You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The OpenID Connect Dynamic Client Registration specification has no concept of whitelisting OAuth 2.0 Scope. If you want to expose Dynamic Client Registration, you should set the default scope enabled for newly registered clients. Keep in mind that users can overwrite this default by setting the "scope" key in the registration payload, effectively disabling the concept of whitelisted scopes.
@@ -12934,7 +12963,7 @@ components:
12934
12963
GenericUsage:
12935
12964
properties:
12936
12965
additional_price:
12937
-
$ref: '#/components/schemas/Money'
12966
+
type: string
12938
12967
included_usage:
12939
12968
description: IncludedUsage is the number of included items.
12940
12969
format: int64
@@ -13552,15 +13581,7 @@ components:
13552
13581
type: string
13553
13582
type: object
13554
13583
Money:
13555
-
properties:
13556
-
Cents:
13557
-
format: int64
13558
-
type: integer
13559
-
String:
13560
-
type: string
13561
-
Unit:
13562
-
type: string
13563
-
type: object
13584
+
type: string
13564
13585
NormalizedProjectRevisionCourierChannel:
13565
13586
properties:
13566
13587
channel_id:
@@ -13787,12 +13808,12 @@ components:
13787
13808
type: string
13788
13809
development_features:
13789
13810
additionalProperties:
13790
-
$ref: '#/components/schemas/GenericUsage'
13811
+
$ref: '#/components/schemas/Usage'
13791
13812
title: PlanFeatures are the feature definitions included in the plan.
13792
13813
type: object
13793
13814
features:
13794
13815
additionalProperties:
13795
-
$ref: '#/components/schemas/GenericUsage'
13816
+
$ref: '#/components/schemas/Usage'
13796
13817
title: PlanFeatures are the feature definitions included in the plan.
13797
13818
type: object
13798
13819
latest:
@@ -13804,12 +13825,12 @@ components:
13804
13825
type: string
13805
13826
production_features:
13806
13827
additionalProperties:
13807
-
$ref: '#/components/schemas/GenericUsage'
13828
+
$ref: '#/components/schemas/Usage'
13808
13829
title: PlanFeatures are the feature definitions included in the plan.
13809
13830
type: object
13810
13831
staging_features:
13811
13832
additionalProperties:
13812
-
$ref: '#/components/schemas/GenericUsage'
13833
+
$ref: '#/components/schemas/Usage'
13813
13834
title: PlanFeatures are the feature definitions included in the plan.
13814
13835
type: object
13815
13836
version:
@@ -13835,7 +13856,7 @@ components:
13835
13856
type: object
13836
13857
PlanFeatures:
13837
13858
additionalProperties:
13838
-
$ref: '#/components/schemas/GenericUsage'
13859
+
$ref: '#/components/schemas/Usage'
13839
13860
title: PlanFeatures are the feature definitions included in the plan.
13840
13861
type: object
13841
13862
Pricing:
@@ -14244,10 +14265,11 @@ components:
14244
14265
- token
14245
14266
type: object
14246
14267
Usage:
14247
-
properties:
14248
-
GenericUsage:
14249
-
$ref: '#/components/schemas/GenericUsage'
14250
-
type: object
14268
+
oneOf:
14269
+
- $ref: '#/components/schemas/GenericUsage'
14270
+
- type: string
14271
+
- type: boolean
14272
+
- type: number
14251
14273
VerifiableCredentialProof:
14252
14274
example:
14253
14275
proof_type: proof_type
@@ -19105,8 +19127,18 @@ components:
19105
19127
19106
19128
If set to `null` or `"0s"`, the graceful refresh token rotation is disabled.
19107
19129
19108
-
This governs the "oauth2.grant.refresh_token_rotation_grace_period" setting.
19130
+
This governs the "oauth2.grant.refresh_token.rotation_grace_period" setting.
The OpenID Connect Dynamic Client Registration specification has no concept of whitelisting OAuth 2.0 Scope. If you want to expose Dynamic Client Registration, you should set the default scope enabled for newly registered clients. Keep in mind that users can overwrite this default by setting the "scope" key in the registration payload, effectively disabling the concept of whitelisted scopes.
|**hydraOauth2GrantJwtIatOptional**|**Boolean**| Configures if the issued at (`iat`) claim is required in the JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523). If set to `false`, the `iat` claim is required. Set this value to `true` only after careful consideration. This governs the \"oauth2.grant.jwt.iat_optional\" setting. |[optional]|
32
32
|**hydraOauth2GrantJwtJtiOptional**|**Boolean**| Configures if the JSON Web Token ID (`jti`) claim is required in the JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523). If set to `false`, the `jti` claim is required. Set this value to `true` only after careful consideration. This governs the \"oauth2.grant.jwt.jti_optional\" setting. |[optional]|
33
33
|**hydraOauth2GrantJwtMaxTtl**|**String**| Configures what the maximum age of a JWT assertion used in the JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523) can be. This feature uses the `exp` claim and `iat` claim to calculate assertion age. Assertions exceeding the max age will be denied. Useful as a safety measure and recommended to keep below 720h. This governs the \"oauth2.grant.jwt.max_ttl\" setting. |[optional]|
34
-
|**hydraOauth2GrantRefreshTokenRotationGracePeriod**|**String**| Configures the OAuth2 Grant Refresh Token Rotation Grace Period If set to `null` or `\"0s\"`, the graceful refresh token rotation is disabled. This governs the \"oauth2.grant.refresh_token_rotation_grace_period\" setting. |[optional]|
34
+
|**hydraOauth2GrantRefreshTokenRotationGracePeriod**|**String**| Configures the OAuth2 Grant Refresh Token Rotation Grace Period If set to `null` or `\"0s\"`, the graceful refresh token rotation is disabled. This governs the \"oauth2.grant.refresh_token.rotation_grace_period\" setting. |[optional]|
35
+
|**hydraOauth2GrantRefreshTokenRotationGraceReuseCount**|**Long**| Configures the OAuth2 Grant Refresh Token Rotation Grace Reuse Count. The maximum number of times a refresh token can be reused within the grace period. If set to `null` or `0`, the limit is disabled. This governs the \"oauth2.grant.refresh_token.rotation_grace_reuse_count\" setting. |[optional]|
35
36
|**hydraOauth2MirrorTopLevelClaims**|**Boolean**| Set to false if you don't want to mirror custom claims under 'ext'. This governs the \"oauth2.mirror_top_level_claims\" setting. |[optional]|
36
37
|**hydraOauth2PkceEnforced**|**Boolean**| Configures whether PKCE should be enforced for all OAuth2 Clients. This governs the \"oauth2.pkce.enforced\" setting. |[optional]|
37
38
|**hydraOauth2PkceEnforcedForPublicClients**|**Boolean**| Configures whether PKCE should be enforced for OAuth2 Clients without a client secret (public clients). This governs the \"oauth2.pkce.enforced_for_public_clients\" setting. |[optional]|
38
39
|**hydraOauth2PreserveExtClaims**|**Boolean**| Set to true to keep custom claims that are not promoted to the top level in the 'ext' claim. Only applies when mirror_top_level_claims is false. This governs the \"oauth2.preserve_ext_claims\" setting. |[optional]|
39
40
|**hydraOauth2RefreshTokenHook**|**String**| Sets the Refresh Token Hook Endpoint. If set this endpoint will be called during the OAuth2 Token Refresh grant update the OAuth2 Access Token claims. This governs the \"oauth2.refresh_token_hook\" setting. |[optional]|
40
41
|**hydraOauth2TokenHook**|**String**| Sets the token hook endpoint for all grant types. If set it will be called while providing token to customize claims. This governs the \"oauth2.token_hook.url\" setting. |[optional]|
42
+
|**hydraOauth2TokenPrefix**|**String**| Sets a per-project Access Token, Refresh Token, and Authorization Code prefix. The literal \"%s\" is replaced at issuance time with the token kind: \"at\" (access token), \"rt\" (refresh token), or \"ac\" (authorization code). For example, \"acme_%s_\" yields \"acme_at_…\", \"acme_rt_…\", and \"acme_ac_…\". Must be a fmt.Sprintf template with exactly one \"%s\" substitution. The rendered prefix may contain only ASCII letters, digits, and underscores — no other \"%\" directives (\"%d\", \"%%\", positional or width-flagged verbs), no hyphens, dots, slashes, whitespace, quotes, or non-ASCII characters. Leave empty to keep the default \"ory_%s_\" prefix. This is an Enterprise feature. This governs the \"oauth2.token_prefix\" setting. |[optional]|
41
43
|**hydraOidcDynamicClientRegistrationDefaultScope**|**List<String>**| The OpenID Connect Dynamic Client Registration specification has no concept of whitelisting OAuth 2.0 Scope. If you want to expose Dynamic Client Registration, you should set the default scope enabled for newly registered clients. Keep in mind that users can overwrite this default by setting the \"scope\" key in the registration payload, effectively disabling the concept of whitelisted scopes. This governs the \"oidc.dynamic_client_registration.default_scope\" setting. |[optional]|
42
44
|**hydraOidcDynamicClientRegistrationEnabled**|**Boolean**| Configures OpenID Connect Dynamic Client Registration. This governs the \"oidc.dynamic_client_registration.enabled\" setting. |[optional]|
43
45
|**hydraOidcSubjectIdentifiersPairwiseSalt**|**String**| Configures OpenID Connect Discovery and overwrites the pairwise algorithm This governs the \"oidc.subject_identifiers.pairwise_salt\" setting. |[optional]|
0 commit comments