Endpoints
Always available
| Method | Path | CORS | Rate class |
|---|---|---|---|
GET | /health | none | exempt |
GET | /.well-known/security.txt | none | public |
GET | /.well-known/openid-configuration | open | public |
GET | /jwks | open | public |
GET | /auth | none | strict |
POST | /auth | none | strict |
POST | /token | client-based | strict |
Governed by a flag
A flag that is off means the route is not served: the response is indistinguishable from a path the server does not have.
| Method | Path | Flag | CORS | Rate class |
|---|---|---|---|---|
POST | /par | par.enabled | client-based | strict |
POST | /token/introspect | introspection.enabled | none | ordinary |
POST | /token/revocation | revocation.enabled | client-based | ordinary |
POST | /reg | registration.enabled | none | strict |
GET | /reg/:clientId | registration.enabled | none | ordinary |
PUT | /reg/:clientId | registrationManagement.enabled | none | ordinary |
DELETE | /reg/:clientId | registrationManagement.enabled | none | ordinary |
GET | /logout | rpInitiatedLogout.enabled | none | ordinary |
POST | /logout/confirm | rpInitiatedLogout.enabled | none | ordinary |
GET | /userinfo | userinfo.enabled | client-based | ordinary |
POST | /userinfo | userinfo.enabled | client-based | ordinary |
POST | /device/auth | deviceFlow.enabled | client-based | strict |
GET | /device | deviceFlow.enabled | none | strict |
POST | /device | deviceFlow.enabled | none | strict |
POST | /backchannel | ciba.enabled | none | strict |
POST | /mcp | mcp.enabled | none | ordinary |
GET | /mcp | mcp.enabled | none | ordinary |
GET | /.well-known/oauth-protected-resource/mcp | mcp.enabled | none | public |
GET | /ui/:uid/federation/:providerId/start | federation.enabled | none | ordinary |
GET | /ui/:uid/federation/complete | federation.enabled | none | ordinary |
GET | /federation/callback | federation.enabled | none | ordinary |
Route families
Whole subtrees that are unconditional by design, reached by redirect or through the console:
/ui/…/verify-email/…/reset-password/…/admin/…/public/…
CORS and rate classes
CORS: open echoes any Origin; client-based echoes only an Origin listed on the project that owns the calling client; none is not readable cross-origin.
Rate: strict, ordinary and public are the three per-origin allowances (defaults 60, 300 and 1200 requests per minute); exempt is never counted.