# OpenID Discovery Endpoint

```
GET /.well-known/openid-configuration
```

The OpenID Discovery Endpoint provides essential metadata about the OpenID Provider (OP) configuration. This metadata allows Relying Parties (RPs) to dynamically configure their interactions with the OP.

{% hint style="info" %}
Responses from the OpenID Discovery Endpoint should be cached for at least 1 hour to minimize repeated requests during OIDC/OAuth2 operations.
{% endhint %}

#### Response

Response Example

```http
HTTP/2 200
content-type: application/json; charset=utf-8
content-length: 1667  

{
  "authorization_endpoint": "https://stg-id.corppass.gov.sg/mga/sps/oauth/oauth20/authorize",
  "claims_parameter_supported": false,
  "claims_supported": [
    "nonce",
    "aud",
    "iss",
    "sub",
    "exp",
    "iat",
    "userInfo",
    "entityInfo",
    "AuthInfo",
    "TPAuthInfo",
    "rt_hash",
    "at_hash",
    "amr",
    "email",
    "email_verified",
    "sid",
    "auth_time",
    "EntityInfo"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "grant_types_supported": [
    "authorization_code"
  ],
  "issuer": "https://stg-id.corppass.gov.sg",
  "jwks_uri": "https://stg-id.corppass.gov.sg/.well-known/keys",
  "authorization_response_iss_parameter_supported": false,
  "response_modes_supported": [
    "form_post",
    "fragment",
    "query"
  ],
  "response_types_supported": [
    "code"
  ],
  "scopes_supported": [
    "openid"
  ],
  "subject_types_supported": [
    "public"
  ],
  "token_endpoint_auth_methods_supported": [
    "private_key_jwt"
  ],
  "token_endpoint_auth_signing_alg_values_supported": [
    "ES256",
    "ES256K",
    "ES384",
    "ES512"
  ],
  "token_endpoint": "https://stg-id.corppass.gov.sg/mga/sps/oauth/oauth20/token",
  "id_token_signing_alg_values_supported": [
    "ES256"
  ],
  "id_token_encryption_alg_values_supported": [
    "ECDH-ES+A128KW",
    "ECDH-ES+A192KW",
    "ECDH-ES+A256KW"
  ],
  "id_token_encryption_enc_values_supported": [
    "A256CBC-HS512"
  ],
  "request_parameter_supported": false,
  "request_uri_parameter_supported": false,
  "userinfo_endpoint": "https://stg-id.corppass.gov.sg/authorization-info",
  "userinfo_signing_alg_values_supported": [
    "ES256"
  ],
  "userinfo_encryption_alg_values_supported": [
    "A128KW",
    "A256KW",
    "ECDH-ES",
    "RSA-OAEP",
    "RSA-OAEP-256",
    "dir"
  ],
  "userinfo_encryption_enc_values_supported": [
    "A128CBC-HS256",
    "A128GCM",
    "A256CBC-HS512",
    "A256GCM"
  ],
  "claim_types_supported": [
    "normal"
  ],
  "name": "corppass",
  "authorization-info_endpoint": "https://stg-id.corppass.gov.sg/authorization-info"
}
```

Response Fields

<table><thead><tr><th width="259">Field</th><th width="125">Type</th><th>Description</th></tr></thead><tbody><tr><td>issuer</td><td>String</td><td>The URL identifying the OpenID Provider (OP) as the issuer of tokens. Defined in <a href="https://tools.ietf.org/html/rfc7519#section-4.1.1">RFC 7519, Section 4.1.1</a>.</td></tr><tr><td>authorization_endpoint</td><td>String</td><td>The URL of the OP's OAuth 2.0 Authorization Endpoint, where users authenticate and provide consent. Refer to <a href="https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint">OpenID Connect Core 1.0, Section 3.1.2</a>.</td></tr><tr><td>jwks_uri</td><td>String</td><td>The URL of the OP's JSON Web Key Set (JWKS) endpoint. Clients use this endpoint to retrieve public keys for validating token signatures. Refer to <a href="https://tools.ietf.org/html/rfc7517#section-4">RFC 7517, Section 4</a>.</td></tr><tr><td>response_types_supported</td><td>Array</td><td>JSON array containing a list of OAuth 2.0 <code>response_type</code> values that the OP supports. Defined in OAuth 2.0 Multiple Response Type Encoding Practices.</td></tr><tr><td>scopes_supported</td><td>Array</td><td>JSON array listing the OAuth 2.0 <code>scope</code> values that the OP supports, such as <code>openid</code>, which is mandatory for OpenID Connect flows.</td></tr><tr><td>subject_types_supported</td><td>Array</td><td>JSON array containing a list of Subject Identifier types that the OP supports, such as <code>public</code> or <code>pairwise</code>. Refer to <a href="https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes">OpenID Connect Core 1.0, Section 8</a>.</td></tr><tr><td>claims_supported</td><td>Array</td><td>JSON array containing a list of Claim Names the OP may supply in tokens or the UserInfo response. Defined in <a href="https://openid.net/specs/openid-connect-core-1_0.html#Claims">OpenID Connect Core 1.0, Section 5.1</a>.</td></tr><tr><td>grant_types_supported</td><td>Array</td><td>JSON array listing the OAuth 2.0 <code>grant_type</code> values supported by the OP, such as <code>authorization_code</code> or <code>refresh_token</code>. Refer to RFC 6749, Section 4.</td></tr><tr><td>token_endpoint</td><td>String</td><td>The URL of the OP's OAuth 2.0 Token Endpoint. Clients exchange an authorization code for tokens at this endpoint.</td></tr><tr><td>token_endpoint_auth_methods_supported</td><td>Array</td><td>JSON array listing the client authentication methods supported by the Token Endpoint, such as <code>private_key_jwt</code>. Refer to <a href="https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OpenID Connect Core 1.0, Section 9</a>.</td></tr><tr><td>token_endpoint_auth_signing_alg_values_supported</td><td>Array</td><td>JSON array listing the JWS signing algorithms (<code>alg</code> values) supported by the Token Endpoint for JWT authentication. Refer to <a href="https://tools.ietf.org/html/rfc7518#section-3.1">RFC 7518, Section 3.1</a>.</td></tr><tr><td>id_token_signing_alg_values_supported</td><td>Array</td><td>JSON array listing the JWS signing algorithms (<code>alg</code> values) supported by the OP for signing ID Tokens. Defined in <a href="https://tools.ietf.org/html/rfc7518#section-3.1">RFC 7518, Section 3.1</a>.</td></tr><tr><td>id_token_encryption_alg_values_supported</td><td>Array</td><td>JSON array listing the JWE encryption algorithms (<code>alg</code> values) supported by the OP for encrypting ID Tokens. Defined in <a href="https://tools.ietf.org/html/rfc7516#section-4.1.1">RFC 7516, Section 4.1.1</a>.</td></tr><tr><td>id_token_encryption_enc_values_supported</td><td>Array</td><td>JSON array listing the JWE encryption algorithms (<code>enc</code> values) supported by the OP for encrypting ID Tokens. Defined in <a href="https://tools.ietf.org/html/rfc7516#section-4.1.2">RFC 7516, Section 4.1.2</a>.</td></tr><tr><td>authorization-info_endpoint</td><td>String</td><td>The URL of the OP's Authorization Info Endpoint, used to retrieve the user's authorization and third-party authorization details.</td></tr><tr><td>claims_parameter_supported</td><td>Boolean</td><td>Boolean value indicating whether the OP supports the <code>claims</code> parameter to request specific claims. If omitted, the default value is <code>false</code>. Refer to <a href="https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests">OpenID Connect Core 1.0, Section 5.5</a>.</td></tr><tr><td>code_challenge_methods_supported</td><td>Array</td><td>JSON array listing the Proof Key for Code Exchange (PKCE) <code>code_challenge</code> methods supported by the OP, such as <code>S256</code>. Defined in <a href="https://tools.ietf.org/html/rfc7636#section-4.3">RFC 7636, Section 4.3</a>.</td></tr><tr><td>authorization_response_iss_parameter_supported</td><td>Boolean</td><td>Boolean indicating whether the OP includes the <code>iss</code> parameter in the authorization response. If omitted, the default value is <code>false</code>.</td></tr><tr><td>response_modes_supported</td><td>Array</td><td>JSON array listing OAuth 2.0 <code>response_mode</code> values supported by the OP, such as <code>query</code> or <code>fragment</code>. Defined in OAuth 2.0 Multiple Response Type Encoding Practices.</td></tr><tr><td>request_parameter_supported</td><td>Boolean</td><td>Boolean indicating whether the OP supports the <code>request</code> parameter for JWT-based requests. Default is <code>false</code> if omitted.</td></tr><tr><td>request_uri_parameter_supported</td><td>Boolean</td><td>Boolean indicating whether the OP supports the <code>request_uri</code> parameter. Default is <code>true</code> if omitted.</td></tr><tr><td>claim_types_supported</td><td>Array</td><td>JSON array listing the Claim Types supported by the OP, such as <code>normal</code>, <code>aggregated</code>, or <code>distributed</code>. Defined in <a href="https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests">OpenID Connect Core 1.0, Section 5.6</a>.</td></tr><tr><td>userinfo_endpoint</td><td>String</td><td>The URL of the OP's UserInfo Endpoint, used to retrieve claims about the authenticated user. Defined in <a href="https://openid.net/specs/openid-connect-core-1_0.html#UserInfo">OpenID Connect Core 1.0, Section 5.3</a>.</td></tr><tr><td>userinfo_signing_alg_values_supported</td><td>Array</td><td>JSON array listing JWS signing algorithms (<code>alg</code> values) supported by the UserInfo Endpoint for encoding claims in a JWT. Defined in <a href="https://tools.ietf.org/html/rfc7515#section-4">RFC 7515, Section 4</a>.</td></tr><tr><td>userinfo_encryption_alg_values_supported</td><td>Array</td><td>JSON array listing JWE encryption algorithms (<code>alg</code> values) supported by the UserInfo Endpoint for encrypting claims in a JWT. Defined in <a href="https://tools.ietf.org/html/rfc7516#section-4.1.1">RFC 7516, Section 4.1.1</a>.</td></tr><tr><td>userinfo_encryption_enc_values_supported</td><td>Array</td><td>JSON array listing JWE encryption algorithms (<code>enc</code> values) supported by the UserInfo Endpoint for encrypting claims in a JWT. Defined in <a href="https://tools.ietf.org/html/rfc7516#section-4.1.2">RFC 7516, Section 4.1.2</a>.</td></tr></tbody></table>

{% hint style="info" %}
The `userinfo_endpoint` in OIDC is analogous to the `authorization-info_endpoint` in the Corppass Authorization system, which provides similar functionalities, offering detailed information about the authenticated user after a successful login.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-legacy/endpoints/well-known-endpoints/openid-discovery-endpoint.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.