Authority API Reference

Operations

GET /.well-known/openapi

Responses:

GET /.well-known/openid-configuration

OpenID Provider configuration endpoint.

Bridges Gateway microservice /.well-known/openid-configuration requests to Authority OIDC discovery.

Responses:

POST /advisory-ai/remote-inference/logs

Responses:

GET /api/v1/authority/revocation/status

Get Authority revocation bundle status

Returns revocation bundle metadata without exposing token identifiers.

Responses:

GET /api/v1/buildinfo

API alias for /buildinfo.json (same payload).

Responses:

GET /api/v1/claims/overrides

Get router claims overrides

Returns Authority-managed endpoint claim overrides consumed by router-gateway authorization refresh.

Responses:

GET /api/v1/internal/operator-signing/provider-change-recipients

Resolve exception-granting operators for a provider change

Responses:

GET /api/v1/tenants/{tenantId}/assurance-packs

Read tenant-enabled Assurance packs and Authority-owned readiness reason codes.

Parameters:

Responses:

GET /api/v1/tenants/{tenantId}/compliance-profile

Read the Authority-owned nullable tenant compliance profile.

Parameters:

Responses:

GET /api/v1/tenants/{tenantId}/submission-authorizations

Read runtime-safe operator submission authorization for a tenant purpose and optional channel.

Parameters:

Responses:

GET /assets/img/stella-identity.png

Serves the embedded transparent Stella Ops Authority login identity image.

Responses:

GET /assets/img/stella-logo.png

Serves the embedded transparent Stella Ops Authority login logo image.

Responses:

GET /assets/js/authority-login.js

Serves the dependency-free interaction script for the Authority login form.

Responses:

GET /authority/audit/airgap

List air-gapped bundle import audit records for the current tenant.

Parameters:

Responses:

POST /authority/audit/airgap

Record an audit entry for an air-gapped bundle import action.

Responses:

GET /authority/audit/incident

List recent obs:incident token issuances for auditors.

Parameters:

Responses:

GET /authorize

OpenID Connect authorization endpoint (GET). Renders the interactive login form for the authorization code flow. Accepts OIDC parameters (client_id, redirect_uri, scope, state, nonce, code_challenge, etc.). Handles prompt=none for silent refresh with redirect-based error response.

Responses:

POST /authorize

OpenID Connect authorization endpoint (POST). Validates credentials submitted via the login form and issues an authorization code via OpenIddict SignIn on success. Redirects the browser back to the client redirect_uri with the authorization code.

Responses:

GET /buildinfo.json

Image build provenance (module, gitSha, gitCommitTime, imageBuiltAt, branch) for drift detection.

Responses:

GET /catalog-changes/{catalog}

Parameters:

Responses:

GET /connect/assets/img/stella-identity.png

Serves the embedded Authority login identity image through the gateway-routed OIDC prefix.

Responses:

GET /connect/authorize

OpenID Connect authorization endpoint alias (GET). Mirrors /authorize for clients that use the discovery-advertised /connect/authorize route.

Responses:

POST /connect/authorize

OpenID Connect authorization endpoint alias (POST). Mirrors /authorize for clients that use the discovery-advertised /connect/authorize route.

Responses:

GET /connect/logout

OpenID Connect RP-Initiated Logout (end-session) endpoint alias. Mirrors /logout for clients that use the discovery-advertised /connect/logout route.

Responses:

POST /connect/logout

OpenID Connect RP-Initiated Logout (end-session) endpoint alias. Mirrors /logout for clients that use the discovery-advertised /connect/logout route.

Responses:

GET /console/admin/audit

List administrative audit events for a tenant.

Responses:

GET /console/admin/branding

Get branding configuration with edit metadata.

Responses:

PUT /console/admin/branding

Update tenant branding configuration.

Responses:

POST /console/admin/branding/preview

Preview branding changes before applying.

Responses:

GET /console/admin/clients

List OAuth2 client registrations.

Responses:

POST /console/admin/clients

Register a new OAuth2 client.

Responses:

PATCH /console/admin/clients/{clientId}

Update client metadata and allowed scopes.

Parameters:

Responses:

POST /console/admin/clients/{clientId}/rotate

Rotate client secret or key credentials.

Parameters:

Responses:

GET /console/admin/identity-providers

List process-global Authority identity-provider configuration and runtime status.

Responses:

POST /console/admin/identity-providers

Create process-global Authority identity-provider configuration.

Responses:

POST /console/admin/identity-providers/test-connection

Probe candidate configuration through its mounted signed provider bundle without persisting it.

Responses:

GET /console/admin/identity-providers/{name}

Read one process-global Authority identity-provider configuration.

Parameters:

Responses:

PUT /console/admin/identity-providers/{name}

Replace process-global Authority identity-provider configuration.

Parameters:

Responses:

DELETE /console/admin/identity-providers/{name}

Delete process-global Authority identity-provider configuration.

Parameters:

Responses:

POST /console/admin/identity-providers/{name}/apply

Persist optional configuration, reload Authority providers, and return typed apply status.

Parameters:

Responses:

POST /console/admin/identity-providers/{name}/disable

Disable process-global Authority identity-provider configuration.

Parameters:

Responses:

POST /console/admin/identity-providers/{name}/enable

Enable process-global Authority identity-provider configuration.

Parameters:

Responses:

GET /console/admin/identity-providers/{name}/status

Probe one configured Authority identity provider and return typed runtime status.

Parameters:

Responses:

GET /console/admin/roles

List all role bundles and their scope mappings.

Responses:

POST /console/admin/roles

Create a custom role bundle.

Responses:

PATCH /console/admin/roles/{roleId}

Update role bundle scopes and metadata.

Parameters:

Responses:

POST /console/admin/roles/{roleId}/preview-impact

Preview the impact of role changes on users and clients.

Parameters:

Responses:

GET /console/admin/tenants

List all tenants in the installation.

Responses:

POST /console/admin/tenants

Create a new tenant.

Responses:

PATCH /console/admin/tenants/{tenantId}

Update tenant metadata.

Parameters:

Responses:

GET /console/admin/tenants/{tenantId}/operator-compliance

Read tenant-owned operator compliance settings.

Parameters:

Responses:

PUT /console/admin/tenants/{tenantId}/operator-compliance

Replace tenant-owned operator compliance settings.

Parameters:

Responses:

POST /console/admin/tenants/{tenantId}/operator-compliance/approvers

Assign a tenant operator approver.

Parameters:

Responses:

DELETE /console/admin/tenants/{tenantId}/operator-compliance/approvers/{approverId}

Revoke a tenant operator approver assignment.

Parameters:

Responses:

POST /console/admin/tenants/{tenantId}/resume

Resume a suspended tenant.

Parameters:

Responses:

POST /console/admin/tenants/{tenantId}/suspend

Suspend a tenant (blocks token issuance).

Parameters:

Responses:

GET /console/admin/tokens

List active and revoked tokens for a tenant.

Responses:

POST /console/admin/tokens/revoke

Revoke one or more access/refresh tokens.

Responses:

GET /console/admin/users

List users for the specified tenant.

Responses:

POST /console/admin/users

Create a local user (does not apply to external IdP users).

Responses:

PATCH /console/admin/users/{userId}

Update user metadata and role assignments.

Parameters:

Responses:

POST /console/admin/users/{userId}/disable

Disable a user account.

Parameters:

Responses:

POST /console/admin/users/{userId}/enable

Enable a disabled user account.

Parameters:

Responses:

GET /console/branding

Get branding configuration for the tenant (public endpoint).

Responses:

GET /console/dashboard

Tenant-scoped aggregates for findings, VEX overrides, advisory deltas, run health, and policy change log.

Responses:

GET /console/filters

Available filter categories with options and counts for deterministic console queries.

Responses:

GET /console/profile

Return the authenticated principal profile metadata.

Responses:

GET /console/tenants

List the tenant metadata for the authenticated principal.

Responses:

POST /console/token/introspect

Introspect the current access token and return expiry, scope, and tenant metadata.

Responses:

GET /console/vex/events

Report that live VEX event streaming is unsupported by Authority.

Authority fails closed for live VEX SSE until a durable tenant-scoped VEX event source exists.

Responses:

GET /console/vex/statements

List VEX statements impacting the tenant.

Responses:

GET /console/vuln/findings

List tenant-scoped vulnerability findings with policy/VEX metadata.

Responses:

POST /console/vuln/tickets

Generate a signed payload payload for external ticketing workflows.

Responses:

GET /console/vuln/{findingId}

Return the full finding document, including evidence and policy overlays.

Parameters:

Responses:

GET /doctor/authority/checks

Responses:

GET /health

Responses:

POST /internal/plugins/probe

Probe Authority plugins with deterministic local health checks.

Responses:

GET /internal/plugins/status

Return canonical Authority plugin runtime status.

Responses:

GET /issuer-directory/issuers

issuerdirectory.issuer.list_description

Parameters:

Responses:

POST /issuer-directory/issuers

issuerdirectory.issuer.create_description

Responses:

GET /issuer-directory/issuers/{id}

issuerdirectory.issuer.get_description

Parameters:

Responses:

PUT /issuer-directory/issuers/{id}

issuerdirectory.issuer.update_description

Parameters:

Responses:

DELETE /issuer-directory/issuers/{id}

issuerdirectory.issuer.delete_description

Parameters:

Responses:

GET /issuer-directory/issuers/{issuerId}/keys

issuerdirectory.key.list_description

Parameters:

Responses:

POST /issuer-directory/issuers/{issuerId}/keys

issuerdirectory.key.create_description

Parameters:

Responses:

DELETE /issuer-directory/issuers/{issuerId}/keys/{keyId}

issuerdirectory.key.revoke_description

Parameters:

Responses:

POST /issuer-directory/issuers/{issuerId}/keys/{keyId}/rotate

issuerdirectory.key.rotate_description

Parameters:

Responses:

GET /issuer-directory/issuers/{issuerId}/trust

issuerdirectory.trust.get_description

Parameters:

Responses:

PUT /issuer-directory/issuers/{issuerId}/trust

issuerdirectory.trust.set_description

Parameters:

Responses:

DELETE /issuer-directory/issuers/{issuerId}/trust

issuerdirectory.trust.delete_description

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/coverage

Admin coverage read model for operator decision-signing (ADR-025 / OSK-P4): groups the tenant’s decision-signing key history by operator subject and derives each operator’s enrolment state (pending | enrolled | re_enroll_required). Admin-scoped; a projection over append-only history that returns no key material.

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/enroll-invite

Admin-initiated operator enrolment invite: returns a deep-link (and QR payload) to the enrolment ceremony pre-filled with the tenant’s issuer namespace and active compliance provider (ADR-025 / OSK-P3). Non-custodial — the link starts a client-side enrol ceremony; no key is minted server-side.

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/keys

issuerdirectory.operator_key.list_description

Parameters:

Responses:

POST /issuer-directory/operator-signing-keys/{issuerId}/keys

issuerdirectory.operator_key.enroll_description

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/keys/subjects/{subjectId}

List the public decision-signing keys enrolled for one operator subject. Intended for authenticated service-side key-presence checks; private key material is never returned.

Parameters:

Responses:

GET /issuer-directory/operator-signing-keys/{issuerId}/keys/{keyId}

issuerdirectory.operator_key.get_description

Parameters:

Responses:

DELETE /issuer-directory/operator-signing-keys/{issuerId}/keys/{keyId}

issuerdirectory.operator_key.revoke_description

Parameters:

Responses:

POST /issuer-directory/operator-signing-keys/{issuerId}/keys/{keyId}/approve

issuerdirectory.operator_key.approve_description

Parameters:

Responses:

POST /issuer-directory/operator-signing-keys/{issuerId}/keys/{keyId}/rotate

issuerdirectory.operator_key.rotate_description

Parameters:

Responses:

POST /issuer-directory/operator-signing-keys/{issuerId}/provider-change-supersede

Retires active, provider-incompatible DecisionSigning keys for Authority-resolved exception-granting subjects. Retained public keys remain historically resolvable; the configured provider-change grace cutoff controls new-decision verification. A stable operationId returns the original immutable receipt on replay.

Parameters:

Responses:

GET /jwks

Responses:

GET /logout

OpenID Connect RP-Initiated Logout (end-session) endpoint. Terminates the Authority session and, when a registered post_logout_redirect_uri is supplied, redirects the user agent back to the client.

Responses:

POST /logout

OpenID Connect RP-Initiated Logout (end-session) endpoint. Terminates the Authority session and, when a registered post_logout_redirect_uri is supplied, redirects the user agent back to the client.

Responses:

POST /notify/ack-tokens/issue

Responses:

POST /notify/ack-tokens/rotate

Responses:

POST /notify/ack-tokens/verify

Responses:

POST /permalinks/vuln

Responses:

GET /ready

Responses:

POST /vuln/attachments/tokens/issue

Responses:

POST /vuln/attachments/tokens/verify

Responses:

POST /vuln/workflow/anti-forgery/issue

Responses:

POST /vuln/workflow/anti-forgery/verify

Responses: