Get Service - Authlete Documentation

Typescript (SDK)

import { Authlete } from "@authlete/typescript-sdk";

const authlete = new Authlete({
  serviceId: "<id>",
  bearer: process.env["AUTHLETE_BEARER"] ?? "",
});

async function run() {
  const result = await authlete.service.get({});

  console.log(result);
}

run();

require 'authlete_ruby_sdk'

Models = ::Authlete::Models
s = ::Authlete::Client.new(
  service_id: '<id>',
  bearer: '<YOUR_BEARER_TOKEN_HERE>'
)
res = s.services.retrieve

unless res.service.nil?
  # handle response
end

package main

import(
	"context"
	"os"
	authlete "github.com/authlete/authlete-go-sdk"
	"github.com/authlete/authlete-go-sdk/models/operations"
	"log"
)

func main() {
    ctx := context.Background()

    s := authlete.New(
        authlete.WithServiceID("<id>"),
        authlete.WithSecurity(os.Getenv("AUTHLETE_BEARER")),
    )

    res, err := s.Service.Get(ctx, operations.ServiceGetAPIRequest{})
    if err != nil {
        log.Fatal(err)
    }
    if res.Service != nil {
        // handle response
    }
}

{
  "accessTokenDuration": 3600,
  "accessTokenType": "Bearer",
  "allowableClockSkew": 0,
  "apiKey": 21653835348762,
  "attributes": [
    {
      "key": "attribute1-key",
      "value": "attribute1-value"
    },
    {
      "key": "attribute2-key",
      "value": "attribute2-value"
    }
  ],
  "authorizationEndpoint": "https://my-service.example.com/authz",
  "authorizationResponseDuration": 0,
  "authorizationCodeDuration": 0,
  "backchannelAuthReqIdDuration": 0,
  "backchannelBindingMessageRequiredInFapi": false,
  "backchannelPollingInterval": 0,
  "backchannelUserCodeParameterSupported": false,
  "claimShortcutRestrictive": false,
  "clientIdAliasEnabled": true,
  "clientsPerDeveloper": 0,
  "createdAt": 1639373421000,
  "dcrScopeUsedAsRequestable": false,
  "deviceFlowCodeDuration": 0,
  "deviceFlowPollingInterval": 0,
  "directAuthorizationEndpointEnabled": false,
  "directIntrospectionEndpointEnabled": false,
  "directJwksEndpointEnabled": false,
  "directRevocationEndpointEnabled": false,
  "directTokenEndpointEnabled": false,
  "directUserInfoEndpointEnabled": false,
  "dynamicRegistrationSupported": false,
  "errorDescriptionOmitted": false,
  "errorUriOmitted": false,
  "frontChannelRequestObjectEncryptionRequired": false,
  "grantManagementActionRequired": false,
  "hsmEnabled": false,
  "idTokenDuration": 0,
  "introspectionEndpoint": "https://my-service.example.com/introspection",
  "issSuppressed": false,
  "issuer": "https://my-service.example.com",
  "metadata": [
    {
      "key": "clientCount",
      "value": "1"
    }
  ],
  "missingClientIdAllowed": false,
  "modifiedAt": 1639373421000,
  "mutualTlsValidatePkiCertChain": false,
  "nbfOptional": false,
  "number": 5041,
  "parRequired": false,
  "pkceRequired": true,
  "pkceS256Required": false,
  "pushedAuthReqDuration": 0,
  "refreshTokenDuration": 3600,
  "refreshTokenDurationKept": false,
  "refreshTokenDurationReset": false,
  "refreshTokenKept": false,
  "requestObjectEncryptionAlgMatchRequired": false,
  "requestObjectEncryptionEncMatchRequired": false,
  "requestObjectRequired": false,
  "revocationEndpoint": "https://my-service.example.com/revocation",
  "scopeRequired": false,
  "serviceName": "My service",
  "serviceOwnerNumber": 2,
  "singleAccessTokenPerSubject": false,
  "supportedClaimTypes": [
    "NORMAL"
  ],
  "supportedDisplays": [
    "PAGE"
  ],
  "supportedGrantTypes": [
    "AUTHORIZATION_CODE",
    "REFRESH_TOKEN"
  ],
  "supportedIntrospectionAuthMethods": [
    "CLIENT_SECRET_BASIC"
  ],
  "supportedResponseTypes": [
    "CODE"
  ],
  "supportedRevocationAuthMethods": [
    "CLIENT_SECRET_BASIC"
  ],
  "supportedScopes": [
    {
      "defaultEntry": false,
      "description": "A permission to read your history.",
      "name": "history.read"
    },
    {
      "defaultEntry": false,
      "description": "A permission to read your timeline.",
      "name": "timeline.read"
    }
  ],
  "supportedTokenAuthMethods": [
    "CLIENT_SECRET_BASIC"
  ],
  "tlsClientCertificateBoundAccessTokens": false,
  "tokenEndpoint": "https://my-service.example.com/token",
  "tokenExpirationLinked": false,
  "traditionalRequestObjectProcessingApplied": false,
  "unauthorizedOnClientConfigSupported": false,
  "userCodeLength": 0
}

GET

api

{serviceId}

service

get

Typescript (SDK)

import { Authlete } from "@authlete/typescript-sdk";

const authlete = new Authlete({
  serviceId: "<id>",
  bearer: process.env["AUTHLETE_BEARER"] ?? "",
});

async function run() {
  const result = await authlete.service.get({});

  console.log(result);
}

run();

require 'authlete_ruby_sdk'

Models = ::Authlete::Models
s = ::Authlete::Client.new(
  service_id: '<id>',
  bearer: '<YOUR_BEARER_TOKEN_HERE>'
)
res = s.services.retrieve

unless res.service.nil?
  # handle response
end

package main

import(
	"context"
	"os"
	authlete "github.com/authlete/authlete-go-sdk"
	"github.com/authlete/authlete-go-sdk/models/operations"
	"log"
)

func main() {
    ctx := context.Background()

    s := authlete.New(
        authlete.WithServiceID("<id>"),
        authlete.WithSecurity(os.Getenv("AUTHLETE_BEARER")),
    )

    res, err := s.Service.Get(ctx, operations.ServiceGetAPIRequest{})
    if err != nil {
        log.Fatal(err)
    }
    if res.Service != nil {
        // handle response
    }
}

{
  "accessTokenDuration": 3600,
  "accessTokenType": "Bearer",
  "allowableClockSkew": 0,
  "apiKey": 21653835348762,
  "attributes": [
    {
      "key": "attribute1-key",
      "value": "attribute1-value"
    },
    {
      "key": "attribute2-key",
      "value": "attribute2-value"
    }
  ],
  "authorizationEndpoint": "https://my-service.example.com/authz",
  "authorizationResponseDuration": 0,
  "authorizationCodeDuration": 0,
  "backchannelAuthReqIdDuration": 0,
  "backchannelBindingMessageRequiredInFapi": false,
  "backchannelPollingInterval": 0,
  "backchannelUserCodeParameterSupported": false,
  "claimShortcutRestrictive": false,
  "clientIdAliasEnabled": true,
  "clientsPerDeveloper": 0,
  "createdAt": 1639373421000,
  "dcrScopeUsedAsRequestable": false,
  "deviceFlowCodeDuration": 0,
  "deviceFlowPollingInterval": 0,
  "directAuthorizationEndpointEnabled": false,
  "directIntrospectionEndpointEnabled": false,
  "directJwksEndpointEnabled": false,
  "directRevocationEndpointEnabled": false,
  "directTokenEndpointEnabled": false,
  "directUserInfoEndpointEnabled": false,
  "dynamicRegistrationSupported": false,
  "errorDescriptionOmitted": false,
  "errorUriOmitted": false,
  "frontChannelRequestObjectEncryptionRequired": false,
  "grantManagementActionRequired": false,
  "hsmEnabled": false,
  "idTokenDuration": 0,
  "introspectionEndpoint": "https://my-service.example.com/introspection",
  "issSuppressed": false,
  "issuer": "https://my-service.example.com",
  "metadata": [
    {
      "key": "clientCount",
      "value": "1"
    }
  ],
  "missingClientIdAllowed": false,
  "modifiedAt": 1639373421000,
  "mutualTlsValidatePkiCertChain": false,
  "nbfOptional": false,
  "number": 5041,
  "parRequired": false,
  "pkceRequired": true,
  "pkceS256Required": false,
  "pushedAuthReqDuration": 0,
  "refreshTokenDuration": 3600,
  "refreshTokenDurationKept": false,
  "refreshTokenDurationReset": false,
  "refreshTokenKept": false,
  "requestObjectEncryptionAlgMatchRequired": false,
  "requestObjectEncryptionEncMatchRequired": false,
  "requestObjectRequired": false,
  "revocationEndpoint": "https://my-service.example.com/revocation",
  "scopeRequired": false,
  "serviceName": "My service",
  "serviceOwnerNumber": 2,
  "singleAccessTokenPerSubject": false,
  "supportedClaimTypes": [
    "NORMAL"
  ],
  "supportedDisplays": [
    "PAGE"
  ],
  "supportedGrantTypes": [
    "AUTHORIZATION_CODE",
    "REFRESH_TOKEN"
  ],
  "supportedIntrospectionAuthMethods": [
    "CLIENT_SECRET_BASIC"
  ],
  "supportedResponseTypes": [
    "CODE"
  ],
  "supportedRevocationAuthMethods": [
    "CLIENT_SECRET_BASIC"
  ],
  "supportedScopes": [
    {
      "defaultEntry": false,
      "description": "A permission to read your history.",
      "name": "history.read"
    },
    {
      "defaultEntry": false,
      "description": "A permission to read your timeline.",
      "name": "timeline.read"
    }
  ],
  "supportedTokenAuthMethods": [
    "CLIENT_SECRET_BASIC"
  ],
  "tlsClientCertificateBoundAccessTokens": false,
  "tokenEndpoint": "https://my-service.example.com/token",
  "tokenExpirationLinked": false,
  "traditionalRequestObjectProcessingApplied": false,
  "unauthorizedOnClientConfigSupported": false,
  "userCodeLength": 0
}

Authorizations

Authorization

string

header

required

Authenticate every request with a Service Access Token or Organization Token. Set the token value in the Authorization: Bearer <token> header.

Service Access Token: Scoped to a single service. Use when automating service-level configuration or runtime flows.

Organization Token: Scoped to the organization; inherits permissions across services. Use for org-wide automation or when managing multiple services programmatically.

Both token types are issued by the Authlete console or provisioning APIs.

Path Parameters

serviceId

string

required

A service ID.

Response

number

integer<int32>

read-only

The sequential number of the service. The value of this property is assigned by Authlete.

serviceName

string | null

The name of this service.

issuer

string | null

The issuer identifier of the service.

A URL that starts with https:// and has no query or fragment component.

The value of this property is used as iss claim in an ID token and issuer property in the OpenID Provider Metadata.

description

string | null

The description about the service.

apiKey

integer<int64>

read-only

The service ID used in Authlete API calls. The value of this property is assigned by Authlete.

apiSecret

string | null

read-only

The API secret of this service. This value is assigned by Authlete and is used for service authentication in API calls.

tokenBatchNotificationEndpoint

string<uri> | null

read-only

The endpoint for batch token notifications. This endpoint is called when multiple tokens are issued or revoked in a batch operation.

clientAssertionAudRestrictedToIssuer

boolean

The flag indicating whether the audience of client assertion JWTs must match the issuer identifier of this service.

serviceOwnerNumber

integer<int32>

read-only

The number of the organization that owns this service. This value is assigned by Authlete.

clientsPerDeveloper

integer<int32>

The maximum number of client applications that a developer can have.

developerAuthenticationCallbackEndpoint

string<uri> | null

read-only

The endpoint for developer authentication callbacks. This is used when developers log into the developer portal.

developerAuthenticationCallbackApiKey

string | null

read-only

The API key for basic authentication at the developer authentication callback endpoint.

developerAuthenticationCallbackApiSecret

string | null

read-only

The API secret for basic authentication at the developer authentication callback endpoint.

supportedSnses

enum<string>[] | null

read-only

Social login services (SNS) that this service supports for end-user authentication.

Available options:

FACEBOOK

The credentials for social login services (SNS) that are used for end-user authentication.

Show child attributes

supportedDeveloperSnses

enum<string>[] | null

Social login services (SNS) that this service supports for developer authentication.

Available options:

FACEBOOK

The credentials for social login services (SNS) that are used for developer authentication.

Show child attributes

clientIdAliasEnabled

boolean

read-only

Deprecated. Always true.

metadata

object[] | null

The metadata of the service. The content of the returned array depends on contexts. The predefined service metadata is listed in the following table.

Key	Description
`clientCount`	The number of client applications which belong to this service.

Show child attributes

createdAt

integer<int64>

read-only

The time at which this service was created. The value is represented as milliseconds since the UNIX epoch (1970-01-01).

modifiedAt

integer<int64>

read-only

The time at which this service was last modified. The value is represented as milliseconds since the UNIX epoch (1970-01-01).

authenticationCallbackEndpoint

string<uri> | null

A Web API endpoint for user authentication which is to be prepared on the service side.

The endpoint must be implemented if you do not implement the UI at the authorization endpoint but use the one provided by Authlete.

The user authentication at the authorization endpoint provided by Authlete is performed by making a POST request to this endpoint.

authenticationCallbackApiKey

string | null

API key for basic authentication at the authentication callback endpoint.

If the value is not empty, Authlete generates Authorization header for Basic authentication when making a request to the authentication callback endpoint.

authenticationCallbackApiSecret

string | null

API secret for basic authentication at the authentication callback endpoint.

supportedAcrs

string[] | null

read-only

Values of acrs (authentication context class references) that the service supports.

The value of this property is used as acr_values_supported property in the OpenID Provider Metadata.

supportedGrantTypes

enum<string>[] | null

Values of grant_type request parameter that the service supports.

The value of this property is used as grant_types_supported property in the OpenID Provider Metadata.

The grant type of the access token when the access token was created.

Available options:

AUTHORIZATION_CODE,

IMPLICIT,

PASSWORD,

CLIENT_CREDENTIALS,

REFRESH_TOKEN,

CIBA,

DEVICE_CODE,

TOKEN_EXCHANGE,

JWT_BEARER,

PRE_AUTHORIZED_CODE

supportedResponseTypes

enum<string>[] | null

Values of response_type request parameter that the service supports. Valid values are listed in Response Type.

The value of this property is used as response_types_supported property in the OpenID Provider Metadata.

Available options:

NONE,

CODE,

TOKEN,

ID_TOKEN,

CODE_TOKEN,

CODE_ID_TOKEN,

ID_TOKEN_TOKEN,

CODE_ID_TOKEN_TOKEN

supportedAuthorizationDetailsTypes

string[] | null

The supported data types that can be used as values of the type field in authorization_details.

This property corresponds to the authorization_details_types_supported metadata. See "OAuth 2.0 Rich Authorization Requests" (RAR) for details.

supportedServiceProfiles

enum<string>[] | null

The profiles that this service supports.

Available options:

FAPI,

OPEN_BANKING

errorDescriptionOmitted

boolean

The flag to indicate whether the error_description response parameter is omitted.

According to RFC 6749, an authorization server may include the error_description response parameter in error responses.

If true, Authlete does not embed the error_description response parameter in error responses.

errorUriOmitted

boolean

The flag to indicate whether the error_uri response parameter is omitted.

According to RFC 6749, an authorization server may include the error_uri response parameter in error responses.

If true, Authlete does not embed the error_uri response parameter in error responses.

authorizationEndpoint

string<uri> | null

The authorization endpoint of the service.

A URL that starts with https:// and has no fragment component. For example, https://example.com/auth/authorization.

The value of this property is used as authorization_endpoint property in the OpenID Provider Metadata.

directAuthorizationEndpointEnabled

boolean

deprecated

read-only

Deprecated. The direct authorization endpoint was removed in Authlete 3.0.15, so this flag has no effect and is always returned as false.

supportedUiLocales

string[] | null

UI locales that the service supports.

Each element is a language tag defined in RFC 5646. For example, en-US and ja-JP.

The value of this property is used as ui_locales_supported property in the OpenID Provider Metadata.

supportedDisplays

enum<string>[] | null

Values of display request parameter that service supports.

The value of this property is used as display_values_supported property in the Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).

The display mode which the client application requests by display request parameter. When the authorization request does not have display request parameter, PAGE is set as the default value.

It is ensured that the value of display is one of the supported display modes which are specified by supportedDisplays configuration parameter of the service. If the display mode specified by the authorization request is not supported, an error is raised.

Values for this property correspond to the values listed in "OpenID Connect Core 1.0, 3.1.2.1. Authentication Request, display".

Available options:

PAGE,

POPUP,

TOUCH,

WAP

pkceRequired

boolean

The flag to indicate whether the use of Proof Key for Code Exchange (PKCE) is always required for authorization requests by Authorization Code Flow.

If true, code_challenge request parameter is always required for authorization requests using Authorization Code Flow.

See RFC 7636 (Proof Key for Code Exchange by OAuth Public Clients) for details about code_challenge request parameter.

pkceS256Required

boolean

The flag to indicate whether S256 is always required as the code challenge method whenever PKCE (RFC 7636) is used.

If this flag is set to true, code_challenge_method=S256 must be included in the authorization request whenever it includes the code_challenge request parameter. Neither omission of the code_challenge_method request parameter nor use of plain (code_challenge_method=plain) is allowed.

authorizationResponseDuration

integer<int64>

The duration of authorization response JWTs in seconds.

Financial-grade API: JWT Secured Authorization Response Mode for OAuth 2.0 (JARM) defines new values for the response_mode request parameter. They are query.jwt, fragment.jwt, form_post.jwt and jwt. If one of them is specified as the response mode, response parameters from the authorization endpoint will be packed into a JWT. This property is used to compute the value of the exp claim of the JWT.

authorizationCodeDuration

integer<int64>

The duration of authorization codes in seconds.

tokenEndpoint

string<uri> | null

The token endpoint of the service.

A URL that starts with https:// and has not fragment component. For example, https://example.com/auth/token.

The value of this property is used as token_endpoint property in the OpenID Provider Metadata.

directTokenEndpointEnabled

boolean

deprecated

read-only

Deprecated. The direct token endpoint was removed in Authlete 3.0.15, so this flag has no effect and is always returned as false.

supportedTokenAuthMethods

enum<string>[] | null

Client authentication methods supported by the token endpoint of the service.

The value of this property is used as token_endpoint_auth_methods_supports property in the OpenID Provider Metadata.

The client authentication method that the client application declares that it uses at the token endpoint. This property corresponds to token_endpoint_auth_method in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

Available options:

NONE,

CLIENT_SECRET_BASIC,

CLIENT_SECRET_POST,

CLIENT_SECRET_JWT,

PRIVATE_KEY_JWT,

TLS_CLIENT_AUTH,

SELF_SIGNED_TLS_CLIENT_AUTH,

ATTEST_JWT_CLIENT_AUTH,

SPIFFE_JWT

missingClientIdAllowed

boolean

The flag to indicate token requests from public clients without the client_id request parameter are allowed when the client can be guessed from authorization_code or refresh_token.

This flag should not be set unless you have special reasons.

revocationEndpoint

string<uri> | null

The revocation endpoint of the service.

A URL that starts with https://. For example, https://example.com/auth/revocation.

directRevocationEndpointEnabled

boolean

deprecated

read-only

Deprecated. The direct revocation endpoint was removed in Authlete 3.0.15, so this flag has no effect and is always returned as false.

supportedRevocationAuthMethods

enum<string>[] | null

Client authentication methods supported at the revocation endpoint.

Available options:

NONE,

CLIENT_SECRET_BASIC,

CLIENT_SECRET_POST,

CLIENT_SECRET_JWT,

PRIVATE_KEY_JWT,

TLS_CLIENT_AUTH,

SELF_SIGNED_TLS_CLIENT_AUTH,

ATTEST_JWT_CLIENT_AUTH,

SPIFFE_JWT

introspectionEndpoint

string<uri> | null

The URI of the introspection endpoint.

directIntrospectionEndpointEnabled

boolean

deprecated

read-only

Deprecated. The direct introspection endpoint was removed in Authlete 3.0.15, so this flag has no effect and is always returned as false.

supportedIntrospectionAuthMethods

enum<string>[] | null

Client authentication methods supported at the introspection endpoint.

Available options:

NONE,

CLIENT_SECRET_BASIC,

CLIENT_SECRET_POST,

CLIENT_SECRET_JWT,

PRIVATE_KEY_JWT,

TLS_CLIENT_AUTH,

SELF_SIGNED_TLS_CLIENT_AUTH,

ATTEST_JWT_CLIENT_AUTH,

SPIFFE_JWT

pushedAuthReqEndpoint

string<uri> | null

The URI of the pushed authorization request endpoint.

This property corresponds to the pushed_authorization_request_endpoint metadata defined in "5. Authorization Server Metadata" of OAuth 2.0 Pushed Authorization Requests.

pushedAuthReqDuration

integer<int64>

The duration of pushed authorization requests in seconds.

parRequired

boolean

The flag to indicate whether this service requires that clients use the pushed authorization request endpoint.

This property corresponds to the require_pushed_authorization_requests server metadata defined in OAuth 2.0 Pushed Authorization Requests.

requestObjectRequired

boolean

The flag to indicate whether this service requires that authorization requests always utilize a request object by using either request or request_uri request parameter.

If this flag is set to true and the value of traditionalRequestObjectProcessingApplied is false, the value of require_signed_request_object server metadata of this service is reported as true in the discovery document. The metadata is defined in JAR (JWT Secured Authorization Request). That require_signed_request_object is true means that authorization requests which don't conform to the JAR specification are rejected.

traditionalRequestObjectProcessingApplied

boolean

The flag to indicate whether a request object is processed based on rules defined in OpenID Connect Core 1.0 or JAR (JWT Secured Authorization Request).

mutualTlsValidatePkiCertChain

boolean

The flag to indicate whether this service validates certificate chains during PKI-based client mutual TLS authentication.

trustedRootCertificates

string[] | null

The list of root certificates trusted by this service for PKI-based client mutual TLS authentication.

mtlsEndpointAliases

object[] | null

The MTLS endpoint aliases.

Show child attributes

accessTokenType

string | null

The access token type.

This value is used as the value of token_type property in access token responses. If this service complies with RFC 6750, the value of this property should be Bearer.

See RFC 6749 (OAuth 2.0), 7.1. Access Token Types for details.

tlsClientCertificateBoundAccessTokens

boolean

The flag to indicate whether this service supports issuing TLS client certificate bound access tokens.

accessTokenDuration

integer<int64>

The duration of access tokens in seconds. This value is used as the value of expires_in property in access token responses. expires_in is defined RFC 6749, 5.1. Successful Response.

singleAccessTokenPerSubject

boolean

The flag to indicate whether the number of access tokens per subject (and per client) is at most one or can be more.

If true, an attempt to issue a new access token invalidates existing access tokens that are associated with the same subject and the same client.

Note that, however, attempts by Client Credentials Flow do not invalidate existing access tokens because access tokens issued by Client Credentials Flow are not associated with any end-user's subject. Also note that an attempt by Refresh Token Flow invalidates the coupled access token only and this invalidation is always performed regardless of whether the value of this setting item is true or false.

accessTokenSignAlg

enum<string> | null

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.

Available options:

NONE,

HS256,

HS384,

HS512,

RS256,

RS384,

RS512,

ES256,

ES384,

ES512,

PS256,

PS384,

PS512,

ES256K,

EdDSA

accessTokenSignatureKeyId

string | null

The key ID to identify a JWK used for signing access tokens.

A JWK Set can be registered as a property of a service. A JWK Set can contain 0 or more JWKs. Authlete Server has to pick up one JWK for signing from the JWK Set when it generates a JWT-based access token. Authlete Server searches the registered JWK Set for a JWK which satisfies conditions for access token signature. If the number of JWK candidates which satisfy the conditions is 1, there is no problem. On the other hand, if there exist multiple candidates, a Key ID is needed to be specified so that Authlete Server can pick up one JWK from among the JWK candidates.

refreshTokenDuration

integer<int64>

The duration of refresh tokens in seconds. The related specifications have no requirements on refresh token duration, but Authlete sets expiration for refresh tokens.

refreshTokenDurationKept

boolean

The flag to indicate whether the remaining duration of the used refresh token is taken over to the newly issued refresh token.

refreshTokenDurationReset

boolean

The flag which indicates whether duration of refresh tokens are reset when they are used even if the refreshTokenKept property of this service set to is true (= even if "Refresh Token Continuous Use" is "Kept").

This flag has no effect when the refreshTokenKept property is set to false. In other words, if this service issues a new refresh token on every refresh token request, the refresh token will have fresh duration (unless refreshTokenDurationKept is set to true) and this refreshTokenDurationReset property is not referenced.

refreshTokenKept

boolean

The flag to indicate whether a refresh token remains unchanged or gets renewed after its use.

If true, a refresh token used to get a new access token remains valid after its use. Otherwise, if false, a refresh token is invalidated after its use and a new refresh token is issued.

See RFC 6749 6. Refreshing an Access Token, as to how to get a new access token using a refresh token.

supportedScopes

object[] | null

Scopes supported by the service.

Show child attributes

scopeRequired

boolean

The flag to indicate whether requests that request no scope are rejected or not.

idTokenDuration

integer<int64>

'The duration of ID tokens in seconds. This value is used to calculate the value of exp claim in an ID token.'

allowableClockSkew

integer<int32>

The allowable clock skew between the server and clients in seconds.

The clock skew is taken into consideration when time-related claims in a JWT (e.g. exp, iat, nbf) are verified.

supportedClaimTypes

enum<string>[] | null

Claim types supported by the service. Valid values are listed in Claim Type. Note that Authlete currently doesn't provide any API to help implementations for AGGREGATED and DISTRIBUTED.

The value of this property is used as claim_types_supported property in the OpenID Provider Metadata.

Available options:

NORMAL,

AGGREGATED,

DISTRIBUTED

supportedClaimLocales

string[] | null

Claim locales that the service supports. Each element is a language tag defined in RFC 5646. For example, en-US and ja-JP. See OpenID Connect Core 1.0, 5.2. Languages and Scripts for details.

The value of this property is used as claims_locales_supported property in the OpenID Provider Metadata.

supportedClaims

string[] | null

Claim names that the service supports. The standard claim names listed in OpenID Connect Core 1.0, 5.1. Standard Claim should be supported. The following is the list of standard claims.

claimShortcutRestrictive

boolean

The flag indicating whether claims specified by shortcut scopes (e.g. profile) are included in the issued ID token only when no access token is issued.

jwksUri

string<uri> | null

The URL of the service's JSON Web Key Set document. For example, http://example.com/auth/jwks.

Client applications accesses this URL (1) to get the public key of the service to validate the signature of an ID token issued by the service and (2) to get the public key of the service to encrypt an request object of the client application. See OpenID Connect Core 1.0, 10. Signatures and Encryption for details.

The value of this property is used as jwks_uri property in the OpenID Provider Metadata.

directJwksEndpointEnabled

boolean

deprecated

read-only

Deprecated. The direct JWKS endpoint was removed in Authlete 3.0.15, so this flag has no effect and is always returned as false.

jwks

string | null

The content of the service's JSON Web Key Set document.

If this property is not null in a /service/create request or a /service/update request, Authlete hosts the content in the database. This property must not be null and must contain pairs of public/private keys if the service wants to support asymmetric signatures for ID tokens and asymmetric encryption for request objects. See OpenID Connect Core 1.0, 10. Signatures and Encryption for details.

idTokenSignatureKeyId

string | null

The key ID to identify a JWK used for ID token signature using an asymmetric key.

userInfoSignatureKeyId

string | null

The key ID to identify a JWK used for user info signature using an asymmetric key.

authorizationSignatureKeyId

string | null

The key ID to identify a JWK used for signing authorization responses using an asymmetric key.

userInfoEndpoint

string<uri> | null

The user info endpoint of the service. A URL that starts with https://. For example, https://example.com/auth/userinfo.

The value of this property is used as userinfo_endpoint property in the OpenID Provider Metadata.

directUserInfoEndpointEnabled

boolean

deprecated

read-only

Deprecated. The direct userinfo endpoint was removed in Authlete 3.0.15, so this flag has no effect and is always returned as false.

dynamicRegistrationSupported

boolean

The boolean flag which indicates whether the OAuth 2.0 Dynamic Client Registration Protocol is supported.

registrationEndpoint

string<uri> | null

The registration endpoint of the service. A URL that starts with https://. For example, https://example.com/auth/registration.

The value of this property is used as registration_endpoint property in the OpenID Provider Metadata.

registrationManagementEndpoint

string<uri> | null

The URI of the registration management endpoint. If dynamic client registration is supported, and this is set, this URI will be used as the basis of the client's management endpoint by appending /clientid}/ to it as a path element. If this is unset, the value of registrationEndpoint will be used as the URI base instead.

policyUri

string<uri> | null

The URL of the "Policy" of the service.

The value of this property is used as op_policy_uri property in the OpenID Provider Metadata.

tosUri

string<uri> | null

The URL of the "Terms Of Service" of the service.

The value of this property is used as op_tos_uri property in the OpenID Provider Metadata.

serviceDocumentation

string<uri> | null

The URL of a page where documents for developers can be found.

The value of this property is used as service_documentation property in the OpenID Provider Metadata.

backchannelAuthenticationEndpoint

string<uri> | null

The URI of backchannel authentication endpoint, which is defined in the specification of CIBA (Client Initiated Backchannel Authentication).

supportedBackchannelTokenDeliveryModes

enum<string>[] | null

The supported backchannel token delivery modes. This property corresponds to the backchannel_token_delivery_modes_supported metadata.

Backchannel token delivery modes are defined in the specification of CIBA (Client Initiated Backchannel Authentication).

Available options:

PING,

POLL,

PUSH

backchannelAuthReqIdDuration

integer<int32>

The duration of backchannel authentication request IDs issued from the backchannel authentication endpoint in seconds. This is used as the value of the expires_in property in responses from the backchannel authentication endpoint.

backchannelPollingInterval

integer<int32>

The minimum interval between polling requests to the token endpoint from client applications in seconds. This is used as the value of the interval property in responses from the backchannel authentication endpoint.

backchannelUserCodeParameterSupported

boolean

The boolean flag which indicates whether the user_code request parameter is supported at the backchannel authentication endpoint. This property corresponds to the backchannel_user_code_parameter_supported metadata.

backchannelBindingMessageRequiredInFapi

boolean

The flag to indicate whether the binding_message request parameter is always required whenever a backchannel authentication request is judged as a request for Financial-grade API.

deviceAuthorizationEndpoint

string<uri> | null

The URI of the device authorization endpoint.

Device authorization endpoint is defined in the specification of OAuth 2.0 Device Authorization Grant.

deviceVerificationUri

string<uri> | null

The verification URI for the device flow. This URI is used as the value of the verification_uri parameter in responses from the device authorization endpoint.

deviceVerificationUriComplete

string<uri> | null

The verification URI for the device flow with a placeholder for a user code. This URI is used to build the value of the verification_uri_complete parameter in responses from the device authorization endpoint.

deviceFlowCodeDuration

integer<int32>

The duration of device verification codes and end-user verification codes issued from the device authorization endpoint in seconds. This is used as the value of the expires_in property in responses from the device authorization endpoint.

deviceFlowPollingInterval

integer<int32>

The minimum interval between polling requests to the token endpoint from client applications in seconds in device flow. This is used as the value of the interval property in responses from the device authorization endpoint.

userCodeCharset

enum<string> · null · null

The character set for end-user verification codes (user_code) for Device Flow.

Available options:

BASE20,

NUMERIC

userCodeLength

integer<int32>

The length of end-user verification codes (user_code) for Device Flow.

supportedTrustFrameworks

string[] | null

Trust frameworks supported by this service. This corresponds to the trust_frameworks_supported metadata.

supportedEvidence

string[] | null

Evidence supported by this service. This corresponds to the evidence_supported metadata.

supportedIdentityDocuments

string[] | null

Identity documents supported by this service. This corresponds to the id_documents_supported metadata.

supportedVerificationMethods

string[] | null

Verification methods supported by this service. This corresponds to the id_documents_verification_methods_supported metadata.

supportedVerifiedClaims

string[] | null

Verified claims supported by this service. This corresponds to the claims_in_verified_claims_supported metadata.

verifiedClaimsValidationSchemaSet

enum<string> | null

OIDC4IDA / verifiedClaimsValidationSchemaSet

Available options:

standard,

standard+id_document

attributes

object[] | null

The attributes of this service.

Show child attributes

nbfOptional

boolean

The flag indicating whether the nbf claim in the request object is optional even when the authorization request is regarded as a FAPI-Part2 request.

issSuppressed

boolean

The flag indicating whether generation of the iss response parameter is suppressed.

supportedCustomClientMetadata

string[] | null

custom client metadata supported by this service.

tokenExpirationLinked

boolean

The flag indicating whether the expiration date of an access token never exceeds that of the corresponding refresh token.

frontChannelRequestObjectEncryptionRequired

boolean

The flag indicating whether encryption of request object is required when the request object is passed through the front channel.

requestObjectEncryptionAlgMatchRequired

boolean

The flag indicating whether the JWE alg of encrypted request object must match the request_object_encryption_alg client metadata of the client that has sent the request object.

requestObjectEncryptionEncMatchRequired

boolean

The flag indicating whether the JWE enc of encrypted request object must match the request_object_encryption_enc client metadata of the client that has sent the request object.

hsmEnabled

boolean

The flag indicating whether HSM (Hardware Security Module) support is enabled for this service.

When this flag is false, keys managed in HSMs are not used even if they exist. In addition, /api/hsk/* APIs reject all requests.

Even if this flag is true, HSM-related features do not work if the configuration of the Authlete server you are using does not support HSM.

hsks

object[] | null

The information about keys managed on HSMs (Hardware Security Modules).

This hsks property is output only, meaning that hsks in requests to /api/service/create API and /api/service/update API do not have any effect. The contents of this property is controlled only by /api/hsk/* APIs.

Show child attributes

grantManagementEndpoint

string | null

The URL of the grant management endpoint.

grantManagementActionRequired

boolean

The flag indicating whether every authorization request (and any request serving as an authorization request such as CIBA backchannel authentication request and device authorization request) must include the grant_management_action request parameter.

unauthorizedOnClientConfigSupported

boolean

The flag indicating whether Authlete's /api/client/registration API uses UNAUTHORIZED as a value of the action response parameter when appropriate.

dcrScopeUsedAsRequestable

boolean

The flag indicating whether the scope request parameter in dynamic client registration and update requests (RFC 7591 and RFC 7592) is used as scopes that the client can request.

Limiting the range of scopes that a client can request is achieved by listing scopes in the client.extension.requestableScopes property and setting the client.extension.requestableScopesEnabled property to true. This feature is called "requestable scopes".

This property affects behaviors of /api/client/registration and other family APIs.

endSessionEndpoint

string<uri> | null

The endpoint for clients ending the sessions.

A URL that starts with https:// and has no fragment component. For example, https://example.com/auth/endSession.

The value of this property is used as end_session_endpoint property in the OpenID Provider Metadata.

challengeEndpoint

string<uri> | null

The URL of the challenge endpoint, which is defined in OAuth 2.0 Attestation-Based Client Authentication.

loopbackRedirectionUriVariable

boolean

The flag indicating whether the port number component of redirection URIs can be variable when the host component indicates loopback.

requestObjectAudienceChecked

boolean

The flag indicating whether Authlete checks whether the aud claim of request objects matches the issuer identifier of this service.

accessTokenForExternalAttachmentEmbedded

boolean

The flag indicating whether Authlete generates access tokens for external attachments and embeds them in ID tokens and userinfo responses.

authorityHints

string[] | null

Identifiers of entities that can issue entity statements for this service. This property corresponds to the authority_hints property that appears in a self-signed entity statement that is defined in OpenID Connect Federation 1.0.

federationEnabled

boolean

flag indicating whether this service supports OpenID Connect Federation 1

federationJwks

string | null

JWK Set document containing keys that are used to sign (1) self-signed entity statement of this service and (2) the response from signed_jwks_uri.

federationSignatureKeyId

string | null

A key ID to identify a JWK used to sign the entity configuration and the signed JWK Set.

federationConfigurationDuration

integer

The duration of the entity configuration in seconds.

federationRegistrationEndpoint

string | null

The URI of the federation registration endpoint. This property corresponds to the federation_registration_endpoint server metadata that is defined in OpenID Connect Federation 1.0.

organizationName

string | null

The human-readable name representing the organization that operates this service. This property corresponds to the organization_name server metadata that is defined in OpenID Connect Federation 1.0.

predefinedTransformedClaims

string | null

The transformed claims predefined by this service in JSON format. This property corresponds to the transformed_claims_predefined server metadata.

refreshTokenIdempotent

boolean

flag indicating whether refresh token requests with the same refresh token can be made multiple times in quick succession and they can obtain the same renewed refresh token within the short period.

signedJwksUri

string | null

The URI of the endpoint that returns this service's JWK Set document in the JWT format. This property corresponds to the signed_jwks_uri server metadata defined in OpenID Connect Federation 1.0.

supportedAttachments

enum<string>[] | null

Supported attachment types. This property corresponds to the {@code attachments_supported} server metadata which was added by the third implementer's draft of OpenID Connect for Identity Assurance 1.0.

Supported attachment types. This property corresponds to the attachments_supported server metadata which was added by the third implementer's draft of OpenID Connect for Identity Assurance 1.0.

Available options:

EMBEDDED,

EXTERNAL

supportedDigestAlgorithms

string[] | null

Supported algorithms used to compute digest values of external attachments. This property corresponds to the digest_algorithms_supported server metadata which was added by the third implementer's draft of OpenID Connect for Identity Assurance 1.0.

supportedDocuments

string[] | null

Document types supported by this service. This property corresponds to the documents_supported server metadata.

supportedDocumentsMethods

string[] | null

validation and verification processes supported by this service. This property corresponds to the documents_methods_supported server metadata.

The third implementer's draft of OpenID Connect for Identity Assurance 1.0 renamed the id_documents_verification_methods_supported server metadata to documents_methods_supported.

supportedDocumentsValidationMethods

string[] | null

Document validation methods supported by this service. This property corresponds to the documents_validation_methods_supported server metadata which was added by the third implementer's draft of

supportedDocumentsVerificationMethods

string[] | null

Document verification methods supported by this service. This property corresponds to the documents_verification_methods_supported server metadata which was added by the third implementer's draft of OpenID Connect for Identity Assurance 1.0

supportedElectronicRecords

string[] | null

Electronic record types supported by this service. This property corresponds to the electronic_records_supported server metadata which was added by the third implementer's draft of OpenID Connect for Identity Assurance 1.0

supportedClientRegistrationTypes

enum<string>[] | null

Values for the client_registration_types RP metadata and the client_registration_types_supported OP metadata that are defined in OpenID Connect Federation 1.0.

Available options:

AUTOMATIC,

EXPLICIT

tokenExchangeByIdentifiableClientsOnly

boolean

The flag indicating whether to prohibit unidentifiable clients from making token exchange requests.

tokenExchangeByConfidentialClientsOnly

boolean

The flag indicating whether to prohibit public clients from making token exchange requests.

tokenExchangeByPermittedClientsOnly

boolean

The flag indicating whether to prohibit clients that have no explicit permission from making token exchange requests.

tokenExchangeEncryptedJwtRejected

boolean

The flag indicating whether to reject token exchange requests which use encrypted JWTs as input tokens.

tokenExchangeUnsignedJwtRejected

boolean

The flag indicating whether to reject token exchange requests which use unsigned JWTs as input tokens.

jwtGrantByIdentifiableClientsOnly

boolean

The flag indicating whether to prohibit unidentifiable clients from using the grant type "urn:ietf:params:oauth:grant-type:jwt-bearer".

jwtGrantEncryptedJwtRejected

boolean

The flag indicating whether to reject token requests that use an encrypted JWT as an authorization grant with the grant type "urn:ietf:params:oauth:grant-type:jwt-bearer".

jwtGrantUnsignedJwtRejected

boolean

The flag indicating whether to reject token requests that use an unsigned JWT as an authorization grant with the grant type "urn:ietf:params:oauth:grant-type:jwt-bearer".

dcrDuplicateSoftwareIdBlocked

boolean

The flag indicating whether to block DCR (Dynamic Client Registration) requests whose "software_id" has already been used previously.

trustAnchors

object[] | null

The trust anchors that are referenced when this service resolves trust chains of relying parties.

If this property is empty, client registration fails regardless of whether its type is automatic or explicit. It means that OpenID Connect Federation 1.0 does not work.

Show child attributes

openidDroppedOnRefreshWithoutOfflineAccess

boolean

The flag indicating whether the openid scope should be dropped from scopes list assigned to access token issued when a refresh token grant is used.

idTokenDroppedOnIssueWithoutOpenid

boolean

The flag indicating whether to refrain from issuing an ID token when the openid scope has been removed from the scopes to be granted by the scopes request parameter of the /auth/authorization/issue API.

Flows whose response_type contains id_token, and flows that requested Native SSO, are not affected, because both require an ID token.

supportedDocumentsCheckMethods

string[] | null

Supported document check methods. This property corresponds to the documents_check_methods_supported server metadata which was added by the fourth implementer's draft of OpenID Connect for Identity Assurance 1.0.

rsResponseSigned

boolean

The flag indicating whether this service signs responses from the resource server.

cnonceDuration

integer<int64>

The duration of c_nonce.

dpopNonceRequired

boolean

Whether to require DPoP proof JWTs to include the nonce claim whenever they are presented.

verifiableCredentialsEnabled

boolean

Get the flag indicating whether the feature of Verifiable Credentials for this service is enabled or not.

credentialJwksUri

string | null

The URL at which the JWK Set document of the credential issuer is exposed.

credentialOfferDuration

integer<int64>

The default duration of credential offers in seconds.

dpopNonceDuration

integer<int64>

The duration of nonce values for DPoP proof JWTs in seconds.

preAuthorizedGrantAnonymousAccessSupported

boolean

The flag indicating whether token requests using the pre-authorized code grant flow by unidentifiable clients are allowed.

credentialTransactionDuration

integer<int64>

The duration of transaction ID in seconds that may be issued as a result of a credential request or a batch credential request.

introspectionSignatureKeyId

string | null

The key ID of the key for signing introspection responses.

resourceSignatureKeyId

string | null

The key ID of the key for signing introspection responses.

userPinLength

integer<int32>

The default length of user PINs.

supportedPromptValues

enum<string>[] | null

The supported prompt values.

The prompt that the UI displayed to the end-user must satisfy as the minimum level. This value comes from prompt request parameter.

When the authorization request does not contain prompt request parameter, CONSENT is used as the default value.

See "OpenID Connect Core 1.0, 3.1.2.1. Authentication Request, prompt" for prompt request parameter.

Available options:

NONE,

LOGIN,

CONSENT,

SELECT_ACCOUNT,

CREATE

idTokenReissuable

boolean

The flag indicating whether to enable the feature of ID token reissuance in the refresh token flow.

credentialJwks

string | null

The JWK Set document containing private keys that are used to sign verifiable credentials.

fapiModes

enum<string>[] | null

FAPI modes for this service.

When the value of this property is not null, Authlete always processes requests to this service based on the specified FAPI modes if the FAPI feature is enabled in Authlete and the FAPI profile is supported by this service.

For instance, when this property is set to an array containing FAPI1_ADVANCED only, Authlete always processes requests to this service based on "Financial-grade API Security Profile 1.0 - Part 2: Advanced" if the FAPI feature is enabled in Authlete and the FAPI profile is supported by this service.

Available options:

FAPI1_ADVANCED,

FAPI1_BASELINE,

FAPI2_MESSAGE_SIGNING_AUTH_REQ,

FAPI2_MESSAGE_SIGNING_AUTH_RES,

FAPI2_MESSAGE_SIGNING_INTROSPECTION_RES,

FAPI2_SECURITY

credentialDuration

integer<int64>

The default duration of verifiable credentials in seconds.

credentialIssuerMetadata

object | null

Show child attributes

idTokenAudType

string | null

The type of the aud claim in ID tokens.

nativeSsoSupported

boolean

Flag that enables the OpenID Connect Native SSO for Mobile Apps 1.0 specification (“Native SSO”). When this property is not true, Native SSO specific parameters are ignored or treated as errors. For example:

The device_sso scope has no special meaning (Authlete does not embed the sid claim in ID tokens).
The urn:openid:params:token-type:device-secret token type is treated as unknown and results in an error.

When set to true, the server metadata advertises "native_sso_supported": true. See OpenID Connect Discovery 1.0 and RFC 8414 §2 for background. Native SSO is available in Authlete 3.0 and later.

oid4vciVersion

string | null

Version of the OpenID for Verifiable Credential Issuance (OID4VCI) specification to support.

Accepted values are:

null or "1.0-ID1" → Implementer’s Draft 1.
"1.0" or "1.0-Final" → Final 1.0 specification.

Choose the value that matches the OID4VCI behaviour your service should expose. See the OID4VCI documentation for details.

cimdMetadataPolicyEnabled

boolean

Flag that controls whether the CIMD metadata policy is applied to client metadata obtained through the Client ID Metadata Document (CIMD) mechanism.

clientIdMetadataDocumentSupported

boolean

Indicates whether the Client ID Metadata Document (CIMD) mechanism is supported. When true, the service will attempt to retrieve client metadata via CIMD where applicable.

cimdAllowlistEnabled

boolean

Enables the allowlist for CIMD. When true, only CIMD endpoints that are on the allowlist are used.

cimdAllowlist

string[] | null

The allowlist of CIMD endpoints (hosts/URIs) that may be used when retrieving client metadata via Client ID Metadata Documents.

cimdAlwaysRetrieved

boolean

If true, CIMD retrieval is always attempted for clients, regardless of other conditions.

cimdHttpPermitted

boolean

Allows CIMD retrieval over plain HTTP. When false, only HTTPS CIMD endpoints are allowed.

cimdQueryPermitted

boolean

Allows the use of query parameters when retrieving CIMD metadata. When false, query parameters are disallowed for CIMD requests.

cimdMetadataPolicy

string | null

The metadata policy applied to client metadata obtained through the CIMD mechanism. The value must follow the metadata policy grammar defined in OpenID Federation 1.0 §6.1 Metadata Policy.

httpAliasProhibited

boolean

When true, client ID aliases starting with https:// or http:// are prohibited.

attestationChallengeTimeWindow

integer<int64>

The time window of attestation challenges in seconds. This is used for OAuth 2.0 Attestation-Based Client Authentication.

clientAttesterRootsEnabled

boolean

The flag indicating whether the attester roots for Client Attestation JWT x5c chain validation are enabled.

clientAttesterRootsOnly

boolean

The flag indicating whether only client authentication validated via attester roots is accepted.

keyAttesterRootsEnabled

boolean

The flag indicating whether the attester roots for Key Attestation JWT x5c chain validation are enabled.

keyAttesterRootsOnly

boolean

The flag indicating whether only key attestation validated via attester roots is accepted.

clientAttesterRoots

string[] | null

The trusted root certificates (PEM-encoded X.509) for validating the x5c chain in Client Attestation JWTs.

keyAttesterRoots

string[] | null

The trusted root certificates (PEM-encoded X.509) for validating the x5c chain in Key Attestation JWTs.

backchannelLogoutSupported

boolean

The flag indicating whether this service supports OpenID Connect Back-Channel Logout 1.0.

backchannelLogoutSessionSupported

boolean

The flag indicating whether this service includes a sid (session ID) claim in ID tokens, supporting per-session backchannel logout.

haipVersion

string | null

The HAIP version to comply with. Valid values for this property are as follows: "1.0". If this property is set, requests to this service undergo additional validation based on the specified version of the HAIP specification.