Auth Service API

Authentication, authorization, token exchange, and DID key management for the Guardian Platform. Supports Auth0, Keycloak, Microsoft Entra ID, and generic OIDC providers with multi-tenant RBAC, API keys, and service-account tokens.

Version: 1.2.1
Base URL: https://localhost:8080

Authentication

ApiKeyAuth · API key in header "Authorization" — Type "Bearer" followed by a space and API key
BearerAuth · API key in header "Authorization" — Type "Bearer" followed by a space and JWT token

API Keys

getList API keys/api/v1/api-keys
postCreate API key/api/v1/api-keys
getGet API key details/api/v1/api-keys/{keyId}
deleteRevoke API key/api/v1/api-keys/{keyId}
getGet API key usage/api/v1/api-keys/{keyId}/usage
getList creatable API key scopes/api/v1/api-keys/creatable-scopes

Authentication

getGet JSON Web Key Set for token validation/api/v1/auth/.well-known/jwks.json
postEnrich JWT claims with user context and ensure DID key/api/v1/auth/claims-enrichment
postExchange or refresh an access token/api/v1/auth/token
postExchange or refresh an access token/api/v1/auth/token-exchange
postValidate a credential and resolve the caller/api/v1/auth/validate

DID Keys

postCreate a DID key for a user/api/v1/auth/did-key
getGet DID key information/api/v1/auth/did-key/{keyId}
deleteDelete a DID key/api/v1/auth/did-key/{keyId}
getList user's DID keys/api/v1/auth/users/{userId}/did-keys
getGet an organization member's DID document/api/v1/organizations/{organizationId}/members/{userId}/did-doc
getGet current user's DID document/api/v1/protected/did-doc
getGet platform DID document/api/v1/protected/platform/did-doc
postSign a digest with the platform DID key/api/v1/protected/platform/sign
getGet version-bound signing metadata for the shared platform key/api/v1/protected/platform/signing-key
postSign a digest with the authenticated user's DID key/api/v1/protected/sign
postSign a PDF digest with the platform DID key/api/v1/protected/sign-pdf
getGet the version-bound PDF signing certificate for the platform key/api/v1/protected/sign-pdf/certificate
getGet version-bound signing metadata for the current user/api/v1/protected/signing-key
getGet platform DID document/platform/api/v1/protected/did-doc
postSign a digest with the platform DID key/platform/api/v1/protected/sign
getGet version-bound signing metadata for the shared platform key/platform/api/v1/protected/signing-key

External Users

getList external users from IDP/api/v1/external-users
postImport an external IDP user into the platform/api/v1/external-users/import

Organizations

postAdd user to organization/api/v1/organizations/{organizationId}/members
deleteRemove user from organization/api/v1/organizations/{organizationId}/members/{userId}
patchUpdate organization member roles/api/v1/organizations/{organizationId}/members/{userId}

Memberships

getGet user memberships within an organization/api/v1/organizations/{organizationId}/members/{userId}/memberships
getList memberships for all users in an organization/api/v1/organizations/{organizationId}/memberships
putUpdate user roles in a project/api/v1/organizations/{organizationId}/projects/{projectId}/members/{userId}
postAssign user to project/api/v1/organizations/{organizationId}/projects/{projectId}/members/{userId}
deleteRemove user from project/api/v1/organizations/{organizationId}/projects/{projectId}/members/{userId}

Users

getGet user profile/api/v1/protected/profile
getList platform users/api/v1/users

RBAC

getCheck user permission/api/v1/rbac/check/permission/{permission}
getCheck user permission in project/api/v1/rbac/check/permission/{permission}/project/{projectId}
getGet permission metadata/api/v1/rbac/metadata/permissions
getGet role metadata/api/v1/rbac/metadata/roles
getList projects where the user holds a permission/api/v1/rbac/permission/{permission}/projects
getGet user permissions for governance/api/v1/rbac/user/permissions
getGet current user's roles/api/v1/rbac/user/roles

Service Accounts

getGet service account access token/api/v1/service-accounts/{serviceName}/token

Service API

getGet DID key for service/api/v1/service/did-keys/{keyId}
getList user's DID keys for service/api/v1/service/users/{userId}/did-keys

Health

getLiveness probe/health
getAuthenticated health check for IDP actions/health/auth
getReadiness check endpoint/health/ready
getSigning backend health and telemetry/health/signing