Auth
Read the public keys of Plotwork's issuer for an organisation
The RS256 public key of the organisation's connection when it signs client assertions, and the one a rotation replaced for a day after.
GET
/sso/oidc/{org}/jwks.jsonTL;DR
| Question | Answer |
|---|---|
| What does it do? | Read the public keys of Plotwork's issuer for an organisation. |
| What does it take? | org in the path. |
| What does it return? | Status 200 with a body of type SsoJwks. |
| What can go wrong? | 400 not an organisation id; 429 too many requests; 503 this server has no api_url, or no accounts database (sso.unavailable). Every failure uses the one error envelope. |
What it does
The RS256 public key of the organisation's connection when it signs client assertions, and the one a rotation replaced for a day after. Public members only; an empty set for an organisation with none. Public, cacheable for five minutes.
Path parameters
| Field | Type | Required | Description |
|---|---|---|---|
org | string | yes |
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | The public keys. | SsoJwks |
| 400 | Not an organisation id. | ErrorResponse |
| 429 | Too many requests. | ErrorResponse |
| 503 | This server has no API_URL, or no accounts database (sso.unavailable). | ErrorResponse |
Response body
A 200 answer has the type SsoJwks.
| Field | Type | Required | Description |
|---|---|---|---|
keys | SsoPublicJwk[] | yes | |
keys[].kty | "RSA" | yes | |
keys[].n | string | yes | The modulus, base64url. |
keys[].e | string | yes | The public exponent, base64url. |
keys[].kid | string | yes | The key id: the key's RFC 7638 thumbprint. |
keys[].alg | "RS256" | yes | |
keys[].use | "sig" | yes |
See also
| Doc | Why |
|---|---|
| API reference | Every endpoint, and the error envelope |
| Schemas | Every request and response type |
| Tool reference | The operations as callable tools |