OAuth, OIDC and SAML endpoints

The reference table of every public protocol endpoint, the grant types of the token endpoint, and the SAML and SCIM surfaces.

All protocol endpoints live on your sign-in domain. Examples use https://accounts.obexal.com, the default domain: if your organization uses a custom domain, it replaces that host everywhere, including in the issuer.

Discovery

Two public documents are the entry point for any integration:

curl https://accounts.obexal.com/.well-known/openid-configuration
curl https://accounts.obexal.com/.well-known/jwks.json

The discovery document advertises the exact capabilities of the platform:

OAuth 2.1 and OIDC endpoints

/oauth/authorize also accepts a request_uri obtained from /oauth/par (single use); the other query parameters are then ignored. /oauth/logout accepts client_id, post_logout_redirect_uri (validated against the client's registered allowlist) and state.

Grant types at the token endpoint

POST /oauth/token takes a form-encoded body and returns JSON with Cache-Control: no-store. The grant_type parameter selects the flow:

Client authentication supports client_secret_basic, client_secret_post, private_key_jwt (signed assertion, RFC 7523) and none for public clients, which rely on PKCE alone. On any grant, an optional DPoP header binds the issued token to the client's key (cnf.jkt claim) and the token_type becomes DPoP instead of Bearer. See Advanced client security.

curl -X POST https://accounts.obexal.com/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=svc-reporting \
  -d client_secret="$CLIENT_SECRET"

{"access_token": "eyJhbGciOiJSUzI1NiIs...", "token_type": "Bearer", "expires_in": 600, "scope": "reports:read"}

Only authorization_code and refresh_token return a refresh token and, with the openid scope, an ID token. Token Exchange responses add issued_token_type. Error responses use the OAuth shape (error, error_description): see Errors and limits, and Validate tokens for consuming what you receive.

Back-channel logout

Back-channel logout is emitted, not received: there is no inbound logout endpoint. When a user's session ends, Obexal POSTs a signed logout_token (JWT, typ: logout+jwt, RS256) to the backchannel_logout_uri registered on each application the user had consented to. Logout is keyed by sub, not by session (backchannel_logout_session_supported: false). See Sessions and logout.

SAML 2.0 endpoints

In the paths below, {tenant} is your organization slug.

Obexal as identity provider (outbound SSO, see SAML IdP):

Obexal as service provider (inbound enterprise SSO, see SAML SP):

SCIM 2.0

Inbound provisioning is served under /scim/v2 (resource Users only), authenticated by a per-tenant bearer token. The full surface, attribute schema and limits are documented in the SCIM reference.