Skip to content

Commit 4e358c8

Browse files
aeneasraeneasr
committed
docs: bump to 1af78686a6c0115464624eb6f554fdb874407aee
1 parent ceeb96b commit 4e358c8

1 file changed

Lines changed: 57 additions & 11 deletions

File tree

‎docs/reference/api.json‎

Lines changed: 57 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -970,6 +970,10 @@
970970
"pattern": "^([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+$",
971971
"type": "string"
972972
},
973+
"hydra_oauth2_grant_jwt_omit_assertion_audience": {
974+
"description": "Configures whether the audience (`aud`) claim from the assertion JSON Web Token (JWT) in the JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523) is omitted from the resulting access token.\n\nWhen set to `true` (the default for new projects), the audience values from the inbound assertion JWT are not granted in the access token. Set to `false` to copy the assertion audience into the access token (the legacy behavior).\n\nThis governs the \"oauth2.grant.jwt.omit_assertion_audience\" setting.",
975+
"type": "boolean"
976+
},
973977
"hydra_oauth2_grant_refresh_token_rotation_grace_period": {
974978
"description": "Configures the OAuth2 Grant Refresh Token Rotation Grace Period\n\nIf set to `null` or `\"0s\"`, the graceful refresh token rotation is disabled.\n\nThis governs the \"oauth2.grant.refresh_token.rotation_grace_period\" setting.",
975979
"type": "string"
@@ -1457,6 +1461,10 @@
14571461
"description": "Configures the group for the password method in the registration flow.\n\nIf true, it sets the password method group value to \"password\" if it is the only method available. This is the legacy behavior.\nIf false is, it sets the password method group value to \"default\".\n\nThis governs the \"feature_flags.password_profile_registration_node_group\" setting.",
14581462
"type": "boolean"
14591463
},
1464+
"kratos_feature_flags_refresh_login_choose_address": {
1465+
"description": "Render an address picker on the code refresh login screen\n\nIf true, a code-strategy refresh (privileged re-authentication) login renders a \"Send code to \u003caddress\u003e\" button per available code address instead of re-asking for the identifier. The identity is already fixed by the active session, so re-entering the identifier is unnecessary. It is safe to toggle this back and forth.\n\nThis governs the \"feature_flags.refresh_login_choose_address\" setting.",
1466+
"type": "boolean"
1467+
},
14601468
"kratos_feature_flags_use_continue_with_transitions": {
14611469
"description": "Configures the Ory Kratos Session use_continue_with_transitions flag\n\nThis governs the \"feature_flags.use_continue_with_transitions\" setting.",
14621470
"type": "boolean"
@@ -1783,10 +1791,24 @@
17831791
"description": "This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.\n\nThis governs the \"selfservice.methods.code.passwordless_login_fallback_enabled\" setting.",
17841792
"type": "boolean"
17851793
},
1794+
"kratos_selfservice_methods_deviceauthn_config_android_app_ids": {
1795+
"description": "Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.\n\nThis governs the \"selfservice.methods.deviceauthn.config.android_app_ids\" setting.",
1796+
"items": {
1797+
"type": "string"
1798+
},
1799+
"type": "array"
1800+
},
17861801
"kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation": {
17871802
"description": "Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing\n\nOnly allowed on development projects and forced off otherwise. Keys enrolled\nunder relaxation are short-lived and refused once this is turned off.\n\nThis governs the \"selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation\" setting.",
17881803
"type": "boolean"
17891804
},
1805+
"kratos_selfservice_methods_deviceauthn_config_ios_app_ids": {
1806+
"description": "Configures the allow-list of Apple App IDs that a device key may be bound to.\n\nThis governs the \"selfservice.methods.deviceauthn.config.ios_app_ids\" setting.",
1807+
"items": {
1808+
"type": "string"
1809+
},
1810+
"type": "array"
1811+
},
17901812
"kratos_selfservice_methods_deviceauthn_enabled": {
17911813
"description": "Configures whether Ory Kratos Device authentication is enabled\n\nThis governs the \"selfservice.methods.deviceauthn.enabled\" setting.",
17921814
"type": "boolean"
@@ -2205,7 +2227,7 @@
22052227
"$ref": "#/components/schemas/deviceAuthnAttestation"
22062228
},
22072229
"client_key_id": {
2208-
"description": "ClientKeyID is a client-chosen id for the key and is unique per identity.",
2230+
"description": "ClientKeyID is the key's stable, unique-per-identity id, computed as\nhex(SHA-256(PublicKey)) — the lowercase-hex SHA-256 digest of the public\nkey's PKIX, ASN.1 DER (SubjectPublicKeyInfo) encoding, exactly the bytes\nstored in PublicKey. It is a deterministic fingerprint of the enrolled\nsigning key, so the device recomputes the identical value locally instead\nof receiving it from the server. Keys enrolled before the server derived\nthe id keep their original client-chosen value.",
22092231
"type": "string"
22102232
},
22112233
"created_at": {
@@ -2221,7 +2243,7 @@
22212243
"$ref": "#/components/schemas/DeviceType"
22222244
},
22232245
"public_key": {
2224-
"description": "PublicKey is an EC (in v1) public key, used to verify signatures, stored as uncompressed bytes.\nThe private key resides inside the device and does not exist on the server.",
2246+
"description": "PublicKey is the device's public key (EC P-256 in v1), used to verify\nsignatures. It is stored in PKIX, ASN.1 DER form (the SubjectPublicKeyInfo\nencoding produced by x509.MarshalPKIXPublicKey). The private key resides\ninside the device and does not exist on the server.",
22252247
"items": {
22262248
"format": "uint8",
22272249
"type": "integer"
@@ -7360,6 +7382,10 @@
73607382
"pattern": "^([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+$",
73617383
"type": "string"
73627384
},
7385+
"hydra_oauth2_grant_jwt_omit_assertion_audience": {
7386+
"description": "Configures whether the audience (`aud`) claim from the assertion JSON Web Token (JWT) in the JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523) is omitted from the resulting access token.\n\nWhen set to `true` (the default for new projects), the audience values from the inbound assertion JWT are not granted in the access token. Set to `false` to copy the assertion audience into the access token (the legacy behavior).\n\nThis governs the \"oauth2.grant.jwt.omit_assertion_audience\" setting.",
7387+
"type": "boolean"
7388+
},
73637389
"hydra_oauth2_grant_refresh_token_rotation_grace_period": {
73647390
"description": "Configures the OAuth2 Grant Refresh Token Rotation Grace Period\n\nIf set to `null` or `\"0s\"`, the graceful refresh token rotation is disabled.\n\nThis governs the \"oauth2.grant.refresh_token.rotation_grace_period\" setting.",
73657391
"type": "string"
@@ -7847,6 +7873,10 @@
78477873
"description": "Configures the group for the password method in the registration flow.\n\nIf true, it sets the password method group value to \"password\" if it is the only method available. This is the legacy behavior.\nIf false is, it sets the password method group value to \"default\".\n\nThis governs the \"feature_flags.password_profile_registration_node_group\" setting.",
78487874
"type": "boolean"
78497875
},
7876+
"kratos_feature_flags_refresh_login_choose_address": {
7877+
"description": "Render an address picker on the code refresh login screen\n\nIf true, a code-strategy refresh (privileged re-authentication) login renders a \"Send code to \u003caddress\u003e\" button per available code address instead of re-asking for the identifier. The identity is already fixed by the active session, so re-entering the identifier is unnecessary. It is safe to toggle this back and forth.\n\nThis governs the \"feature_flags.refresh_login_choose_address\" setting.",
7878+
"type": "boolean"
7879+
},
78507880
"kratos_feature_flags_use_continue_with_transitions": {
78517881
"description": "Configures the Ory Kratos Session use_continue_with_transitions flag\n\nThis governs the \"feature_flags.use_continue_with_transitions\" setting.",
78527882
"type": "boolean"
@@ -8173,10 +8203,24 @@
81738203
"description": "This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.\n\nThis governs the \"selfservice.methods.code.passwordless_login_fallback_enabled\" setting.",
81748204
"type": "boolean"
81758205
},
8206+
"kratos_selfservice_methods_deviceauthn_config_android_app_ids": {
8207+
"description": "Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.\n\nThis governs the \"selfservice.methods.deviceauthn.config.android_app_ids\" setting.",
8208+
"items": {
8209+
"type": "string"
8210+
},
8211+
"type": "array"
8212+
},
81768213
"kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation": {
81778214
"description": "Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing\n\nOnly allowed on development projects and forced off otherwise. Keys enrolled\nunder relaxation are short-lived and refused once this is turned off.\n\nThis governs the \"selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation\" setting.",
81788215
"type": "boolean"
81798216
},
8217+
"kratos_selfservice_methods_deviceauthn_config_ios_app_ids": {
8218+
"description": "Configures the allow-list of Apple App IDs that a device key may be bound to.\n\nThis governs the \"selfservice.methods.deviceauthn.config.ios_app_ids\" setting.",
8219+
"items": {
8220+
"type": "string"
8221+
},
8222+
"type": "array"
8223+
},
81808224
"kratos_selfservice_methods_deviceauthn_enabled": {
81818225
"description": "Configures whether Ory Kratos Device authentication is enabled\n\nThis governs the \"selfservice.methods.deviceauthn.enabled\" setting.",
81828226
"type": "boolean"
@@ -8679,6 +8723,12 @@
86798723
"type": "string",
86808724
"x-go-enum-desc": "enabled ThirdPartyProviderStateEnabled\ndisabled ThirdPartyProviderStateDisabled"
86818725
},
8726+
"update_identity_on_login": {
8727+
"description": "UpdateIdentityOnLogin controls whether the identity is updated from SAML\nclaims on each login.\n\nPossible values are \"never\" (default) and \"automatic\".\nnever UpdateIdentityOnLoginNever UpdateIdentityOnLoginNever disables identity updates on login (default).\nautomatic UpdateIdentityOnLoginAutomatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically.",
8728+
"enum": ["never", "automatic"],
8729+
"type": "string",
8730+
"x-go-enum-desc": "never UpdateIdentityOnLoginNever UpdateIdentityOnLoginNever disables identity updates on login (default).\nautomatic UpdateIdentityOnLoginAutomatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically."
8731+
},
86828732
"updated_at": {
86838733
"description": "Last Time Project's Revision was Updated",
86848734
"format": "date-time",
@@ -8897,10 +8947,10 @@
88978947
"type": "string"
88988948
},
88998949
"update_identity_on_login": {
8900-
"description": "UpdateIdentityOnLogin controls whether the identity is updated from OIDC\nclaims on each login.\n\nPossible values are \"never\" (default) and \"automatic\".\nnever UpdateIdentityOnLoginNever UpdateIdentityOnLoginNever disables identity updates on login (default).\nautomatic UpdateIdentityOnLoginAutomatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every OIDC login and updates the identity's traits and metadata automatically.",
8950+
"description": "UpdateIdentityOnLogin controls whether the identity is updated from OIDC\nclaims on each login.\n\nPossible values are \"never\" (default) and \"automatic\".\nnever UpdateIdentityOnLoginNever UpdateIdentityOnLoginNever disables identity updates on login (default).\nautomatic UpdateIdentityOnLoginAutomatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically.",
89018951
"enum": ["never", "automatic"],
89028952
"type": "string",
8903-
"x-go-enum-desc": "never UpdateIdentityOnLoginNever UpdateIdentityOnLoginNever disables identity updates on login (default).\nautomatic UpdateIdentityOnLoginAutomatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every OIDC login and updates the identity's traits and metadata automatically."
8953+
"x-go-enum-desc": "never UpdateIdentityOnLoginNever UpdateIdentityOnLoginNever disables identity updates on login (default).\nautomatic UpdateIdentityOnLoginAutomatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically."
89048954
},
89058955
"updated_at": {
89068956
"description": "Last Time Project's Revision was Updated",
@@ -12792,7 +12842,7 @@
1279212842
"description": "No CSRF token since this method may not be used from the browser.",
1279312843
"properties": {
1279412844
"client_key_id": {
12795-
"description": "Login with a DeviceAuthn Security Key.\n\nThis must contain the client ID of the DeviceAuthN key,\na.k.a 'key alias' on Android and 'key id' on iOS.",
12845+
"description": "ClientKeyID identifies the DeviceAuthn key to authenticate with.\n\nIt is the key's deterministic fingerprint — the lowercase-hex SHA-256 of\nthe device public key in PKIX, ASN.1 DER (SubjectPublicKeyInfo) form —\nwhich the device recomputes locally after enrollment. Keys enrolled before\nthe server derived the id use their original client-chosen value.",
1279612846
"type": "string"
1279712847
},
1279812848
"method": {
@@ -13456,10 +13506,6 @@
1345613506
},
1345713507
"type": "array"
1345813508
},
13459-
"client_key_id": {
13460-
"description": "ClientKeyID is the key id/alias on the device.",
13461-
"type": "string"
13462-
},
1346313509
"device_name": {
1346413510
"description": "DeviceName is a human-readable name for the device e.g. 'My work phone'.",
1346513511
"type": "string"
@@ -13470,13 +13516,13 @@
1347013516
"type": "integer"
1347113517
}
1347213518
},
13473-
"required": ["device_name", "client_key_id"],
13519+
"required": ["device_name"],
1347413520
"type": "object"
1347513521
},
1347613522
"updateSettingsFlowWithDeviceAuthnMethodDelete": {
1347713523
"properties": {
1347813524
"client_key_id": {
13479-
"description": "ClientKeyID is the key id/alias on the device.",
13525+
"description": "ClientKeyID is the deterministic fingerprint of the key to remove: the\nlowercase-hex SHA-256 of the device public key in PKIX, ASN.1 DER\n(SubjectPublicKeyInfo) form. Keys enrolled before the server derived the\nid use their original client-chosen value.",
1348013526
"type": "string"
1348113527
}
1348213528
},

0 commit comments

Comments
 (0)