Connect2id Server API

Name: Connect2id Server API API
Brand: Connect2id Server API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthenticationbearer, basic18 EndpointsREST

For Agents

Issue and introspect OAuth 2.0 / OIDC tokens, register OIDC clients, and manage authorization sessions on a Connect2id server. Useful for agents that automate IdP client onboarding or token validation.

Quickstart

Get started with Connect2id Server API in minutes using your preferred integration method.

# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
  "jentic": {
    "url": "https://api.jentic.com/mcp",
    "auth": "oauth"
  }
}

# Then ask your agent:
"register an oidc client on connect2id"

# → Jentic returns the GET /events tool with parameter schema, agent executes.

Capabilities

What an agent can do with Connect2id Server API API.

Update OIDC client metadata such as redirect URIs, grant types, and token endpoint auth method

Introspect a bearer token to confirm it is active and read its scopes and subject

Revoke an access or refresh token at the /token/revoke endpoint

GET STARTED

Start building with Connect2id Server API API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Connect2id Server API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Connect2id Server API, keeping it validated and agent-ready. Connect2id is a self-hosted OAuth 2.0 and OpenID Connect server that issues tokens, hosts the UserInfo endpoint, and manages OIDC clients and authorization sessions. The 18 endpoints cover the standard OAuth/OIDC surface (authorize, token, userinfo, introspection, revocation, JWKS, discovery, PAR, end session) plus Connect2id-specific management APIs for client registration and authorization sessions.

Use Cases

Patterns agents use Connect2id Server API API for, with concrete tasks.

★ Headless OIDC Client Provisioning

Provision OIDC clients automatically as new services are deployed. The agent calls POST /clients with the client metadata (redirect URIs, grant types, response types) and stores the returned client_id and client_secret in the deployment secret manager. Updates and deletes follow the standard registration endpoints, so client lifecycle stays in lockstep with infrastructure-as-code without operator intervention.

Call POST /clients with redirect_uris=[https://app.example.com/callback] and grant_types=[authorization_code, refresh_token], then write the returned client_secret to the secret store.

Token Introspection in a Resource Gateway

When an API gateway receives a request with a bearer token, it calls POST /token/introspect on the Connect2id server to confirm the token is active and to extract the subject and scopes for authorization decisions. This is the recommended pattern when stateless JWT validation is not enough and you need real-time revocation behavior.

Call POST /token/introspect with token=<access_token> and client credentials, and route the request based on the returned active and scope claims.

Token Revocation on Sign-Out

On user-initiated sign-out, the agent calls POST /token/revoke to invalidate the user's refresh token and POST /session/end (or the discovered end_session endpoint) to terminate their SSO session. This closes the loop on logout in a way that JWT expiry alone cannot, which is important for shared-device scenarios.

Call POST /token/revoke with token=<refresh_token> followed by GET /session/end with id_token_hint=<id_token> to complete sign-out.

AI Agent IdP Operations via Jentic

Wire Connect2id management into an AI assistant used by platform engineers. The agent searches Jentic for register an oidc client, loads the POST /clients schema, and executes it with the master API token isolated in the Jentic vault. The same flow covers updates, deletes, and introspection, so the assistant becomes a thin layer over the IdP control plane.

Through Jentic, search register an oidc client, load the POST /clients schema, and execute it with redirect_uris and grant_types for the new service.

Key Endpoints

18 endpoints — jentic publishes the only available openapi specification for connect2id server api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/clients

PUT

/clients/{clientId}

Update an OIDC client registration

DELETE

/clients/{clientId}

Delete an OIDC client

POST

/token

Token endpoint (issue access/refresh tokens)

POST

/token/introspect

Token introspection (RFC 7662)

POST

/token/revoke

Token revocation (RFC 7009)

GET

/.well-known/openid-configuration

OpenID Connect Discovery

POST

/clients

PUT

/clients/{clientId}

Update an OIDC client registration

DELETE

/clients/{clientId}

Delete an OIDC client

POST

/token

Token endpoint (issue access/refresh tokens)

POST

/token/introspect

Token introspection (RFC 7662)

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Connect2id master API tokens and client credentials are stored encrypted in the Jentic vault. Agents call operations through scoped Jentic tokens; raw tokens and client secrets never enter the agent's context.

Intent-based discovery

Agents search Jentic by intent (for example, register an oidc client) and Jentic returns the matching Connect2id operation with its input schema, so the agent picks the right endpoint without reading the docs portal.

Time to first call

Direct Connect2id integration: 1-2 days to wire client registration, token issuance, and introspection. Through Jentic: under 1 hour for a single workflow — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Auth0 Management API

Auth0 is a hosted identity platform with similar OIDC support

Pick Auth0 for a fully hosted IdP with extensive UI; pick Connect2id when you need a self-hosted, standards-strict OAuth/OIDC server.

Alternative

Okta API

Okta is a hosted workforce and customer identity platform

Pick Okta for enterprise SSO, lifecycle, and policy management; pick Connect2id when the deployment must be self-hosted in your own infrastructure.

Alternative

Keycloak Admin API

Keycloak is the open-source self-hosted IdP from Red Hat

Pick Keycloak when an open-source license is required; pick Connect2id for a commercial, lighter-weight server with strict spec compliance.

FAQs

Specific to using Connect2id Server API API through Jentic.

Why is there no official OpenAPI spec for Connect2id Server API?

Connect2id documents the API as standards-based REST endpoints in HTML pages but does not ship a single OpenAPI 3 specification. Jentic generates and maintains this spec so that AI agents and developers can call Connect2id Server API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Connect2id Server API use?

Two schemes are supported: HTTP Bearer with a master API token or an access token for management endpoints, and HTTP Basic with client_id and client_secret for client-authenticated calls (token endpoint, introspection, revocation). Through Jentic the credential is held in the vault and inserted server-side.

Can I introspect a bearer token through this API?

Yes. POST /token/introspect implements RFC 7662 and returns whether the token is active along with its scope, sub, exp, and other claims. This is the recommended endpoint for resource servers that need real-time revocation checks rather than relying on JWT expiry alone.

Can I dynamically register OIDC clients?

Yes. POST /clients implements OIDC dynamic client registration. The response returns a client_id and (for confidential clients) a client_secret, plus a registration_access_token that can be used with PUT and DELETE on /clients/{clientId} for subsequent updates.

Where do I get the JWKS for token verification?

GET /jwks.json returns the server's public JSON Web Key Set, which clients use to verify access token and ID token signatures locally. The JWKS URL is also published in the discovery document at GET /.well-known/openid-configuration.

How do I provision an OIDC client through Jentic?

Run pip install jentic, then await client.search('register an oidc client'), load the matching operation schema, and execute it. The underlying call is POST /clients with the client metadata you supply at runtime.