open | public |
GET | /auth | none | strict |
POST | /auth | none | strict |
POST | /token | client-based | strict |
GET | /account/apps | none | ordinary |
POST | /account/apps | none | ordinary |
GET | /account/apps/callback | none | ordinary |
Governed by a flag
A flag that is off means the route is not served: the response is indistinguishable from a path the server does not have.
| Method | Path | Flag | CORS | Rate class |
|---|---|---|---|---|
POST | /par | par.enabled | client-based | strict |
POST | /token/introspect | introspection.enabled | none | ordinary |
POST | /token/revocation | revocation.enabled | client-based | ordinary |
POST | /reg | registration.enabled | none | strict |
GET | /reg/:clientId | registration.enabled | none | ordinary |
PUT | /reg/:clientId | registrationManagement.enabled | none | ordinary |
DELETE | /reg/:clientId | registrationManagement.enabled | none | ordinary |
GET | /logout | rpInitiatedLogout.enabled | none | ordinary |
POST | /logout | rpInitiatedLogout.enabled | none | ordinary |
POST | /logout/confirm | rpInitiatedLogout.enabled | none | ordinary |
GET | /userinfo | userinfo.enabled | client-based | ordinary |
POST | /userinfo | userinfo.enabled | client-based | ordinary |
POST | /device/auth | deviceFlow.enabled | client-based | strict |
GET | /device | deviceFlow.enabled | none | strict |
POST | /device | deviceFlow.enabled | none | strict |
POST | /backchannel | ciba.enabled | none | strict |
POST | /mcp | mcp.enabled | none | ordinary |
GET | /mcp | mcp.enabled | none | ordinary |
GET | /.well-known/oauth-protected-resource/mcp | mcp.enabled | none | public |
GET | /ui/:uid/federation/:providerId/start | federation.enabled | none | ordinary |
GET | /ui/:uid/federation/complete | federation.enabled | none | ordinary |
GET | /federation/callback | federation.enabled | none | ordinary |
POST | /federation/callback | federation.enabled | none | ordinary |
POST | /global-token-revocation | globalTokenRevocation.enabled | none | ordinary |
POST | /federation/backchannel-logout | federation.enabled | none | ordinary |
GET | /scim/v2/ServiceProviderConfig | scim.enabled | none | exempt |
GET | /scim/v2/ResourceTypes | scim.enabled | none | exempt |
GET | /scim/v2/ResourceTypes/:resourceTypeId | scim.enabled | none | exempt |
GET | /scim/v2/Schemas | scim.enabled | none | exempt |
GET | /scim/v2/Schemas/:schemaId | scim.enabled | none | exempt |
GET | /scim/v2/Users | scim.enabled | none | exempt |
POST | /scim/v2/Users | scim.enabled | none | exempt |
GET | /scim/v2/Users/:userId | scim.enabled | none | exempt |
PUT | /scim/v2/Users/:userId | scim.enabled | none | exempt |
PATCH | /scim/v2/Users/:userId | scim.enabled | none | exempt |
DELETE | /scim/v2/Users/:userId | scim.enabled | none | exempt |
GET | /scim/v2/Groups | scim.enabled | none | exempt |
POST | /scim/v2/Groups | scim.enabled | none | exempt |
GET | /scim/v2/Groups/:groupId | scim.enabled | none | exempt |
PUT | /scim/v2/Groups/:groupId | scim.enabled | none | exempt |
PATCH | /scim/v2/Groups/:groupId | scim.enabled | none | exempt |
DELETE | /scim/v2/Groups/:groupId | scim.enabled | none | exempt |
GET | /.well-known/oauth-protected-resource/scim/v2 | scim.enabled | none | public |
Route families
Whole subtrees that are unconditional by design, reached by redirect or through the console:
/ui/…/verify-email/…/reset-password/…/admin/…/public/…
CORS and rate classes
CORS: open echoes any Origin; client-based echoes only an Origin listed on the calling application's own record; none is not readable cross-origin.
Rate: strict, ordinary and public are the three per-origin allowances (defaults 60, 300 and 1200 requests per minute); exempt is never counted.