{
  "opencollection": "1.0.0",
  "info": {
    "name": "SPIRE OIDC Discovery Provider API",
    "version": "1.0"
  },
  "items": [
    {
      "info": {
        "name": "Discovery",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "SPIRE Get OpenID Connect discovery document",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{domain}/.well-known/openid-configuration"
          },
          "docs": "Returns the OpenID Connect discovery document describing the OIDC provider's configuration. The document includes the issuer URL, JWKS URI, supported response types, subject types, and supported signing algorithms. This endpoint is used by OIDC-compatible systems to auto-configure themselves to validate JWT-SVIDs issued by SPIRE. The path prefix can be customized via the server_path_prefix option."
        }
      ]
    },
    {
      "info": {
        "name": "Keys",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "SPIRE Get JSON Web Key Set",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{domain}/keys"
          },
          "docs": "Returns the JSON Web Key Set (JWKS) containing the public keys used to verify JWT-SVIDs issued by SPIRE. The keys are derived from the SPIRE trust bundle and are automatically rotated as SPIRE rotates its signing keys. Consumers must re-fetch this endpoint periodically to stay current with key rotations. Supported signing algorithms include RS256, ES256, and ES384."
        }
      ]
    }
  ],
  "bundled": true
}