Ory Sh Ory APIs

Name: Ory APIs
Brand: Ory APIs
Availability: InStock

✓ Official Vendor SpecIdentity AuthAuthenticationoauth2, bearer, basic146 EndpointsREST

For Agents

Run identity, OAuth 2.0, OpenID Connect, and Zanzibar-style permission checks against Ory Network. Agents can manage users, sessions, OAuth clients, and access policies through a single API.

Install Jentic One Beta

Connect the Ory APIs to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Ory APIs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Ory APIs.

Run self-service login, registration, recovery, and settings flows for end users

Manage OAuth 2.0 clients, authorisation requests, and token introspection

Issue and revoke user sessions, including impersonation and refresh handling

GET STARTED

Start building with Ory APIs

Explore with Jentic

View OpenAPI Document

Ory APIs provide a unified surface over Ory Network's identity, session, OAuth 2.0, OpenID Connect, and permission services. Developers can register and authenticate users, run self-service flows for login, registration, recovery, verification, and settings, issue and introspect OAuth 2.0 tokens, and evaluate fine-grained permissions backed by Google Zanzibar. With 146 endpoints across identity, frontend, courier, oAuth2, OIDC, permission, and project management, Ory replaces a stack of bespoke auth code for SaaS and B2B platforms.

Use Cases

Patterns agents use Ory APIs for, with concrete tasks.

★ Customer Identity for SaaS Applications

SaaS teams use Ory to ship login, registration, MFA, and account recovery without building auth from scratch. The frontend self-service flows handle browser and native clients, while the identity admin endpoints let backend services list, update, and deactivate users. A typical embedded login page goes live in 1-2 days using the prebuilt Ory Account Experience or in a week with a fully custom UI.

Initialise a registration flow with GET /self-service/registration/api, then submit the user's email and password to the returned action URL and capture the resulting session token.

OAuth 2.0 Authorisation Server

Platforms that expose third-party APIs use Ory Hydra (surfaced via /admin/clients and /oauth2/*) as their OAuth 2.0 and OpenID Connect provider. Endpoints cover the full authorisation code, client credentials, and refresh token flows, plus token introspection and revocation. Hydra handles consent UI hand-off, so teams keep their own login experience while delegating protocol compliance.

Create a new confidential OAuth client by POSTing to /admin/clients with client_name, redirect_uris, and grant_types ['authorization_code','refresh_token'].

Fine-Grained Authorisation with Keto

Applications that need per-resource permission checks (who can read which document, who can edit which project) use Ory's permission API to evaluate Zanzibar-style relation tuples. Endpoints under /relation-tuples and /permissions answer 'subject X has permission Y on resource Z' in milliseconds, letting agents enforce ACLs without hard-coding role checks in application code.

Check whether user 'alice@example.com' has 'editor' permission on document 'doc-42' by calling GET /relation-tuples/check with subject and object query params.

AI Agent Identity Plumbing via Jentic

Agents that act on behalf of human users need session validation, OAuth token issuance, and permission checks at runtime. Through Jentic, an agent searches for 'check user permission' and Ory's permission endpoints surface with their schemas. The agent can then enforce per-call authorisation without the developer wiring a bespoke Ory client into the agent loop.

Use Jentic to search 'verify a session token', load the GET /sessions/whoami schema, and execute it with the session cookie supplied by the calling user.

Key Endpoints

146 endpoints — ory apis provide a unified surface over ory network's identity, session, oauth 2.

METHOD

PATH

DESCRIPTION

GET

/sessions/whoami

Return the current user's session

GET

/admin/identities

List identities in the project

POST

/admin/identities

Create a new identity

POST

/admin/clients

POST

/oauth2/token

Issue an OAuth 2.0 token

POST

/oauth2/introspect

Introspect an OAuth 2.0 access or refresh token

GET

/relation-tuples/check

Check a permission relation tuple

GET

/.well-known/openid-configuration

OpenID Connect discovery document

GET

/sessions/whoami

Return the current user's session

GET

/admin/identities

List identities in the project

POST

/admin/identities

Create a new identity

POST

/admin/clients

POST

/oauth2/token

Issue an OAuth 2.0 token

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Ory access tokens, OAuth client secrets, and workspace API keys are stored encrypted in the Jentic vault. Agents receive scoped access tokens — raw Bearer tokens never enter the agent's context, and Basic auth credentials for OAuth client endpoints are injected only at execution time.

Intent-based discovery

Agents search by intent (e.g. 'check a user permission') and Jentic returns the matching Ory operation with its input schema, so the agent picks the right tag — identity, oAuth2, permission, or frontend — without walking the 146-endpoint spec.

Time to first call

Direct Ory integration: 3-7 days to wire up self-service flows, OAuth client management, and Keto checks. Through Jentic: under 1 hour — search, load schema, execute.

FAQs

Specific to using Ory APIs through Jentic.

What authentication does the Ory API use?

Ory APIs accept multiple schemes depending on the operation: OAuth 2.0 access tokens for protected user data, an Ory access token (Bearer) for project-admin actions, an Ory workspace API key for cross-project operations, and HTTP Basic for legacy OAuth client endpoints. Through Jentic the appropriate credential for each operation is held in the Jentic vault and injected at call time.

Can I issue OAuth 2.0 tokens with the Ory API?

Yes. POST /oauth2/token implements the standard OAuth 2.0 token endpoint and supports authorization_code, client_credentials, and refresh_token grants. Companion endpoints /oauth2/introspect and /oauth2/revoke handle introspection and revocation.

What are the rate limits for the Ory API?

Ory Network applies plan-based rate limits per project, but specific limits are not encoded in the OpenAPI spec. The API returns a 429 with a Retry-After header when a project exceeds its quota. Self-hosted deployments of Ory Kratos, Hydra, and Keto have no built-in rate limits.

How do I check a user's permission through Jentic?

Through Jentic, search for 'check user permission', load the GET /relation-tuples/check schema, and execute it with namespace, object, relation, and subject_id query parameters. Jentic injects the project's Ory access token automatically.

How do I run a self-service login flow with the Ory API?

Initialise the flow with GET /self-service/login/api or /self-service/login/browser, follow the action URL returned in the flow body, and submit the user's credentials. On success the response contains a session token (API flow) or sets a session cookie (browser flow).

Is the Ory API free to use?

Ory Network has a free Developer plan with limited monthly active users; production tiers are usage-priced based on MAUs and add-ons. The underlying Ory Kratos, Hydra, and Keto projects are open source and free to self-host.

Ory Sh Ory APIs

Connect the Ory APIs to your agent

Capabilities

Start building with Ory APIs

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs