<!-- Generated by `just docs` from catalog/toolkits/ory_hydra.yaml, catalog/expansions/ory_hydra.yaml, catalog/evals/scorecard.json. Edit the source, not this file. -->

# Ory Hydra

OAuth and OpenID Connect server. Manage client apps and their secrets, accept or reject login and consent requests, and rotate keys.

| Property | Value |
| --- | --- |
| Slug | `ory_hydra` |
| Definition version | `0.1.0` |
| Base URL | `https://{{account.project_slug}}.projects.oryapis.com` |
| Auth schemes | `api_key` |
| Action tools | 36 |
| By class | 17 read, 18 write, 1 destructive |
| Triggers | 0 |
| Provider rate limit | not declared, so outbound calls are unpaced |

## Measured routing accuracy

62 golden cases replayed through the router over the whole index: measured over corpus `ea4f12ad2948` (65 toolkits, 2283 tools indexed and 13 declared uncallable), 36 cases written by hand and 26 cases from the paraphrase pass. A case counts as top-1 when its gold tool ranked first and top-8 when it reached the slate at all.

| Measure | Cases | Share |
| --- | --- | --- |
| top-1 | 35/62 | 56.5% |
| top-8 | 58/62 | 93.5% |

The sweep is offline: the reranker is a deterministic identity fake that returns candidates in the order retrieval produced them, so top-1 measures retrieval order rather than a reranked slate. `just eval-live` measures the same cases through the live reranker.

## Authentication

Connect an entity with `ConnectionsService.InitiateConnection`, naming this toolkit's slug. Credentials stay in the connections vault; callers hold connected-account ids only.

### `api_key`

| Property | Value |
| --- | --- |
| Placement | `header` |
| Name | `Authorization` |
| Rendered as | `Bearer {key}` |

Submit the key with `ConnectionsService` rather than putting it in a request; it is sealed at rest and never returned.

## Tools

36 action tools. The catalog-wide slug is `ory_hydra.<tool>`, which is what `search_tools` returns and `call_tool` takes.

### `ory_hydra.discover_json_web_keys`

Discover Well-Known JSON Web Keys. This endpoint returns JSON Web Keys required to verifying OpenID Connect ID Tokens and, if enabled, OAuth 2.0 JWT Access Tokens. Calls GET /.well-known/jwks.json.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /.well-known/jwks.json`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `keys` | array of object | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |
| `keys[].alg` | string | The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry... |
| `keys[].crv` | string |  |
| `keys[].d` | string |  |
| `keys[].dp` | string |  |
| `keys[].dq` | string |  |
| `keys[].e` | string |  |
| `keys[].k` | string |  |
| `keys[].kid` | string | The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is... |
| `keys[].kty` | string | The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types"... |
| `keys[].n` | string |  |
| `keys[].p` | string |  |
| `keys[].q` | string |  |
| `keys[].qi` | string |  |
| `keys[].use` | string | Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data... |
| `keys[].x` | string |  |
| `keys[].x5c` | array | The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each... |
| `keys[].y` | string |  |

Also retrieved by: "public keys for verifying id tokens", "the jwks endpoint clients read", "what signatures should be checked against".

### `ory_hydra.discover_oidc_configuration`

OpenID Connect Discovery. A mechanism for an OpenID Connect Relying Party to discover the End-User's OpenID Provider and obtain information needed to interact with it, including its OAuth 2.0 endpoint locations. Calls GET /.well-known/openid-configuration.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /.well-known/openid-configuration`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `authorization_endpoint` | string | OAuth 2.0 Authorization Endpoint URL |
| `backchannel_logout_session_supported` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the OP can pass a sid (session ID) Claim in the Logout Token to identify the RP session with the OP. If supported... |
| `backchannel_logout_supported` | boolean | OpenID Connect Back-Channel Logout Supported Boolean value specifying whether the OP supports back-channel logout, with true indicating support. |
| `claims_parameter_supported` | boolean | OpenID Connect Claims Parameter Parameter Supported Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. |
| `claims_supported` | array of string | OpenID Connect Supported Claims JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this... |
| `code_challenge_methods_supported` | array of string | OAuth 2.0 PKCE Supported Code Challenge Methods JSON array containing a list of Proof Key for Code Exchange (PKCE) [RFC7636] code challenge methods supported by this authorization server. |
| `credentials_endpoint_draft_00` | string | OpenID Connect Verifiable Credentials Endpoint Contains the URL of the Verifiable Credentials Endpoint. |
| `credentials_supported_draft_00` | array of object | OpenID Connect Verifiable Credentials Supported JSON array containing a list of the Verifiable Credentials supported by this authorization server. |
| `credentials_supported_draft_00[].cryptographic_binding_methods_supported` | array | OpenID Connect Verifiable Credentials Cryptographic Binding Methods Supported Contains a list of cryptographic binding methods supported for signing the proof. |
| `credentials_supported_draft_00[].cryptographic_suites_supported` | array | OpenID Connect Verifiable Credentials Cryptographic Suites Supported Contains a list of cryptographic suites methods supported for signing the proof. |
| `credentials_supported_draft_00[].format` | string | OpenID Connect Verifiable Credentials Format Contains the format that is supported by this authorization server. |
| `credentials_supported_draft_00[].types` | array | OpenID Connect Verifiable Credentials Types Contains the types of verifiable credentials supported. |
| `device_authorization_endpoint` | string | OAuth 2.0 Device Authorization Endpoint URL |
| `end_session_endpoint` | string | OpenID Connect End-Session Endpoint URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP. |
| `frontchannel_logout_session_supported` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the OP can pass iss (issuer) and sid (session ID) query parameters to identify the RP session with the OP when... |
| `frontchannel_logout_supported` | boolean | OpenID Connect Front-Channel Logout Supported Boolean value specifying whether the OP supports HTTP-based logout, with true indicating support. |
| `grant_types_supported` | array of string | OAuth 2.0 Supported Grant Types JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports. |
| `id_token_signed_response_alg` | array of string | OpenID Connect Default ID Token Signing Algorithms Algorithm used to sign OpenID Connect ID Tokens. |
| `id_token_signing_alg_values_supported` | array of string | OpenID Connect Supported ID Token Signing Algorithms JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. |
| `issuer` | string | OpenID Connect Issuer URL An URL using the https scheme with no query or fragment component that the OP asserts as its IssuerURL Identifier. If IssuerURL discovery is supported , this value MUST be... |
| `jwks_uri` | string | OpenID Connect Well-Known JSON Web Keys URL URL of the OP's JSON Web Key Set [JWK] document. This contains the signing key(s) the RP uses to validate signatures from the OP. The JWK Set MAY also... |
| `registration_endpoint` | string | OpenID Connect Dynamic Client Registration Endpoint URL |
| `request_object_signing_alg_values_supported` | array of string | OpenID Connect Supported Request Object Signing Algorithms JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in... |
| `request_parameter_supported` | boolean | OpenID Connect Request Parameter Supported Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. |
| `request_uri_parameter_supported` | boolean | OpenID Connect Request URI Parameter Supported Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. |
| `require_request_uri_registration` | boolean | OpenID Connect Requires Request URI Registration Boolean value specifying whether the OP requires any request_uri values used to be pre-registered using the request_uris registration parameter. |
| `response_modes_supported` | array of string | OAuth 2.0 Supported Response Modes JSON array containing a list of the OAuth 2.0 response_mode values that this OP supports. |
| `response_types_supported` | array of string | OAuth 2.0 Supported Response Types JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token... |
| `revocation_endpoint` | string | OAuth 2.0 Token Revocation URL URL of the authorization server's OAuth 2.0 revocation endpoint. |

Also retrieved by: "the well-known openid metadata", "endpoint urls a relying party needs", "what does this provider support".

### `ory_hydra.list_o_auth2_clients`

List the OAuth2 client applications registered with Ory Hydra: every app or service that can request tokens and sign users in through this identity server. Calls GET /admin/clients.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/clients`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `client_name` | string | no | The name of the clients to filter by. |
| `owner` | string | no | The owner of the clients to filter by. |
| `page_size` | integer (int64) | no | Items per Page This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). Defaults to 250. |
| `page_token` | string | no | Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). |

Also retrieved by: "show every registered application", "which apps can request tokens here", "list the services signed up with this server".

### `ory_hydra.create_o_auth2_client`

Register a new OAuth2 client application in Ory Hydra: onboard an app or service so it can run the login and token flow, with its redirect URIs, grant types, and scopes. Calls POST /admin/clients.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /admin/clients`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `access_token_strategy` | string | no | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | no | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | no | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | no | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | no | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | no | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | no | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | no | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | no | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | no | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | no | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | no | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | no | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | no | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | no | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | no | JSON Web Key Set |
| `jwks.keys` | array | no | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | JSON Web Key Set |
| `jwks.keys` | array | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Also retrieved by: "register a new application", "onboard an app that can log users in", "add a service to the identity server".

### `ory_hydra.get_o_auth2_client`

Get one registered OAuth2 client application from Ory Hydra by its id: the configuration of a single app, its redirect URIs, grants, and scopes. Calls GET /admin/clients/{id}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/clients/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | The id of the OAuth 2.0 Client. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | JSON Web Key Set |
| `jwks.keys` | array | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Also retrieved by: "pull up one application by its id", "show a single registered app's config", "fetch the details of an app".

### `ory_hydra.set_o_auth2_client`

Set OAuth 2.0 Client. Replaces an existing OAuth 2.0 Client with the payload you send. Calls PUT /admin/clients/{id}.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/clients/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `access_token_strategy` | string | no | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | no | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | no | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | no | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | no | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | no | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | no | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | no | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | no | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | no | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | no | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | no | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | no | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | no | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | no | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `id` | string | **yes** | OAuth 2.0 Client ID |
| `implicit_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | no | JSON Web Key Set |
| `jwks.keys` | array | no | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | JSON Web Key Set |
| `jwks.keys` | array | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Also retrieved by: "overwrite an application's registration", "replace redirect uris and grant types", "put a full client record in place".

### `ory_hydra.set_o_auth2_client_lifespans`

Set OAuth2 Client Token Lifespans. Set lifespans of different token types issued for this OAuth 2.0 client. Calls PUT /admin/clients/{id}/lifespans.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/clients/{{params.id}}/lifespans`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `authorization_code_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_credentials_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `id` | string | **yes** | OAuth 2.0 Client ID |
| `implicit_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwt_bearer_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `refresh_token_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `refresh_token_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `refresh_token_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | JSON Web Key Set |
| `jwks.keys` | array | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Also retrieved by: "how long an app's tokens stay valid", "set access and refresh expiry per client", "override default ttls for one application".

### `ory_hydra.rotate_o_auth2_client_secret`

Rotate an OAuth2 client application's secret in Ory Hydra: issue a fresh password or credential for an app and retire the old one. Calls POST /admin/clients/{id}/secrets/rotate.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /admin/clients/{{params.id}}/secrets/rotate`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | OAuth 2.0 Client ID |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | JSON Web Key Set |
| `jwks.keys` | array | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Also retrieved by: "issue a fresh password for an app", "cycle an application's credential", "replace an app's signing secret".

### `ory_hydra.delete_rotated_o_auth2_client_secrets`

Delete Rotated OAuth 2.0 Client Secrets. Removes all rotated secrets from an OAuth 2.0 client. Calls DELETE /admin/clients/{id}/secrets/rotate.

Class `destructive` (held by the mutation gate until the call's own arguments carry `"confirm": true`). No scopes beyond the connection's defaults. Calls `DELETE /admin/clients/{{params.id}}/secrets/rotate`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | OAuth 2.0 Client ID |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | JSON Web Key Set |
| `jwks.keys` | array | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Also retrieved by: "purge old secrets after rotation", "drop the previous client passwords", "clean up superseded credentials on an app".

### `ory_hydra.get_json_web_key_set`

Get a JSON Web Key Set (JWKS) from Ory Hydra: the public signing keys and certificate material used to verify tokens, fetched by set name. Calls GET /admin/keys/{set}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/keys/{{params.set}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `set` | string | **yes** | JSON Web Key Set ID |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `keys` | array of object | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |
| `keys[].alg` | string | The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry... |
| `keys[].crv` | string |  |
| `keys[].d` | string |  |
| `keys[].dp` | string |  |
| `keys[].dq` | string |  |
| `keys[].e` | string |  |
| `keys[].k` | string |  |
| `keys[].kid` | string | The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is... |
| `keys[].kty` | string | The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types"... |
| `keys[].n` | string |  |
| `keys[].p` | string |  |
| `keys[].q` | string |  |
| `keys[].qi` | string |  |
| `keys[].use` | string | Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data... |
| `keys[].x` | string |  |
| `keys[].x5c` | array | The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each... |
| `keys[].y` | string |  |

Also retrieved by: "fetch the public signing keys", "get the jwks for verifying tokens", "the certificate material for a key set".

### `ory_hydra.create_json_web_key_set`

Create JSON Web Key. This endpoint is capable of generating JSON Web Key Sets for you. Calls POST /admin/keys/{set}.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /admin/keys/{{params.set}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `alg` | string | **yes** | JSON Web Key Algorithm The algorithm to be used for creating the key. Supports `RS256`, `ES256`, `ES512`, `HS512`, and `HS256`. |
| `kid` | string | **yes** | JSON Web Key ID The Key ID of the key to be created. |
| `set` | string | **yes** | The JSON Web Key Set ID |
| `use` | string | **yes** | JSON Web Key Use The "use" (public key use) parameter identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `keys` | array of object | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |
| `keys[].alg` | string | The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry... |
| `keys[].crv` | string |  |
| `keys[].d` | string |  |
| `keys[].dp` | string |  |
| `keys[].dq` | string |  |
| `keys[].e` | string |  |
| `keys[].k` | string |  |
| `keys[].kid` | string | The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is... |
| `keys[].kty` | string | The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types"... |
| `keys[].n` | string |  |
| `keys[].p` | string |  |
| `keys[].q` | string |  |
| `keys[].qi` | string |  |
| `keys[].use` | string | Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data... |
| `keys[].x` | string |  |
| `keys[].x5c` | array | The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each... |
| `keys[].y` | string |  |

Also retrieved by: "generate a signing keypair", "have the server mint jwks for a set", "make new keys for token signatures".

### `ory_hydra.set_json_web_key_set`

Update a JSON Web Key Set. Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own. Calls PUT /admin/keys/{set}.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/keys/{{params.set}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `keys` | array of object | no | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |
| `keys[].alg` | string | **yes** | The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry... |
| `keys[].crv` | string | no |  |
| `keys[].d` | string | no |  |
| `keys[].dp` | string | no |  |
| `keys[].dq` | string | no |  |
| `keys[].e` | string | no |  |
| `keys[].k` | string | no |  |
| `keys[].kid` | string | **yes** | The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is... |
| `keys[].kty` | string | **yes** | The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types"... |
| `keys[].n` | string | no |  |
| `keys[].p` | string | no |  |
| `keys[].q` | string | no |  |
| `keys[].qi` | string | no |  |
| `keys[].use` | string | **yes** | Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data... |
| `keys[].x` | string | no |  |
| `keys[].x5c` | array | no | The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each... |
| `keys[].y` | string | no |  |
| `set` | string | **yes** | The JSON Web Key Set ID |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `keys` | array of object | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |
| `keys[].alg` | string | The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry... |
| `keys[].crv` | string |  |
| `keys[].d` | string |  |
| `keys[].dp` | string |  |
| `keys[].dq` | string |  |
| `keys[].e` | string |  |
| `keys[].k` | string |  |
| `keys[].kid` | string | The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is... |
| `keys[].kty` | string | The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types"... |
| `keys[].n` | string |  |
| `keys[].p` | string |  |
| `keys[].q` | string |  |
| `keys[].qi` | string |  |
| `keys[].use` | string | Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data... |
| `keys[].x` | string |  |
| `keys[].x5c` | array | The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each... |
| `keys[].y` | string |  |

Also retrieved by: "upload a whole key set of your own", "replace every jwk under one name", "store keys instead of generating them".

### `ory_hydra.get_json_web_key`

Get JSON Web Key. This endpoint returns a singular JSON Web Key contained in a set. Calls GET /admin/keys/{set}/{kid}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/keys/{{params.set}}/{{params.kid}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `kid` | string | **yes** | JSON Web Key ID |
| `set` | string | **yes** | JSON Web Key Set ID |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `keys` | array of object | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |
| `keys[].alg` | string | The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry... |
| `keys[].crv` | string |  |
| `keys[].d` | string |  |
| `keys[].dp` | string |  |
| `keys[].dq` | string |  |
| `keys[].e` | string |  |
| `keys[].k` | string |  |
| `keys[].kid` | string | The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is... |
| `keys[].kty` | string | The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types"... |
| `keys[].n` | string |  |
| `keys[].p` | string |  |
| `keys[].q` | string |  |
| `keys[].qi` | string |  |
| `keys[].use` | string | Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data... |
| `keys[].x` | string |  |
| `keys[].x5c` | array | The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each... |
| `keys[].y` | string |  |

Also retrieved by: "one signing key out of a set", "read a single jwk by its id", "details of a particular public key".

### `ory_hydra.set_json_web_key`

Set JSON Web Key. Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own. Calls PUT /admin/keys/{set}/{kid}.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/keys/{{params.set}}/{{params.kid}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `alg` | string | **yes** | The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry... |
| `body_kid` | string | **yes** | The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is... |
| `crv` | string | no |  |
| `d` | string | no |  |
| `dp` | string | no |  |
| `dq` | string | no |  |
| `e` | string | no |  |
| `k` | string | no |  |
| `kid` | string | **yes** | JSON Web Key ID |
| `kty` | string | **yes** | The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types"... |
| `n` | string | no |  |
| `p` | string | no |  |
| `q` | string | no |  |
| `qi` | string | no |  |
| `set` | string | **yes** | The JSON Web Key Set ID |
| `use` | string | **yes** | Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data... |
| `x` | string | no |  |
| `x5c` | array of string | no | The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each... |
| `y` | string | no |  |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `alg` | string | The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry... |
| `crv` | string |  |
| `d` | string |  |
| `dp` | string |  |
| `dq` | string |  |
| `e` | string |  |
| `k` | string |  |
| `kid` | string | The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is... |
| `kty` | string | The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types"... |
| `n` | string |  |
| `p` | string |  |
| `q` | string |  |
| `qi` | string |  |
| `use` | string | Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data... |
| `x` | string |  |
| `x5c` | array of string | The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each... |
| `y` | string |  |

Also retrieved by: "store a keypair you generated yourself", "upload one jwk into a set", "replace a single public key".

### `ory_hydra.get_o_auth2_consent_request`

Get a pending OAuth2 consent request from Ory Hydra: the permission prompt an app is asking a user to approve during login, so your UI can show what access is being granted. Calls GET /admin/oauth2/auth/requests/consent.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/oauth2/auth/requests/consent`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `consent_challenge` | string | **yes** | OAuth 2.0 Consent Request Challenge |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `acr` | string | ACR represents the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it to express that, for example, a user authenticated using two factor... |
| `amr` | array of string | AMR is the Authentication Methods References value for this authentication session. You can use it to specify the method a user used to authenticate. For example, if the acr indicates a user used two... |
| `challenge` | string | Challenge is used to retrieve/accept/deny the consent request. |
| `client` | object | OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. |
| `client.access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `client.allowed_cors_origins` | array | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `client.audience` | array | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `client.authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `client.backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client.client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client.client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client.client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client.client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client.client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `client.contacts` | array | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `client.created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `client.device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `client.frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `client.grant_types` | array | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `client.implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.jwks` | object | JSON Web Key Set |
| `consent_request_id` | string | ConsentRequestID is the ID of the consent request. |
| `context` | object |  |
| `login_challenge` | string | LoginChallenge is the login challenge this consent challenge belongs to. It can be used to associate a login and consent request in the login & consent app. |
| `login_session_id` | string | LoginSessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication... |
| `oidc_context` | object |  |
| `oidc_context.acr_values` | array | ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request. It is a parameter defined by OpenID Connect and expresses which level of... |
| `oidc_context.display` | string | Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. The defined values are: page: The Authorization... |
| `oidc_context.id_token_hint_claims` | object | IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. |
| `oidc_context.login_hint` | string | LoginHint hints about the login identifier the End-User might use to log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier)... |
| `oidc_context.ui_locales` | array | UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance... |
| `request_url` | string | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is... |
| `requested_access_token_audience` | array of string | RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client. |
| `requested_scope` | array of string | RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client. |
| `skip` | boolean | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you must not ask the user to grant the requested scopes. You must however either allow or... |
| `subject` | string | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. |

Also retrieved by: "what permission prompt is the app asking", "look up a pending approval during login", "show what access is being requested".

### `ory_hydra.accept_o_auth2_consent_request`

Approve an OAuth2 consent request in Ory Hydra: tell the server the user granted the permission prompt and which scopes to allow, completing the authorization. Calls PUT /admin/oauth2/auth/requests/consent/accept.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/oauth2/auth/requests/consent/accept`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `consent_challenge` | string | **yes** | OAuth 2.0 Consent Request Challenge |
| `context` | object | no |  |
| `grant_access_token_audience` | array of string | no | GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`. |
| `grant_scope` | array of string | no | GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`. |
| `remember` | boolean | no | Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope. |
| `remember_for` | integer (int64) | no | RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the authorization will be remembered indefinitely. |
| `session` | object | no |  |
| `session.access_token` | object | no | AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0... |
| `session.id_token` | object | no | IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session'id payloads are readable by anyone that has access to the ID Challenge. Use with care! |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `redirect_to` | string | RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed. |

Also retrieved by: "approve the permission prompt for the user", "grant the access the app asked for", "allow the requested scopes".

### `ory_hydra.reject_o_auth2_consent_request`

Reject an OAuth2 consent request in Ory Hydra: tell the server the user denied the permission prompt, so the app is refused the access it asked for. Calls PUT /admin/oauth2/auth/requests/consent/reject.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/oauth2/auth/requests/consent/reject`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `consent_challenge` | string | **yes** | OAuth 2.0 Consent Request Challenge |
| `error` | string | no | The error should follow the OAuth2 error format (e.g. `invalid_request`, `login_required`). Defaults to `request_denied`. |
| `error_debug` | string | no | Debug contains information to help resolve the problem as a developer. Usually not exposed to the public but only in the server logs. |
| `error_description` | string | no | Description of the error in a human readable format. |
| `error_hint` | string | no | Hint to help resolve the error. |
| `status_code` | integer (int64) | no | Represents the HTTP status code of the error (e.g. 401 or 403) Defaults to 400 |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `redirect_to` | string | RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed. |

Also retrieved by: "deny the permission prompt", "refuse the access the app wanted", "turn down the requested scopes".

### `ory_hydra.accept_user_code_request`

Accepts a device grant user_code request. Calls PUT /admin/oauth2/auth/requests/device/accept.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/oauth2/auth/requests/device/accept`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `device_challenge` | string | **yes** |  |
| `user_code` | string | no |  |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `redirect_to` | string | RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed. |

Also retrieved by: "approve a device code the user typed", "confirm the tv or cli pairing step", "let a device grant proceed".

### `ory_hydra.get_o_auth2_login_request`

Get a pending OAuth2 login request from Ory Hydra: the sign-in challenge an app started, so your login page knows who is authenticating and for which app. Calls GET /admin/oauth2/auth/requests/login.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/oauth2/auth/requests/login`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `login_challenge` | string | **yes** | OAuth 2.0 Login Request Challenge |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `challenge` | string | ID is the identifier of the login request. |
| `client` | object | OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. |
| `client.access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `client.allowed_cors_origins` | array | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `client.audience` | array | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `client.authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `client.backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client.client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client.client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client.client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client.client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client.client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `client.contacts` | array | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `client.created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `client.device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `client.frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `client.grant_types` | array | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `client.implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.jwks` | object | JSON Web Key Set |
| `oidc_context` | object |  |
| `oidc_context.acr_values` | array | ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request. It is a parameter defined by OpenID Connect and expresses which level of... |
| `oidc_context.display` | string | Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. The defined values are: page: The Authorization... |
| `oidc_context.id_token_hint_claims` | object | IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. |
| `oidc_context.login_hint` | string | LoginHint hints about the login identifier the End-User might use to log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier)... |
| `oidc_context.ui_locales` | array | UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance... |
| `request_url` | string | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is... |
| `requested_access_token_audience` | array of string | RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client. |
| `requested_scope` | array of string | RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client. |
| `session_id` | string | SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication... |
| `skip` | boolean | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to... |
| `subject` | string | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST... |

Also retrieved by: "look up a pending sign-in challenge", "who is authenticating for this app", "fetch the login flow an app started".

### `ory_hydra.accept_o_auth2_login_request`

Accept an OAuth2 login request in Ory Hydra: tell the server the user authenticated successfully and who they are, completing the sign-in challenge. Calls PUT /admin/oauth2/auth/requests/login/accept.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/oauth2/auth/requests/login/accept`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `acr` | string | no | ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it to express that, for example, a user authenticated using two-factor... |
| `amr` | array of string | no | AMR sets the Authentication Methods References value for this authentication session. You can use it to specify the method a user used to authenticate. For example, if the acr indicates a user used... |
| `context` | object | no |  |
| `extend_session_lifespan` | boolean | no | Extend OAuth2 authentication session lifespan If set to `true`, the OAuth2 authentication cookie lifespan is extended. This is for example useful if you want the user to be able to use `prompt=none`... |
| `force_subject_identifier` | string | no | ForceSubjectIdentifier forces the "pairwise" user ID of the end-user that authenticated. The "pairwise" user ID refers to the (Pairwise Identifier... |
| `identity_provider_session_id` | string | no | IdentityProviderSessionID is the session ID of the end-user that authenticated. If specified, we will use this value to propagate the logout. |
| `login_challenge` | string | **yes** | OAuth 2.0 Login Request Challenge |
| `remember` | boolean | no | Remember, if set to true, tells Ory Hydra to remember this user by telling the user agent (browser) to store a cookie with authentication data. If the same user performs another OAuth 2.0... |
| `remember_for` | integer (int64) | no | RememberFor sets how long the authentication should be remembered for in seconds. If set to `0`, the authorization will be remembered for the duration of the browser session (using a session cookie). |
| `subject` | string | **yes** | Subject is the user ID of the end-user that authenticated. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `redirect_to` | string | RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed. |

Also retrieved by: "the user signed in successfully", "complete the authentication challenge", "confirm who the person is to the server".

### `ory_hydra.reject_o_auth2_login_request`

Reject OAuth 2.0 Login Request. When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service about it. Calls PUT /admin/oauth2/auth/requests/login/reject.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/oauth2/auth/requests/login/reject`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `error` | string | no | The error should follow the OAuth2 error format (e.g. `invalid_request`, `login_required`). Defaults to `request_denied`. |
| `error_debug` | string | no | Debug contains information to help resolve the problem as a developer. Usually not exposed to the public but only in the server logs. |
| `error_description` | string | no | Description of the error in a human readable format. |
| `error_hint` | string | no | Hint to help resolve the error. |
| `login_challenge` | string | **yes** | OAuth 2.0 Login Request Challenge |
| `status_code` | integer (int64) | no | Represents the HTTP status code of the error (e.g. 401 or 403) Defaults to 400 |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `redirect_to` | string | RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed. |

Also retrieved by: "deny an authentication attempt", "tell hydra the subject failed to sign in", "refuse a pending login challenge".

### `ory_hydra.get_o_auth2_logout_request`

Get OAuth 2.0 Session Logout Request. Use this endpoint to fetch an Ory OAuth 2.0 logout request. Calls GET /admin/oauth2/auth/requests/logout.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/oauth2/auth/requests/logout`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `logout_challenge` | string | **yes** |  |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `challenge` | string | Challenge is used to retrieve/accept/deny the logout request. |
| `client` | object | OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. |
| `client.access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `client.allowed_cors_origins` | array | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `client.audience` | array | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `client.authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `client.backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client.client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client.client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client.client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client.client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client.client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `client.contacts` | array | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `client.created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `client.device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `client.frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `client.grant_types` | array | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `client.implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client.jwks` | object | JSON Web Key Set |
| `expires_at` | string (date-time) |  |
| `request_url` | string | RequestURL is the original Logout URL requested. |
| `requested_at` | string (date-time) |  |
| `rp_initiated` | boolean | RPInitiated is set to true if the request was initiated by a Relying Party (RP), also known as an OAuth 2.0 Client. |
| `sid` | string | SessionID is the login session ID that was requested to log out. |
| `subject` | string | Subject is the user for whom the logout was requested. |

Also retrieved by: "details of a pending sign-out", "what subject is being logged out", "read the logout challenge".

### `ory_hydra.accept_o_auth2_logout_request`

Accept OAuth 2.0 Session Logout Request. When a user or an application requests Ory OAuth 2.0 to remove the session state of a subject, this endpoint is used to confirm that logout request. Calls PUT /admin/oauth2/auth/requests/logout/accept.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/oauth2/auth/requests/logout/accept`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `logout_challenge` | string | **yes** | OAuth 2.0 Logout Request Challenge |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `redirect_to` | string | RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed. |

Also retrieved by: "confirm a single sign-out", "approve ending the subject's session", "tell hydra the user agreed to log out".

### `ory_hydra.list_o_auth2_consent_sessions`

List a user's granted OAuth2 consent sessions in Ory Hydra: the apps a subject has already approved and the access they hold, so you can review or revoke them. Calls GET /admin/oauth2/auth/sessions/consent.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/oauth2/auth/sessions/consent`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `login_session_id` | string | no | The login session id to list the consent sessions for. |
| `page_size` | integer (int64) | no | Items per Page This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). Defaults to 250. |
| `page_token` | string | no | Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). |
| `subject` | string | **yes** | The subject to list the consent sessions for. |

Also retrieved by: "which apps has this user approved", "review a subject's granted access", "what has a person already authorized".

### `ory_hydra.list_trusted_o_auth2_jwt_grant_issuers`

List Trusted OAuth2 JWT Bearer Grant Type Issuers. Use this endpoint to list all trusted JWT Bearer Grant Type Issuers. Calls GET /admin/trust/grants/jwt-bearer/issuers.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/trust/grants/jwt-bearer/issuers`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `issuer` | string | no | If optional "issuer" is supplied, only jwt-bearer grants with this issuer will be returned. |
| `page_size` | integer (int64) | no | Items per Page This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). Defaults to 250. |
| `page_token` | string | no | Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). |

Also retrieved by: "every jwt bearer issuer we trust", "all grant trust relationships", "who may assert tokens on behalf of subjects".

### `ory_hydra.trust_o_auth2_jwt_grant_issuer`

Trust OAuth2 JWT Bearer Grant Type Issuer. Use this endpoint to establish a trust relationship for a JWT issuer to perform JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants [RFC7523](https://datatracker.ietf.org/doc/html/rfc7523). Calls POST /admin/trust/grants/jwt-bearer/issuers.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /admin/trust/grants/jwt-bearer/issuers`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `allow_any_subject` | boolean | no | The "allow_any_subject" indicates that the issuer is allowed to have any principal as the subject of the JWT. |
| `expires_at` | string (date-time) | **yes** | The "expires_at" indicates, when grant will expire, so we will reject assertion from "issuer" targeting "subject". |
| `issuer` | string | **yes** | The "issuer" identifies the principal that issued the JWT assertion (same as "iss" claim in JWT). |
| `jwk` | object | **yes** |  |
| `jwk.alg` | string | **yes** | The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA "JSON Web Signature and Encryption Algorithms" registry... |
| `jwk.crv` | string | no |  |
| `jwk.d` | string | no |  |
| `jwk.dp` | string | no |  |
| `jwk.dq` | string | no |  |
| `jwk.e` | string | no |  |
| `jwk.k` | string | no |  |
| `jwk.kid` | string | **yes** | The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the "kid" value is... |
| `jwk.kty` | string | **yes** | The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". "kty" values should either be registered in the IANA "JSON Web Key Types"... |
| `jwk.n` | string | no |  |
| `jwk.p` | string | no |  |
| `jwk.q` | string | no |  |
| `jwk.qi` | string | no |  |
| `jwk.use` | string | **yes** | Use ("public key use") identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data... |
| `jwk.x` | string | no |  |
| `jwk.x5c` | array | no | The "x5c" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each... |
| `jwk.y` | string | no |  |
| `scope` | array of string | **yes** | The "scope" contains list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) |
| `subject` | string | no | The "subject" identifies the principal that is the subject of the JWT. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `allow_any_subject` | boolean | The "allow_any_subject" indicates that the issuer is allowed to have any principal as the subject of the JWT. |
| `created_at` | string (date-time) | The "created_at" indicates, when grant was created. |
| `expires_at` | string (date-time) | The "expires_at" indicates, when grant will expire, so we will reject assertion from "issuer" targeting "subject". |
| `id` | string |  |
| `issuer` | string | The "issuer" identifies the principal that issued the JWT assertion (same as "iss" claim in JWT). |
| `public_key` | object | OAuth2 JWT Bearer Grant Type Issuer Trusted JSON Web Key |
| `public_key.kid` | string | The "key_id" is key unique identifier (same as kid header in jws/jwt). |
| `public_key.set` | string | The "set" is basically a name for a group(set) of keys. Will be the same as "issuer" in grant. |
| `scope` | array of string | The "scope" contains list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) |
| `subject` | string | The "subject" identifies the principal that is the subject of the JWT. |

Also retrieved by: "let an issuer assert tokens for subjects", "establish a jwt bearer trust relationship", "allow rfc7523 grants from a signer".

### `ory_hydra.get_trusted_o_auth2_jwt_grant_issuer`

Get Trusted OAuth2 JWT Bearer Grant Type Issuer. Use this endpoint to get a trusted JWT Bearer Grant Type Issuer. Calls GET /admin/trust/grants/jwt-bearer/issuers/{id}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/trust/grants/jwt-bearer/issuers/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | The id of the desired grant |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `allow_any_subject` | boolean | The "allow_any_subject" indicates that the issuer is allowed to have any principal as the subject of the JWT. |
| `created_at` | string (date-time) | The "created_at" indicates, when grant was created. |
| `expires_at` | string (date-time) | The "expires_at" indicates, when grant will expire, so we will reject assertion from "issuer" targeting "subject". |
| `id` | string |  |
| `issuer` | string | The "issuer" identifies the principal that issued the JWT assertion (same as "iss" claim in JWT). |
| `public_key` | object | OAuth2 JWT Bearer Grant Type Issuer Trusted JSON Web Key |
| `public_key.kid` | string | The "key_id" is key unique identifier (same as kid header in jws/jwt). |
| `public_key.set` | string | The "set" is basically a name for a group(set) of keys. Will be the same as "issuer" in grant. |
| `scope` | array of string | The "scope" contains list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) |
| `subject` | string | The "subject" identifies the principal that is the subject of the JWT. |

Also retrieved by: "one trusted jwt bearer issuer", "details of a grant trust relationship", "which subjects may an issuer assert".

### `ory_hydra.create_verifiable_credential`

Issues a Verifiable Credential. This endpoint creates a verifiable credential that attests that the user authenticated with the provided access token owns a certain public/private key pair. Calls POST /credentials.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /credentials`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `format` | string | no |  |
| `proof` | object | no |  |
| `proof.jwt` | string | no |  |
| `proof.proof_type` | string | no |  |
| `types` | array of string | no |  |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `credential_draft_00` | string |  |
| `format` | string |  |

Also retrieved by: "issue a credential proving key ownership", "mint a signed attestation for the caller", "hand out a vc tied to an access token".

### `ory_hydra.is_alive`

Check whether the Ory Hydra server is alive: a liveness probe that tells you the auth endpoints are up and responding. Calls GET /health/alive.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /health/alive`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `status` | string | Status always contains "ok". |

Also retrieved by: "are the auth endpoints responding", "liveness check for the server", "is the identity service up".

### `ory_hydra.is_ready`

Check whether the Ory Hydra server is ready: a readiness probe that tells you the auth service can handle requests and reach its database and dependencies. Calls GET /health/ready.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /health/ready`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `status` | string | Always "ok". |

Also retrieved by: "can the service handle requests yet", "readiness check including the database", "is the auth server ready to serve".

### `ory_hydra.o_auth2_device_flow`

Start the OAuth2 device authorization grant in Ory Hydra: begin the pairing flow a TV, console, or CLI uses to sign in on a separate screen. Calls POST /oauth2/device/auth.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /oauth2/device/auth`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `device_code` | string | The device verification code. |
| `expires_in` | integer (int64) | The lifetime in seconds of the "device_code" and "user_code". |
| `interval` | integer (int64) | The minimum amount of time in seconds that the client SHOULD wait between polling requests to the token endpoint. If no value is provided, clients MUST use 5 as the default. |
| `user_code` | string | The end-user verification code. |
| `verification_uri` | string | The end-user verification URI on the authorization server. The URI should be short and easy to remember as end users will be asked to manually type it into their user agent. |
| `verification_uri_complete` | string | A verification URI that includes the "user_code" (or other information with the same function as the "user_code"), which is designed for non-textual transmission. |

Also retrieved by: "begin the tv and console pairing grant", "start sign-in on a separate screen", "the cli device authorization flow".

### `ory_hydra.create_oidc_dynamic_client`

Register OAuth2 Client using OpenID Dynamic Client Registration. This endpoint behaves like the administrative counterpart (`createOAuth2Client`) but is capable of facing the public internet directly and can be used in self-service. Calls POST /oauth2/register.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /oauth2/register`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `access_token_strategy` | string | no | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | no | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | no | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | no | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | no | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | no | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | no | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | no | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | no | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | no | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | no | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | no | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | no | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | no | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | no | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | no | JSON Web Key Set |
| `jwks.keys` | array | no | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | JSON Web Key Set |
| `jwks.keys` | array | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Also retrieved by: "self-register an application", "let a third party sign itself up for oauth", "public dynamic registration of a relying party".

### `ory_hydra.get_oidc_dynamic_client`

Get OAuth2 Client using OpenID Dynamic Client Registration. This endpoint behaves like the administrative counterpart (`getOAuth2Client`) but is capable of facing the public internet directly and can be used in self-service. Calls GET /oauth2/register/{id}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /oauth2/register/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | The id of the OAuth 2.0 Client. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | JSON Web Key Set |
| `jwks.keys` | array | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Also retrieved by: "read a self-registered application", "what a dynamically registered relying party looks like", "settings of an app that signed itself up".

### `ory_hydra.set_oidc_dynamic_client`

Set OAuth2 Client using OpenID Dynamic Client Registration. This endpoint behaves like the administrative counterpart (`setOAuth2Client`) but is capable of facing the public internet directly to be used by third parties. Calls PUT /oauth2/register/{id}.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /oauth2/register/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `access_token_strategy` | string | no | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | no | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | no | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | no | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | no | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | no | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | no | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | no | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | no | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | no | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | no | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | no | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | no | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | no | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | no | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `id` | string | **yes** | OAuth 2.0 Client ID |
| `implicit_grant_access_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | no | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | no | JSON Web Key Set |
| `jwks.keys` | array | no | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `access_token_strategy` | string | OAuth 2.0 Access Token Strategy AccessTokenStrategy is the strategy used to generate access tokens. Valid options are `jwt` and `opaque`. `jwt` is a bad idea, see... |
| `allowed_cors_origins` | array of string | OAuth 2.0 Client Allowed CORS Origins One or more URLs (scheme://host[:port]) which are allowed to make CORS requests to the /oauth/token endpoint. If this array is empty, the server's CORS origin... |
| `audience` | array of string | OAuth 2.0 Client Audience An allow-list defining the audiences this client is allowed to request tokens for. An audience limits the applicability of an OAuth 2.0 Access Token to, for example, certain... |
| `authorization_code_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `authorization_code_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `backchannel_logout_session_required` | boolean | OpenID Connect Back-Channel Logout Session Required Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the... |
| `backchannel_logout_uri` | string | OpenID Connect Back-Channel Logout URI RP URL that will cause the RP to log itself out when sent a Logout Token by the OP. |
| `client_credentials_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `client_id` | string | OAuth 2.0 Client ID The ID is immutable. If no ID is provided, a UUID4 will be generated. |
| `client_name` | string | OAuth 2.0 Client Name The human-readable name of the client to be presented to the end-user during authorization. |
| `client_secret` | string | OAuth 2.0 Client Secret The secret will be included in the create request as cleartext, and then never again. The secret is kept in hashed format and is not recoverable once lost. |
| `client_secret_expires_at` | integer (int64) | OAuth 2.0 Client Secret Expires At The field is currently not supported and its value is always 0. |
| `client_uri` | string | OAuth 2.0 Client URI ClientURI is a URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |
| `contacts` | array of string | OAuth 2.0 Client Contact An array of strings representing ways to contact people responsible for this client, typically email addresses. |
| `created_at` | string (date-time) | OAuth 2.0 Client Creation Date CreatedAt returns the timestamp of the client's creation. |
| `device_authorization_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `device_authorization_grant_refresh_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `frontchannel_logout_session_required` | boolean | OpenID Connect Front-Channel Logout Session Required Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session... |
| `frontchannel_logout_uri` | string | OpenID Connect Front-Channel Logout URI RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter... |
| `grant_types` | array of string | OAuth 2.0 Client Grant Types An array of OAuth 2.0 grant types the client is allowed to use. Can be one of: Client Credentials Grant: `client_credentials` Authorization Code Grant... |
| `implicit_grant_access_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `implicit_grant_id_token_lifespan` | string | Specify a time duration in milliseconds, seconds, minutes, hours. |
| `jwks` | object | JSON Web Key Set |
| `jwks.keys` | array | List of JSON Web Keys The value of the "keys" parameter is an array of JSON Web Key (JWK) values. By default, the order of the JWK values within the array does not imply an order of preference among... |

Also retrieved by: "overwrite a self-registered application", "replace a dynamically registered relying party", "update an app that signed itself up".

### `ory_hydra.get_oidc_user_info`

Get OpenID Connect UserInfo from Ory Hydra: the profile claims (name, email, subject) for the signed-in person behind an access token. Calls GET /userinfo.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /userinfo`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `birthdate` | string | End-User's birthday, represented as an ISO 8601:2004 [ISO8601‑2004] YYYY-MM-DD format. The year MAY be 0000, indicating that it is omitted. To represent only the year, YYYY format is allowed. Note... |
| `email` | string | End-User's preferred e-mail address. Its value MUST conform to the RFC 5322 [RFC5322] addr-spec syntax. The RP MUST NOT rely upon this value being unique, as discussed in Section 5.7. |
| `email_verified` | boolean | True if the End-User's e-mail address has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this e-mail address was... |
| `family_name` | string | Surname(s) or last name(s) of the End-User. Note that in some cultures, people can have multiple family names or no family name; all can be present, with the names being separated by space characters. |
| `gender` | string | End-User's gender. Values defined by this specification are female and male. Other values MAY be used when neither of the defined values are applicable. |
| `given_name` | string | Given name(s) or first name(s) of the End-User. Note that in some cultures, people can have multiple given names; all can be present, with the names being separated by space characters. |
| `locale` | string | End-User's locale, represented as a BCP47 [RFC5646] language tag. This is typically an ISO 639-1 Alpha-2 [ISO639‑1] language code in lowercase and an ISO 3166-1 Alpha-2 [ISO3166‑1] country code... |
| `middle_name` | string | Middle name(s) of the End-User. Note that in some cultures, people can have multiple middle names; all can be present, with the names being separated by space characters. Also note that in some... |
| `name` | string | End-User's full name in displayable form including all name parts, possibly including titles and suffixes, ordered according to the End-User's locale and preferences. |
| `nickname` | string | Casual name of the End-User that may or may not be the same as the given_name. For instance, a nickname value of Mike might be returned alongside a given_name value of Michael. |
| `phone_number` | string | End-User's preferred telephone number. E.164 [E.164] is RECOMMENDED as the format of this Claim, for example, +1 (425) 555-1212 or +56 (2) 687 2400. If the phone number contains an extension, it is... |
| `phone_number_verified` | boolean | True if the End-User's phone number has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this phone number was controlled by... |
| `picture` | string | URL of the End-User's profile picture. This URL MUST refer to an image file (for example, a PNG, JPEG, or GIF image file), rather than to a Web page containing an image. Note that this URL SHOULD... |
| `preferred_username` | string | Non-unique shorthand name by which the End-User wishes to be referred to at the RP, such as janedoe or j.doe. This value MAY be any valid JSON string including special characters such as @, /, or... |
| `profile` | string | URL of the End-User's profile page. The contents of this Web page SHOULD be about the End-User. |
| `sub` | string | Subject - Identifier for the End-User at the IssuerURL. |
| `updated_at` | integer (int64) | Time the End-User's information was last updated. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time. |
| `website` | string | URL of the End-User's Web page or blog. This Web page SHOULD contain information published by the End-User or an organization that the End-User is affiliated with. |
| `zoneinfo` | string | String from zoneinfo [zoneinfo] time zone database representing the End-User's time zone. For example, Europe/Paris or America/Los_Angeles. |

Also retrieved by: "profile claims for the signed-in person", "name and email behind a token", "who the access token belongs to".

### `ory_hydra.get_version`

Return Running Software Version. This endpoint returns the version of Ory Hydra. Calls GET /version.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /version`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `version` | string | The version of Ory Hydra. |

Also retrieved by: "what release is this server on", "build number of the identity service", "which hydra am i talking to".