API Documentation
Official API reference and OIDC discovery documentation for clouburstlab identity provider.
Quick Links
OIDC Discovery
Returns the OpenID Connect discovery document containing issuer, endpoints, and supported scopes/claims.
GET/.well-known/openid-configuration
Response
JSON object with OpenID Provider metadata.
Authorization Endpoint
Initiates the OAuth 2.0 Authorization Code flow.
POST/api/sso/v1/authorize
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| client_id | string | Required | Your application's Client ID. |
| redirect_uri | string | Required | Where to redirect the user after auth. |
| response_type | string | Required | Must be 'code'. |
| scope | string | Optional | Space-separated scopes (e.g., 'openid profile email'). |
| state | string | Required | Opaque value for maintaining state to mitigate CSRF. |
| code_challenge | string | Required | PKCE code challenge. |
| code_challenge_method | string | Required | Must be 'S256'. |
Response
Redirects to the redirect_uri with a `code` and `state`.
Token Endpoint
Exchanges an authorization code or refresh token for access tokens.
POST/api/sso/v1/token
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| grant_type | string | Required | 'authorization_code' or 'refresh_token'. |
| code | string | Required | The authorization code (if grant_type is authorization_code). |
| redirect_uri | string | Required | Must match the original redirect URI. |
| client_id | string | Required | Your application's Client ID. |
| client_secret | string | Required | Your application's Client Secret. |
| code_verifier | string | Required | PKCE code verifier. |
Response
JSON object containing access_token, id_token, and refresh_token.
UserInfo Endpoint
Retrieves claims about the authenticated end-user.
GET/api/sso/v1/userinfo
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| Authorization | header | Required | Bearer token containing the access token. |
Response
JSON object containing user claims (sub, name, email, etc.).
JWKS Endpoint
Returns the JSON Web Key Set used to sign ID tokens.
GET/api/sso/v1/jwks.json
Response
JSON Web Key Set containing public keys.
Token Revocation Endpoint
Revokes an active access or refresh token.
POST/api/sso/v1/revoke
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| client_id | string | Required | Your application's Client ID. |
| client_secret | string | Required | Your application's Client Secret. |
| token | string | Required | The token you want to revoke. |
| token_type_hint | string | Optional | Optional hint ('access_token' or 'refresh_token'). |
Response
Empty 200 OK response on success.