Get FAPI and security settings

GET

/api/admin/settings/fapi-security

Code sample: Shell / cURL

curl --request GET \
  --url https://auth.example.com/api/admin/settings/fapi-security \
  --header 'Authorization: Bearer <token>'

Returns FAPI 2.0 security profile settings and supported OIDC ACR values with source metadata.

Authorizations

• adminBearer
• adminSessionCookie

Responses

200

FAPI and OIDC security settings.

Media type application/json

object

settings

object

fapi

object

key

additional properties

object

value

Resolved value for the setting.

source

Configuration source for this value.

string

default

Default value used when no override exists.

description

string

validValues

Array

key

additional properties

oidc

object

key

additional properties

object

value

Resolved value for the setting.

source

Configuration source for this value.

string

default

Default value used when no override exists.

description

string

validValues

Array

key

additional properties

key

additional properties

sources

Setting sources, returned by DELETE after clearing overrides.

object

key

additional properties

note

string

key

additional properties

Example

{
  "settings": {
    "fapi": {
      "enabled": {
        "value": true,
        "source": "kv",
        "default": false,
        "description": "Enable FAPI 2.0 Security Profile mode"
      },
      "strictDPoP": {
        "value": true,
        "source": "kv",
        "default": false,
        "description": "When FAPI is enabled, reject invalid DPoP proofs instead of continuing without binding"
      },
      "allowPublicClients": {
        "value": false,
        "source": "kv",
        "default": false,
        "description": "Allow public clients in FAPI 2.0 mode (not recommended)"
      }
    },
    "oidc": {
      "supportedAcrValues": {
        "value": [
          "urn:mace:incommon:iap:silver"
        ],
        "source": "kv",
        "default": [
          "urn:mace:incommon:iap:bronze"
        ],
        "description": "Supported Authentication Context Class Reference values for ACR negotiation"
      }
    }
  },
  "note": "FAPI 2.0 enforces PAR, PKCE S256, and confidential clients. strictDPoP rejects invalid DPoP proofs when enabled."
}

400

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}