PediID Discovery

GET PediID's OpenID provider metadata

GET /id/.well-known/openid-configuration

What an integrator's off-the-shelf client library reads to configure itself. Public, like the key set, because a client has no credential before it has read this. Three fields are narrower than an OpenID provider usually advertises, and each narrowing is deliberate. requirePushedAuthorizationRequests is true: a request must be pushed back-channel before a person is ever shown it, so parameters cannot be tampered with in a redirect. codeChallengeMethodsSupported lists S256 and not plain, because plain transmits the verifier itself and protects nothing. subjectTypesSupported is pairwise only - there is no public subject type, because a public subject identifier is the cross-integrator correlation key this design exists to withhold.

Headers

Example

Response: DiscoveryDocumentResponse

curl -X GET "https://api.bridgemoni.com/id/.well-known/openid-configuration" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "issuer": "string",
  "jwks_uri": "string",
  "pushed_authorization_request_endpoint": "string",
  "token_endpoint": "string",
  "id_token_signing_alg_values_supported": [
    "string"
  ],
  "code_challenge_methods_supported": [
    "string"
  ],
  "require_pushed_authorization_requests": true,
  "subject_types_supported": [
    "string"
  ],
  "grant_types_supported": [
    "string"
  ],
  "response_types_supported": [
    "string"
  ]
}

Responses