{
  "openapi": "3.1.0",
  "info": {
    "title": "Authentication API",
    "version": "v1",
    "description": "# Authentication API\n\nThe Authentication API enables you to manage all aspects of user identity when you use Auth0. It offers endpoints so your users can log in, sign up, log out, access APIs, and more.\n\nThe API supports various identity protocols, like [OpenID Connect](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol), [OAuth 2.0](https://auth0.com/docs/authenticate/protocols/oauth), [FAPI](https://auth0.com/docs/secure/highly-regulated-identity#advanced-security-with-openid-connect-fapi-), and [SAML](https://auth0.com/docs/protocols/saml).\n\n:::note\nThis API is designed for developers who are comfortable integrating with RESTful APIs. If you prefer a more guided approach, check out our [Quickstarts](https://auth0.com/docs/quickstarts) or [Libraries](https://auth0.com/docs/libraries).\n:::\n\n## Base URL\n\nThe Authentication API is served over HTTPS. All URLs referenced in the documentation have the following base:\n\n```\nhttps://{yourDomain}\n```\n\nReplace `{yourDomain}` with your Auth0 tenant domain (e.g., `your-tenant.auth0.com` or `your-tenant.us.auth0.com`).\n\n---\n\n## Understanding OAuth 2.0 Flows\n\nAuth0 implements various OAuth 2.0 flows to accommodate different application types and security requirements. The two most important endpoints for these flows are:\n\n- **`/authorize`** - Initiates the authorization process\n- **`/oauth/token`** - Exchanges credentials for tokens\n\n### Flow Selection Guide\n\n| Application Type | Recommended Flow | Endpoints Used |\n|-----------------|------------------|----------------|\n| **Regular Web Application** (server-side) | Authorization Code Flow | `/authorize` → `/oauth/token` |\n| **Single-Page Application** (SPA) | Authorization Code Flow with PKCE | `/authorize` → `/oauth/token` |\n| **Native Mobile App** | Authorization Code Flow with PKCE | `/authorize` → `/oauth/token` |\n| **Machine-to-Machine** (API, CLI, Daemon) | Client Credentials Flow | `/oauth/token` only |\n| **Trusted First-Party App** | Resource Owner Password Flow | `/oauth/token` only |\n| **Input-Constrained Device** (TV, IoT) | Device Authorization Flow | `/oauth/device/code` → `/oauth/token` |\n\n---\n\n## Common Authentication Flows\n\n### 1. Authorization Code Flow\n\n**Best for:** Server-side web applications that can securely store a client secret.\n\n**How it works:**\n\n1. **User initiates login** - Your app redirects the user to Auth0's `/authorize` endpoint:\n   ```\n   GET https://{yourDomain}/authorize?\n     response_type=code&\n     client_id={yourClientId}&\n     redirect_uri={yourCallbackUrl}&\n     scope=openid%20profile%20email&\n     state={randomState}\n   ```\n\n2. **User authenticates** - Auth0 shows the login page, user enters credentials.\n\n3. **Auth0 redirects back** - After successful authentication, Auth0 redirects to your `redirect_uri` with an authorization code:\n   ```\n   {yourCallbackUrl}?code=AUTHORIZATION_CODE&state={randomState}\n   ```\n\n4. **Exchange code for tokens** - Your backend exchanges the code for tokens at `/oauth/token`:\n   ```\n   POST https://{yourDomain}/oauth/token\n   Content-Type: application/x-www-form-urlencoded\n\n   grant_type=authorization_code&\n   client_id={yourClientId}&\n   client_secret={yourClientSecret}&\n   code=AUTHORIZATION_CODE&\n   redirect_uri={yourCallbackUrl}\n   ```\n\n5. **Receive tokens** - Auth0 returns access token, ID token, and optionally a refresh token.\n\n**Learn more:** [Authorization Code Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow)\n\n---\n\n### 2. Authorization Code Flow with PKCE\n\n**Best for:** Single-page applications (SPAs) and native mobile apps that cannot securely store a client secret.\n\n**How it works:**\n\n1. **Generate code verifier and challenge** - Your app generates:\n   - A random `code_verifier` (cryptographically random string)\n   - A `code_challenge` derived from the verifier: `BASE64URL(SHA256(code_verifier))`\n\n2. **User initiates login** - Your app redirects to `/authorize` with the code challenge:\n   ```\n   GET https://{yourDomain}/authorize?\n     response_type=code&\n     client_id={yourClientId}&\n     redirect_uri={yourCallbackUrl}&\n     scope=openid%20profile%20email&\n     state={randomState}&\n     code_challenge={codeChallenge}&\n     code_challenge_method=S256\n   ```\n\n3. **User authenticates** - Auth0 shows login page, user authenticates.\n\n4. **Auth0 redirects back** - After authentication, Auth0 redirects with authorization code:\n   ```\n   {yourCallbackUrl}?code=AUTHORIZATION_CODE&state={randomState}\n   ```\n\n5. **Exchange code for tokens** - Your app exchanges the code using the original verifier:\n   ```\n   POST https://{yourDomain}/oauth/token\n   Content-Type: application/x-www-form-urlencoded\n\n   grant_type=authorization_code&\n   client_id={yourClientId}&\n   code=AUTHORIZATION_CODE&\n   code_verifier={codeVerifier}&\n   redirect_uri={yourCallbackUrl}\n   ```\n   Note: No `client_secret` required!\n\n6. **Receive tokens** - Auth0 returns tokens after verifying the code verifier.\n\n**Why PKCE?** PKCE prevents authorization code interception attacks by ensuring only the app that initiated the flow can exchange the code for tokens.\n\n**Learn more:** [Authorization Code Flow with PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)\n\n---\n\n### 3. Implicit Flow (Deprecated)\n\n**Status:** ⚠️ **Not recommended for new applications**\n\n**Best for:** Legacy SPAs (replaced by Authorization Code Flow with PKCE).\n\n**How it works:**\n\n1. **User initiates login** - Your app redirects to `/authorize` requesting tokens directly:\n   ```\n   GET https://{yourDomain}/authorize?\n     response_type=token&\n     client_id={yourClientId}&\n     redirect_uri={yourCallbackUrl}&\n     scope=openid%20profile%20email&\n     state={randomState}&\n     nonce={randomNonce}\n   ```\n\n2. **Receive tokens immediately** - Auth0 redirects back with tokens in the URL fragment:\n   ```\n   {yourCallbackUrl}#access_token=...&id_token=...&token_type=Bearer&expires_in=86400\n   ```\n\n**Why deprecated?** Tokens are exposed in the browser history and cannot be securely stored. Use PKCE instead.\n\n**Learn more:** [Implicit Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/implicit-flow-with-form-post)\n\n---\n\n### 4. Client Credentials Flow\n\n**Best for:** Machine-to-machine (M2M) communication where no user is involved.\n\n**How it works:**\n\n1. **Request token** - Your service authenticates with its credentials:\n   ```\n   POST https://{yourDomain}/oauth/token\n   Content-Type: application/x-www-form-urlencoded\n\n   grant_type=client_credentials&\n   client_id={yourClientId}&\n   client_secret={yourClientSecret}&\n   audience={apiIdentifier}\n   ```\n\n2. **Receive access token** - Auth0 returns an access token for the API:\n   ```json\n   {\n     \"access_token\": \"eyJ...\",\n     \"token_type\": \"Bearer\",\n     \"expires_in\": 86400\n   }\n   ```\n\n3. **Call API** - Use the access token to call your API.\n\n**Use cases:** Background jobs, microservices, CLIs, server-to-server integrations.\n\n**Learn more:** [Client Credentials Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow)\n\n---\n\n### 5. Resource Owner Password Flow\n\n**Best for:** Highly trusted first-party applications (use sparingly).\n\n**Status:** ⚠️ **Only use if redirect-based flows are not possible**\n\n**How it works:**\n\n1. **Collect credentials** - Your app collects username and password directly from the user.\n\n2. **Request token** - Your app sends credentials to Auth0:\n   ```\n   POST https://{yourDomain}/oauth/token\n   Content-Type: application/x-www-form-urlencoded\n\n   grant_type=password&\n   username={username}&\n   password={password}&\n   client_id={yourClientId}&\n   client_secret={yourClientSecret}&\n   audience={apiIdentifier}&\n   scope=openid%20profile%20email\n   ```\n\n3. **Receive tokens** - Auth0 returns tokens if credentials are valid.\n\n**Important:** This flow requires your app to handle user credentials directly. Use only when absolutely necessary.\n\n**Learn more:** [Resource Owner Password Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow)\n\n---\n\n### 6. Device Authorization Flow\n\n**Best for:** Input-constrained devices like smart TVs, IoT devices, or gaming consoles.\n\n**How it works:**\n\n1. **Request device code** - Your device requests a code:\n   ```\n   POST https://{yourDomain}/oauth/device/code\n   Content-Type: application/x-www-form-urlencoded\n\n   client_id={yourClientId}&\n   scope=openid%20profile&\n   audience={apiIdentifier}\n   ```\n\n2. **Receive codes** - Auth0 returns:\n   ```json\n   {\n     \"device_code\": \"GmRh...\",\n     \"user_code\": \"WDJB-MJHT\",\n     \"verification_uri\": \"https://{yourDomain}/activate\",\n     \"verification_uri_complete\": \"https://{yourDomain}/activate?user_code=WDJB-MJHT\",\n     \"expires_in\": 900,\n     \"interval\": 5\n   }\n   ```\n\n3. **Show user code** - Display the `user_code` and `verification_uri` to the user.\n\n4. **User activates on another device** - User visits the URL on their phone/computer and enters the code.\n\n5. **Poll for token** - Your device polls `/oauth/token` every `interval` seconds:\n   ```\n   POST https://{yourDomain}/oauth/token\n   Content-Type: application/x-www-form-urlencoded\n\n   grant_type=urn:ietf:params:oauth:grant-type:device_code&\n   device_code={deviceCode}&\n   client_id={yourClientId}\n   ```\n\n6. **Receive tokens** - Once user authorizes, Auth0 returns tokens.\n\n**Learn more:** [Device Authorization Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow)\n\n---\n\n### 7. Refresh Token Flow\n\n**Purpose:** Obtain new access tokens without user interaction.\n\n**How it works:**\n\n1. **Use refresh token** - When your access token expires, request a new one:\n   ```\n   POST https://{yourDomain}/oauth/token\n   Content-Type: application/x-www-form-urlencoded\n\n   grant_type=refresh_token&\n   client_id={yourClientId}&\n   client_secret={yourClientSecret}&\n   refresh_token={refreshToken}\n   ```\n\n2. **Receive new access token** - Auth0 returns a fresh access token:\n   ```json\n   {\n     \"access_token\": \"eyJ...\",\n     \"token_type\": \"Bearer\",\n     \"expires_in\": 86400\n   }\n   ```\n\n**Getting refresh tokens:** Include `offline_access` in the `scope` parameter during initial authorization.\n\n**Learn more:** [Refresh Tokens](https://auth0.com/docs/secure/tokens/refresh-tokens)\n\n---\n\n## Multi-Factor Authentication (MFA) Flows\n\nWhen MFA is enabled, authentication flows may require additional verification steps.\n\n### MFA Flow Sequence\n\n1. **Initial authentication** - User provides primary credentials (username/password).\n\n2. **MFA required response** - Auth0 returns an `mfa_required` error with an `mfa_token`:\n   ```json\n   {\n     \"error\": \"mfa_required\",\n     \"error_description\": \"Multifactor authentication required\",\n     \"mfa_token\": \"Fe26...Ha\"\n   }\n   ```\n\n3. **Request MFA challenge** - Request a challenge using `/mfa/challenge`:\n   ```\n   POST https://{yourDomain}/mfa/challenge\n   Content-Type: application/json\n\n   {\n     \"mfa_token\": \"Fe26...Ha\",\n     \"client_id\": \"{yourClientId}\",\n     \"client_secret\": \"{yourClientSecret}\",\n     \"challenge_type\": \"otp\"\n   }\n   ```\n\n4. **Complete MFA verification** - Submit the MFA code to `/oauth/token`:\n   ```\n   POST https://{yourDomain}/oauth/token\n   Content-Type: application/x-www-form-urlencoded\n\n   grant_type=http://auth0.com/oauth/grant-type/mfa-otp&\n   client_id={yourClientId}&\n   client_secret={yourClientSecret}&\n   mfa_token={mfaToken}&\n   otp={otpCode}\n   ```\n\n5. **Receive tokens** - After successful MFA verification, Auth0 returns tokens.\n\n### MFA Challenge Types\n\n- **OTP (One-Time Password)** - Authenticator app codes (Google Authenticator, Authy, etc.)\n- **OOB (Out-of-Band)** - SMS, voice call, or push notification\n- **Recovery Code** - Backup codes for account recovery\n\n**Learn more:** [Multi-factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication)\n\n---\n\n## Passwordless Authentication Flows\n\nPasswordless authentication allows users to log in without passwords using email or SMS.\n\n### Passwordless Flow Sequence\n\n1. **Start passwordless** - Request a verification code or magic link:\n   ```\n   POST https://{yourDomain}/passwordless/start\n   Content-Type: application/json\n\n   {\n     \"client_id\": \"{yourClientId}\",\n     \"client_secret\": \"{yourClientSecret}\",\n     \"connection\": \"email\",\n     \"email\": \"user@example.com\",\n     \"send\": \"code\"\n   }\n   ```\n\n2. **User receives code** - Auth0 sends a verification code via email or SMS.\n\n3. **Verify and get tokens** - Exchange the code for tokens:\n   ```\n   POST https://{yourDomain}/oauth/token\n   Content-Type: application/x-www-form-urlencoded\n\n   grant_type=http://auth0.com/oauth/grant-type/passwordless/otp&\n   client_id={yourClientId}&\n   client_secret={yourClientSecret}&\n   username={emailOrPhone}&\n   otp={verificationCode}&\n   realm={connection}&\n   scope=openid%20profile%20email\n   ```\n\n4. **Receive tokens** - Auth0 returns tokens after successful verification.\n\n**Learn more:** [Passwordless Authentication](https://auth0.com/docs/authenticate/passwordless)\n\n---\n\n## Advanced Flows\n\n### Pushed Authorization Requests (PAR)\n\n**Best for:** High-security applications requiring FAPI compliance.\n\n**How it works:**\n\n1. **Push authorization parameters** - Send authorization request to `/oauth/par`:\n   ```\n   POST https://{yourDomain}/oauth/par\n   Content-Type: application/x-www-form-urlencoded\n\n   response_type=code&\n   client_id={yourClientId}&\n   client_secret={yourClientSecret}&\n   redirect_uri={yourCallbackUrl}&\n   scope=openid%20profile&\n   code_challenge={codeChallenge}&\n   code_challenge_method=S256\n   ```\n\n2. **Receive request URI** - Auth0 returns a reference:\n   ```json\n   {\n     \"request_uri\": \"urn:ietf:params:oauth:request_uri:bwc4JK-ESC0w8acc191e-Y1LTC2\",\n     \"expires_in\": 90\n   }\n   ```\n\n3. **Initiate authorization** - Redirect user to `/authorize` with the request URI:\n   ```\n   GET https://{yourDomain}/authorize?\n     client_id={yourClientId}&\n     request_uri=urn:ietf:params:oauth:request_uri:bwc4JK-ESC0w8acc191e-Y1LTC2\n   ```\n\n4. **Complete flow** - Continue with standard authorization code exchange.\n\n**Benefits:** Keeps sensitive parameters out of browser history and prevents parameter tampering.\n\n**Learn more:** [Pushed Authorization Requests](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-par)\n\n---\n\n## Token Types\n\n### Access Token\n- **Purpose:** Access protected APIs\n- **Format:** JWT (JSON Web Token) or opaque string\n- **Lifetime:** Typically 24 hours (configurable)\n- **Contains:** User permissions (scopes), audience (API identifier)\n\n### ID Token\n- **Purpose:** Contains user profile information\n- **Format:** Always JWT\n- **Contains:** User claims (name, email, etc.), issuer, expiration\n- **Use:** Client-side user information display\n\n### Refresh Token\n- **Purpose:** Obtain new access tokens\n- **Format:** Opaque string\n- **Lifetime:** Long-lived (days to months)\n- **Security:** Must be stored securely, can be revoked\n\n**Learn more:** [Tokens](https://auth0.com/docs/secure/tokens)\n\n---\n\n## Authentication Methods\n\nYou have multiple options for authenticating with this API:\n\n### 1. OAuth2 Access Token\n\nSend a valid Access Token in the `Authorization` header using the `Bearer` scheme:\n\n```\nAuthorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\n```\n\n**Example:** The `/userinfo` endpoint requires a valid access token.\n\n### 2. Client ID and Client Secret\n\nSend Client ID and Client Secret in the request. The method depends on your application's Token Endpoint Authentication Method:\n\n**HTTP Basic Authentication:**\n```\nAuthorization: Basic BASE64(client_id:client_secret)\n```\n\n**POST Body:**\n```\nclient_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET\n```\n\n### 3. Client ID and Client Assertion (Private Key JWT)\n\nFor enhanced security, use a signed JWT:\n\n```\nclient_id=YOUR_CLIENT_ID&\nclient_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&\nclient_assertion=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\n```\n\n**Learn more:** [Private Key JWT](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-private-key-jwt)\n\n### 4. Client ID Only\n\nFor public applications (SPAs, mobile apps) that cannot securely store secrets:\n\n```\nclient_id=YOUR_CLIENT_ID\n```\n\n### 5. mTLS Authentication\n\nFor highly regulated industries, use mutual TLS:\n\n- Client presents certificate during TLS handshake\n- Certificate verified by Auth0 edge network\n- No client secret needed\n\n**Learn more:** [mTLS Authentication](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-mtls)\n\n---\n\n## Request Parameters\n\n### GET Requests\n\nParameters are passed as query strings:\n\n```\nGET https://{yourDomain}/authorize?client_id=abc123&response_type=code&redirect_uri=https://app.com/callback\n```\n\n### POST Requests\n\nParameters are encoded as JSON or form data:\n\n**JSON:**\n```\nPOST https://{yourDomain}/oauth/token\nContent-Type: application/json\n\n{\n  \"grant_type\": \"authorization_code\",\n  \"code\": \"abc123\",\n  \"client_id\": \"YOUR_CLIENT_ID\"\n}\n```\n\n**Form-encoded:**\n```\nPOST https://{yourDomain}/oauth/token\nContent-Type: application/x-www-form-urlencoded\n\ngrant_type=authorization_code&code=abc123&client_id=YOUR_CLIENT_ID\n```\n\n---\n\n## Testing\n\nYou can test the endpoints using the [Authentication API Debugger](https://auth0.com/docs/customize/extensions/authentication-api-debugger-extension) extension.\n\n---\n\n## Errors\n\nWhen an error occurs, you will receive an error object with an error code and description:\n\n```json\n{\n  \"error\": \"invalid_request\",\n  \"error_description\": \"The request is missing a required parameter: redirect_uri\"\n}\n```\n\n### HTTP Status Codes\n\n- **4xx** - Client errors (bad request, invalid parameters, unauthorized)\n- **5xx** - Server errors (check [Auth0 Status Page](https://status.auth0.com/))\n\n**Common errors:**\n- `invalid_request` - Missing or invalid parameters\n- `invalid_client` - Invalid client credentials\n- `invalid_grant` - Invalid authorization code or refresh token\n- `unauthorized_client` - Client not authorized for this grant type\n- `access_denied` - User denied authorization\n- `mfa_required` - Multi-factor authentication required\n\n---\n\n## Rate Limiting\n\nThe Authentication API is subject to rate limiting. Limits vary by endpoint.\n\nIf you exceed the rate limit, you will receive:\n\n```\nHTTP/1.1 429 Too Many Requests\nX-RateLimit-Limit: 10\nX-RateLimit-Remaining: 0\nX-RateLimit-Reset: 1640000000\n\n{\n  \"error\": \"too_many_requests\",\n  \"error_description\": \"Too many requests. Check the X-RateLimit-* headers.\"\n}\n```\n\n### Rate Limit Headers\n\n- `X-RateLimit-Limit` - Requests allowed per time window\n- `X-RateLimit-Remaining` - Requests remaining in current window\n- `X-RateLimit-Reset` - UTC epoch seconds when limit resets\n\n**Learn more:** [Rate Limit Policy](https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy)\n\n---\n\n## Legacy Endpoints\n\nThis API includes legacy endpoints marked with **[Legacy]** tags and the `deprecated` flag. These endpoints are part of the legacy authentication pipeline and are maintained for backward compatibility only.\n\n**For new implementations, use the current endpoints documented above.**\n\nLegacy endpoints may:\n- Be disabled for new tenants\n- Have limited support\n- Not support modern security features\n- Be removed in future versions\n\n**Migration Guide:** [OIDC Conformant Authentication](https://auth0.com/docs/authenticate/login/oidc-conformant-authentication)\n\n---\n\n## Support\n\nIf you have problems or need help:\n\n- **Documentation:** [Auth0 Docs](https://auth0.com/docs)\n- **Community:** [Auth0 Community](https://community.auth0.com/)\n- **Support:** [Support Center](https://support.auth0.com/) (paid plans)\n\n---\n\n## Additional Resources\n\n- [Auth0 Quickstarts](https://auth0.com/docs/quickstarts)\n- [SDKs and Libraries](https://auth0.com/docs/libraries)\n- [API Authorization](https://auth0.com/docs/get-started/apis)\n- [Tokens Best Practices](https://auth0.com/docs/secure/tokens/token-best-practices)\n- [Security Best Practices](https://auth0.com/docs/secure/security-guidance)"
  },
  "servers": [
    {
      "url": "https://{yourDomain}",
      "description": "Your Auth0 tenant domain",
      "variables": {
        "yourDomain": {
          "default": "your-tenant.auth0.com",
          "description": "Your Auth0 domain (e.g., tenant.auth0.com, tenant.us.auth0.com, tenant.eu.auth0.com)"
        }
      }
    }
  ],
  "security": [
    {
      "oauth2": []
    }
  ],
  "externalDocs": {
    "description": "Auth0 Authentication API Documentation",
    "url": "https://auth0.com/docs/api/authentication"
  },
  "tags": [
    {
      "name": "Authorization",
      "description": "OAuth 2.0 authorization flows for authenticating users. The `/authorize` endpoint initiates browser-based authentication flows including Authorization Code Flow, Authorization Code Flow with PKCE, and Implicit Flow."
    },
    {
      "name": "Token Exchange",
      "description": "Exchange credentials for access tokens, ID tokens, and refresh tokens. The `/oauth/token` endpoint supports multiple OAuth 2.0 grant types including authorization code, refresh token, client credentials, password, device code, and Auth0-specific MFA and passwordless grants."
    },
    {
      "name": "Multi-factor Authentication",
      "description": "MFA enrollment, challenge request, and verification endpoints. Use these endpoints to implement multi-factor authentication using OTP (authenticator apps), OOB (SMS/push), or recovery codes."
    },
    {
      "name": "Passwordless",
      "description": "Passwordless authentication via email or SMS. Users can log in using a one-time code or magic link sent to their email or phone number."
    },
    {
      "name": "User Profile",
      "description": "Retrieve authenticated user information using the OpenID Connect UserInfo endpoint."
    },
    {
      "name": "Logout",
      "description": "End user sessions and log users out of Auth0 and optionally their identity provider. Supports Auth0 logout, OIDC RP-Initiated Logout, SAML logout, and universal logout."
    },
    {
      "name": "Device Authorization",
      "description": "OAuth 2.0 Device Authorization Flow for input-constrained devices like smart TVs, IoT devices, and gaming consoles."
    },
    {
      "name": "Token Management",
      "description": "Refresh access tokens and revoke refresh tokens."
    },
    {
      "name": "Pushed Authorization Requests",
      "description": "Push authorization request parameters to Auth0 before initiating the authorization flow. Used for high-security scenarios and FAPI compliance."
    },
    {
      "name": "SAML",
      "description": "SAML protocol endpoints for SAML-based authentication flows."
    },
    {
      "name": "WS-Federation",
      "description": "WS-Federation protocol endpoints for legacy enterprise integrations."
    },
    {
      "name": "Dynamic Client Registration",
      "description": "Dynamically register OAuth 2.0 clients using OpenID Connect Dynamic Client Registration."
    },
    {
      "name": "Database Connections",
      "description": "User signup and password management for Auth0 database connections."
    },
    {
      "name": "Native Social",
      "description": "Token exchange for native social authentication (Sign in with Apple, etc.)."
    },
    {
      "name": "Login [Legacy]",
      "description": "⚠️ **LEGACY**: These endpoints are part of the legacy authentication pipeline. Use the current Authorization and Token Exchange endpoints instead.\n\n**Status:** Disabled by default for new tenants as of June 8, 2017.\n\n**Migration:** [OIDC Conformant Authentication](https://auth0.com/docs/authenticate/login/oidc-conformant-authentication)",
      "externalDocs": {
        "description": "Migration Guide",
        "url": "https://auth0.com/docs/authenticate/login/oidc-conformant-authentication"
      }
    },
    {
      "name": "Account Linking [Legacy]",
      "description": "⚠️ **LEGACY**: Account linking via the Authentication API is deprecated.\n\n**Use instead:** [Management API v2 - Link User Accounts](https://auth0.com/docs/api/management/v2#!/Users/post_identities)\n\n**Migration:** [Account Linking Migration](https://auth0.com/docs/migrations/past-migrations#account-linking-removal)",
      "externalDocs": {
        "description": "Current Account Linking API",
        "url": "https://auth0.com/docs/api/management/v2#!/Users/post_identities"
      }
    },
    {
      "name": "Delegation [Legacy]",
      "description": "⚠️ **LEGACY**: Delegation tokens are deprecated and disabled for new tenants.\n\n**Status:** Maintained only for tenants with active add-ons that require delegation.\n\n**Learn more:** [Delegation Tokens](https://auth0.com/docs/secure/tokens/delegation-tokens)"
    },
    {
      "name": "User Profile [Legacy]",
      "description": "⚠️ **LEGACY**: The `/tokeninfo` endpoint is part of the legacy pipeline.\n\n**Use instead:** `/userinfo` endpoint (OpenID Connect UserInfo)"
    },
    {
      "name": "Resource Owner [Legacy]",
      "description": "⚠️ **LEGACY**: The `/oauth/ro` endpoint is part of the legacy authentication pipeline.\n\n**Use instead:** `/oauth/token` with `grant_type=password` (Resource Owner Password Flow)"
    },
    {
      "name": "Impersonation [Legacy]",
      "description": "⚠️ **LEGACY**: User impersonation using Global Client credentials.\n\n**Note:** Global Client credentials are deprecated."
    }
  ],
  "paths": {
    "/authorize": {
      "get": {
        "operationId": "authorize",
        "summary": "Authorization Endpoint",
        "description": "Initiates the OAuth 2.0 authorization flow. This endpoint supports multiple authentication flows including Authorization Code Flow, Authorization Code Flow with PKCE, Implicit Flow, and Hybrid Flow.\n\n**Supported Flows:**\n- **Authorization Code Flow** - Use `response_type=code` (for server-side apps)\n- **Authorization Code Flow with PKCE** - Use `response_type=code` with `code_challenge` (for SPAs and mobile apps)\n- **Implicit Flow** - Use `response_type=token` or `response_type=id_token` (deprecated)\n- **Hybrid Flow** - Use `response_type=code id_token` or `response_type=code token`\n\nThe user will be redirected to Auth0's login page to authenticate. After successful authentication, Auth0 redirects back to your `redirect_uri` with the appropriate response based on the `response_type`.",
        "tags": [
          "Authorization"
        ],
        "parameters": [
          {
            "name": "response_type",
            "in": "query",
            "required": true,
            "description": "Specifies the type of response you expect. Determines which OAuth 2.0 flow to use.\n\n- `code` - Authorization Code Flow (returns authorization code)\n- `token` - Implicit Flow for Access Token (returns access token)\n- `id_token` - Implicit Flow for ID Token (returns ID token)\n- `id_token token` - Implicit Flow (returns both)\n- `code id_token` - Hybrid Flow\n- `code token` - Hybrid Flow\n- `code id_token token` - Hybrid Flow",
            "schema": {
              "type": "string",
              "enum": [
                "code",
                "token",
                "id_token",
                "id_token token",
                "code id_token",
                "code token",
                "code id_token token"
              ]
            },
            "example": "code"
          },
          {
            "name": "client_id",
            "in": "query",
            "required": true,
            "description": "Your application's Client ID. You can find this value in your [Application Settings](https://manage.auth0.com/#/applications).",
            "schema": {
              "type": "string"
            },
            "example": "your_client_id"
          },
          {
            "name": "redirect_uri",
            "in": "query",
            "required": false,
            "description": "The URL to which Auth0 will redirect the browser after authorization has been granted by the user. This URL must be registered in your application's **Allowed Callback URLs** settings.\n\n**Note:** Required for most flows, but may be optional if a default is configured.",
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "example": "https://your-app.com/callback"
          },
          {
            "name": "scope",
            "in": "query",
            "required": false,
            "description": "Space-delimited list of scopes you want to request authorization for. Include `openid` to get an ID Token. Include `offline_access` to get a Refresh Token.\n\n**OIDC Scopes:**\n- `openid` - Required for OpenID Connect\n- `profile` - User profile info (name, picture, etc.)\n- `email` - User email address\n- `address` - User address\n- `phone` - User phone number\n- `offline_access` - Refresh token\n\n**Custom Scopes:** You can also request custom API scopes defined in your Auth0 APIs.",
            "schema": {
              "type": "string"
            },
            "example": "openid profile email"
          },
          {
            "name": "state",
            "in": "query",
            "required": false,
            "description": "An opaque arbitrary alphanumeric string your app adds to the initial request that Auth0 includes when redirecting back to your application. This value must be used by the application to prevent CSRF attacks.\n\n**Recommended:** Always include this parameter for security.",
            "schema": {
              "type": "string"
            },
            "example": "xyzABC123"
          },
          {
            "name": "audience",
            "in": "query",
            "required": false,
            "description": "The unique identifier of the target API you want to access. This is the **API Identifier** found in your API settings.\n\n**When to use:** Include this when requesting an Access Token to call a specific API.",
            "schema": {
              "type": "string"
            },
            "example": "https://api.example.com"
          },
          {
            "name": "code_challenge",
            "in": "query",
            "required": false,
            "description": "Generated challenge from the `code_verifier` for PKCE flow. Required when using Authorization Code Flow with PKCE.\n\n**Format:** `BASE64URL(SHA256(code_verifier))`\n\n**PKCE Flow:** Used to prevent authorization code interception attacks in public clients (SPAs, mobile apps).",
            "schema": {
              "type": "string"
            },
            "example": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
          },
          {
            "name": "code_challenge_method",
            "in": "query",
            "required": false,
            "description": "Method used to generate the challenge. Auth0 supports `S256` (SHA-256).\n\n**Required when:** Using `code_challenge` parameter.",
            "schema": {
              "type": "string",
              "enum": [
                "S256"
              ]
            },
            "example": "S256"
          },
          {
            "name": "nonce",
            "in": "query",
            "required": false,
            "description": "A random string value used to associate a client session with an ID Token and to mitigate replay attacks. The nonce value is included in the ID Token.\n\n**Required when:** Using `response_type` that includes `id_token` (Implicit or Hybrid flows).",
            "schema": {
              "type": "string"
            },
            "example": "abc123nonce"
          },
          {
            "name": "connection",
            "in": "query",
            "required": false,
            "description": "The name of the connection configured for your application. Forces the user to sign in with a specific connection.\n\n**Examples:** `google-oauth2`, `facebook`, `Username-Password-Authentication`, `windowslive`, `linkedin`\n\n**When to use:** To skip the Auth0 Universal Login page and go directly to a specific identity provider.",
            "schema": {
              "type": "string"
            },
            "example": "google-oauth2"
          },
          {
            "name": "prompt",
            "in": "query",
            "required": false,
            "description": "Controls the authentication prompts presented to the user.\n\n**Values:**\n- `none` - Silent authentication (no prompts, fails if user is not logged in)\n- `login` - Forces the user to re-enter credentials\n- `consent` - Forces consent prompt even if consent was previously given\n- `select_account` - Prompts user to select an account (when multiple sessions exist)\n\n**Use case:** `none` is used for checking if a user is already authenticated without interrupting their experience.",
            "schema": {
              "type": "string",
              "enum": [
                "none",
                "login",
                "consent",
                "select_account"
              ]
            },
            "example": "none"
          },
          {
            "name": "organization",
            "in": "query",
            "required": false,
            "description": "ID of the organization to use when authenticating a user. When not provided, if your application is configured to **Display Organization Prompt**, the user will be able to enter the organization name when authenticating.\n\n**Use case:** Authenticate users in the context of a specific organization (B2B scenarios).",
            "schema": {
              "type": "string"
            },
            "example": "org_abc123"
          },
          {
            "name": "invitation",
            "in": "query",
            "required": false,
            "description": "Ticket ID of the organization invitation. When inviting a member to an Organization, your application should handle invitation acceptance by forwarding the invitation parameter along with the organization parameter when the user accepts the invitation.\n\n**Use case:** Organization member invitation acceptance flow.",
            "schema": {
              "type": "string"
            },
            "example": "invitation_abc123xyz"
          },
          {
            "name": "login_hint",
            "in": "query",
            "required": false,
            "description": "Hint to the Authorization Server about the login identifier the user might use to log in. Can be an email address or other identifier.\n\n**Use case:** Pre-fill the username/email field on the login page.",
            "schema": {
              "type": "string"
            },
            "example": "user@example.com"
          },
          {
            "name": "acr_values",
            "in": "query",
            "required": false,
            "description": "Space-separated string that specifies the authentication context class reference values. Used to request specific authentication methods (e.g., MFA).\n\n**Example:** `http://schemas.openid.net/pape/policies/2007/06/multi-factor`",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "max_age",
            "in": "query",
            "required": false,
            "description": "Maximum authentication age in seconds. If the elapsed time since the last authentication is greater than this value, the user must re-authenticate.\n\n**Use case:** Require recent authentication for sensitive operations.",
            "schema": {
              "type": "integer"
            },
            "example": 3600
          },
          {
            "name": "ui_locales",
            "in": "query",
            "required": false,
            "description": "Space-delimited list of locales used to constrain the language list for the login page. The first locale on the list must match an enabled locale in your tenant.\n\n**Example:** `en es fr`",
            "schema": {
              "type": "string"
            },
            "example": "en es"
          },
          {
            "name": "response_mode",
            "in": "query",
            "required": false,
            "description": "Specifies how the result of the authorization request is formatted.\n\n**Values:**\n- `query` - Response parameters encoded in query string (default for code)\n- `fragment` - Response parameters encoded in URL fragment (default for token)\n- `form_post` - Response parameters sent as form POST to redirect_uri\n- `web_message` - For silent authentication in iframes",
            "schema": {
              "type": "string",
              "enum": [
                "query",
                "fragment",
                "form_post",
                "web_message"
              ]
            }
          },
          {
            "name": "dpop_jkt",
            "in": "query",
            "required": false,
            "description": "The JWK Thumbprint of the DPoP proof-of-possession public key using SHA-256 hash function (as defined in RFC 7638).\n\n**Use case:** Demonstrating Proof-of-Possession (DPoP) for enhanced security in OAuth 2.0.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "302": {
            "description": "Redirect response. Auth0 redirects the user to authenticate or redirects back to your application with the authorization result.\n\n**Authorization Code Flow:** Redirects to `redirect_uri` with `code` and `state` parameters:\n```\nhttps://your-app.com/callback?code=AUTHORIZATION_CODE&state=xyzABC123\n```\n\n**Implicit Flow (token):** Redirects to `redirect_uri` with tokens in fragment:\n```\nhttps://your-app.com/callback#access_token=...&token_type=Bearer&expires_in=86400&state=xyzABC123\n```\n\n**Implicit Flow (id_token):** Redirects to `redirect_uri` with ID token in fragment:\n```\nhttps://your-app.com/callback#id_token=...&state=xyzABC123\n```",
            "headers": {
              "Location": {
                "description": "The URL to which the user is redirected",
                "schema": {
                  "type": "string",
                  "format": "uri"
                }
              }
            }
          },
          "400": {
            "description": "Bad Request - Invalid parameters",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                },
                "examples": {
                  "invalidRequest": {
                    "summary": "Invalid request parameters",
                    "value": {
                      "error": "invalid_request",
                      "error_description": "The request is missing a required parameter: redirect_uri"
                    }
                  },
                  "unsupportedResponseType": {
                    "summary": "Unsupported response type",
                    "value": {
                      "error": "unsupported_response_type",
                      "error_description": "The authorization server does not support obtaining an authorization code using this method"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                },
                "examples": {
                  "loginRequired": {
                    "summary": "Login required (prompt=none)",
                    "value": {
                      "error": "login_required",
                      "error_description": "The user is not logged in"
                    }
                  }
                }
              }
            }
          },
          "403": {
            "description": "Access Denied",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                },
                "examples": {
                  "accessDenied": {
                    "summary": "User denied authorization",
                    "value": {
                      "error": "access_denied",
                      "error_description": "The user denied the authorization request"
                    }
                  }
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "Authorization Endpoint Documentation",
          "url": "https://auth0.com/docs/api/authentication#authorization-code-flow"
        },
        "x-codeSamples": [
          {
            "lang": "HTTP",
            "label": "Authorization Code Flow",
            "source": "GET /authorize?\n  response_type=code&\n  client_id=YOUR_CLIENT_ID&\n  redirect_uri=https://your-app.com/callback&\n  scope=openid%20profile%20email&\n  state=xyzABC123\nHost: your-tenant.auth0.com"
          },
          {
            "lang": "HTTP",
            "label": "Authorization Code Flow with PKCE",
            "source": "GET /authorize?\n  response_type=code&\n  client_id=YOUR_CLIENT_ID&\n  redirect_uri=https://your-app.com/callback&\n  scope=openid%20profile%20email&\n  state=xyzABC123&\n  code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&\n  code_challenge_method=S256\nHost: your-tenant.auth0.com"
          },
          {
            "lang": "HTTP",
            "label": "Implicit Flow (Access Token)",
            "source": "GET /authorize?\n  response_type=token&\n  client_id=YOUR_CLIENT_ID&\n  redirect_uri=https://your-app.com/callback&\n  scope=openid%20profile%20email&\n  state=xyzABC123&\n  nonce=abc123nonce\nHost: your-tenant.auth0.com"
          },
          {
            "lang": "HTTP",
            "label": "Social Connection",
            "source": "GET /authorize?\n  response_type=code&\n  client_id=YOUR_CLIENT_ID&\n  redirect_uri=https://your-app.com/callback&\n  scope=openid%20profile%20email&\n  state=xyzABC123&\n  connection=google-oauth2\nHost: your-tenant.auth0.com"
          },
          {
            "lang": "HTTP",
            "label": "Silent Authentication",
            "source": "GET /authorize?\n  response_type=code&\n  client_id=YOUR_CLIENT_ID&\n  redirect_uri=https://your-app.com/callback&\n  scope=openid%20profile%20email&\n  state=xyzABC123&\n  prompt=none\nHost: your-tenant.auth0.com"
          },
          {
            "lang": "HTTP",
            "label": "Organization Login",
            "source": "GET /authorize?\n  response_type=code&\n  client_id=YOUR_CLIENT_ID&\n  redirect_uri=https://your-app.com/callback&\n  scope=openid%20profile%20email&\n  state=xyzABC123&\n  organization=org_abc123\nHost: your-tenant.auth0.com"
          }
        ]
      }
    },
    "/oauth/token": {
      "post": {
        "operationId": "exchangeToken",
        "summary": "Token Endpoint",
        "description": "Exchange various types of credentials for access tokens, ID tokens, and refresh tokens. This endpoint is the core of OAuth 2.0 token exchange and supports multiple grant types.\n\n**Supported Grant Types:**\n\n- **authorization_code** - Exchange authorization code for tokens (Authorization Code Flow)\n- **authorization_code** + code_verifier - Exchange with PKCE (Authorization Code Flow with PKCE)\n- **refresh_token** - Get new access token using refresh token\n- **client_credentials** - Machine-to-machine authentication\n- **password** - Resource Owner Password flow\n- **urn:ietf:params:oauth:grant-type:device_code** - Device authorization flow\n- **http://auth0.com/oauth/grant-type/mfa-otp** - MFA verification with OTP\n- **http://auth0.com/oauth/grant-type/mfa-oob** - MFA verification with OOB\n- **http://auth0.com/oauth/grant-type/mfa-recovery-code** - MFA verification with recovery code\n- **http://auth0.com/oauth/grant-type/passwordless/otp** - Passwordless authentication\n- **urn:ietf:params:oauth:grant-type:token-exchange** - Token exchange for native social\n\nThe request body parameters vary based on the grant_type. See the examples below for each flow.",
        "tags": [
          "Token Exchange"
        ],
        "parameters": [
          {
            "name": "DPoP",
            "in": "header",
            "required": false,
            "description": "A DPoP proof JWT for enhanced security. Required only if your application uses Demonstrating Proof-of-Possession (DPoP).",
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "oneOf": [
                  {
                    "$ref": "#/components/schemas/AuthorizationCodeGrant"
                  },
                  {
                    "$ref": "#/components/schemas/AuthorizationCodePKCEGrant"
                  },
                  {
                    "$ref": "#/components/schemas/RefreshTokenGrant"
                  },
                  {
                    "$ref": "#/components/schemas/ClientCredentialsGrant"
                  },
                  {
                    "$ref": "#/components/schemas/PasswordGrant"
                  },
                  {
                    "$ref": "#/components/schemas/DeviceCodeGrant"
                  },
                  {
                    "$ref": "#/components/schemas/MfaOtpGrant"
                  },
                  {
                    "$ref": "#/components/schemas/MfaOobGrant"
                  },
                  {
                    "$ref": "#/components/schemas/MfaRecoveryCodeGrant"
                  },
                  {
                    "$ref": "#/components/schemas/PasswordlessOtpGrant"
                  },
                  {
                    "$ref": "#/components/schemas/TokenExchangeGrant"
                  }
                ],
                "discriminator": {
                  "propertyName": "grant_type",
                  "mapping": {
                    "authorization_code": "#/components/schemas/AuthorizationCodeGrant",
                    "refresh_token": "#/components/schemas/RefreshTokenGrant",
                    "client_credentials": "#/components/schemas/ClientCredentialsGrant",
                    "password": "#/components/schemas/PasswordGrant",
                    "urn:ietf:params:oauth:grant-type:device_code": "#/components/schemas/DeviceCodeGrant",
                    "http://auth0.com/oauth/grant-type/mfa-otp": "#/components/schemas/MfaOtpGrant",
                    "http://auth0.com/oauth/grant-type/mfa-oob": "#/components/schemas/MfaOobGrant",
                    "http://auth0.com/oauth/grant-type/mfa-recovery-code": "#/components/schemas/MfaRecoveryCodeGrant",
                    "http://auth0.com/oauth/grant-type/passwordless/otp": "#/components/schemas/PasswordlessOtpGrant",
                    "urn:ietf:params:oauth:grant-type:token-exchange": "#/components/schemas/TokenExchangeGrant"
                  }
                }
              },
              "examples": {
                "authorizationCode": {
                  "summary": "Authorization Code Flow",
                  "description": "Exchange an authorization code for tokens. Used by server-side web applications that can securely store a client secret.",
                  "value": {
                    "grant_type": "authorization_code",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "code": "AUTHORIZATION_CODE_FROM_CALLBACK",
                    "redirect_uri": "https://your-app.com/callback"
                  }
                },
                "pkce": {
                  "summary": "Authorization Code Flow with PKCE",
                  "description": "Exchange an authorization code for tokens using PKCE. Used by SPAs and mobile apps that cannot securely store a client secret.",
                  "value": {
                    "grant_type": "authorization_code",
                    "client_id": "YOUR_CLIENT_ID",
                    "code": "AUTHORIZATION_CODE_FROM_CALLBACK",
                    "code_verifier": "CODE_VERIFIER_RANDOM_STRING",
                    "redirect_uri": "https://your-app.com/callback"
                  }
                },
                "refreshToken": {
                  "summary": "Refresh Token",
                  "description": "Obtain a new access token using a refresh token without requiring user interaction.",
                  "value": {
                    "grant_type": "refresh_token",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "refresh_token": "YOUR_REFRESH_TOKEN"
                  }
                },
                "clientCredentials": {
                  "summary": "Client Credentials (M2M)",
                  "description": "Machine-to-machine authentication. Request an access token using application credentials without user involvement.",
                  "value": {
                    "grant_type": "client_credentials",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "audience": "https://api.example.com"
                  }
                },
                "password": {
                  "summary": "Resource Owner Password",
                  "description": "Exchange user credentials for tokens. Only use this for highly trusted first-party applications.",
                  "value": {
                    "grant_type": "password",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "username": "user@example.com",
                    "password": "user_password",
                    "audience": "https://api.example.com",
                    "scope": "openid profile email"
                  }
                },
                "deviceCode": {
                  "summary": "Device Authorization Flow",
                  "description": "Exchange a device code for tokens. Used by input-constrained devices like smart TVs.",
                  "value": {
                    "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
                    "client_id": "YOUR_CLIENT_ID",
                    "device_code": "DEVICE_CODE_FROM_DEVICE_ENDPOINT"
                  }
                },
                "mfaOtp": {
                  "summary": "MFA with OTP",
                  "description": "Complete multi-factor authentication using a one-time password from an authenticator app.",
                  "value": {
                    "grant_type": "http://auth0.com/oauth/grant-type/mfa-otp",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "mfa_token": "MFA_TOKEN_FROM_CHALLENGE",
                    "otp": "123456"
                  }
                },
                "mfaOob": {
                  "summary": "MFA with OOB (SMS/Push)",
                  "description": "Complete multi-factor authentication using out-of-band verification (SMS, push notification).",
                  "value": {
                    "grant_type": "http://auth0.com/oauth/grant-type/mfa-oob",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "mfa_token": "MFA_TOKEN_FROM_CHALLENGE",
                    "oob_code": "OOB_CODE_FROM_CHALLENGE",
                    "binding_code": "123456"
                  }
                },
                "mfaRecoveryCode": {
                  "summary": "MFA with Recovery Code",
                  "description": "Complete multi-factor authentication using a recovery code when the primary MFA method is unavailable.",
                  "value": {
                    "grant_type": "http://auth0.com/oauth/grant-type/mfa-recovery-code",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "mfa_token": "MFA_TOKEN_FROM_CHALLENGE",
                    "recovery_code": "ABCDEFGHIJ"
                  }
                },
                "passwordlessOtp": {
                  "summary": "Passwordless with OTP",
                  "description": "Authenticate using a one-time code sent via email or SMS (passwordless authentication).",
                  "value": {
                    "grant_type": "http://auth0.com/oauth/grant-type/passwordless/otp",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "username": "user@example.com",
                    "otp": "123456",
                    "realm": "email",
                    "scope": "openid profile email"
                  }
                },
                "tokenExchange": {
                  "summary": "Token Exchange (Native Social)",
                  "description": "Exchange a native social provider token (e.g., Sign in with Apple) for Auth0 tokens.",
                  "value": {
                    "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
                    "client_id": "YOUR_CLIENT_ID",
                    "subject_token": "APPLE_ID_TOKEN",
                    "subject_token_type": "http://auth0.com/oauth/token-type/apple-authz-code",
                    "scope": "openid profile email"
                  }
                }
              }
            },
            "application/json": {
              "schema": {
                "oneOf": [
                  {
                    "$ref": "#/components/schemas/AuthorizationCodeGrant"
                  },
                  {
                    "$ref": "#/components/schemas/AuthorizationCodePKCEGrant"
                  },
                  {
                    "$ref": "#/components/schemas/RefreshTokenGrant"
                  },
                  {
                    "$ref": "#/components/schemas/ClientCredentialsGrant"
                  },
                  {
                    "$ref": "#/components/schemas/PasswordGrant"
                  },
                  {
                    "$ref": "#/components/schemas/DeviceCodeGrant"
                  },
                  {
                    "$ref": "#/components/schemas/MfaOtpGrant"
                  },
                  {
                    "$ref": "#/components/schemas/MfaOobGrant"
                  },
                  {
                    "$ref": "#/components/schemas/MfaRecoveryCodeGrant"
                  },
                  {
                    "$ref": "#/components/schemas/PasswordlessOtpGrant"
                  },
                  {
                    "$ref": "#/components/schemas/TokenExchangeGrant"
                  }
                ],
                "discriminator": {
                  "propertyName": "grant_type"
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful token exchange. Returns access token and optionally ID token and refresh token.",
            "headers": {
              "DPoP-Nonce": {
                "description": "A DPoP nonce that must be included in the DPoP proof as the 'nonce' claim for subsequent requests to this endpoint.",
                "required": false,
                "schema": {
                  "type": "string"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenResponse"
                },
                "examples": {
                  "withRefreshToken": {
                    "summary": "Success with Refresh Token",
                    "description": "Typical response for Authorization Code Flow with offline_access scope",
                    "value": {
                      "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0...",
                      "refresh_token": "v1.MRHbz1VqR_y42v...",
                      "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
                      "token_type": "Bearer",
                      "expires_in": 86400,
                      "scope": "openid profile email offline_access"
                    }
                  },
                  "withoutRefreshToken": {
                    "summary": "Success without Refresh Token",
                    "description": "Response when offline_access scope was not requested",
                    "value": {
                      "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0...",
                      "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
                      "token_type": "Bearer",
                      "expires_in": 86400,
                      "scope": "openid profile email"
                    }
                  },
                  "clientCredentials": {
                    "summary": "Client Credentials Response",
                    "description": "Machine-to-machine flow returns only access token (no ID token or refresh token)",
                    "value": {
                      "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0...",
                      "token_type": "Bearer",
                      "expires_in": 86400
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Bad Request - Invalid parameters or grant",
            "headers": {
              "DPoP-Nonce": {
                "description": "A DPoP nonce for subsequent requests",
                "required": false,
                "schema": {
                  "type": "string"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                },
                "examples": {
                  "invalidGrant": {
                    "summary": "Invalid authorization code",
                    "value": {
                      "error": "invalid_grant",
                      "error_description": "Invalid authorization code"
                    }
                  },
                  "invalidRequest": {
                    "summary": "Missing required parameter",
                    "value": {
                      "error": "invalid_request",
                      "error_description": "Missing required parameter: code"
                    }
                  },
                  "unsupportedGrantType": {
                    "summary": "Unsupported grant type",
                    "value": {
                      "error": "unsupported_grant_type",
                      "error_description": "Grant type not supported"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized - Invalid client credentials",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                },
                "examples": {
                  "invalidClient": {
                    "summary": "Invalid client credentials",
                    "value": {
                      "error": "invalid_client",
                      "error_description": "Client authentication failed"
                    }
                  },
                  "mfaRequired": {
                    "summary": "MFA Required",
                    "description": "Multi-factor authentication is required. Use the mfa_token to complete MFA challenge.",
                    "value": {
                      "error": "mfa_required",
                      "error_description": "Multifactor authentication required",
                      "mfa_token": "Fe26...Ha"
                    }
                  }
                }
              }
            }
          },
          "403": {
            "description": "Forbidden - Access denied or invalid credentials",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                },
                "examples": {
                  "accessDenied": {
                    "summary": "Access denied",
                    "value": {
                      "error": "access_denied",
                      "error_description": "Access denied"
                    }
                  },
                  "invalidUserPassword": {
                    "summary": "Invalid user credentials (password grant)",
                    "value": {
                      "error": "invalid_user_password",
                      "error_description": "Wrong email or password"
                    }
                  }
                }
              }
            }
          },
          "429": {
            "description": "Too Many Requests - Rate limit exceeded",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                },
                "examples": {
                  "rateLimitExceeded": {
                    "summary": "Rate limit exceeded",
                    "value": {
                      "error": "too_many_requests",
                      "error_description": "Rate limit exceeded. Please retry after some time."
                    }
                  }
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "Token Endpoint Documentation",
          "url": "https://auth0.com/docs/api/authentication#get-token"
        },
        "x-codeSamples": []
      }
    },
    "/mfa/challenge": {
      "post": {
        "operationId": "requestMfaChallenge",
        "summary": "Request MFA Challenge",
        "description": "Request a challenge for multi-factor authentication. This endpoint is used during the MFA flow when a user needs to verify their identity using a second factor.\n\n**When to use:** After receiving an `mfa_required` error from `/oauth/token`, use this endpoint to request a challenge (OTP or OOB) before completing authentication.\n\n**Challenge Types:**\n- `otp` - One-time password from authenticator app\n- `oob` - Out-of-band via SMS, voice, or push notification",
        "tags": [
          "Multi-factor Authentication"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "mfa_token",
                  "client_id",
                  "challenge_type"
                ],
                "properties": {
                  "mfa_token": {
                    "type": "string",
                    "description": "The MFA token received in the mfa_required error response from /oauth/token"
                  },
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "client_secret": {
                    "type": "string",
                    "description": "Your application's Client Secret (required for confidential clients)"
                  },
                  "challenge_type": {
                    "type": "string",
                    "enum": [
                      "otp",
                      "oob"
                    ],
                    "description": "The type of MFA challenge to request"
                  },
                  "authenticator_id": {
                    "type": "string",
                    "description": "The ID of a specific authenticator to challenge (optional, for users with multiple MFA methods enrolled)"
                  },
                  "oob_channel": {
                    "type": "string",
                    "enum": [
                      "sms",
                      "voice",
                      "auth0"
                    ],
                    "description": "The channel to use for OOB challenges (required when challenge_type is 'oob')"
                  }
                }
              },
              "examples": {
                "otpChallenge": {
                  "summary": "Request OTP Challenge",
                  "description": "Request a challenge for TOTP authenticator app",
                  "value": {
                    "mfa_token": "Fe26...Ha",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "challenge_type": "otp"
                  }
                },
                "smsChallenge": {
                  "summary": "Request SMS Challenge",
                  "description": "Request a challenge via SMS",
                  "value": {
                    "mfa_token": "Fe26...Ha",
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "challenge_type": "oob",
                    "oob_channel": "sms"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Challenge request successful",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "challenge_type": {
                      "type": "string",
                      "description": "The type of challenge"
                    },
                    "oob_code": {
                      "type": "string",
                      "description": "The OOB code to use when completing the challenge (for OOB challenges)"
                    },
                    "binding_method": {
                      "type": "string",
                      "description": "The binding method for the OOB challenge"
                    }
                  }
                },
                "examples": {
                  "otpResponse": {
                    "summary": "OTP Challenge Response",
                    "value": {
                      "challenge_type": "otp"
                    }
                  },
                  "oobResponse": {
                    "summary": "OOB Challenge Response",
                    "value": {
                      "challenge_type": "oob",
                      "oob_code": "abcd1234",
                      "binding_method": "prompt"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/mfa/associate": {
      "post": {
        "operationId": "associateMfaAuthenticator",
        "summary": "Associate MFA Authenticator",
        "description": "Associate a new MFA authenticator with the user's account. This endpoint is used to enroll users in MFA.\n\n**Supported Authenticator Types:**\n- `otp` - TOTP authenticator app (Google Authenticator, Authy, etc.)\n- `oob` - Out-of-band (SMS, voice)\n\n**Flow:**\n1. Call this endpoint to initiate enrollment\n2. For OTP: Display the QR code or secret to the user\n3. User enters the first code to confirm enrollment",
        "tags": [
          "Multi-factor Authentication"
        ],
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "authenticator_types"
                ],
                "properties": {
                  "authenticator_types": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "enum": [
                        "otp",
                        "oob"
                      ]
                    },
                    "description": "List of authenticator types to enroll"
                  },
                  "oob_channels": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "enum": [
                        "sms",
                        "voice",
                        "auth0"
                      ]
                    },
                    "description": "List of OOB channels (required when enrolling OOB authenticators)"
                  },
                  "phone_number": {
                    "type": "string",
                    "description": "Phone number for SMS/voice OOB (required when enrolling SMS/voice)"
                  }
                }
              },
              "examples": {
                "enrollOtp": {
                  "summary": "Enroll OTP Authenticator",
                  "value": {
                    "authenticator_types": [
                      "otp"
                    ]
                  }
                },
                "enrollSms": {
                  "summary": "Enroll SMS Authenticator",
                  "value": {
                    "authenticator_types": [
                      "oob"
                    ],
                    "oob_channels": [
                      "sms"
                    ],
                    "phone_number": "+1234567890"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Authenticator association successful",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "authenticator_type": {
                      "type": "string",
                      "description": "The type of authenticator enrolled"
                    },
                    "secret": {
                      "type": "string",
                      "description": "The secret key for OTP authenticators"
                    },
                    "barcode_uri": {
                      "type": "string",
                      "description": "QR code URI for OTP authenticators"
                    },
                    "recovery_codes": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      },
                      "description": "Recovery codes for account recovery"
                    },
                    "oob_code": {
                      "type": "string",
                      "description": "OOB code for out-of-band authenticators"
                    },
                    "oob_channel": {
                      "type": "string",
                      "description": "The OOB channel used"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized - Invalid or missing access token",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/mfa/authenticators": {
      "get": {
        "operationId": "listMfaAuthenticators",
        "summary": "List MFA Authenticators",
        "description": "List all MFA authenticators associated with the current user's account.\n\n**Authentication:** Requires a valid access token with MFA permissions.",
        "tags": [
          "Multi-factor Authentication"
        ],
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "responses": {
          "200": {
            "description": "List of authenticators",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "id": {
                        "type": "string",
                        "description": "Authenticator ID"
                      },
                      "authenticator_type": {
                        "type": "string",
                        "enum": [
                          "otp",
                          "oob",
                          "recovery-code"
                        ],
                        "description": "Type of authenticator"
                      },
                      "active": {
                        "type": "boolean",
                        "description": "Whether the authenticator is active"
                      },
                      "oob_channel": {
                        "type": "string",
                        "description": "OOB channel (for OOB authenticators)"
                      },
                      "name": {
                        "type": "string",
                        "description": "Authenticator name"
                      }
                    }
                  }
                },
                "examples": {
                  "authenticatorsList": {
                    "summary": "User with multiple authenticators",
                    "value": [
                      {
                        "id": "totp|dev_abc123",
                        "authenticator_type": "otp",
                        "active": true,
                        "name": "Authenticator App"
                      },
                      {
                        "id": "sms|dev_xyz789",
                        "authenticator_type": "oob",
                        "oob_channel": "sms",
                        "active": true,
                        "name": "SMS +1***5678"
                      }
                    ]
                  }
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/mfa/authenticators/{id}": {
      "delete": {
        "operationId": "deleteMfaAuthenticator",
        "summary": "Delete MFA Authenticator",
        "description": "Delete a specific MFA authenticator from the user's account. Users must have at least one authenticator remaining or MFA will be disabled.\n\n**Authentication:** Requires a valid access token with MFA permissions.",
        "tags": [
          "Multi-factor Authentication"
        ],
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "description": "The ID of the authenticator to delete",
            "schema": {
              "type": "string"
            },
            "example": "totp|dev_abc123"
          }
        ],
        "responses": {
          "204": {
            "description": "Authenticator deleted successfully"
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "404": {
            "description": "Authenticator not found",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/passwordless/start": {
      "post": {
        "operationId": "startPasswordless",
        "summary": "Start Passwordless Authentication",
        "description": "Start a passwordless authentication flow by sending a verification code or magic link to the user's email or phone.\n\n**Supported connection types:**\n- `email` - Send code or link via email\n- `sms` - Send code via SMS\n\n**Send options:**\n- `link` - Send a magic link (email only)\n- `code` - Send a one-time code",
        "tags": [
          "Passwordless"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "connection",
                  "send"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "client_secret": {
                    "type": "string",
                    "description": "Your application's Client Secret (required for confidential clients)"
                  },
                  "connection": {
                    "type": "string",
                    "enum": [
                      "email",
                      "sms"
                    ],
                    "description": "The connection type for passwordless authentication"
                  },
                  "email": {
                    "type": "string",
                    "format": "email",
                    "description": "The user's email address (required when connection is 'email')"
                  },
                  "phone_number": {
                    "type": "string",
                    "description": "The user's phone number in E.164 format (required when connection is 'sms')"
                  },
                  "send": {
                    "type": "string",
                    "enum": [
                      "link",
                      "code"
                    ],
                    "description": "Whether to send a magic link or a code. Only 'code' is supported for SMS."
                  },
                  "authParams": {
                    "type": "object",
                    "description": "Additional authentication parameters to include (scope, state, etc.)"
                  }
                }
              },
              "examples": {
                "emailCode": {
                  "summary": "Email with Code",
                  "value": {
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "connection": "email",
                    "email": "user@example.com",
                    "send": "code"
                  }
                },
                "emailLink": {
                  "summary": "Email with Magic Link",
                  "value": {
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "connection": "email",
                    "email": "user@example.com",
                    "send": "link",
                    "authParams": {
                      "scope": "openid profile email",
                      "state": "xyzABC123"
                    }
                  }
                },
                "sms": {
                  "summary": "SMS with Code",
                  "value": {
                    "client_id": "YOUR_CLIENT_ID",
                    "client_secret": "YOUR_CLIENT_SECRET",
                    "connection": "sms",
                    "phone_number": "+11234567890",
                    "send": "code"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Passwordless request sent successfully",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "_id": {
                      "type": "string",
                      "description": "Request ID"
                    },
                    "email": {
                      "type": "string",
                      "description": "Email address (for email connections)"
                    },
                    "phone_number": {
                      "type": "string",
                      "description": "Phone number (for SMS connections)"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/oauth/device/code": {
      "post": {
        "operationId": "requestDeviceCode",
        "summary": "Request Device Code",
        "description": "Request a device code and user code for the OAuth 2.0 Device Authorization Flow. This flow is designed for input-constrained devices like smart TVs, IoT devices, or gaming consoles.\n\n**How it works:**\n1. Device requests a device code from this endpoint\n2. Device displays the `user_code` and `verification_uri` to the user\n3. User visits the URL on another device and enters the code\n4. Device polls `/oauth/token` using the `device_code` until user completes authorization",
        "tags": [
          "Device Authorization"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "scope": {
                    "type": "string",
                    "description": "Space-delimited list of requested scopes",
                    "example": "openid profile email"
                  },
                  "audience": {
                    "type": "string",
                    "description": "The unique identifier of the target API you want to access"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Device code issued successfully",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "device_code",
                    "user_code",
                    "verification_uri",
                    "expires_in",
                    "interval"
                  ],
                  "properties": {
                    "device_code": {
                      "type": "string",
                      "description": "The device verification code used when polling for tokens"
                    },
                    "user_code": {
                      "type": "string",
                      "description": "The end-user verification code. Display this to the user."
                    },
                    "verification_uri": {
                      "type": "string",
                      "format": "uri",
                      "description": "The URI the user should visit to enter the user_code"
                    },
                    "verification_uri_complete": {
                      "type": "string",
                      "format": "uri",
                      "description": "Optional URI that includes the user_code for easier user experience"
                    },
                    "expires_in": {
                      "type": "integer",
                      "description": "The lifetime in seconds of the device_code and user_code"
                    },
                    "interval": {
                      "type": "integer",
                      "description": "The minimum number of seconds to wait between polling requests to /oauth/token"
                    }
                  }
                },
                "example": {
                  "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
                  "user_code": "WDJB-MJHT",
                  "verification_uri": "https://your-tenant.auth0.com/activate",
                  "verification_uri_complete": "https://your-tenant.auth0.com/activate?user_code=WDJB-MJHT",
                  "expires_in": 900,
                  "interval": 5
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "Device Authorization Flow",
          "url": "https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow"
        },
        "x-codeSamples": []
      }
    },
    "/oauth/revoke": {
      "post": {
        "operationId": "revokeToken",
        "summary": "Revoke Refresh Token",
        "description": "Revoke a refresh token to prevent it from being used to obtain new access tokens. Once revoked, the refresh token can no longer be used.\n\n**Use cases:**\n- User logout\n- Security concerns (token compromise)\n- User revokes application access\n\n**Note:** This endpoint only revokes refresh tokens. Access tokens cannot be revoked and will remain valid until they expire.",
        "tags": [
          "Token Management"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "token"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "client_secret": {
                    "type": "string",
                    "description": "Your application's Client Secret (required for confidential clients)"
                  },
                  "token": {
                    "type": "string",
                    "description": "The refresh token you want to revoke"
                  },
                  "client_assertion": {
                    "type": "string",
                    "description": "A JWT signed with your client secret or private key (for Private Key JWT authentication)"
                  },
                  "client_assertion_type": {
                    "type": "string",
                    "enum": [
                      "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
                    ],
                    "description": "Must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' when using client_assertion"
                  }
                }
              },
              "example": {
                "client_id": "YOUR_CLIENT_ID",
                "client_secret": "YOUR_CLIENT_SECRET",
                "token": "YOUR_REFRESH_TOKEN"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Token revoked successfully (or token was already invalid/revoked)",
            "content": {
              "text/plain": {
                "schema": {
                  "type": "string"
                },
                "example": "OK"
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/oauth/par": {
      "post": {
        "operationId": "pushAuthorizationRequest",
        "summary": "Pushed Authorization Request (PAR)",
        "description": "Push an authorization request to Auth0 and receive a request URI to use in the authorization flow. PAR enhances security by moving authorization parameters from the front channel (browser) to the back channel (direct server-to-server).\n\n**Benefits:**\n- Prevents parameter tampering\n- Keeps sensitive data out of browser history\n- Required for FAPI (Financial-grade API) compliance\n- Supports large authorization requests\n\n**How it works:**\n1. POST authorization parameters to this endpoint\n2. Receive a `request_uri` in response\n3. Redirect user to `/authorize` with only `client_id` and `request_uri`\n4. Auth0 retrieves the parameters using the `request_uri`",
        "tags": [
          "Pushed Authorization Requests"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "response_type"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "client_secret": {
                    "type": "string",
                    "description": "Your application's Client Secret (required for confidential clients)"
                  },
                  "response_type": {
                    "type": "string",
                    "enum": [
                      "code"
                    ],
                    "description": "Must be 'code' for PAR"
                  },
                  "redirect_uri": {
                    "type": "string",
                    "format": "uri",
                    "description": "The redirect URI for your application"
                  },
                  "scope": {
                    "type": "string",
                    "description": "Space-delimited list of requested scopes"
                  },
                  "state": {
                    "type": "string",
                    "description": "An opaque value to maintain state between request and callback"
                  },
                  "audience": {
                    "type": "string",
                    "description": "The unique identifier of the target API"
                  },
                  "code_challenge": {
                    "type": "string",
                    "description": "The PKCE code challenge"
                  },
                  "code_challenge_method": {
                    "type": "string",
                    "enum": [
                      "S256"
                    ],
                    "description": "The method used to generate the code challenge"
                  },
                  "nonce": {
                    "type": "string",
                    "description": "A random string value for ID Token validation"
                  },
                  "client_assertion": {
                    "type": "string",
                    "description": "A JWT signed with your client secret or private key (for Private Key JWT authentication)"
                  },
                  "client_assertion_type": {
                    "type": "string",
                    "enum": [
                      "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
                    ],
                    "description": "Must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' when using client_assertion"
                  }
                }
              },
              "example": {
                "client_id": "YOUR_CLIENT_ID",
                "client_secret": "YOUR_CLIENT_SECRET",
                "response_type": "code",
                "redirect_uri": "https://your-app.com/callback",
                "scope": "openid profile email",
                "state": "xyzABC123",
                "code_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
                "code_challenge_method": "S256"
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Request URI created successfully",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "request_uri",
                    "expires_in"
                  ],
                  "properties": {
                    "request_uri": {
                      "type": "string",
                      "format": "uri",
                      "description": "The request URI to use in the authorization request. Pass this to the /authorize endpoint."
                    },
                    "expires_in": {
                      "type": "integer",
                      "description": "The lifetime in seconds of the request URI (typically 90 seconds)"
                    }
                  }
                },
                "example": {
                  "request_uri": "urn:ietf:params:oauth:request_uri:bwc4JK-ESC0w8acc191e-Y1LTC2",
                  "expires_in": 90
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "Pushed Authorization Requests Documentation",
          "url": "https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/authorization-code-flow-with-par"
        },
        "x-codeSamples": []
      }
    },
    "/userinfo": {
      "get": {
        "operationId": "getUserInfo",
        "summary": "Get User Info",
        "description": "Get the user's profile information using the OpenID Connect UserInfo endpoint. This endpoint returns claims about the authenticated user.\n\n**Authentication:** Requires a valid access token obtained from an authentication flow that included the `openid` scope.\n\n**Returned claims depend on:**\n- The `scope` requested during authentication (profile, email, address, phone)\n- Custom claims added via Rules or Actions\n- The API (audience) the access token was issued for",
        "tags": [
          "User Profile"
        ],
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "responses": {
          "200": {
            "description": "User information retrieved successfully",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "sub": {
                      "type": "string",
                      "description": "The user's unique identifier (subject)"
                    },
                    "name": {
                      "type": "string",
                      "description": "The user's full name"
                    },
                    "given_name": {
                      "type": "string",
                      "description": "The user's given (first) name"
                    },
                    "family_name": {
                      "type": "string",
                      "description": "The user's family (last) name"
                    },
                    "middle_name": {
                      "type": "string",
                      "description": "The user's middle name"
                    },
                    "nickname": {
                      "type": "string",
                      "description": "The user's nickname"
                    },
                    "preferred_username": {
                      "type": "string",
                      "description": "The user's preferred username"
                    },
                    "profile": {
                      "type": "string",
                      "format": "uri",
                      "description": "URL of the user's profile page"
                    },
                    "picture": {
                      "type": "string",
                      "format": "uri",
                      "description": "URL of the user's profile picture"
                    },
                    "website": {
                      "type": "string",
                      "format": "uri",
                      "description": "URL of the user's website"
                    },
                    "email": {
                      "type": "string",
                      "format": "email",
                      "description": "The user's email address"
                    },
                    "email_verified": {
                      "type": "boolean",
                      "description": "Whether the user's email address has been verified"
                    },
                    "gender": {
                      "type": "string",
                      "description": "The user's gender"
                    },
                    "birthdate": {
                      "type": "string",
                      "format": "date",
                      "description": "The user's birthday"
                    },
                    "zoneinfo": {
                      "type": "string",
                      "description": "The user's time zone"
                    },
                    "locale": {
                      "type": "string",
                      "description": "The user's locale"
                    },
                    "phone_number": {
                      "type": "string",
                      "description": "The user's phone number"
                    },
                    "phone_number_verified": {
                      "type": "boolean",
                      "description": "Whether the user's phone number has been verified"
                    },
                    "address": {
                      "type": "object",
                      "description": "The user's address",
                      "properties": {
                        "country": {
                          "type": "string"
                        }
                      }
                    },
                    "updated_at": {
                      "type": "string",
                      "format": "date-time",
                      "description": "Time the user's information was last updated"
                    }
                  },
                  "required": [
                    "sub"
                  ]
                },
                "example": {
                  "sub": "auth0|507f1f77bcf86cd799439011",
                  "name": "Jane Doe",
                  "given_name": "Jane",
                  "family_name": "Doe",
                  "nickname": "jane",
                  "email": "jane.doe@example.com",
                  "email_verified": true,
                  "picture": "https://s.gravatar.com/avatar/abc123.png",
                  "updated_at": "2023-11-15T14:30:00.000Z"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized - Invalid or missing access token",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                },
                "example": {
                  "error": "invalid_token",
                  "error_description": "The access token is invalid or has expired"
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "UserInfo Endpoint Documentation",
          "url": "https://auth0.com/docs/api/authentication#user-profile"
        },
        "x-codeSamples": []
      }
    },
    "/v2/logout": {
      "get": {
        "operationId": "logout",
        "summary": "Logout",
        "description": "Log out a user and optionally redirect them to a specified URL. This endpoint clears the user's session with Auth0.\n\n**Logout Types:**\n- **Local logout** - Clears the Auth0 session only (no `federated` parameter)\n- **Federated logout** - Also logs out from the upstream identity provider (pass `federated` parameter)\n\n**Post-logout redirect:** The `returnTo` URL must be registered in your application's **Allowed Logout URLs** settings.",
        "tags": [
          "Logout"
        ],
        "parameters": [
          {
            "name": "returnTo",
            "in": "query",
            "required": false,
            "description": "URL to redirect the user after logout. Must be registered in Allowed Logout URLs.",
            "schema": {
              "type": "string",
              "format": "uri"
            },
            "example": "https://your-app.com"
          },
          {
            "name": "client_id",
            "in": "query",
            "required": false,
            "description": "Your application's Client ID. Required if `returnTo` is specified.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "federated",
            "in": "query",
            "required": false,
            "description": "Add this parameter (with any value) to log the user out of their identity provider as well.",
            "schema": {
              "type": "string"
            },
            "example": ""
          }
        ],
        "responses": {
          "302": {
            "description": "Redirect to returnTo URL or Auth0 logout confirmation page",
            "headers": {
              "Location": {
                "description": "The URL to which the user is redirected",
                "schema": {
                  "type": "string",
                  "format": "uri"
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "Logout Documentation",
          "url": "https://auth0.com/docs/api/authentication#logout"
        },
        "x-codeSamples": []
      }
    },
    "/oidc/logout": {
      "get": {
        "operationId": "oidcLogout",
        "summary": "OIDC RP-Initiated Logout",
        "description": "OpenID Connect RP-Initiated Logout endpoint. This is the standardized OIDC logout endpoint that allows relying parties (your application) to initiate logout.\n\n**Differences from /v2/logout:**\n- Follows OIDC RP-Initiated Logout specification\n- Uses `post_logout_redirect_uri` instead of `returnTo`\n- Uses `id_token_hint` for identifying the session\n\n**Note:** The `post_logout_redirect_uri` must be registered in your application's **Allowed Logout URLs** settings.",
        "tags": [
          "Logout"
        ],
        "parameters": [
          {
            "name": "id_token_hint",
            "in": "query",
            "required": false,
            "description": "The ID Token obtained during authentication. Provides a hint about the user's session to be terminated.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "post_logout_redirect_uri",
            "in": "query",
            "required": false,
            "description": "URL to redirect the user after logout. Must be registered in Allowed Logout URLs.",
            "schema": {
              "type": "string",
              "format": "uri"
            }
          },
          {
            "name": "state",
            "in": "query",
            "required": false,
            "description": "Opaque value to maintain state between logout request and callback",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "client_id",
            "in": "query",
            "required": false,
            "description": "Your application's Client ID",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "federated",
            "in": "query",
            "required": false,
            "description": "Add this parameter to also log the user out of their identity provider",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "302": {
            "description": "Redirect to post_logout_redirect_uri or logout confirmation page",
            "headers": {
              "Location": {
                "description": "The URL to which the user is redirected",
                "schema": {
                  "type": "string",
                  "format": "uri"
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "OIDC RP-Initiated Logout Specification",
          "url": "https://openid.net/specs/openid-connect-rpinitiated-1_0.html"
        },
        "x-codeSamples": []
      }
    },
    "/dbconnections/signup": {
      "post": {
        "operationId": "signup",
        "summary": "Sign Up User",
        "description": "Create a new user in an Auth0 database connection.\n\n**Use case:** Allow users to create new accounts in your application using email/password authentication.\n\n**Note:** This endpoint only creates the user. They still need to authenticate using `/authorize` or `/oauth/token` to receive tokens.",
        "tags": [
          "Database Connections"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "email",
                  "password",
                  "connection"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "email": {
                    "type": "string",
                    "format": "email",
                    "description": "The user's email address"
                  },
                  "password": {
                    "type": "string",
                    "description": "The user's desired password. Must meet the connection's password strength requirements."
                  },
                  "connection": {
                    "type": "string",
                    "description": "The name of the database connection (e.g., 'Username-Password-Authentication')"
                  },
                  "username": {
                    "type": "string",
                    "description": "The user's desired username (if the connection requires usernames)"
                  },
                  "given_name": {
                    "type": "string",
                    "description": "The user's given (first) name"
                  },
                  "family_name": {
                    "type": "string",
                    "description": "The user's family (last) name"
                  },
                  "name": {
                    "type": "string",
                    "description": "The user's full name"
                  },
                  "nickname": {
                    "type": "string",
                    "description": "The user's nickname"
                  },
                  "picture": {
                    "type": "string",
                    "format": "uri",
                    "description": "URL of the user's profile picture"
                  },
                  "user_metadata": {
                    "type": "object",
                    "description": "Custom user metadata (key-value pairs)"
                  }
                }
              },
              "example": {
                "client_id": "YOUR_CLIENT_ID",
                "email": "newuser@example.com",
                "password": "SecurePassword123!",
                "connection": "Username-Password-Authentication",
                "given_name": "John",
                "family_name": "Doe",
                "user_metadata": {
                  "plan": "premium"
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "User created successfully",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "_id": {
                      "type": "string",
                      "description": "The user's unique identifier"
                    },
                    "email": {
                      "type": "string",
                      "description": "The user's email address"
                    },
                    "email_verified": {
                      "type": "boolean",
                      "description": "Whether the email has been verified"
                    }
                  }
                },
                "example": {
                  "_id": "507f1f77bcf86cd799439011",
                  "email": "newuser@example.com",
                  "email_verified": false
                }
              }
            }
          },
          "400": {
            "description": "Bad Request - Invalid parameters or password doesn't meet requirements",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                },
                "examples": {
                  "weakPassword": {
                    "summary": "Password too weak",
                    "value": {
                      "error": "invalid_password",
                      "error_description": "Password is too weak"
                    }
                  },
                  "userExists": {
                    "summary": "User already exists",
                    "value": {
                      "error": "invalid_signup",
                      "error_description": "The user already exists"
                    }
                  }
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/dbconnections/change_password": {
      "post": {
        "operationId": "changePassword",
        "summary": "Request Password Change",
        "description": "Send a password reset email to a user. The user will receive an email with a link to reset their password.\n\n**Flow:**\n1. User requests password reset\n2. Auth0 sends email with reset link\n3. User clicks link and is redirected to change password page\n4. User sets new password\n\n**Note:** This endpoint only initiates the password reset flow. The actual password change happens when the user follows the link in the email.",
        "tags": [
          "Database Connections"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "email",
                  "connection"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "email": {
                    "type": "string",
                    "format": "email",
                    "description": "The user's email address"
                  },
                  "connection": {
                    "type": "string",
                    "description": "The name of the database connection"
                  },
                  "organization": {
                    "type": "string",
                    "description": "The ID of the organization (for organization-specific password reset)"
                  }
                }
              },
              "example": {
                "client_id": "YOUR_CLIENT_ID",
                "email": "user@example.com",
                "connection": "Username-Password-Authentication"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Password reset email sent successfully (or user not found - response is the same for security)",
            "content": {
              "text/plain": {
                "schema": {
                  "type": "string"
                },
                "example": "We've just sent you an email to reset your password."
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/oauth/access_token": {
      "post": {
        "operationId": "socialWithProviderAccessToken",
        "summary": "Social with Provider's Access Token",
        "description": "⚠️ **LEGACY ENDPOINT** - This endpoint is part of the legacy authentication pipeline and is deprecated.\n\n**Status:** Disabled by default for new tenants as of June 8, 2017.\n\n**Migration:** Use browser-based social authentication instead, which is what [Google and Facebook recommend](https://developers.googleblog.com/2016/08/modernizing-oauth-interactions-in-native-apps.html). Use the standard `/authorize` endpoint with a social connection.\n\nGiven the social provider's access token and the connection, this endpoint authenticates the user with the provider and returns a JSON with the access token and, optionally, an ID token. Only works for Facebook, Google, Twitter, and Weibo.",
        "deprecated": true,
        "tags": [
          "Login [Legacy]"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "access_token",
                  "connection"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "access_token": {
                    "type": "string",
                    "description": "The social provider's access token"
                  },
                  "connection": {
                    "type": "string",
                    "enum": [
                      "facebook",
                      "google-oauth2",
                      "twitter",
                      "weibo"
                    ],
                    "description": "The name of the social connection"
                  },
                  "scope": {
                    "type": "string",
                    "description": "Space-delimited list of requested scopes"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful authentication",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenResponse"
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "OIDC Conformant Authentication Migration",
          "url": "https://auth0.com/docs/authenticate/login/oidc-conformant-authentication"
        },
        "x-codeSamples": []
      }
    },
    "/oauth/ro": {
      "post": {
        "operationId": "resourceOwnerLegacy",
        "summary": "Resource Owner (Legacy)",
        "description": "⚠️ **LEGACY ENDPOINT** - This endpoint is part of the legacy authentication pipeline and is deprecated.\n\n**Status:** Part of legacy pipeline. New applications should not use this endpoint.\n\n**Migration:** Use `/oauth/token` with `grant_type=password` (Resource Owner Password Flow) or preferably use redirect-based flows like Authorization Code Flow with PKCE.\n\nThis endpoint allows you to authenticate a user using their username and password.",
        "deprecated": true,
        "tags": [
          "Resource Owner [Legacy]"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "username",
                  "password",
                  "connection",
                  "grant_type"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "username": {
                    "type": "string",
                    "description": "The user's username or email"
                  },
                  "password": {
                    "type": "string",
                    "description": "The user's password"
                  },
                  "connection": {
                    "type": "string",
                    "description": "The name of the database connection"
                  },
                  "grant_type": {
                    "type": "string",
                    "enum": [
                      "password"
                    ],
                    "description": "Must be 'password'"
                  },
                  "scope": {
                    "type": "string",
                    "description": "Space-delimited list of requested scopes"
                  },
                  "id_token": {
                    "type": "string",
                    "description": "Used for delegation flows"
                  },
                  "device": {
                    "type": "string",
                    "description": "Device identifier"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful authentication",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenResponse"
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized - Invalid credentials",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "OIDC Conformant Authentication Migration",
          "url": "https://auth0.com/docs/authenticate/login/oidc-conformant-authentication"
        },
        "x-codeSamples": []
      }
    },
    "/tokeninfo": {
      "post": {
        "operationId": "getTokenInfo",
        "summary": "Get Token Info (Legacy)",
        "description": "⚠️ **LEGACY ENDPOINT** - This endpoint is deprecated.\n\n**Status:** Part of legacy pipeline. Returns limited user profile information.\n\n**Migration:** Use the `/userinfo` endpoint (OpenID Connect UserInfo) instead, which is the standard OIDC endpoint for retrieving user information.\n\nValidates an ID Token and returns the user profile information.",
        "deprecated": true,
        "tags": [
          "User Profile [Legacy]"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "id_token"
                ],
                "properties": {
                  "id_token": {
                    "type": "string",
                    "description": "The ID Token to validate and extract user information from"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Token is valid, returns user information",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "user_id": {
                      "type": "string",
                      "description": "The user's unique identifier"
                    },
                    "email": {
                      "type": "string",
                      "description": "The user's email address"
                    },
                    "email_verified": {
                      "type": "boolean",
                      "description": "Whether the email has been verified"
                    },
                    "name": {
                      "type": "string",
                      "description": "The user's name"
                    },
                    "picture": {
                      "type": "string",
                      "description": "URL of the user's profile picture"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid token",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/delegation": {
      "post": {
        "operationId": "getDelegationToken",
        "summary": "Get Delegation Token (Legacy)",
        "description": "⚠️ **LEGACY ENDPOINT** - Delegation tokens are deprecated and disabled for new tenants.\n\n**Status:** This feature is disabled by default for new tenants. Maintained only for tenants with active add-ons that require delegation.\n\n**Migration:** There is no direct replacement. Specific use cases should migrate to:\n- Token refresh: Use refresh tokens with `/oauth/token` and `grant_type=refresh_token`\n- Third-party APIs: Configure proper API authorization\n\nAllowed applications to obtain an ID Token or a JWT for calling a different API using an existing token.",
        "deprecated": true,
        "tags": [
          "Delegation [Legacy]"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "grant_type",
                  "id_token"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "Your application's Client ID"
                  },
                  "grant_type": {
                    "type": "string",
                    "enum": [
                      "urn:ietf:params:oauth:grant-type:jwt-bearer"
                    ],
                    "description": "The grant type for delegation"
                  },
                  "id_token": {
                    "type": "string",
                    "description": "The ID Token you want to exchange"
                  },
                  "target": {
                    "type": "string",
                    "description": "The Client ID of the target application"
                  },
                  "scope": {
                    "type": "string",
                    "description": "Space-delimited list of requested scopes"
                  },
                  "api_type": {
                    "type": "string",
                    "description": "The type of API (e.g., 'firebase', 'aws', 'azure_sb', etc.)"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Delegation token returned successfully",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "id_token": {
                      "type": "string",
                      "description": "The delegated ID Token"
                    },
                    "token_type": {
                      "type": "string",
                      "description": "The type of token"
                    },
                    "expires_in": {
                      "type": "integer",
                      "description": "Token lifetime in seconds"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "externalDocs": {
          "description": "Delegation Tokens Documentation",
          "url": "https://auth0.com/docs/secure/tokens/delegation-tokens"
        },
        "x-codeSamples": []
      }
    },
    "/users/{user_id}/impersonate": {
      "post": {
        "operationId": "impersonateUser",
        "summary": "Impersonate a User (Legacy)",
        "description": "⚠️ **LEGACY ENDPOINT** - User impersonation using Global Client credentials is deprecated.\n\n**Status:** This endpoint uses Global Client credentials which are deprecated.\n\n**Migration:** Use the Management API v2 for impersonation flows with proper client credentials.\n\nGenerates an impersonation URL that logs you in as another user. Useful for customer support scenarios.",
        "deprecated": true,
        "tags": [
          "Impersonation [Legacy]"
        ],
        "parameters": [
          {
            "name": "user_id",
            "in": "path",
            "required": true,
            "description": "The ID of the user to impersonate",
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "protocol",
                  "impersonator_id",
                  "client_id"
                ],
                "properties": {
                  "protocol": {
                    "type": "string",
                    "enum": [
                      "oauth2",
                      "samlp",
                      "wsfed",
                      "wstrust-usernamemixed"
                    ],
                    "description": "The protocol to use for impersonation"
                  },
                  "impersonator_id": {
                    "type": "string",
                    "description": "The ID of the user performing the impersonation (admin)"
                  },
                  "client_id": {
                    "type": "string",
                    "description": "The Client ID of the application to impersonate into"
                  },
                  "additionalParameters": {
                    "type": "object",
                    "description": "Additional parameters for the impersonation"
                  },
                  "response_type": {
                    "type": "string",
                    "description": "The response type (e.g., 'code')"
                  },
                  "state": {
                    "type": "string",
                    "description": "State parameter for OAuth flow"
                  }
                }
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "required": [
                  "protocol",
                  "impersonator_id",
                  "client_id"
                ],
                "properties": {
                  "protocol": {
                    "type": "string",
                    "description": "The protocol to use"
                  },
                  "impersonator_id": {
                    "type": "string",
                    "description": "The impersonator's user ID"
                  },
                  "client_id": {
                    "type": "string",
                    "description": "The Client ID"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Impersonation URL generated successfully",
            "content": {
              "text/plain": {
                "schema": {
                  "type": "string",
                  "description": "The impersonation URL"
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/bc-authorize": {
      "post": {
        "tags": [
          "Authorization"
        ],
        "summary": "Back-Channel Login",
        "description": "The Back-Channel Login endpoint enables applications to send an authentication request to a user’s phone, or the authentication device, provided they have an app installed and are enrolled for [push notifications using the Guardian SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian#enroll-in-push-notifications).\n\nUse the Back-Channel Login endpoint to authenticate users for the following use cases:\n\n- Users are not in front of the application that requires authentication, such as when they're telephoning a call center.\n- The consumption device, or the device that helps the user consume a service, is insecure for sensitive operations (e.g., web browser for financial transactions).\n- The consumption device has limited interactive capability (e.g., e-bicycles or e-scooters).\n\n### Response Body\n\nIf the request is successful, you should receive a response like the following:\n\n```http\n{\n  \"auth_req_id\": \"eyJh...\",\n  \"expires_in\": 300,\n  \"interval\": 5\n}\n```\n\nThe `auth_req_id` value should be kept as it is used later in the flow to identify the authentication request.\n\nThe `expires_in` value tells you how many seconds you have until the authentication request expires.\n\nThe `interval` value tells you how many seconds you must wait between poll requests.\n\nThe request should be approved or rejected on the user’s authentication device using the Guardian SDK.\n\n### Remarks\n\n- The `login_hint` value follows the `iss_sub` format. For example:\n\n```http\n{ \"format\": \"iss_sub\", \"iss\": \"https://[TENANT_DOMAIN]/\", \"sub\": \"auth0|[USER ID]\" }\n```\n\n- Authentication can use Client Secret (via HTTP Basic Auth or Post), Private Key JWT, or mTLS. Please refer to the detailed examples above.",
        "operationId": "startBackChannelLogin",
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "client_id": {
                    "type": "string",
                    "description": "The `client_id` of your application."
                  },
                  "binding_message": {
                    "type": "string",
                    "description": "A human-readable string for the user to ensure they approve the correct request."
                  },
                  "login_hint": {
                    "type": "string",
                    "description": "A JSON object containing user details for authentication in the `iss_sub` format."
                  },
                  "scope": {
                    "type": "string",
                    "description": "Space-separated list of OIDC and custom API scopes, including `openid` at a minimum.",
                    "example": "openid"
                  },
                  "audience": {
                    "type": "string",
                    "description": "Optional unique identifier of the target API for access tokens."
                  },
                  "resource": {
                    "type": "string",
                    "description": "The identifier of the target API (resource server) you want to access. Must match an API Identifier registered in your Auth0 tenant. Used as an alternative to `audience` when the tenant's [Resource Parameter Compatibility Profile](https://auth0.com/docs/get-started/tenant-settings#settings-advanced) is set to `compatibility`.",
                    "example": "https://api.example.com/"
                  },
                  "requested_expiry": {
                    "type": "string",
                    "description": "Custom expiry time for the request in seconds (1-300). Defaults to 300 seconds.",
                    "example": 300
                  },
                  "authorization_details": {
                    "type": "array",
                    "description": "An optional JSON array of objects that describe the permissions to be authorized. Each object’s `type` value should be previously registered on the resource server using the Resource Server’s `authorization_details` parameter. To learn more, read the [Update a resource server](https://auth0.com/docs/api/management/v2/resource-servers/patch-resource-servers-by-id#body-parameters) Management API documentation."
                  }
                },
                "required": [
                  "client_id",
                  "binding_message",
                  "login_hint",
                  "scope"
                ]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Authentication request successfully initiated.",
            "content": {
              "application/json": {
                "example": {
                  "auth_req_id": "eyJh...",
                  "expires_in": 300,
                  "interval": 5
                }
              }
            }
          },
          "400": {
            "description": "Bad Request - Invalid parameters"
          },
          "500": {
            "description": "Internal Server Error"
          }
        },
        "x-learnMore": [
          "/secure/multi-factor-authentication/auth0-guardian#enroll-in-push-notifications",
          "/protocols/ciba",
          "/protocols/oauth2/oauth-state"
        ],
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "x-codeSamples": []
      }
    },
    "/passwordless/verify": {
      "post": {
        "summary": "Verify",
        "description": ":::note\nThis feature is disabled by default for new tenants as of 8 June 2017. Please see [Application Grant Types](/applications/concepts/application-grant-types) for more information.\n:::\n\nOnce you have a verification code, use this endpoint to login the user with their phone number/email and verification code. This is active authentication, so the user must enter the code in your app.\n\n### Remarks\n\n- The `profile` <dfn data-key=\"scope\">scope</dfn> value requests access to the End-User's default profile Claims, which are: `name`, `family_name`, `given_name`, `middle_name`, `nickname`, `preferred_username`, `profile`, `picture`, `website`, `gender`, `birthdate`, `zoneinfo`, `locale`, and `updated_at`.\n- The `email` scope value requests access to the `email` and `email_verified` Claims.\n- The sample auth0.js script uses the library version 8. If you are using auth0.js version 7, please see this [reference guide](https://auth0.com/docs/libraries/auth0js).\n\n### Learn More\n\n- [Passwordless Best Practices](/connections/passwordless/best-practices)",
        "tags": [
          "Passwordless"
        ],
        "operationId": "verify",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "grant_type": {
                    "type": "string",
                    "description": "Grant type, must be `password`.",
                    "example": "password"
                  },
                  "client_id": {
                    "type": "string",
                    "description": "The `client_id` of your application.",
                    "example": "${account.clientId}"
                  },
                  "connection": {
                    "type": "string",
                    "enum": [
                      "email",
                      "sms"
                    ],
                    "description": "Use `sms` or `email` (should be the same as [POST /passwordless/start](#get-code-or-link)).",
                    "example": "email"
                  },
                  "username": {
                    "type": "string",
                    "description": "The user's phone number if `connection=sms`, or the user's email if `connection=email`.",
                    "example": "USER_EMAIL_OR_PHONE"
                  },
                  "password": {
                    "type": "string",
                    "description": "The user's verification code.",
                    "example": "VERIFICATION_CODE"
                  },
                  "scope": {
                    "type": "string",
                    "description": "Use `openid` to get an ID Token, or `openid profile email` to include user profile information in the ID Token.",
                    "example": "openid profile"
                  },
                  "redirect_uri": {
                    "type": "string",
                    "description": "Callback URL registered with your application's Allowed Callback URLs.",
                    "example": "https://yourapp.com/callback"
                  }
                },
                "required": [
                  "grant_type",
                  "client_id",
                  "connection",
                  "username",
                  "password",
                  "redirect_uri"
                ]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "User authenticated successfully."
          },
          "400": {
            "description": "Bad Request. Invalid parameters."
          },
          "401": {
            "description": "Unauthorized. Invalid credentials."
          },
          "403": {
            "description": "Forbidden. Client authentication is required."
          },
          "500": {
            "description": "Internal Server Error."
          }
        },
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "x-codeSamples": []
      }
    },
    "/oidc/register": {
      "post": {
        "summary": "Dynamic Application Registration",
        "description": "With a name and the necessary <dfn data-key=\"callback\">callback URL</dfn>, you can dynamically register a client with Auth0. No token is needed for this request.",
        "operationId": "dynamicApplicationRegistration",
        "tags": [
          "Dynamic Client Registration"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "client_name": {
                    "type": "string",
                    "description": "The name of the Dynamic Client to be created."
                  },
                  "redirect_uris": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "An array of URLs that Auth0 will deem valid to call at the end of an Authentication flow."
                  },
                  "token_endpoint_auth_method": {
                    "type": "string",
                    "description": "Method used for authentication at the token endpoint."
                  }
                },
                "required": [
                  "redirect_uris"
                ]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful response with client details.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "client_name": {
                      "type": "string",
                      "description": "The name of the newly registered client."
                    },
                    "client_id": {
                      "type": "string",
                      "description": "The unique identifier for the client."
                    },
                    "client_secret": {
                      "type": "string",
                      "description": "The secret key for the client."
                    },
                    "redirect_uris": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      },
                      "description": "The valid redirect URIs for the client."
                    },
                    "client_secret_expires_at": {
                      "type": "integer",
                      "description": "Expiration time for the client secret."
                    }
                  }
                }
              }
            }
          }
        },
        "x-codeSamples": []
      }
    },
    "/samlp/{clientId}": {
      "get": {
        "summary": "Accept Request",
        "description": "Use this endpoint to accept a <dfn data-key=\"security-assertion-markup-language\">SAML</dfn> request to initiate a login.\n\nOptionally, you can include a `connection` parameter to log in with a specific provider. If no connection is specified, the [Auth0 Login Page](https://auth0.com/docs/authenticate/login/auth0-universal-login) will be shown.\n\nOptionally, SP-initiated login requests can include an `organization` parameter to authenticate users in the context of an organization. To learn more, see [Organizations](https://auth0.com/docs/manage-users/organizations).",
        "tags": [
          "SAML"
        ],
        "operationId": "acceptSAMLRequest",
        "parameters": [
          {
            "name": "clientId",
            "in": "path",
            "required": true,
            "description": "Client ID of your application.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "required": false,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "connection": {
                    "type": "string",
                    "description": "Connection to use during login."
                  },
                  "organization": {
                    "type": "string",
                    "description": "Organization ID, if authenticating in the context of an organization."
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful SAML request acceptance."
          }
        },
        "x-codeSamples": []
      }
    },
    "/samlp/metadata/{clientId}": {
      "get": {
        "summary": "Get Metadata",
        "description": "This endpoint returns the <dfn data-key=\"security-assertion-markup-language\">SAML</dfn> 2.0 metadata.\n\n### Learn More\n- [SAML](https://auth0.com/docs/authenticate/protocols/saml/saml-configuration)",
        "tags": [
          "SAML"
        ],
        "operationId": "getSAMLMetadata",
        "parameters": [
          {
            "name": "clientId",
            "in": "path",
            "required": true,
            "description": "The client_id of your application.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful retrieval of SAML metadata."
          }
        },
        "x-codeSamples": []
      }
    },
    "/samlp/{client_id}/logout": {
      "post": {
        "summary": "SAML Logout",
        "description": "Use this endpoint to log out a user from an Auth0 tenant configured as a SAML identity provider (IdP). Logout behavior is determined by the configuration of the SAML2 Web App addon for the application on the Auth0 tenant acting as the SAML IdP. To learn more, read [Log Users Out of SAML Identity Providers](https://auth0.com/docs/authenticate/login/logout/log-users-out-of-saml-idps#configure-slo-when-auth0-is-the-saml-idp).\n\n### Remarks\n\n- The POST body must contain a valid SAML `<LogoutRequest>` message. To learn more, read [Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0 on Oasis](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf).\n\n### Learn More\n\n- [Logout](https://auth0.com/docs/authenticate/login/logout)\n- [Log Users Out of SAML Identity Providers](https://auth0.com/docs/authenticate/login/logout/log-users-out-of-saml-idps)",
        "tags": [
          "Logout"
        ],
        "operationId": "samlLogout",
        "parameters": [
          {
            "name": "client_id",
            "in": "path",
            "required": true,
            "description": "Client ID of your application configured with the [SAML2 Web App addon](https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/enable-saml2-web-app-addon).",
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/xml": {
              "schema": {
                "type": "string",
                "description": "SAML `<LogoutRequest>` message to be sent as the body of the request."
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successfully logged out"
          },
          "400": {
            "description": "Bad request, possibly due to an invalid SAML message"
          }
        },
        "x-codeSamples": []
      }
    },
    "/wsfed/{clientId}": {
      "get": {
        "summary": "Accept WS-Federation Request",
        "description": "This endpoint accepts a WS-Federation request to initiate a login.\n\n### Remarks\n\n- The `wtrealm` parameter must be in one of these formats:\n  - `urn:clientID` (for example, urn:${account.clientId})\n  - If this parameter does not begin with a urn, the `client.clientAliases` array is used for look-up. This can only be set with the [/api/v2/clients](https://auth0.com/docs/api/management/v2/clients/get-clients) Management API.\n- The `whr` parameter is mapped to the connection like this: `urn:CONNECTION_NAME`. For example, `urn:google-oauth2` indicates login with Google. If there is no `whr` parameter included, the user will be directed to the [Auth0 Login Page](https://auth0.com/docs/login_page).\n\n### Learn More\n- [WS-Federation](https://auth0.com/docs/authenticate/protocols/ws-fed-protocol)",
        "operationId": "acceptWsFederationRequest",
        "tags": [
          "WS-Federation"
        ],
        "parameters": [
          {
            "name": "client-id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "The `client-id` of your application."
          },
          {
            "name": "wtrealm",
            "in": "query",
            "required": false,
            "schema": {
              "type": "string"
            },
            "description": "Can be used in place of `client-id`."
          },
          {
            "name": "whr",
            "in": "query",
            "required": false,
            "schema": {
              "type": "string"
            },
            "description": "The name of the connection (used to skip the login page)."
          },
          {
            "name": "wctx",
            "in": "query",
            "required": false,
            "schema": {
              "type": "string"
            },
            "description": "Your application's state."
          },
          {
            "name": "wreply",
            "in": "query",
            "required": false,
            "schema": {
              "type": "string"
            },
            "description": "The callback URL."
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response for WS-Federation request."
          }
        },
        "x-codeSamples": []
      }
    },
    "/wsfed/FederationMetadata/2007-06/FederationMetadata.xml": {
      "get": {
        "summary": "Get WS-Federation Metadata",
        "description": "This endpoint returns the WS-Federation metadata.\n\n### Learn More\n- [WS-Federation](https://auth0.com/docs/authenticate/protocols/ws-fed-protocol)",
        "operationId": "getWsFederationMetadata",
        "tags": [
          "WS-Federation"
        ],
        "responses": {
          "200": {
            "description": "Successful response with WS-Federation metadata."
          }
        },
        "x-codeSamples": []
      }
    },
    "/login/callback": {
      "post": {
        "summary": "IdP-Initiated Single Sign-On (SSO) Flow",
        "description": "This endpoint accepts an IdP-Initiated Sign On SAMLResponse from a SAML Identity Provider. The connection corresponding to the identity provider is specified in the query string. The user will be redirected to the application that is specified in the SAML Provider IdP-Initiated Sign On section.\n\n### Learn More\n- [SAML](https://auth0.com/docs/authenticate/protocols/saml/saml-configuration)",
        "tags": [
          "SAML"
        ],
        "operationId": "idpInitiatedSSO",
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "connection": {
                    "type": "string",
                    "description": "The name of an identity provider configured to your application."
                  },
                  "SAMLResponse": {
                    "type": "string",
                    "description": "An IdP-Initiated Sign On SAML Response."
                  }
                },
                "required": [
                  "connection",
                  "SAMLResponse"
                ]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful authentication."
          },
          "400": {
            "description": "Bad request due to missing or invalid parameters."
          }
        },
        "x-codeSamples": []
      }
    },
    "/login/unlink": {
      "post": {
        "summary": "Unlink",
        "description": ":::note\nThis endpoint is **deprecated**. The [DELETE /api/v2/users/{id}/identities/{provider}/{user_id}](/api/management/v2#!/Users/delete_user_identity_by_user_id) should be used instead.\n:::\n\nGiven a logged-in user's `access_token` and `user_id`, this endpoint will unlink a user's account from the identity provider.\n\n### Learn More\n- [Unlink User Accounts](https://auth0.com/docs/manage-users/user-accounts/user-account-linking/unlink-user-accounts)",
        "deprecated": true,
        "operationId": "unlink",
        "tags": [
          "Account Linking [Legacy]"
        ],
        "responses": {
          "200": {
            "description": "Successfully unlinked user account"
          }
        },
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "x-codeSamples": []
      }
    },
    "/oauth/global-token-revocation/connection/{connection_name}": {
      "post": {
        "summary": "Global Token Revocation",
        "description": "Use this endpoint with the [Okta Workforce Identity Cloud Universal Logout](https://developer.okta.com/docs/guides/oin-universal-logout-overview/) to log users out of your applications. A request to this endpoint revokes session cookies and refresh tokens, but not access tokens. To learn more, read [Universal Logout](https://auth0.com/docs/authenticate/login/logout/universal-logout). The request must be authenticated before revoking user sessions. Review [Endpoint Authentication](https://developer.okta.com/docs/guides/oin-universal-logout-overview/#endpoint-authentication).",
        "tags": [
          "Logout"
        ],
        "operationId": "globalTokenRevocation",
        "parameters": [
          {
            "name": "connection_name",
            "in": "path",
            "required": true,
            "description": "The name of the connection for which you want to revoke the user's session.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "subject": {
                    "type": "object",
                    "properties": {
                      "format": {
                        "type": "string",
                        "enum": [
                          "iss_sub"
                        ]
                      },
                      "iss": {
                        "type": "string",
                        "description": "The issuer URL (typically your authorization server's URL)."
                      },
                      "sub": {
                        "type": "string",
                        "description": "The subject identifier (typically the user identifier)."
                      }
                    },
                    "required": [
                      "format",
                      "iss",
                      "sub"
                    ]
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successfully revoked session cookies and refresh tokens."
          },
          "400": {
            "description": "Bad request, possibly due to an invalid `subject` format or missing authentication."
          },
          "401": {
            "description": "Unauthorized, authentication failed."
          },
          "500": {
            "description": "Internal Server Error."
          }
        },
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "x-codeSamples": []
      }
    }
  },
  "components": {
    "securitySchemes": {
      "oauth2": {
        "type": "oauth2",
        "flows": {
          "authorizationCode": {
            "authorizationUrl": "/authorize",
            "tokenUrl": "/oauth/token",
            "scopes": {
              "openid": "OpenID Connect authentication",
              "profile": "User profile information (name, picture, etc.)",
              "email": "User email address",
              "offline_access": "Refresh token for offline access"
            }
          },
          "clientCredentials": {
            "tokenUrl": "/oauth/token",
            "scopes": {}
          }
        }
      },
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "Access token obtained from the authentication flow"
      }
    },
    "schemas": {
      "ErrorResponse": {
        "type": "object",
        "description": "Standard OAuth 2.0 error response",
        "properties": {
          "error": {
            "type": "string",
            "description": "Error code indicating the type of error that occurred",
            "example": "invalid_request"
          },
          "error_description": {
            "type": "string",
            "description": "Human-readable text providing additional information about the error",
            "example": "The request is missing a required parameter"
          },
          "error_uri": {
            "type": "string",
            "format": "uri",
            "description": "URI identifying a human-readable web page with information about the error"
          }
        },
        "required": [
          "error"
        ]
      },
      "TokenResponse": {
        "type": "object",
        "description": "Successful token response containing access token and optionally ID token and refresh token",
        "properties": {
          "access_token": {
            "type": "string",
            "description": "The access token issued by the authorization server. Use this token to access protected resources (APIs).",
            "example": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0..."
          },
          "token_type": {
            "type": "string",
            "description": "The type of the token issued. Always 'Bearer' for Auth0.",
            "enum": [
              "Bearer"
            ],
            "example": "Bearer"
          },
          "expires_in": {
            "type": "integer",
            "description": "The lifetime in seconds of the access token. After this time, the token will expire and can no longer be used.",
            "example": 86400
          },
          "refresh_token": {
            "type": "string",
            "description": "The refresh token which can be used to obtain new access tokens. Only returned if 'offline_access' scope was requested.",
            "example": "v1.MRHbz1VqR_y42v..."
          },
          "id_token": {
            "type": "string",
            "description": "The ID Token containing user profile information. Only returned if 'openid' scope was requested. This is a JWT containing user claims.",
            "example": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
          },
          "scope": {
            "type": "string",
            "description": "The scopes granted by the authorization server. May differ from requested scopes.",
            "example": "openid profile email"
          }
        },
        "required": [
          "access_token",
          "token_type",
          "expires_in"
        ]
      },
      "DPoPHeader": {
        "type": "object",
        "description": "DPoP (Demonstrating Proof-of-Possession) header parameters for enhanced OAuth 2.0 security",
        "properties": {
          "DPoP": {
            "type": "string",
            "description": "A DPoP proof JWT. This is a signed JWT that proves possession of a private key corresponding to a public key.",
            "example": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImRwb3Arand0IiwiandrIjp7Imt0eSI6Ik..."
          }
        }
      },
      "DPoPNonceHeader": {
        "type": "object",
        "description": "DPoP nonce header returned by the server",
        "properties": {
          "DPoP-Nonce": {
            "type": "string",
            "description": "A server-generated nonce that must be included in the DPoP proof as the 'nonce' claim for subsequent requests. Helps prevent replay attacks.",
            "example": "eyJ7S_zG.eyJH0-Z.HX4w-7v"
          }
        }
      },
      "AuthorizationCodeGrant": {
        "type": "object",
        "description": "Authorization Code Grant - Exchange an authorization code for tokens. Used by server-side web applications that can securely store a client secret.",
        "title": "Authorization Code",
        "required": [
          "grant_type",
          "code",
          "client_id",
          "redirect_uri"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "authorization_code"
            ],
            "description": "Must be 'authorization_code'"
          },
          "code": {
            "type": "string",
            "description": "The authorization code received from the authorization endpoint"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "client_secret": {
            "type": "string",
            "description": "Your application's Client Secret. Required for confidential clients."
          },
          "redirect_uri": {
            "type": "string",
            "format": "uri",
            "description": "The same redirect_uri used in the authorization request. Must match exactly."
          },
          "audience": {
            "type": "string",
            "description": "The unique identifier of the target API you want to access"
          },
          "client_assertion": {
            "type": "string",
            "description": "A JWT signed with your client secret or private key (for Private Key JWT authentication)"
          },
          "client_assertion_type": {
            "type": "string",
            "enum": [
              "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
            ],
            "description": "Must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' when using client_assertion"
          }
        }
      },
      "AuthorizationCodePKCEGrant": {
        "type": "object",
        "description": "Authorization Code Grant with PKCE - Exchange an authorization code for tokens using PKCE. Used by SPAs and mobile apps that cannot securely store a client secret.",
        "title": "Authorization Code (PKCE)",
        "required": [
          "grant_type",
          "code",
          "client_id",
          "code_verifier",
          "redirect_uri"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "authorization_code"
            ],
            "description": "Must be 'authorization_code'"
          },
          "code": {
            "type": "string",
            "description": "The authorization code received from the authorization endpoint"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "client_secret": {
            "type": "string",
            "description": "Your application's Client Secret. Required for confidential clients."
          },
          "code_verifier": {
            "type": "string",
            "description": "The original code verifier for the PKCE request. The authorization server will hash this and compare it to the code_challenge from the authorization request.",
            "minLength": 43,
            "maxLength": 128
          },
          "redirect_uri": {
            "type": "string",
            "format": "uri",
            "description": "The same redirect_uri used in the authorization request. Must match exactly."
          },
          "audience": {
            "type": "string",
            "description": "The unique identifier of the target API you want to access"
          }
        }
      },
      "RefreshTokenGrant": {
        "type": "object",
        "description": "Refresh Token Grant - Obtain a new access token using a refresh token without requiring user interaction.",
        "title": "Refresh Token",
        "required": [
          "grant_type",
          "client_id",
          "refresh_token"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "refresh_token"
            ],
            "description": "Must be 'refresh_token'"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "client_secret": {
            "type": "string",
            "description": "Your application's Client Secret. Required for confidential clients."
          },
          "refresh_token": {
            "type": "string",
            "description": "The refresh token returned from the initial authorization"
          },
          "scope": {
            "type": "string",
            "description": "Space-delimited list of scopes. Requested scopes must not exceed the scopes granted in the original access token."
          },
          "client_assertion": {
            "type": "string",
            "description": "A JWT signed with your client secret or private key (for Private Key JWT authentication)"
          },
          "client_assertion_type": {
            "type": "string",
            "enum": [
              "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
            ],
            "description": "Must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' when using client_assertion"
          }
        }
      },
      "ClientCredentialsGrant": {
        "type": "object",
        "description": "Client Credentials Grant - Machine-to-machine authentication. Request an access token using application credentials without user involvement.",
        "title": "Client Credentials",
        "required": [
          "grant_type",
          "client_id",
          "client_secret"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "client_credentials"
            ],
            "description": "Must be 'client_credentials'"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "client_secret": {
            "type": "string",
            "description": "Your application's Client Secret"
          },
          "audience": {
            "type": "string",
            "description": "The unique identifier of the target API you want to access. Required for Client Credentials flow."
          },
          "organization": {
            "type": "string",
            "description": "The ID of the organization to authenticate against"
          },
          "client_assertion": {
            "type": "string",
            "description": "A JWT signed with your client secret or private key (for Private Key JWT authentication)"
          },
          "client_assertion_type": {
            "type": "string",
            "enum": [
              "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
            ],
            "description": "Must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' when using client_assertion"
          }
        }
      },
      "PasswordGrant": {
        "type": "object",
        "description": "Resource Owner Password Grant - Exchange user credentials for tokens. Only use this for highly trusted first-party applications.",
        "title": "Resource Owner Password",
        "required": [
          "grant_type",
          "client_id",
          "username",
          "password"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "password"
            ],
            "description": "Must be 'password'"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "client_secret": {
            "type": "string",
            "description": "Your application's Client Secret. Required for confidential clients."
          },
          "username": {
            "type": "string",
            "description": "The user's username or email address"
          },
          "password": {
            "type": "string",
            "description": "The user's password"
          },
          "scope": {
            "type": "string",
            "description": "Space-delimited list of requested scopes",
            "example": "openid profile email"
          },
          "audience": {
            "type": "string",
            "description": "The unique identifier of the target API you want to access"
          },
          "realm": {
            "type": "string",
            "description": "The realm the user belongs to (name of the database connection)"
          }
        }
      },
      "DeviceCodeGrant": {
        "type": "object",
        "description": "Device Authorization Grant - Exchange a device code for tokens. Used by input-constrained devices like smart TVs.",
        "title": "Device Authorization",
        "required": [
          "grant_type",
          "client_id",
          "device_code"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "urn:ietf:params:oauth:grant-type:device_code"
            ],
            "description": "Must be 'urn:ietf:params:oauth:grant-type:device_code'"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "device_code": {
            "type": "string",
            "description": "The device code received from the /oauth/device/code endpoint"
          }
        }
      },
      "MfaOtpGrant": {
        "type": "object",
        "description": "MFA OTP Grant - Complete multi-factor authentication using a one-time password from an authenticator app.",
        "title": "MFA with OTP",
        "required": [
          "grant_type",
          "client_id",
          "mfa_token",
          "otp"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "http://auth0.com/oauth/grant-type/mfa-otp"
            ],
            "description": "Must be 'http://auth0.com/oauth/grant-type/mfa-otp'"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "client_secret": {
            "type": "string",
            "description": "Your application's Client Secret. Required for confidential clients."
          },
          "mfa_token": {
            "type": "string",
            "description": "The MFA token received in the mfa_required error response"
          },
          "otp": {
            "type": "string",
            "description": "The one-time password from the user's authenticator app",
            "example": "123456"
          }
        }
      },
      "MfaOobGrant": {
        "type": "object",
        "description": "MFA OOB Grant - Complete multi-factor authentication using out-of-band verification (SMS, push notification).",
        "title": "MFA with OOB",
        "required": [
          "grant_type",
          "client_id",
          "mfa_token",
          "oob_code"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "http://auth0.com/oauth/grant-type/mfa-oob"
            ],
            "description": "Must be 'http://auth0.com/oauth/grant-type/mfa-oob'"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "client_secret": {
            "type": "string",
            "description": "Your application's Client Secret. Required for confidential clients."
          },
          "mfa_token": {
            "type": "string",
            "description": "The MFA token received in the mfa_required error response"
          },
          "oob_code": {
            "type": "string",
            "description": "The OOB code received from the /mfa/challenge endpoint"
          },
          "binding_code": {
            "type": "string",
            "description": "The binding code displayed to the user (for SMS/authenticator app verification)",
            "example": "123456"
          }
        }
      },
      "MfaRecoveryCodeGrant": {
        "type": "object",
        "description": "MFA Recovery Code Grant - Complete multi-factor authentication using a recovery code when the primary MFA method is unavailable.",
        "title": "MFA with Recovery Code",
        "required": [
          "grant_type",
          "client_id",
          "mfa_token",
          "recovery_code"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "http://auth0.com/oauth/grant-type/mfa-recovery-code"
            ],
            "description": "Must be 'http://auth0.com/oauth/grant-type/mfa-recovery-code'"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "client_secret": {
            "type": "string",
            "description": "Your application's Client Secret. Required for confidential clients."
          },
          "mfa_token": {
            "type": "string",
            "description": "The MFA token received in the mfa_required error response"
          },
          "recovery_code": {
            "type": "string",
            "description": "The recovery code provided to the user during MFA enrollment",
            "example": "ABCDEFGHIJ"
          }
        }
      },
      "PasswordlessOtpGrant": {
        "type": "object",
        "description": "Passwordless OTP Grant - Authenticate using a one-time code sent via email or SMS (passwordless authentication).",
        "title": "Passwordless with OTP",
        "required": [
          "grant_type",
          "client_id",
          "username",
          "otp",
          "realm"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "http://auth0.com/oauth/grant-type/passwordless/otp"
            ],
            "description": "Must be 'http://auth0.com/oauth/grant-type/passwordless/otp'"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "client_secret": {
            "type": "string",
            "description": "Your application's Client Secret. Required for confidential clients."
          },
          "username": {
            "type": "string",
            "description": "The user's email address or phone number (depending on the connection type)",
            "example": "user@example.com"
          },
          "otp": {
            "type": "string",
            "description": "The one-time password sent to the user",
            "example": "123456"
          },
          "realm": {
            "type": "string",
            "description": "The connection name used for passwordless authentication (email or sms)",
            "enum": [
              "email",
              "sms"
            ],
            "example": "email"
          },
          "scope": {
            "type": "string",
            "description": "Space-delimited list of requested scopes",
            "example": "openid profile email"
          },
          "audience": {
            "type": "string",
            "description": "The unique identifier of the target API you want to access"
          }
        }
      },
      "TokenExchangeGrant": {
        "type": "object",
        "description": "Token Exchange Grant - Exchange a native social provider token (e.g., Sign in with Apple) for Auth0 tokens.",
        "title": "Token Exchange (Native Social)",
        "required": [
          "grant_type",
          "client_id",
          "subject_token",
          "subject_token_type"
        ],
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "urn:ietf:params:oauth:grant-type:token-exchange"
            ],
            "description": "Must be 'urn:ietf:params:oauth:grant-type:token-exchange'"
          },
          "client_id": {
            "type": "string",
            "description": "Your application's Client ID"
          },
          "subject_token": {
            "type": "string",
            "description": "The token from the native social provider (e.g., Apple ID token, Facebook access token)"
          },
          "subject_token_type": {
            "type": "string",
            "description": "The type of the subject_token",
            "enum": [
              "http://auth0.com/oauth/token-type/apple-authz-code",
              "http://auth0.com/oauth/token-type/apple-id-token"
            ]
          },
          "scope": {
            "type": "string",
            "description": "Space-delimited list of requested scopes",
            "example": "openid profile email"
          },
          "audience": {
            "type": "string",
            "description": "The unique identifier of the target API you want to access"
          },
          "user_profile": {
            "type": "string",
            "description": "Optional user profile information from the native provider (JSON string)"
          }
        }
      }
    }
  }
}