Shyntr Identity Hub API (1.0)

Download OpenAPI specification:Download

Protocol Agnostic Zero Trust Identity Broker

OAuth2/OIDC Core

JSON Web Key Set (JWKS) Endpoint

Returns the public keys used by the Authorization Server to sign JWTs (like ID Tokens). Used by clients to verify signatures.

Responses

Response samples

200

Content type

application/json

{ }

OpenID Connect Discovery Endpoint

Returns the OIDC Provider Configuration Document. Details the supported scopes, claims, and endpoints for a specific tenant.

Responses

Response samples

200
404

Content type

application/json

{ }

OAuth2 Authorization Endpoint

Handles the initial step of the OAuth 2.1 authorization code flow. Enforces PKCE, tenant boundaries, and redirects the user agent to the login or consent UI.

query Parameters

client_id required	string OAuth2 Client ID
response_type required	string Must be 'code'
redirect_uri required	string Registered redirect URI
scope	string Requested space-separated scopes
state	string Opaque value used to maintain state between the request and the callback
code_challenge	string PKCE code challenge (Required if client enforces PKCE)
code_challenge_method	string PKCE method, e.g., 'S256'
prompt	string Forces login or consent (e.g., 'login', 'consent', 'none')

Responses

Token Introspection Endpoint (RFC 7662)

Allows a protected resource (e.g., an API gateway) to query the active state and metadata of a given token.

Request Body schema: application/x-www-form-urlencoded
required

token required	string The token to introspect
client_id	string OAuth2 Client ID
client_secret	string OAuth2 Client Secret

Responses

Response samples

200

Content type

application/json

{ }

OpenID Connect RP-Initiated Logout

Terminates the user's session. Supports id_token_hint for validation and post_logout_redirect_uri for safe redirection. Also propagates logout to federated IdPs if applicable.

query Parameters

id_token_hint	string Previously issued ID Token to validate the logout request
post_logout_redirect_uri	string Registered URI to redirect after successful logout
state	string Opaque value to maintain state

Responses

Token Revocation Endpoint (RFC 7009)

Allows clients to notify the authorization server that a previously obtained refresh or access token is no longer needed.

Request Body schema: application/x-www-form-urlencoded
required

token required	string The token to revoke
token_type_hint	string Hint about the token type (e.g., 'refresh_token' or 'access_token')

Responses

OAuth2 Token Endpoint

Issues access tokens, ID tokens, and refresh tokens based on the provided grant type (e.g., authorization_code, client_credentials, refresh_token). Enforces tenant isolation.

Request Body schema: application/x-www-form-urlencoded
required

grant_type required	string Grant Type (e.g., 'authorization_code', 'client_credentials')
client_id	string OAuth2 Client ID
client_secret	string OAuth2 Client Secret (for basic/post auth)
code	string Authorization code (if grant_type=authorization_code)
redirect_uri	string Registered redirect URI (must match the one in the auth request)
code_verifier	string PKCE code verifier (if PKCE was used)
refresh_token	string Refresh token (if grant_type=refresh_token)

Responses

Response samples

200
400

Content type

application/json

{ }

JSON Web Key Set (JWKS) Endpoint

Returns the public keys used by the Authorization Server to sign JWTs (like ID Tokens). Used by clients to verify signatures.

Responses

Response samples

200

Content type

application/json

{ }

OpenID Connect Discovery Endpoint

Returns the OIDC Provider Configuration Document. Details the supported scopes, claims, and endpoints for a specific tenant.

Responses

Response samples

200
404

Content type

application/json

{ }

OAuth2 Authorization Endpoint

Handles the initial step of the OAuth 2.1 authorization code flow. Enforces PKCE, tenant boundaries, and redirects the user agent to the login or consent UI.

query Parameters

client_id required	string OAuth2 Client ID
response_type required	string Must be 'code'
redirect_uri required	string Registered redirect URI
scope	string Requested space-separated scopes
state	string Opaque value used to maintain state between the request and the callback
code_challenge	string PKCE code challenge (Required if client enforces PKCE)
code_challenge_method	string PKCE method, e.g., 'S256'
prompt	string Forces login or consent (e.g., 'login', 'consent', 'none')

Responses

Token Introspection Endpoint (RFC 7662)

Allows a protected resource (e.g., an API gateway) to query the active state and metadata of a given token.

Request Body schema: application/x-www-form-urlencoded
required

token required	string The token to introspect
client_id	string OAuth2 Client ID
client_secret	string OAuth2 Client Secret

Responses

Response samples

200

Content type

application/json

{ }

OpenID Connect RP-Initiated Logout

Terminates the user's session. Supports id_token_hint for validation and post_logout_redirect_uri for safe redirection. Also propagates logout to federated IdPs if applicable.

query Parameters

id_token_hint	string Previously issued ID Token to validate the logout request
post_logout_redirect_uri	string Registered URI to redirect after successful logout
state	string Opaque value to maintain state

Responses

Token Revocation Endpoint (RFC 7009)

Allows clients to notify the authorization server that a previously obtained refresh or access token is no longer needed.

Request Body schema: application/x-www-form-urlencoded
required

token required	string The token to revoke
token_type_hint	string Hint about the token type (e.g., 'refresh_token' or 'access_token')

Responses

OAuth2 Token Endpoint

Issues access tokens, ID tokens, and refresh tokens based on the provided grant type (e.g., authorization_code, client_credentials, refresh_token). Enforces tenant isolation.

Request Body schema: application/x-www-form-urlencoded
required

grant_type required	string Grant Type (e.g., 'authorization_code', 'client_credentials')
client_id	string OAuth2 Client ID
client_secret	string OAuth2 Client Secret (for basic/post auth)
code	string Authorization code (if grant_type=authorization_code)
redirect_uri	string Registered redirect URI (must match the one in the auth request)
code_verifier	string PKCE code verifier (if PKCE was used)
refresh_token	string Refresh token (if grant_type=refresh_token)

Responses

Response samples

200
400

Content type

application/json

{ }

OIDC UserInfo Endpoint

Returns Claims about the authenticated End-User. Requires a valid Access Token.

Authorizations:

BearerAuth

Responses

Response samples

200
401
500

Content type

application/json

{ }

OIDC UserInfo Endpoint

Returns Claims about the authenticated End-User. Requires a valid Access Token.

Authorizations:

BearerAuth

Responses

Response samples

200
401
500

Content type

application/json

{ }

Auth-Admin

Get OAuth2 Consent Request

Retrieves the details of an active OAuth2 consent challenge, including requested scopes and client tenant context.

query Parameters

consent_challenge

required

string

The cryptographic consent challenge ID

Responses

Response samples

200
400
404
500

Content type

application/json

{ }

Accept OAuth2 Consent Request

Accepts a consent request, granting the requested scopes and audiences to the OAuth2 client.

query Parameters

consent_challenge

required

string

The cryptographic consent challenge ID

Request Body schema: application/json
required

Consent acceptance payload with granted scopes/audiences

grant_audience	Array of strings
grant_scope	Array of strings
remember	boolean
remember_for	integer
session	object

Responses

Request samples

Payload

Content type

application/json

{"grant_audience": ["api.shyntr.internal"
],
"grant_scope": ["openid",
"profile",
"email"
],
"remember": true,
"remember_for": 3600,
"session": { }
}

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

Reject OAuth2 Consent Request

Rejects a consent request (e.g., user denied access to scopes) and aborts the OAuth2 flow.

query Parameters

consent_challenge

required

string

The cryptographic consent challenge ID

Request Body schema: application/json
required

Rejection payload containing error code and description

error required	string
error_description	string

Responses

Request samples

Payload

Content type

application/json

{"error": "access_denied",
"error_description": "The resource owner or authorization server denied the request."
}

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

Get OAuth2 Login Request

Retrieves the details of an active OAuth2 login challenge. Acts as an internal IdP trust boundary.

query Parameters

login_challenge

required

string

The cryptographic login challenge ID

Responses

Response samples

200
400
404

Content type

application/json

{ }

Accept OAuth2 Login Request

Accepts a login request and confirms the user's identity. Returns a redirection URL to continue the OAuth2 flow.

query Parameters

login_challenge

required

string

The cryptographic login challenge ID

Request Body schema: application/json
required

Login acceptance payload containing subject and session preferences

context	object
remember	boolean
remember_for	integer
subject required	string

Responses

Request samples

Payload

Content type

application/json

{"context": { },
"remember": false,
"remember_for": 0,
"subject": "usr_9f8b7c6d5e4a3b2c1"
}

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

Reject OAuth2 Login Request

Rejects a login request (e.g., due to invalid credentials or user denial) and aborts the OAuth2 flow.

query Parameters

login_challenge

required

string

The cryptographic login challenge ID

Request Body schema: application/json
required

Rejection payload containing error code and description

error required	string
error_description	string

Responses

Request samples

Payload

Content type

application/json

{"error": "access_denied",
"error_description": "The resource owner or authorization server denied the request."
}

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

OAuth2 Clients

List All OIDC Clients

Lists all OAuth2/OIDC clients across the system. Secrets are masked.

Authorizations:

BearerAuth

Responses

Response samples

200
500

Content type

application/json

[{"access_token_lifespan": "string",
"allowed_cors_origins": ["string"
],
"app_id": "string",
"audience": ["string"
],
"backchannel_logout_uri": "string",
"client_id": "string",
"client_secret": "string",
"created_at": "string",
"enforce_pkce": true,
"grant_types": ["string"
],
"id_token_encrypted_response_alg": "string",
"id_token_encrypted_response_enc": "string",
"id_token_lifespan": "string",
"jwks_uri": "string",
"name": "string",
"post_logout_redirect_uris": ["string"
],
"public": true,
"redirect_uris": ["string"
],
"refresh_token_lifespan": "string",
"response_modes": ["string"
],
"response_types": ["string"
],
"scopes": ["string"
],
"skip_consent": true,
"subject_type": "string",
"tenant_id": "string",
"token_endpoint_auth_method": "string",
"updated_at": "string"
}
]

Create OIDC Client

Registers a new OAuth2/OIDC client under the specified tenant enforcing OAuth 2.1 standards.

Authorizations:

BearerAuth

Request Body schema: application/json
required

Client Configuration

allowed_cors_origins	Array of strings
audience	Array of strings
backchannel_logout_uri	string
client_id	string
client_secret	string
enforce_pkce	boolean
grant_types required	Array of strings
id_token_encrypted_response_alg	string
id_token_encrypted_response_enc	string
jwks	object
jwks_uri	string
name required	string
post_logout_redirect_uris	Array of strings
public	boolean
redirect_uris required	Array of strings
response_modes	Array of strings
response_types	Array of strings
scopes	Array of strings
subject_type	string
tenant_id required	string
token_endpoint_auth_method	string

Responses

Request samples

Payload

Content type

application/json

{"allowed_cors_origins": ["https://app.example.com"
],
"audience": ["api-service"
],
"backchannel_logout_uri": "https://api.example.com/backchannel-logout",
"client_id": "my-web-app",
"client_secret": "super-secure-secret-key",
"enforce_pkce": true,
"grant_types": ["authorization_code",
"refresh_token"
],
"id_token_encrypted_response_alg": "RSA-OAEP-256",
"id_token_encrypted_response_enc": "A256GCM",
"jwks": { },
"jwks_uri": "https://app.example.com/.well-known/jwks.json",
"name": "My Frontend Application",
"post_logout_redirect_uris": ["https://app.example.com/logout"
],
"public": false,
"redirect_uris": ["https://app.example.com/callback"
],
"response_modes": ["query",
"form_post"
],
"response_types": ["code"
],
"scopes": ["openid",
"profile",
"email",
"offline_access"
],
"subject_type": "public",
"tenant_id": "default",
"token_endpoint_auth_method": "client_secret_basic"
}

Response samples

201
400
500

Content type

application/json

{"allowed_cors_origins": ["https://app.example.com"
],
"audience": ["api-service"
],
"backchannel_logout_uri": "https://api.example.com/backchannel-logout",
"client_id": "my-web-app",
"client_secret": "super-secure-secret-key",
"enforce_pkce": true,
"grant_types": ["authorization_code",
"refresh_token"
],
"id_token_encrypted_response_alg": "RSA-OAEP-256",
"id_token_encrypted_response_enc": "A256GCM",
"jwks": { },
"jwks_uri": "https://app.example.com/.well-known/jwks.json",
"name": "My Frontend Application",
"post_logout_redirect_uris": ["https://app.example.com/logout"
],
"public": false,
"redirect_uris": ["https://app.example.com/callback"
],
"response_modes": ["query",
"form_post"
],
"response_types": ["code"
],
"scopes": ["openid",
"profile",
"email",
"offline_access"
],
"subject_type": "public",
"tenant_id": "default",
"token_endpoint_auth_method": "client_secret_basic"
}

Get OIDC Client

Retrieves details of a specific OAuth2/OIDC client. Secrets are masked.

Authorizations:

BearerAuth

path Parameters

id

required

string

Client ID

Responses

Response samples

200
404

Content type

application/json

{"access_token_lifespan": "string",
"allowed_cors_origins": ["string"
],
"app_id": "string",
"audience": ["string"
],
"backchannel_logout_uri": "string",
"client_id": "string",
"client_secret": "string",
"created_at": "string",
"enforce_pkce": true,
"grant_types": ["string"
],
"id_token_encrypted_response_alg": "string",
"id_token_encrypted_response_enc": "string",
"id_token_lifespan": "string",
"jwks_uri": "string",
"name": "string",
"post_logout_redirect_uris": ["string"
],
"public": true,
"redirect_uris": ["string"
],
"refresh_token_lifespan": "string",
"response_modes": ["string"
],
"response_types": ["string"
],
"scopes": ["string"
],
"skip_consent": true,
"subject_type": "string",
"tenant_id": "string",
"token_endpoint_auth_method": "string",
"updated_at": "string"
}

Update OIDC Client

Updates an existing OAuth2/OIDC client. Pass "*****" or empty string to keep the existing secret.

Authorizations:

BearerAuth

path Parameters

id

required

string

Client ID

Request Body schema: application/json
required

Client Update Configuration

allowed_cors_origins	Array of strings
audience	Array of strings
backchannel_logout_uri	string
client_id	string
client_secret	string
enforce_pkce	boolean
grant_types required	Array of strings
id_token_encrypted_response_alg	string
id_token_encrypted_response_enc	string
jwks	object
jwks_uri	string
name required	string
post_logout_redirect_uris	Array of strings
public	boolean
redirect_uris required	Array of strings
response_modes	Array of strings
response_types	Array of strings
scopes	Array of strings
subject_type	string
tenant_id required	string
token_endpoint_auth_method	string

Responses

Request samples

Payload

Content type

application/json

{"allowed_cors_origins": ["https://app.example.com"
],
"audience": ["api-service"
],
"backchannel_logout_uri": "https://api.example.com/backchannel-logout",
"client_id": "my-web-app",
"client_secret": "super-secure-secret-key",
"enforce_pkce": true,
"grant_types": ["authorization_code",
"refresh_token"
],
"id_token_encrypted_response_alg": "RSA-OAEP-256",
"id_token_encrypted_response_enc": "A256GCM",
"jwks": { },
"jwks_uri": "https://app.example.com/.well-known/jwks.json",
"name": "My Frontend Application",
"post_logout_redirect_uris": ["https://app.example.com/logout"
],
"public": false,
"redirect_uris": ["https://app.example.com/callback"
],
"response_modes": ["query",
"form_post"
],
"response_types": ["code"
],
"scopes": ["openid",
"profile",
"email",
"offline_access"
],
"subject_type": "public",
"tenant_id": "default",
"token_endpoint_auth_method": "client_secret_basic"
}

Response samples

200
400
404
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

DeleteByClient OIDC Client

Deletes an OAuth2/OIDC client from a specific tenant.

Authorizations:

BearerAuth

path Parameters

tenant_id required	string Tenant ID
id required	string Client ID

Responses

Response samples

500

Content type

application/json

{"status_code": 400,
"user_message": "Invalid input provided"
}

List OIDC Clients By Tenant

Lists all OAuth2/OIDC clients for a specific tenant. Secrets are masked.

Authorizations:

BearerAuth

path Parameters

tenant_id

required

string

Tenant ID

Responses

Response samples

200
400
500

Content type

application/json

[{"access_token_lifespan": "string",
"allowed_cors_origins": ["string"
],
"app_id": "string",
"audience": ["string"
],
"backchannel_logout_uri": "string",
"client_id": "string",
"client_secret": "string",
"created_at": "string",
"enforce_pkce": true,
"grant_types": ["string"
],
"id_token_encrypted_response_alg": "string",
"id_token_encrypted_response_enc": "string",
"id_token_lifespan": "string",
"jwks_uri": "string",
"name": "string",
"post_logout_redirect_uris": ["string"
],
"public": true,
"redirect_uris": ["string"
],
"refresh_token_lifespan": "string",
"response_modes": ["string"
],
"response_types": ["string"
],
"scopes": ["string"
],
"skip_consent": true,
"subject_type": "string",
"tenant_id": "string",
"token_endpoint_auth_method": "string",
"updated_at": "string"
}
]

Dashboard

Get Dashboard Statistics

Retrieves global or tenant-specific usage statistics and active connection counts.

Authorizations:

BearerAuth

query Parameters

tenant_id

string

Tenant ID (for filtering)

Responses

Response samples

200

Content type

application/json

{ }

OIDC Connections

List All OIDC Connections

Lists all federated OIDC Identity Providers.

Authorizations:

BearerAuth

Responses

Response samples

200
500

Content type

application/json

[{"active": true,
"attribute_mapping": {"property1": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
},
"property2": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
}
},
"authorization_endpoint": "string",
"client_id": "string",
"client_secret": "string",
"created_at": "string",
"end_session_endpoint": "string",
"id": "string",
"issuer_url": "string",
"jwks_uri": "string",
"name": "string",
"scopes": ["string"
],
"tenant_id": "string",
"token_endpoint": "string",
"updated_at": "string",
"userinfo_endpoint": "string"
}
]

Create OIDC Connection (IdP)

Registers an external OpenID Connect Identity Provider for federated authentication.

Authorizations:

BearerAuth

Request Body schema: application/json
required

OIDC Connection Configuration

attribute_mapping	object
authorization_endpoint	string
client_id required	string
client_secret	string
end_session_endpoint	string
id	string
issuer_url required	string
jwks_uri	string
name required	string
scopes required	Array of strings
tenant_id required	string
token_endpoint	string
user_info_endpoint	string

Responses

Request samples

Payload

Content type

application/json

{"attribute_mapping": { },
"authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth",
"client_id": "google-client-id.apps.googleusercontent.com",
"client_secret": "YOUR_SECURE_CLIENT_SECRET",
"end_session_endpoint": "https://oauth2.googleapis.com/revoke",
"id": "conn_oidc_123",
"issuer_url": "https://accounts.google.com",
"jwks_uri": "https://www.googleapis.com/oauth2/v3/certs",
"name": "Google Workspace SSO",
"scopes": ["openid",
"profile",
"email"
],
"tenant_id": "tnt_alpha01",
"token_endpoint": "https://oauth2.googleapis.com/token",
"user_info_endpoint": "https://openidconnect.googleapis.com/v1/userinfo"
}

Response samples

201
400
500

Content type

application/json

{"attribute_mapping": { },
"authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth",
"client_id": "google-client-id.apps.googleusercontent.com",
"client_secret": "YOUR_SECURE_CLIENT_SECRET",
"end_session_endpoint": "https://oauth2.googleapis.com/revoke",
"id": "conn_oidc_123",
"issuer_url": "https://accounts.google.com",
"jwks_uri": "https://www.googleapis.com/oauth2/v3/certs",
"name": "Google Workspace SSO",
"scopes": ["openid",
"profile",
"email"
],
"tenant_id": "tnt_alpha01",
"token_endpoint": "https://oauth2.googleapis.com/token",
"user_info_endpoint": "https://openidconnect.googleapis.com/v1/userinfo"
}

Update OIDC Connection

Updates an existing OIDC Identity Provider.

Authorizations:

BearerAuth

path Parameters

id

required

string

Connection ID

Request Body schema: application/json
required

OIDC Connection Update Configuration

attribute_mapping	object
authorization_endpoint	string
client_id required	string
client_secret	string
end_session_endpoint	string
id	string
issuer_url required	string
jwks_uri	string
name required	string
scopes required	Array of strings
tenant_id required	string
token_endpoint	string
user_info_endpoint	string

Responses

Request samples

Payload

Content type

application/json

{"attribute_mapping": { },
"authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth",
"client_id": "google-client-id.apps.googleusercontent.com",
"client_secret": "YOUR_SECURE_CLIENT_SECRET",
"end_session_endpoint": "https://oauth2.googleapis.com/revoke",
"id": "conn_oidc_123",
"issuer_url": "https://accounts.google.com",
"jwks_uri": "https://www.googleapis.com/oauth2/v3/certs",
"name": "Google Workspace SSO",
"scopes": ["openid",
"profile",
"email"
],
"tenant_id": "tnt_alpha01",
"token_endpoint": "https://oauth2.googleapis.com/token",
"user_info_endpoint": "https://openidconnect.googleapis.com/v1/userinfo"
}

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

DeleteByClient OIDC Connection

Deletes a federated OIDC Identity Provider from a tenant.

Authorizations:

BearerAuth

path Parameters

tenant_id required	string Tenant ID
id required	string Connection ID

Responses

Response samples

500

Content type

application/json

{"status_code": 400,
"user_message": "Invalid input provided"
}

Get OIDC Connection

Retrieves details of a specific OIDC Identity Provider.

Authorizations:

BearerAuth

path Parameters

tenant_id required	string Tenant ID
id required	string Connection ID

Responses

Response samples

200
404

Content type

application/json

{"active": true,
"attribute_mapping": {"property1": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
},
"property2": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
}
},
"authorization_endpoint": "string",
"client_id": "string",
"client_secret": "string",
"created_at": "string",
"end_session_endpoint": "string",
"id": "string",
"issuer_url": "string",
"jwks_uri": "string",
"name": "string",
"scopes": ["string"
],
"tenant_id": "string",
"token_endpoint": "string",
"updated_at": "string",
"userinfo_endpoint": "string"
}

List OIDC Connections By Tenant

Lists all federated OIDC Identity Providers for a specific tenant.

Authorizations:

BearerAuth

path Parameters

tenant_id

required

string

Tenant ID

Responses

Response samples

200
400
500

Content type

application/json

[{"active": true,
"attribute_mapping": {"property1": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
},
"property2": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
}
},
"authorization_endpoint": "string",
"client_id": "string",
"client_secret": "string",
"created_at": "string",
"end_session_endpoint": "string",
"id": "string",
"issuer_url": "string",
"jwks_uri": "string",
"name": "string",
"scopes": ["string"
],
"tenant_id": "string",
"token_endpoint": "string",
"updated_at": "string",
"userinfo_endpoint": "string"
}
]

Outbound Policies

List outbound policies

Lists outbound policies. If tenant_id is provided, returns tenant and global policies.

query Parameters

tenant_id

string

Tenant ID

Responses

Response samples

200
500

Content type

application/json

[{"allowed_host_patterns": ["*.example.com"
],
"allowed_path_patterns": ["/api/*"
],
"allowed_ports": [443
],
"allowed_schemes": ["https"
],
"block_link_local_ips": true,
"block_localhost_names": true,
"block_loopback_ips": true,
"block_multicast_ips": true,
"block_private_ips": true,
"created_at": "2026-01-01T12:00:00Z",
"disable_redirects": true,
"enabled": true,
"id": "policy-123",
"max_response_bytes": 2097152,
"name": "Default Webhook Policy",
"request_timeout_seconds": 5,
"require_dns_resolve": true,
"target": "webhook_delivery",
"tenant_id": "tenant-abc",
"updated_at": "2026-01-01T12:00:00Z"
}
]

Create outbound policy

Creates a new outbound security policy for global or tenant-specific outbound HTTP controls.

Request Body schema: application/json
required

Create outbound policy request

allowed_host_patterns	Array of strings
allowed_path_patterns	Array of strings
allowed_ports	Array of integers
allowed_schemes	Array of strings
block_link_local_ips	boolean
block_localhost_names	boolean
block_loopback_ips	boolean
block_multicast_ips	boolean
block_private_ips	boolean
disable_redirects	boolean
enabled	boolean
id	string
max_response_bytes	integer [ 1024 .. 10485760 ]
name required	string
request_timeout_seconds	integer [ 1 .. 30 ]
require_dns_resolve	boolean
target required	string Enum: "webhook_delivery" "jwks_fetch" "oidc_discovery"
tenant_id	string

Responses

Request samples

Payload

Content type

application/json

{"allowed_host_patterns": ["*.example.com"
],
"allowed_path_patterns": ["/api/*"
],
"allowed_ports": [443
],
"allowed_schemes": ["https"
],
"block_link_local_ips": true,
"block_localhost_names": true,
"block_loopback_ips": true,
"block_multicast_ips": true,
"block_private_ips": true,
"disable_redirects": true,
"enabled": true,
"id": "policy-123",
"max_response_bytes": 2097152,
"name": "Default Webhook Policy",
"request_timeout_seconds": 5,
"require_dns_resolve": true,
"target": "webhook_delivery",
"tenant_id": "tenant-abc"
}

Response samples

201
400
500

Content type

application/json

{"allowed_host_patterns": ["*.example.com"
],
"allowed_path_patterns": ["/api/*"
],
"allowed_ports": [443
],
"allowed_schemes": ["https"
],
"block_link_local_ips": true,
"block_localhost_names": true,
"block_loopback_ips": true,
"block_multicast_ips": true,
"block_private_ips": true,
"created_at": "2026-01-01T12:00:00Z",
"disable_redirects": true,
"enabled": true,
"id": "policy-123",
"max_response_bytes": 2097152,
"name": "Default Webhook Policy",
"request_timeout_seconds": 5,
"require_dns_resolve": true,
"target": "webhook_delivery",
"tenant_id": "tenant-abc",
"updated_at": "2026-01-01T12:00:00Z"
}

Delete outbound policy

Deletes an outbound policy by id.

path Parameters

id

required

string

Policy ID

Responses

Response samples

500

Content type

application/json

{ }

Get outbound policy

Returns a single outbound policy by id.

path Parameters

id

required

string

Policy ID

Responses

Response samples

200
404

Content type

application/json

{"allowed_host_patterns": ["*.example.com"
],
"allowed_path_patterns": ["/api/*"
],
"allowed_ports": [443
],
"allowed_schemes": ["https"
],
"block_link_local_ips": true,
"block_localhost_names": true,
"block_loopback_ips": true,
"block_multicast_ips": true,
"block_private_ips": true,
"created_at": "2026-01-01T12:00:00Z",
"disable_redirects": true,
"enabled": true,
"id": "policy-123",
"max_response_bytes": 2097152,
"name": "Default Webhook Policy",
"request_timeout_seconds": 5,
"require_dns_resolve": true,
"target": "webhook_delivery",
"tenant_id": "tenant-abc",
"updated_at": "2026-01-01T12:00:00Z"
}

Update outbound policy

Updates an existing outbound policy by id.

path Parameters

id

required

string

Policy ID

Request Body schema: application/json
required

Update outbound policy request

allowed_host_patterns	Array of strings
allowed_path_patterns	Array of strings
allowed_ports	Array of integers
allowed_schemes	Array of strings
block_link_local_ips	boolean
block_localhost_names	boolean
block_loopback_ips	boolean
block_multicast_ips	boolean
block_private_ips	boolean
disable_redirects	boolean
enabled	boolean
max_response_bytes	integer [ 1024 .. 10485760 ]
name required	string
request_timeout_seconds	integer [ 1 .. 30 ]
require_dns_resolve	boolean

Responses

Request samples

Payload

Content type

application/json

{"allowed_host_patterns": ["api.example.com"
],
"allowed_path_patterns": ["/v1/*"
],
"allowed_ports": [443
],
"allowed_schemes": ["https"
],
"block_link_local_ips": true,
"block_localhost_names": true,
"block_loopback_ips": true,
"block_multicast_ips": true,
"block_private_ips": true,
"disable_redirects": true,
"enabled": true,
"max_response_bytes": 2097152,
"name": "Updated Policy Name",
"request_timeout_seconds": 5,
"require_dns_resolve": true
}

Response samples

200
400
404
500

Content type

application/json

{"allowed_host_patterns": ["*.example.com"
],
"allowed_path_patterns": ["/api/*"
],
"allowed_ports": [443
],
"allowed_schemes": ["https"
],
"block_link_local_ips": true,
"block_localhost_names": true,
"block_loopback_ips": true,
"block_multicast_ips": true,
"block_private_ips": true,
"created_at": "2026-01-01T12:00:00Z",
"disable_redirects": true,
"enabled": true,
"id": "policy-123",
"max_response_bytes": 2097152,
"name": "Default Webhook Policy",
"request_timeout_seconds": 5,
"require_dns_resolve": true,
"target": "webhook_delivery",
"tenant_id": "tenant-abc",
"updated_at": "2026-01-01T12:00:00Z"
}

SAML Clients

List All SAML Clients

Lists all SAML Service Providers globally across the hub.

Authorizations:

BearerAuth

Responses

Response samples

200
500

Content type

application/json

[{"acs_url": "string",
"active": true,
"allowed_scopes": ["string"
],
"attribute_mapping": {"property1": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
},
"property2": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
}
},
"created_at": "string",
"encrypt_assertion": true,
"entity_id": "string",
"force_authn": true,
"id": "string",
"metadata_url": "string",
"name": "string",
"sign_assertion": true,
"sign_response": true,
"slo_url": "string",
"tenant_id": "string",
"updated_at": "string"
}
]

Create SAML Client

Registers a legacy SAML Service Provider in the system for federation.

Authorizations:

BearerAuth

Request Body schema: application/json
required

SAML Client Configuration

acs_url	string
allowed_scopes	Array of strings
attribute_mapping	object
encrypt_assertion	boolean
entity_id	string
force_authn	boolean
metadata_url	string
name	string
sign_assertion	boolean
sign_response	boolean
slo_url	string
sp_certificate	string
sp_encryption_certificate	string
tenant_id	string

Responses

Request samples

Payload

Content type

application/json

{"acs_url": "https://finance.acme.corp/saml/acs",
"allowed_scopes": ["email",
"profile",
"groups"
],
"attribute_mapping": { },
"encrypt_assertion": false,
"entity_id": "https://finance.acme.corp/saml/metadata",
"force_authn": true,
"metadata_url": "https://finance.acme.corp/saml/metadata.xml",
"name": "Acme Corp Finance App",
"sign_assertion": true,
"sign_response": true,
"slo_url": "https://finance.acme.corp/saml/slo",
"sp_certificate": "MIID...[Base64_Cert]...==",
"sp_encryption_certificate": "MIID...[Base64_Cert]...==",
"tenant_id": "tnt_alpha01"
}

Response samples

201
400
500

Content type

application/json

{"acs_url": "https://finance.acme.corp/saml/acs",
"allowed_scopes": ["email",
"profile",
"groups"
],
"attribute_mapping": { },
"encrypt_assertion": false,
"entity_id": "https://finance.acme.corp/saml/metadata",
"force_authn": true,
"metadata_url": "https://finance.acme.corp/saml/metadata.xml",
"name": "Acme Corp Finance App",
"sign_assertion": true,
"sign_response": true,
"slo_url": "https://finance.acme.corp/saml/slo",
"sp_certificate": "MIID...[Base64_Cert]...==",
"sp_encryption_certificate": "MIID...[Base64_Cert]...==",
"tenant_id": "tnt_alpha01"
}

Update SAML Client

Updates an existing SAML Service Provider. Automatically pulls metadata if MetadataURL is provided.

Authorizations:

BearerAuth

path Parameters

id

required

string

Client ID

Request Body schema: application/json
required

SAML Client Update Configuration

acs_url	string
allowed_scopes	Array of strings
attribute_mapping	object
encrypt_assertion	boolean
entity_id	string
force_authn	boolean
metadata_url	string
name	string
sign_assertion	boolean
sign_response	boolean
slo_url	string
sp_certificate	string
sp_encryption_certificate	string
tenant_id	string

Responses

Request samples

Payload

Content type

application/json

{"acs_url": "https://finance.acme.corp/saml/acs",
"allowed_scopes": ["email",
"profile",
"groups"
],
"attribute_mapping": { },
"encrypt_assertion": false,
"entity_id": "https://finance.acme.corp/saml/metadata",
"force_authn": true,
"metadata_url": "https://finance.acme.corp/saml/metadata.xml",
"name": "Acme Corp Finance App",
"sign_assertion": true,
"sign_response": true,
"slo_url": "https://finance.acme.corp/saml/slo",
"sp_certificate": "MIID...[Base64_Cert]...==",
"sp_encryption_certificate": "MIID...[Base64_Cert]...==",
"tenant_id": "tnt_alpha01"
}

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

DeleteByClient SAML Client

Removes a SAML Service Provider from a specific tenant.

Authorizations:

BearerAuth

path Parameters

tenant_id required	string Tenant ID
id required	string Client ID

Responses

Response samples

500

Content type

application/json

{"status_code": 400,
"user_message": "Invalid input provided"
}

Get SAML Client

Retrieves details of a specific SAML Service Provider.

Authorizations:

BearerAuth

path Parameters

tenant_id required	string Tenant ID
id required	string Client ID

Responses

Response samples

200
404

Content type

application/json

{"acs_url": "string",
"active": true,
"allowed_scopes": ["string"
],
"attribute_mapping": {"property1": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
},
"property2": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
}
},
"created_at": "string",
"encrypt_assertion": true,
"entity_id": "string",
"force_authn": true,
"id": "string",
"metadata_url": "string",
"name": "string",
"sign_assertion": true,
"sign_response": true,
"slo_url": "string",
"tenant_id": "string",
"updated_at": "string"
}

List SAML Clients By Tenant

Lists all SAML Service Providers for a specific tenant.

Authorizations:

BearerAuth

path Parameters

tenant_id

required

string

Tenant ID

Responses

Response samples

200
400
500

Content type

application/json

[{"acs_url": "string",
"active": true,
"allowed_scopes": ["string"
],
"attribute_mapping": {"property1": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
},
"property2": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
}
},
"created_at": "string",
"encrypt_assertion": true,
"entity_id": "string",
"force_authn": true,
"id": "string",
"metadata_url": "string",
"name": "string",
"sign_assertion": true,
"sign_response": true,
"slo_url": "string",
"tenant_id": "string",
"updated_at": "string"
}
]

SAML Connections

List All SAML Connections

Lists all federated SAML Identity Providers.

Authorizations:

BearerAuth

Responses

Response samples

200
500

Content type

application/json

[{"active": true,
"attribute_mapping": {"property1": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
},
"property2": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
}
},
"created_at": "string",
"force_authn": true,
"id": "string",
"idp_certificate": "string",
"idp_encryption_certificate": "string",
"idp_entity_id": "string",
"idp_metadata_xml": "string",
"idp_single_sign_on": "string",
"idp_slo_url": "string",
"metadata_url": "string",
"name": "string",
"sign_request": true,
"sp_private_key": "string",
"tenant_id": "string",
"updated_at": "string"
}
]

Create SAML Connection (IdP)

Registers an external SAML Identity Provider for federated authentication.

Authorizations:

BearerAuth

Request Body schema: application/json
required

SAML Connection Configuration

attribute_mapping	object
force_authn	boolean
id	string
idp_certificate	string
idp_encryption_certificate	string
idp_entity_id	string
idp_metadata_xml	string
idp_single_sign_on	string
idp_slo_url	string
metadata_url	string
name required	string
sign_request	boolean
sp_private_key	string
tenant_id required	string

Responses

Request samples

Payload

Content type

application/json

{"attribute_mapping": { },
"force_authn": false,
"id": "conn_saml_123",
"idp_certificate": "MIID...[Base64_Cert]...==",
"idp_encryption_certificate": "string",
"idp_entity_id": "http://www.okta.com/exk12345",
"idp_metadata_xml": "<md:EntityDescriptor>...</md:EntityDescriptor>",
"idp_single_sign_on": "https://corp.okta.com/app/shyntr/exk12345/sso/saml",
"idp_slo_url": "https://corp.okta.com/app/shyntr/exk12345/slo/saml",
"metadata_url": "https://corp.okta.com/app/shyntr/exk12345/sso/saml/metadata",
"name": "Corporate Okta SSO",
"sign_request": true,
"sp_private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
"tenant_id": "tnt_alpha01"
}

Response samples

201
400
500

Content type

application/json

{"attribute_mapping": { },
"force_authn": false,
"id": "conn_saml_123",
"idp_certificate": "MIID...[Base64_Cert]...==",
"idp_encryption_certificate": "string",
"idp_entity_id": "http://www.okta.com/exk12345",
"idp_metadata_xml": "<md:EntityDescriptor>...</md:EntityDescriptor>",
"idp_single_sign_on": "https://corp.okta.com/app/shyntr/exk12345/sso/saml",
"idp_slo_url": "https://corp.okta.com/app/shyntr/exk12345/slo/saml",
"metadata_url": "https://corp.okta.com/app/shyntr/exk12345/sso/saml/metadata",
"name": "Corporate Okta SSO",
"sign_request": true,
"sp_private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
"tenant_id": "tnt_alpha01"
}

Update SAML Connection

Updates an existing SAML Identity Provider.

Authorizations:

BearerAuth

path Parameters

id

required

string

Connection ID

Request Body schema: application/json
required

SAML Connection Update Configuration

attribute_mapping	object
force_authn	boolean
id	string
idp_certificate	string
idp_encryption_certificate	string
idp_entity_id	string
idp_metadata_xml	string
idp_single_sign_on	string
idp_slo_url	string
metadata_url	string
name required	string
sign_request	boolean
sp_private_key	string
tenant_id required	string

Responses

Request samples

Payload

Content type

application/json

{"attribute_mapping": { },
"force_authn": false,
"id": "conn_saml_123",
"idp_certificate": "MIID...[Base64_Cert]...==",
"idp_encryption_certificate": "string",
"idp_entity_id": "http://www.okta.com/exk12345",
"idp_metadata_xml": "<md:EntityDescriptor>...</md:EntityDescriptor>",
"idp_single_sign_on": "https://corp.okta.com/app/shyntr/exk12345/sso/saml",
"idp_slo_url": "https://corp.okta.com/app/shyntr/exk12345/slo/saml",
"metadata_url": "https://corp.okta.com/app/shyntr/exk12345/sso/saml/metadata",
"name": "Corporate Okta SSO",
"sign_request": true,
"sp_private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
"tenant_id": "tnt_alpha01"
}

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

DeleteByClient SAML Connection

Deletes a federated SAML Identity Provider from a tenant.

Authorizations:

BearerAuth

path Parameters

tenant_id required	string Tenant ID
id required	string Connection ID

Responses

Response samples

500

Content type

application/json

{"status_code": 400,
"user_message": "Invalid input provided"
}

Get SAML Connection

Retrieves details of a specific SAML Identity Provider.

Authorizations:

BearerAuth

path Parameters

tenant_id required	string Tenant ID
id required	string Connection ID

Responses

Response samples

200
404

Content type

application/json

{"active": true,
"attribute_mapping": {"property1": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
},
"property2": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
}
},
"created_at": "string",
"force_authn": true,
"id": "string",
"idp_certificate": "string",
"idp_encryption_certificate": "string",
"idp_entity_id": "string",
"idp_metadata_xml": "string",
"idp_single_sign_on": "string",
"idp_slo_url": "string",
"metadata_url": "string",
"name": "string",
"sign_request": true,
"sp_private_key": "string",
"tenant_id": "string",
"updated_at": "string"
}

List SAML Connections By Tenant

Lists all federated SAML Identity Providers for a specific tenant.

Authorizations:

BearerAuth

path Parameters

tenant_id

required

string

Tenant ID

Responses

Response samples

200
400
500

Content type

application/json

[{"active": true,
"attribute_mapping": {"property1": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
},
"property2": {"fallback": "string",
"source": "string",
"target": "string",
"target_scopes": ["string"
],
"type": "string",
"value": "string"
}
},
"created_at": "string",
"force_authn": true,
"id": "string",
"idp_certificate": "string",
"idp_encryption_certificate": "string",
"idp_entity_id": "string",
"idp_metadata_xml": "string",
"idp_single_sign_on": "string",
"idp_slo_url": "string",
"metadata_url": "string",
"name": "string",
"sign_request": true,
"sp_private_key": "string",
"tenant_id": "string",
"updated_at": "string"
}
]

Tenants

List Tenants

Lists all tenants configured within the identity hub.

Authorizations:

BearerAuth

Responses

Response samples

200
500

Content type

application/json

[{"description": "Main production environment for Alpha Corp",
"display_name": "Alpha Corp Production",
"id": "tnt_alpha01",
"issuer_url": "https://api.shyntr.internal/t/tnt_alpha01",
"name": "alpha-production"
}
]

Create Tenant

Creates a new isolated tenant environment with strict data boundaries.

Authorizations:

BearerAuth

Request Body schema: application/json
required

Tenant Information

description	string
display_name	string
id	string
name required	string

Responses

Request samples

Payload

Content type

application/json

{"description": "Main production environment for Alpha Corp",
"display_name": "Alpha Corp Production",
"id": "tnt_alpha01",
"name": "alpha-production"
}

Response samples

201
400
500

Content type

application/json

{"created_at": "string",
"description": "string",
"display_name": "string",
"id": "string",
"issuer_url": "string",
"name": "string",
"updated_at": "string"
}

DeleteByClient Tenant

Performs a cascade delete of a tenant and all its associated resources. The default tenant cannot be deleted.

Authorizations:

BearerAuth

path Parameters

id

required

string

Tenant ID

Responses

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

Get Tenant

Retrieves a specific tenant by its ID.

Authorizations:

BearerAuth

path Parameters

id

required

string

Tenant ID

Responses

Response samples

200
404

Content type

application/json

{"created_at": "string",
"description": "string",
"display_name": "string",
"id": "string",
"issuer_url": "string",
"name": "string",
"updated_at": "string"
}

Update Tenant

Updates an existing tenant's details.

Authorizations:

BearerAuth

path Parameters

id

required

string

Tenant ID

Request Body schema: application/json
required

Tenant Update Information

description	string
display_name	string
id	string
name required	string

Responses

Request samples

Payload

Content type

application/json

{"description": "Main production environment for Alpha Corp",
"display_name": "Alpha Corp Production",
"id": "tnt_alpha01",
"name": "alpha-production"
}

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

Scopes

List Scopes

Retrieves all authorization scopes associated with a specific tenant.

Authorizations:

BearerAuth

path Parameters

id

required

string

Tenant ID

Responses

Response samples

200
500

Content type

application/json

[{"active": true,
"claims": ["string"
],
"created_at": "string",
"description": "string",
"id": "string",
"is_system": true,
"name": "string",
"tenant_id": "string",
"updated_at": "string"
}
]

Create Scope

Creates a new authorization scope for a specific tenant.

Authorizations:

BearerAuth

path Parameters

id

required

string

Tenant ID

Request Body schema: application/json
required

Scope configuration payload

active	boolean
claims	Array of strings
created_at	string
description	string
id	string
is_system	boolean
name	string
tenant_id	string
updated_at	string

Responses

Request samples

Payload

Content type

application/json

{"active": true,
"claims": ["string"
],
"created_at": "string",
"description": "string",
"id": "string",
"is_system": true,
"name": "string",
"tenant_id": "string",
"updated_at": "string"
}

Response samples

201
400
500

Content type

application/json

{"active": true,
"claims": ["string"
],
"created_at": "string",
"description": "string",
"id": "string",
"is_system": true,
"name": "string",
"tenant_id": "string",
"updated_at": "string"
}

Delete Scope

Removes an authorization scope from a specific tenant.

Authorizations:

BearerAuth

path Parameters

id required	string Tenant ID
scope_id required	string Scope ID

Responses

Response samples

500

Content type

application/json

{"status_code": 400,
"user_message": "Invalid input provided"
}

Get Scope

Retrieves the details of a specific authorization scope within a tenant boundary.

Authorizations:

BearerAuth

path Parameters

id required	string Tenant ID
scope_id required	string Scope ID

Responses

Response samples

200
404

Content type

application/json

{"active": true,
"claims": ["string"
],
"created_at": "string",
"description": "string",
"id": "string",
"is_system": true,
"name": "string",
"tenant_id": "string",
"updated_at": "string"
}

Update Scope

Updates an existing authorization scope configuration.

Authorizations:

BearerAuth

path Parameters

id required	string Tenant ID
scope_id required	string Scope ID

Request Body schema: application/json
required

Scope update payload

active	boolean
claims	Array of strings
created_at	string
description	string
id	string
is_system	boolean
name	string
tenant_id	string
updated_at	string

Responses

Request samples

Payload

Content type

application/json

{"active": true,
"claims": ["string"
],
"created_at": "string",
"description": "string",
"id": "string",
"is_system": true,
"name": "string",
"tenant_id": "string",
"updated_at": "string"
}

Response samples

200
400
500

Content type

application/json

{"property1": "string",
"property2": "string"
}

Audit

Get Tenant Audit Logs

Retrieves paginated audit logs for a specific tenant.

Authorizations:

BearerAuth

path Parameters

tenant_id

required

string

Tenant ID for isolation boundary

query Parameters

limit	integer Default: 100 Number of records to return
offset	integer Default: 0 Number of records to skip

Responses

Response samples

200
500

Content type

application/json

[{ }
]

Auth-Login

Get Login Methods

Retrieves available identity providers and authentication methods for a given cryptographic login challenge. This discovery endpoint establishes the initial context for the user authentication journey.

query Parameters

login_challenge

required

string

The cryptographic login challenge ID

Responses

Response samples

200
400

Content type

application/json

{ }

Health

Health Check

Evaluates the health of the Shyntr service and its underlying database connection. This is a public endpoint used for observability and orchestration readiness probes.

Responses

Response samples

200

Content type

application/json

{"property1": "string",
"property2": "string"
}

OIDC Federation

OIDC Federation Callback

Handles the callback from an external OIDC Identity Provider. Validates state and CSRF, exchanges the authorization code for tokens, fetches UserInfo, maps attributes, and resumes the original login flow.

path Parameters

tenant_id

required

string

Tenant ID

query Parameters

code required	string Authorization code returned by the external IdP
state required	string State parameter to mitigate CSRF and restore context

Responses

Initiate OIDC Federation Login

Starts the login flow with an external OIDC Identity Provider (e.g., Google, Okta) for a specific tenant and connection. Generates CSRF tokens and redirects the user.

path Parameters

tenant_id required	string Tenant ID
connection_id required	string OIDC Connection ID

query Parameters

login_challenge

required

string

The active cryptographic login challenge ID

Responses

SAML Core

Get SAML Identity Provider Metadata

Returns the XML metadata document describing Shyntr's capabilities as a SAML Identity Provider (IdP) for a specific tenant.

path Parameters

tenant_id

required

string

Tenant ID

Responses

SAML IdP Single Logout

Handles IdP-initiated or SP-initiated Single Logout requests. Clears the local session and potentially notifies other connected applications.

path Parameters

tenant_id

required

string

Tenant ID

query Parameters

SAMLRequest	string SAML LogoutRequest (SP-initiated)
SAMLResponse	string SAML LogoutResponse
RelayState	string Relay state

Responses

SAML IdP Single Logout

Handles IdP-initiated or SP-initiated Single Logout requests. Clears the local session and potentially notifies other connected applications.

path Parameters

tenant_id

required

string

Tenant ID

query Parameters

SAMLRequest	string SAML LogoutRequest (SP-initiated)
SAMLResponse	string SAML LogoutResponse
RelayState	string Relay state

Responses

SAML IdP Single Sign-On

Receives an AuthnRequest from a Service Provider. Challenges the user for authentication and issues a SAMLResponse containing assertions.

path Parameters

tenant_id

required

string

Tenant ID

query Parameters

SAMLRequest	string Deflated and Base64 encoded AuthnRequest (HTTP-Redirect)
RelayState	string Opaque state passed back to the SP
login_verifier	string Internal verifier after a successful login challenge

Request Body schema: application/x-www-form-urlencoded

SAMLRequest

string

Base64 encoded AuthnRequest (HTTP-POST)

Responses

SAML IdP Single Sign-On

Receives an AuthnRequest from a Service Provider. Challenges the user for authentication and issues a SAMLResponse containing assertions.

path Parameters

tenant_id

required

string

Tenant ID

query Parameters

SAMLRequest	string Deflated and Base64 encoded AuthnRequest (HTTP-Redirect)
RelayState	string Opaque state passed back to the SP
login_verifier	string Internal verifier after a successful login challenge

Request Body schema: application/x-www-form-urlencoded

SAMLRequest

string

Base64 encoded AuthnRequest (HTTP-POST)

Responses

Resume SAML Flow

Resumes the SAML SSO flow after a successful internal authentication event.

path Parameters

tenant_id

required

string

Tenant ID

query Parameters

login_challenge

required

string

Active login challenge identifier

Responses

Get SAML Service Provider Metadata

Returns the XML metadata document describing Shyntr's capabilities as a SAML Service Provider (SP) for a specific tenant.

path Parameters

tenant_id

required

string

Tenant ID

Responses

SAML Federation

Initiate SAML SP Login

Starts the SAML SSO flow as a Service Provider against an external Identity Provider. Generates an AuthnRequest and redirects the user.

path Parameters

tenant_id required	string Tenant ID
connection_id required	string SAML Connection ID (IdP Reference)

query Parameters

login_challenge

required

string

Active login challenge

Responses

SAML Assertion Consumer Service (ACS)

Receives and validates the SAMLResponse from an external Identity Provider. Prevents XML Signature Wrapping (XSW) and CSRF attacks.

path Parameters

tenant_id

required

string

Tenant ID

Request Body schema: application/x-www-form-urlencoded
required

SAMLResponse required	string Base64 encoded SAML Response
RelayState required	string Relay state containing the login challenge

Responses

SAML SP Single Logout

Handles logout requests acting as a Service Provider against an external IdP.

path Parameters

tenant_id

required

string

Tenant ID

query Parameters

SAMLRequest	string SAML LogoutRequest
SAMLResponse	string SAML LogoutResponse
connection_id	string IdP Connection ID for SP-initiated SLO
RelayState	string Relay state

Responses

Response samples

200
302
400

Content type

application/json

{"property1": "string",
"property2": "string"
}

Webhook

Create Webhook Destination

Registers a new webhook endpoint for event dispatching. Includes strict SSRF protection to prevent internal network scanning.

Authorizations:

BearerAuth

Request Body schema: application/json
required

Webhook configuration payload including target URL, events, and bound tenants

events required	Array of strings
name required	string
tenant_ids required	Array of strings
url required	string

Responses

Request samples

Payload

Content type

application/json

{"events": ["string"
],
"name": "string",
"tenant_ids": ["string"
],
"url": "string"
}

Response samples

201
400
500

Content type

application/json

{"active": true,
"created_at": "string",
"events": ["string"
],
"failure_count": 0,
"id": "string",
"name": "string",
"tenant_ids": ["string"
],
"updated_at": "string",
"url": "string"
}

Shyntr Identity Hub API (1.0)

OAuth2/OIDC Core

JSON Web Key Set (JWKS) Endpoint

Responses

Response samples

OpenID Connect Discovery Endpoint

Responses

Response samples

OAuth2 Authorization Endpoint

query Parameters

Responses

Token Introspection Endpoint (RFC 7662)

Request Body schema: application/x-www-form-urlencodedrequired

Responses

Response samples

OpenID Connect RP-Initiated Logout

query Parameters

Responses

Token Revocation Endpoint (RFC 7009)

Request Body schema: application/x-www-form-urlencodedrequired

Responses

OAuth2 Token Endpoint

Request Body schema: application/x-www-form-urlencodedrequired

Responses

Response samples

JSON Web Key Set (JWKS) Endpoint

Responses

Response samples

OpenID Connect Discovery Endpoint

Responses

Response samples

OAuth2 Authorization Endpoint

query Parameters

Responses

Token Introspection Endpoint (RFC 7662)

Request Body schema: application/x-www-form-urlencodedrequired

Responses

Response samples

OpenID Connect RP-Initiated Logout

query Parameters

Responses

Token Revocation Endpoint (RFC 7009)

Request Body schema: application/x-www-form-urlencodedrequired

Responses

OAuth2 Token Endpoint

Request Body schema: application/x-www-form-urlencodedrequired

Responses

Response samples

OIDC UserInfo Endpoint

Authorizations:

Responses

Response samples

OIDC UserInfo Endpoint

Authorizations:

Responses

Response samples

Auth-Admin

Get OAuth2 Consent Request

query Parameters

Responses

Response samples

Accept OAuth2 Consent Request

query Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Reject OAuth2 Consent Request

query Parameters

Request Body schema: application/jsonrequired

Responses

Request samples

Response samples

Get OAuth2 Login Request

query Parameters

Responses

Response samples

Accept OAuth2 Login Request

query Parameters

Request Body schema: application/jsonrequired

Request Body schema: application/x-www-form-urlencoded
required

Request Body schema: application/x-www-form-urlencoded
required

Request Body schema: application/x-www-form-urlencoded
required

Request Body schema: application/x-www-form-urlencoded
required

Request Body schema: application/x-www-form-urlencoded
required

Request Body schema: application/x-www-form-urlencoded
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required

Request Body schema: application/json
required