Authority API Reference
| Field | Value |
|---|---|
| Source spec | authority/openapi/v1.json |
| OpenAPI version | 3.1.0 |
| API version | 0.1.0 |
| Operations | 7 |
| Path filter | All paths |
Operations
POST /introspect
Introspect token state
Returns the active status and claims for a given token. Requires a privileged client.
| Property | Value |
|---|---|
| Operation ID | - |
| Tags | Authentication |
| Auth | Required |
| Request body | application/x-www-form-urlencoded |
Responses:
| Status | Description | Content types |
|---|---|---|
200 | Token state evaluated. | application/json |
400 | Malformed request. | application/json |
401 | Client authentication failed or client lacks introspection permission. | application/json |
GET /oauth/introspect
Retrieve signing keys
Returns the JSON Web Key Set used to validate Authority-issued tokens.
| Property | Value |
|---|---|
| Operation ID | - |
| Tags | Keys |
| Auth | Not declared |
| Request body | - |
Responses:
| Status | Description | Content types |
|---|---|---|
200 | JWKS document. | application/json |
POST /oauth/introspect
[Deprecated] Introspect token state
Legacy alias for /introspect. Deprecated; clients must migrate to /introspect. Deprecation headers highlight the removal schedule.
| Property | Value |
|---|---|
| Operation ID | - |
| Tags | Authentication |
| Auth | Required |
| Request body | - |
Responses:
| Status | Description | Content types |
|---|---|---|
200 | Token state evaluated (legacy alias of /introspect). | application/json |
400 | Malformed request. | application/json |
401 | Client authentication failed or client lacks introspection permission. | application/json |
POST /oauth/revoke
[Deprecated] Revoke an access or refresh token
Legacy alias for /revoke. Deprecated; clients should call /revoke directly. Deprecation headers mirror those emitted by the runtime middleware.
| Property | Value |
|---|---|
| Operation ID | - |
| Tags | Authentication |
| Auth | Required |
| Request body | - |
Responses:
| Status | Description | Content types |
|---|---|---|
200 | Token revoked or already invalid (legacy alias of /revoke). | - |
400 | Malformed request. | application/json |
401 | Client authentication failed. | application/json |
POST /oauth/token
[Deprecated] Exchange credentials for tokens
Legacy alias for /token. Responses include Deprecation, Sunset, Warning, and Link headers to advertise the removal timeline. Migrate clients to /token before the announced sunset date (2026-05-01).
| Property | Value |
|---|---|
| Operation ID | - |
| Tags | Authentication |
| Auth | Required |
| Request body | - |
Responses:
| Status | Description | Content types |
|---|---|---|
200 | Token exchange succeeded (legacy alias of /token). | application/json |
400 | Malformed request, unsupported grant type, or invalid credentials. | application/json |
401 | Client authentication failed. | application/json |
POST /revoke
Revoke an access or refresh token
| Property | Value |
|---|---|
| Operation ID | - |
| Tags | Authentication |
| Auth | Required |
| Request body | application/x-www-form-urlencoded |
Responses:
| Status | Description | Content types |
|---|---|---|
200 | Token revoked or already invalid. The response body is intentionally blank. | - |
400 | Malformed request. | application/json |
401 | Client authentication failed. | application/json |
POST /token
Exchange credentials for tokens
Issues OAuth 2.1 bearer tokens for StellaOps clients. Supports password, client credentials, authorization-code, device, and refresh token grants. Confidential clients must authenticate using HTTP Basic auth or client_secret form fields.
| Property | Value |
|---|---|
| Operation ID | - |
| Tags | Authentication |
| Auth | Required |
| Request body | application/x-www-form-urlencoded |
Responses:
| Status | Description | Content types |
|---|---|---|
200 | Token exchange succeeded. | application/json |
400 | Malformed request, unsupported grant type, or invalid credentials. | application/json |
401 | Client authentication failed. | application/json |