Get token exchange settings

GET

/api/admin/settings/token-exchange

Code sample: Shell / cURL

curl --request GET \
  --url https://auth.example.com/api/admin/settings/token-exchange \
  --header 'Authorization: Bearer <token>'

Returns OAuth token exchange and ID-JAG settings with source metadata. refresh_token is never allowed.

Authorizations

• adminBearer
• adminSessionCookie

Responses

200

Token exchange settings.

Media type application/json

object

settings

object

key

additional properties

object

value

Resolved setting value.

source

Source for the resolved setting.

string

default

Default value.

metadata

Setting metadata and validation constraints.

object

key

additional properties

description

string

min

number

max

number

validOptions

Array

key

additional properties

note

string

idJagNote

string

key

additional properties

Example

{
  "settings": {
    "enabled": {
      "value": true,
      "source": "kv",
      "default": true
    },
    "allowedSubjectTokenTypes": {
      "value": [
        "access_token",
        "id_token"
      ],
      "source": "kv",
      "default": [
        "access_token",
        "id_token"
      ],
      "validOptions": [
        "access_token",
        "id_token",
        "jwt"
      ]
    },
    "maxResourceParams": {
      "value": 10,
      "source": "kv",
      "default": 10,
      "min": 1,
      "max": 100
    },
    "maxAudienceParams": {
      "value": 10,
      "source": "kv",
      "default": 10,
      "min": 1,
      "max": 100
    },
    "idJag": {
      "enabled": {
        "value": false,
        "source": "kv",
        "default": false
      },
      "allowedIssuers": {
        "value": [],
        "source": "default",
        "default": []
      },
      "maxTokenLifetime": {
        "value": 300,
        "source": "default",
        "default": 300,
        "min": 60,
        "max": 3600,
        "unit": "seconds"
      },
      "includeTenantClaim": {
        "value": true,
        "source": "kv",
        "default": true
      },
      "requireConfidentialClient": {
        "value": true,
        "source": "kv",
        "default": true
      }
    }
  },
  "note": "refresh_token is never allowed for security reasons, regardless of settings.",
  "idJagNote": "ID-JAG implements draft-ietf-oauth-identity-assertion-authz-grant for IdP-mediated authorization."
}

400

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}