Skip to content
Sursa Developers

GET/.well-known/oauth-authorization-server

Get authorization server metadata

get_oauth_server_metadata

OAuth 2.0 authorization server metadata (RFC 8414): issuer is the main address of the installation, the consent page is on the main address, and the token and revocation endpoints are on the API address when one is set. Lists the supported grant types, PKCE methods, client authentication methods and scopes. Added in 1.62.0.

Authentication

No credentials needed.

Responses

200OK

Response headers

  • RateLimit-Policy

    Limits in effect, in the format of the IETF draft draft-ietf-httpapi-ratelimit-headers: comma-separated items "<name>";q=<quota>;w=<window in seconds>. key is the request rate of the API key (the quota is the burst, the window is the time to refill it fully; for a session it is user, without credentials ip); minute, day and month are the organization's quotas for the calendar minute, day and month in UTC.

  • RateLimit

    What is left of each limit in RateLimit-Policy: "<name>";r=<remaining>;t=<seconds until reset>.

  • X-RateLimit-Limit

    Limit of the strictest entry in RateLimit-Policy (the one with the fewest requests left).

  • X-RateLimit-Remaining

    Requests left under the strictest limit.

  • X-RateLimit-Reset

    Seconds until the strictest limit resets.

application/json

Object: OAuthServerMetadata

  • issuerstringrequired
  • authorization_endpointstringrequired
  • token_endpointstringrequired
  • revocation_endpointstringrequired
  • response_types_supportedarray of stringrequired
  • grant_types_supportedarray of stringrequired
  • code_challenge_methods_supportedarray of stringrequired
  • token_endpoint_auth_methods_supportedarray of stringrequired
  • revocation_endpoint_auth_methods_supportedarray of stringrequired
  • scopes_supportedarray of stringrequired
  • service_documentationstring

Rate limits

Responses carry the RateLimit and RateLimit-Policy headers and the earlier X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. A 429 response has Retry-After in seconds: wait and retry.

← oauth · API reference