[{"data":1,"prerenderedAt":2070},["ShallowReactive",2],{"navigation":3,"/reference/api-endpoints":145,"/reference/api-endpoints-surround":2065},[4,28,49,88,101,127],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Getting Started","/getting-started","1.getting-started/1.index",[9,11,15,19,23],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Working with Agents","/getting-started/working-with-agents","1.getting-started/2.working-with-agents",{"title":16,"path":17,"stem":18},"Setup a Service Provider","/getting-started/setup-service-provider","1.getting-started/3.setup-service-provider",{"title":20,"path":21,"stem":22},"Setup an Identity Provider","/getting-started/setup-identity-provider","1.getting-started/4.setup-identity-provider",{"title":24,"path":25,"stem":26},"Developers","/getting-started/developers","1.getting-started/5.developers",false,{"title":29,"icon":27,"path":30,"stem":31,"children":32,"page":27},"Guides","/guides","2.guides",[33,37,41,45],{"title":34,"path":35,"stem":36},"How It Works","/guides/how-it-works","2.guides/1.how-it-works",{"title":38,"path":39,"stem":40},"Capabilities Guide","/guides/capabilities-guide","2.guides/2.capabilities-guide",{"title":42,"path":43,"stem":44},"End-to-End Tutorial","/guides/end-to-end-tutorial","2.guides/3.end-to-end-tutorial",{"title":46,"path":47,"stem":48},"Delegation Guide","/guides/delegation-guide","2.guides/4.delegation-guide",{"title":50,"path":51,"stem":52,"children":53,"icon":27},"Ecosystem","/ecosystem","3.ecosystem/1.index",[54,56,60,64,68,72,76,80,84],{"title":55,"path":51,"stem":52},"Overview",{"title":57,"path":58,"stem":59},"grapes CLI","/ecosystem/grapes","3.ecosystem/2.grapes",{"title":61,"path":62,"stem":63},"shapes CLI","/ecosystem/shapes","3.ecosystem/3.shapes",{"title":65,"path":66,"stem":67},"escapes","/ecosystem/escapes","3.ecosystem/4.escapes",{"title":69,"path":70,"stem":71},"OpenApe Proxy","/ecosystem/proxy","3.ecosystem/5.proxy",{"title":73,"path":74,"stem":75},"OpenApe Browser","/ecosystem/browser","3.ecosystem/6.browser",{"title":77,"path":78,"stem":79},"OpenApe Auth","/ecosystem/auth","3.ecosystem/7.auth",{"title":81,"path":82,"stem":83},"OpenApe Grants","/ecosystem/grants","3.ecosystem/8.grants",{"title":85,"path":86,"stem":87},"nuxt-auth-sp","/ecosystem/nuxt-auth-sp","3.ecosystem/9.nuxt-auth-sp",{"title":89,"icon":27,"path":90,"stem":91,"children":92,"page":27},"Security","/security","4.security",[93,97],{"title":94,"path":95,"stem":96},"Compliance","/security/compliance","4.security/1.compliance",{"title":98,"path":99,"stem":100},"Threat Model","/security/threat-model","4.security/2.threat-model",{"title":102,"path":103,"stem":104,"children":105,"icon":27},"Reference","/reference","5.reference/1.index",[106,107,111,115,119,123],{"title":102,"path":103,"stem":104},{"title":108,"path":109,"stem":110},"IdP Configuration","/reference/idp-configuration","5.reference/2.idp-configuration",{"title":112,"path":113,"stem":114},"SP Configuration","/reference/sp-configuration","5.reference/3.sp-configuration",{"title":116,"path":117,"stem":118},"API Endpoints","/reference/api-endpoints","5.reference/4.api-endpoints",{"title":120,"path":121,"stem":122},"escapes Config","/reference/escapes-config","5.reference/5.escapes-config",{"title":124,"path":125,"stem":126},"Proxy Config","/reference/proxy-config","5.reference/6.proxy-config",{"title":128,"path":129,"stem":130,"children":131,"icon":27},"Operations","/operations","6.operations/1.index",[132,133,137,141],{"title":128,"path":129,"stem":130},{"title":134,"path":135,"stem":136},"Deployment","/operations/deployment","6.operations/2.deployment",{"title":138,"path":139,"stem":140},"Troubleshooting","/operations/troubleshooting","6.operations/3.troubleshooting",{"title":142,"path":143,"stem":144},"Monitoring","/operations/monitoring","6.operations/4.monitoring",{"id":146,"title":116,"body":147,"description":2058,"extension":2059,"links":2060,"meta":2061,"navigation":2062,"path":117,"seo":2063,"stem":118,"__hash__":2064},"docs/5.reference/4.api-endpoints.md",{"type":148,"value":149,"toc":2022},"minimark",[150,154,167,172,175,246,250,257,260,362,447,460,466,469,510,520,523,529,532,591,600,610,614,620,627,717,857,866,877,883,886,898,904,911,922,928,931,999,1002,1011,1014,1036,1042,1045,1051,1054,1060,1063,1072,1078,1084,1105,1111,1114,1155,1168,1174,1177,1181,1187,1190,1266,1272,1275,1281,1284,1290,1293,1297,1300,1304,1377,1381,1463,1467,1523,1527,1582,1586,1684,1688,1842,1846,1902,1906,2018],[151,152,116],"h1",{"id":153},"api-endpoints",[155,156,157,158,162,163,166],"p",{},"All HTTP endpoints registered by ",[159,160,161],"code",{},"@openape/nuxt-auth-idp"," and ",[159,164,165],{},"@openape/nuxt-auth-sp",".",[168,169,171],"h2",{"id":170},"authentication","Authentication",[155,173,174],{},"API endpoints use three authentication methods:",[176,177,178,194],"table",{},[179,180,181],"thead",{},[182,183,184,188,191],"tr",{},[185,186,187],"th",{},"Method",[185,189,190],{},"Header",[185,192,193],{},"Who uses it",[195,196,197,214,233],"tbody",{},[182,198,199,206,211],{},[200,201,202],"td",{},[203,204,205],"strong",{},"Management Token",[200,207,208],{},[159,209,210],{},"Authorization: Bearer \u003Cmanagement-token>",[200,212,213],{},"Human administrators, deployment tools",[182,215,216,221,226],{},[200,217,218],{},[203,219,220],{},"Agent Token",[200,222,223],{},[159,224,225],{},"Authorization: Bearer \u003Cagent-jwt>",[200,227,228,229,232],{},"Enrolled agents (from ",[159,230,231],{},"/api/agent/authenticate",")",[182,234,235,240,243],{},[200,236,237],{},[203,238,239],{},"Session",[200,241,242],{},"Cookie-based (automatic)",[200,244,245],{},"Logged-in users in the browser",[168,247,249],{"id":248},"idp-agent-endpoints","IdP — Agent Endpoints",[251,252,254],"h3",{"id":253},"post-apiagentenroll",[159,255,256],{},"POST /api/agent/enroll",[155,258,259],{},"Register a new agent. Requires Management Token or admin session.",[261,262,267],"pre",{"className":263,"code":264,"language":265,"meta":266,"style":266},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -X POST https://id.example.com/api/agent/enroll \\\n  -H \"Authorization: Bearer \u003Cmanagement-token>\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"email\": \"agent+deploy@example.com\",\n    \"name\": \"deploy-bot\",\n    \"publicKey\": \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...\"\n  }'\n","bash","",[159,268,269,292,309,323,335,341,347,353],{"__ignoreMap":266},[270,271,274,278,282,285,288],"span",{"class":272,"line":273},"line",1,[270,275,277],{"class":276},"sBMFI","curl",[270,279,281],{"class":280},"sfazB"," -X",[270,283,284],{"class":280}," POST",[270,286,287],{"class":280}," https://id.example.com/api/agent/enroll",[270,289,291],{"class":290},"sTEyZ"," \\\n",[270,293,295,298,302,304,307],{"class":272,"line":294},2,[270,296,297],{"class":280},"  -H",[270,299,301],{"class":300},"sMK4o"," \"",[270,303,210],{"class":280},[270,305,306],{"class":300},"\"",[270,308,291],{"class":290},[270,310,312,314,316,319,321],{"class":272,"line":311},3,[270,313,297],{"class":280},[270,315,301],{"class":300},[270,317,318],{"class":280},"Content-Type: application/json",[270,320,306],{"class":300},[270,322,291],{"class":290},[270,324,326,329,332],{"class":272,"line":325},4,[270,327,328],{"class":280},"  -d",[270,330,331],{"class":300}," '",[270,333,334],{"class":280},"{\n",[270,336,338],{"class":272,"line":337},5,[270,339,340],{"class":280},"    \"email\": \"agent+deploy@example.com\",\n",[270,342,344],{"class":272,"line":343},6,[270,345,346],{"class":280},"    \"name\": \"deploy-bot\",\n",[270,348,350],{"class":272,"line":349},7,[270,351,352],{"class":280},"    \"publicKey\": \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...\"\n",[270,354,356,359],{"class":272,"line":355},8,[270,357,358],{"class":280},"  }",[270,360,361],{"class":300},"'\n",[176,363,364,377],{},[179,365,366],{},[182,367,368,371,374],{},[185,369,370],{},"Field",[185,372,373],{},"Required",[185,375,376],{},"Description",[195,378,379,395,407,422,435],{},[182,380,381,386,389],{},[200,382,383],{},[159,384,385],{},"email",[200,387,388],{},"Yes",[200,390,391,392,232],{},"Agent email (convention: ",[159,393,394],{},"agent+name@domain",[182,396,397,402,404],{},[200,398,399],{},[159,400,401],{},"name",[200,403,388],{},[200,405,406],{},"Human-readable agent name",[182,408,409,414,416],{},[200,410,411],{},[159,412,413],{},"publicKey",[200,415,388],{},[200,417,418,419,232],{},"SSH-format Ed25519 public key (",[159,420,421],{},"ssh-ed25519 ...",[182,423,424,429,432],{},[200,425,426],{},[159,427,428],{},"owner",[200,430,431],{},"No",[200,433,434],{},"Owner email (default: admin)",[182,436,437,442,444],{},[200,438,439],{},[159,440,441],{},"approver",[200,443,431],{},[200,445,446],{},"Approver email (default: admin)",[155,448,449,452,453,456,457],{},[203,450,451],{},"Response:"," ",[159,454,455],{},"201"," with ",[159,458,459],{},"{ agent_id, email, name, owner, approver, status }",[251,461,463],{"id":462},"post-apiagentchallenge",[159,464,465],{},"POST /api/agent/challenge",[155,467,468],{},"Request an authentication challenge. No auth required.",[261,470,472],{"className":263,"code":471,"language":265,"meta":266,"style":266},"curl -X POST https://id.example.com/api/agent/challenge \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"agent_id\": \"agent+deploy@example.com\"}'\n",[159,473,474,487,499],{"__ignoreMap":266},[270,475,476,478,480,482,485],{"class":272,"line":273},[270,477,277],{"class":276},[270,479,281],{"class":280},[270,481,284],{"class":280},[270,483,484],{"class":280}," https://id.example.com/api/agent/challenge",[270,486,291],{"class":290},[270,488,489,491,493,495,497],{"class":272,"line":294},[270,490,297],{"class":280},[270,492,301],{"class":300},[270,494,318],{"class":280},[270,496,306],{"class":300},[270,498,291],{"class":290},[270,500,501,503,505,508],{"class":272,"line":311},[270,502,328],{"class":280},[270,504,331],{"class":300},[270,506,507],{"class":280},"{\"agent_id\": \"agent+deploy@example.com\"}",[270,509,361],{"class":300},[155,511,512,452,514,456,517],{},[203,513,451],{},[159,515,516],{},"200",[159,518,519],{},"{ challenge: \"\u003C64-char-hex>\" }",[155,521,522],{},"Challenge expires after 60 seconds. Single-use.",[251,524,526],{"id":525},"post-apiagentauthenticate",[159,527,528],{},"POST /api/agent/authenticate",[155,530,531],{},"Authenticate with a signed challenge. No auth required.",[261,533,535],{"className":263,"code":534,"language":265,"meta":266,"style":266},"curl -X POST https://id.example.com/api/agent/authenticate \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"agent_id\": \"agent+deploy@example.com\",\n    \"challenge\": \"\u003Cchallenge-from-above>\",\n    \"signature\": \"\u003Cbase64-ed25519-signature>\"\n  }'\n",[159,536,537,550,562,570,575,580,585],{"__ignoreMap":266},[270,538,539,541,543,545,548],{"class":272,"line":273},[270,540,277],{"class":276},[270,542,281],{"class":280},[270,544,284],{"class":280},[270,546,547],{"class":280}," https://id.example.com/api/agent/authenticate",[270,549,291],{"class":290},[270,551,552,554,556,558,560],{"class":272,"line":294},[270,553,297],{"class":280},[270,555,301],{"class":300},[270,557,318],{"class":280},[270,559,306],{"class":300},[270,561,291],{"class":290},[270,563,564,566,568],{"class":272,"line":311},[270,565,328],{"class":280},[270,567,331],{"class":300},[270,569,334],{"class":280},[270,571,572],{"class":272,"line":325},[270,573,574],{"class":280},"    \"agent_id\": \"agent+deploy@example.com\",\n",[270,576,577],{"class":272,"line":337},[270,578,579],{"class":280},"    \"challenge\": \"\u003Cchallenge-from-above>\",\n",[270,581,582],{"class":272,"line":343},[270,583,584],{"class":280},"    \"signature\": \"\u003Cbase64-ed25519-signature>\"\n",[270,586,587,589],{"class":272,"line":349},[270,588,358],{"class":280},[270,590,361],{"class":300},[155,592,593,452,595,456,597],{},[203,594,451],{},[159,596,516],{},[159,598,599],{},"{ token, agent_id, email, name, expires_in }",[155,601,602,603,606,607,166],{},"The ",[159,604,605],{},"token"," is a JWT with claims ",[159,608,609],{},"{ sub, act: \"agent\", iss, iat, exp }",[168,611,613],{"id":612},"idp-grant-endpoints","IdP — Grant Endpoints",[251,615,617],{"id":616},"post-apigrants",[159,618,619],{},"POST /api/grants",[155,621,622,623,626],{},"Create a grant request. Agent token or session optional (auto-sets ",[159,624,625],{},"requester",").",[261,628,630],{"className":263,"code":629,"language":265,"meta":266,"style":266},"curl -X POST https://id.example.com/api/grants \\\n  -H \"Authorization: Bearer \u003Cagent-token>\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"requester\": \"agent+deploy@example.com\",\n    \"target_host\": \"prod-server.example.com\",\n    \"audience\": \"escapes\",\n    \"grant_type\": \"once\",\n    \"command\": [\"systemctl\", \"restart\", \"nginx\"],\n    \"reason\": \"Deploy hotfix\"\n  }'\n",[159,631,632,645,658,670,678,683,688,693,698,704,710],{"__ignoreMap":266},[270,633,634,636,638,640,643],{"class":272,"line":273},[270,635,277],{"class":276},[270,637,281],{"class":280},[270,639,284],{"class":280},[270,641,642],{"class":280}," https://id.example.com/api/grants",[270,644,291],{"class":290},[270,646,647,649,651,654,656],{"class":272,"line":294},[270,648,297],{"class":280},[270,650,301],{"class":300},[270,652,653],{"class":280},"Authorization: Bearer \u003Cagent-token>",[270,655,306],{"class":300},[270,657,291],{"class":290},[270,659,660,662,664,666,668],{"class":272,"line":311},[270,661,297],{"class":280},[270,663,301],{"class":300},[270,665,318],{"class":280},[270,667,306],{"class":300},[270,669,291],{"class":290},[270,671,672,674,676],{"class":272,"line":325},[270,673,328],{"class":280},[270,675,331],{"class":300},[270,677,334],{"class":280},[270,679,680],{"class":272,"line":337},[270,681,682],{"class":280},"    \"requester\": \"agent+deploy@example.com\",\n",[270,684,685],{"class":272,"line":343},[270,686,687],{"class":280},"    \"target_host\": \"prod-server.example.com\",\n",[270,689,690],{"class":272,"line":349},[270,691,692],{"class":280},"    \"audience\": \"escapes\",\n",[270,694,695],{"class":272,"line":355},[270,696,697],{"class":280},"    \"grant_type\": \"once\",\n",[270,699,701],{"class":272,"line":700},9,[270,702,703],{"class":280},"    \"command\": [\"systemctl\", \"restart\", \"nginx\"],\n",[270,705,707],{"class":272,"line":706},10,[270,708,709],{"class":280},"    \"reason\": \"Deploy hotfix\"\n",[270,711,713,715],{"class":272,"line":712},11,[270,714,358],{"class":280},[270,716,361],{"class":300},[176,718,719,729],{},[179,720,721],{},[182,722,723,725,727],{},[185,724,370],{},[185,726,373],{},[185,728,376],{},[195,730,731,742,754,773,794,806,818,833,845],{},[182,732,733,737,739],{},[200,734,735],{},[159,736,625],{},[200,738,388],{},[200,740,741],{},"Agent email",[182,743,744,749,751],{},[200,745,746],{},[159,747,748],{},"target_host",[200,750,388],{},[200,752,753],{},"Host where grant is valid",[182,755,756,761,763],{},[200,757,758],{},[159,759,760],{},"audience",[200,762,388],{},[200,764,765,766,768,769,772],{},"Service identifier (",[159,767,65],{},", ",[159,770,771],{},"proxy",", etc.)",[182,774,775,780,782],{},[200,776,777],{},[159,778,779],{},"grant_type",[200,781,431],{},[200,783,784,787,788,768,791],{},[159,785,786],{},"once"," (default), ",[159,789,790],{},"timed",[159,792,793],{},"always",[182,795,796,801,803],{},[200,797,798],{},[159,799,800],{},"command",[200,802,431],{},[200,804,805],{},"Command array",[182,807,808,813,815],{},[200,809,810],{},[159,811,812],{},"permissions",[200,814,431],{},[200,816,817],{},"Permission strings",[182,819,820,825,830],{},[200,821,822],{},[159,823,824],{},"duration",[200,826,827,828],{},"For ",[159,829,790],{},[200,831,832],{},"Duration in seconds",[182,834,835,840,842],{},[200,836,837],{},[159,838,839],{},"reason",[200,841,431],{},[200,843,844],{},"Human-readable reason",[182,846,847,852,854],{},[200,848,849],{},[159,850,851],{},"run_as",[200,853,431],{},[200,855,856],{},"Execute as this user",[155,858,859,452,861,456,863],{},[203,860,451],{},[159,862,455],{},[159,864,865],{},"{ id, type, request, status: \"pending\", created_at }",[867,868,870],"callout",{"type":869},"info",[155,871,827,872,162,874,876],{},[159,873,790],{},[159,875,793],{}," grants, the system checks for existing reusable grants with matching parameters. If found, the existing grant is returned instead of creating a new one.",[251,878,880],{"id":879},"get-apigrants",[159,881,882],{},"GET /api/grants",[155,884,885],{},"List grants. Session or agent token required.",[155,887,888,452,891,768,894,897],{},[203,889,890],{},"Query params:",[159,892,893],{},"status",[159,895,896],{},"limit"," (max 100)",[251,899,901],{"id":900},"get-apigrantsid",[159,902,903],{},"GET /api/grants/:id",[155,905,906,907,910],{},"Get grant details. Supports ETag-based polling via ",[159,908,909],{},"If-None-Match"," header.",[155,912,913,452,915,917,918,921],{},[203,914,451],{},[159,916,516],{}," with full grant object, or ",[159,919,920],{},"304 Not Modified"," if unchanged.",[251,923,925],{"id":924},"post-apigrantsidapprove",[159,926,927],{},"POST /api/grants/:id/approve",[155,929,930],{},"Approve a pending grant. Requires admin session, management token, or authorized approver.",[261,932,934],{"className":263,"code":933,"language":265,"meta":266,"style":266},"curl -X POST https://id.example.com/api/grants/\u003Cid>/approve \\\n  -H \"Authorization: Bearer \u003Cmanagement-token>\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"grant_type\": \"timed\", \"duration\": 3600}'\n",[159,935,936,964,976,988],{"__ignoreMap":266},[270,937,938,940,942,944,947,950,953,956,959,962],{"class":272,"line":273},[270,939,277],{"class":276},[270,941,281],{"class":280},[270,943,284],{"class":280},[270,945,946],{"class":280}," https://id.example.com/api/grants/",[270,948,949],{"class":300},"\u003C",[270,951,952],{"class":280},"i",[270,954,955],{"class":290},"d",[270,957,958],{"class":300},">",[270,960,961],{"class":280},"/approve",[270,963,291],{"class":290},[270,965,966,968,970,972,974],{"class":272,"line":294},[270,967,297],{"class":280},[270,969,301],{"class":300},[270,971,210],{"class":280},[270,973,306],{"class":300},[270,975,291],{"class":290},[270,977,978,980,982,984,986],{"class":272,"line":311},[270,979,297],{"class":280},[270,981,301],{"class":300},[270,983,318],{"class":280},[270,985,306],{"class":300},[270,987,291],{"class":290},[270,989,990,992,994,997],{"class":272,"line":325},[270,991,328],{"class":280},[270,993,331],{"class":300},[270,995,996],{"class":280},"{\"grant_type\": \"timed\", \"duration\": 3600}",[270,998,361],{"class":300},[155,1000,1001],{},"The request body is optional. Use it to override the grant type or duration.",[155,1003,1004,452,1006,456,1008],{},[203,1005,451],{},[159,1007,516],{},[159,1009,1010],{},"{ grant, authz_jwt }",[155,1012,1013],{},"AuthZ-JWT expiration by grant type:",[1015,1016,1017,1023,1031],"ul",{},[1018,1019,1020,1022],"li",{},[159,1021,786],{}," → 5 minutes",[1018,1024,1025,1027,1028],{},[159,1026,790],{}," → ",[159,1029,1030],{},"grant.expires_at",[1018,1032,1033,1035],{},[159,1034,793],{}," → 1 hour",[251,1037,1039],{"id":1038},"post-apigrantsiddeny",[159,1040,1041],{},"POST /api/grants/:id/deny",[155,1043,1044],{},"Deny a pending grant. Same auth as approve.",[251,1046,1048],{"id":1047},"post-apigrantsidrevoke",[159,1049,1050],{},"POST /api/grants/:id/revoke",[155,1052,1053],{},"Revoke an approved grant. Only the agent's approver or admin.",[251,1055,1057],{"id":1056},"post-apigrantsidtoken",[159,1058,1059],{},"POST /api/grants/:id/token",[155,1061,1062],{},"Get the AuthZ-JWT for an approved grant. Requires agent token or session matching the requester.",[155,1064,1065,452,1067,456,1069],{},[203,1066,451],{},[159,1068,516],{},[159,1070,1071],{},"{ authz_jwt, grant }",[251,1073,1075],{"id":1074},"post-apigrantsidconsume",[159,1076,1077],{},"POST /api/grants/:id/consume",[155,1079,1080,1081,1083],{},"Consume a ",[159,1082,786],{}," grant. Requires the AuthZ-JWT as Bearer token.",[155,1085,1086,452,1088,456,1090,1093,1094,1096,1097,1093,1100,1102,1103,166],{},[203,1087,451],{},[159,1089,516],{},[159,1091,1092],{},"{ status: \"consumed\" }"," for ",[159,1095,786],{}," grants, or ",[159,1098,1099],{},"{ status: \"valid\" }",[159,1101,790],{},"/",[159,1104,793],{},[251,1106,1108],{"id":1107},"post-apigrantsverify",[159,1109,1110],{},"POST /api/grants/verify",[155,1112,1113],{},"Verify an AuthZ-JWT. No auth required.",[261,1115,1117],{"className":263,"code":1116,"language":265,"meta":266,"style":266},"curl -X POST https://id.example.com/api/grants/verify \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"token\": \"\u003Cauthz-jwt>\"}'\n",[159,1118,1119,1132,1144],{"__ignoreMap":266},[270,1120,1121,1123,1125,1127,1130],{"class":272,"line":273},[270,1122,277],{"class":276},[270,1124,281],{"class":280},[270,1126,284],{"class":280},[270,1128,1129],{"class":280}," https://id.example.com/api/grants/verify",[270,1131,291],{"class":290},[270,1133,1134,1136,1138,1140,1142],{"class":272,"line":294},[270,1135,297],{"class":280},[270,1137,301],{"class":300},[270,1139,318],{"class":280},[270,1141,306],{"class":300},[270,1143,291],{"class":290},[270,1145,1146,1148,1150,1153],{"class":272,"line":311},[270,1147,328],{"class":280},[270,1149,331],{"class":300},[270,1151,1152],{"class":280},"{\"token\": \"\u003Cauthz-jwt>\"}",[270,1154,361],{"class":300},[155,1156,1157,452,1159,456,1161,1164,1165],{},[203,1158,451],{},[159,1160,516],{},[159,1162,1163],{},"{ valid: true, claims: {...} }"," or ",[159,1166,1167],{},"{ valid: false, error: \"...\" }",[251,1169,1171],{"id":1170},"post-apigrantsbatch",[159,1172,1173],{},"POST /api/grants/batch",[155,1175,1176],{},"Batch grant operations.",[168,1178,1180],{"id":1179},"idp-delegation-endpoints","IdP — Delegation Endpoints",[251,1182,1184],{"id":1183},"post-apidelegations",[159,1185,1186],{},"POST /api/delegations",[155,1188,1189],{},"Create a delegation. Session or agent token required.",[261,1191,1193],{"className":263,"code":1192,"language":265,"meta":266,"style":266},"curl -X POST https://id.example.com/api/delegations \\\n  -H \"Authorization: Bearer \u003Ctoken>\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"delegate\": \"agent+bot@example.com\",\n    \"audience\": \"escapes\",\n    \"scopes\": [\"read\", \"exec\"],\n    \"approval\": \"always\"\n  }'\n",[159,1194,1195,1208,1221,1233,1241,1246,1250,1255,1260],{"__ignoreMap":266},[270,1196,1197,1199,1201,1203,1206],{"class":272,"line":273},[270,1198,277],{"class":276},[270,1200,281],{"class":280},[270,1202,284],{"class":280},[270,1204,1205],{"class":280}," https://id.example.com/api/delegations",[270,1207,291],{"class":290},[270,1209,1210,1212,1214,1217,1219],{"class":272,"line":294},[270,1211,297],{"class":280},[270,1213,301],{"class":300},[270,1215,1216],{"class":280},"Authorization: Bearer \u003Ctoken>",[270,1218,306],{"class":300},[270,1220,291],{"class":290},[270,1222,1223,1225,1227,1229,1231],{"class":272,"line":311},[270,1224,297],{"class":280},[270,1226,301],{"class":300},[270,1228,318],{"class":280},[270,1230,306],{"class":300},[270,1232,291],{"class":290},[270,1234,1235,1237,1239],{"class":272,"line":325},[270,1236,328],{"class":280},[270,1238,331],{"class":300},[270,1240,334],{"class":280},[270,1242,1243],{"class":272,"line":337},[270,1244,1245],{"class":280},"    \"delegate\": \"agent+bot@example.com\",\n",[270,1247,1248],{"class":272,"line":343},[270,1249,692],{"class":280},[270,1251,1252],{"class":272,"line":349},[270,1253,1254],{"class":280},"    \"scopes\": [\"read\", \"exec\"],\n",[270,1256,1257],{"class":272,"line":355},[270,1258,1259],{"class":280},"    \"approval\": \"always\"\n",[270,1261,1262,1264],{"class":272,"line":700},[270,1263,358],{"class":280},[270,1265,361],{"class":300},[251,1267,1269],{"id":1268},"get-apidelegations",[159,1270,1271],{},"GET /api/delegations",[155,1273,1274],{},"List delegations for the current user.",[251,1276,1278],{"id":1277},"delete-apidelegationsid",[159,1279,1280],{},"DELETE /api/delegations/:id",[155,1282,1283],{},"Delete a delegation.",[251,1285,1287],{"id":1286},"post-apidelegationsidvalidate",[159,1288,1289],{},"POST /api/delegations/:id/validate",[155,1291,1292],{},"Validate a delegation token.",[168,1294,1296],{"id":1295},"idp-admin-endpoints","IdP — Admin Endpoints",[155,1298,1299],{},"All admin endpoints require Management Token or admin session.",[251,1301,1303],{"id":1302},"users","Users",[176,1305,1306,1317],{},[179,1307,1308],{},[182,1309,1310,1312,1315],{},[185,1311,187],{},[185,1313,1314],{},"Path",[185,1316,376],{},[195,1318,1319,1334,1348,1363],{},[182,1320,1321,1326,1331],{},[200,1322,1323],{},[159,1324,1325],{},"GET",[200,1327,1328],{},[159,1329,1330],{},"/api/admin/users",[200,1332,1333],{},"List users",[182,1335,1336,1341,1345],{},[200,1337,1338],{},[159,1339,1340],{},"POST",[200,1342,1343],{},[159,1344,1330],{},[200,1346,1347],{},"Create user",[182,1349,1350,1355,1360],{},[200,1351,1352],{},[159,1353,1354],{},"DELETE",[200,1356,1357],{},[159,1358,1359],{},"/api/admin/users/:email",[200,1361,1362],{},"Delete user",[182,1364,1365,1369,1374],{},[200,1366,1367],{},[159,1368,1325],{},[200,1370,1371],{},[159,1372,1373],{},"/api/admin/users/:email/credentials",[200,1375,1376],{},"List user's WebAuthn credentials",[251,1378,1380],{"id":1379},"agents","Agents",[176,1382,1383,1393],{},[179,1384,1385],{},[182,1386,1387,1389,1391],{},[185,1388,187],{},[185,1390,1314],{},[185,1392,376],{},[195,1394,1395,1409,1422,1436,1450],{},[182,1396,1397,1401,1406],{},[200,1398,1399],{},[159,1400,1325],{},[200,1402,1403],{},[159,1404,1405],{},"/api/admin/agents",[200,1407,1408],{},"List agents",[182,1410,1411,1415,1419],{},[200,1412,1413],{},[159,1414,1340],{},[200,1416,1417],{},[159,1418,1405],{},[200,1420,1421],{},"Create agent",[182,1423,1424,1428,1433],{},[200,1425,1426],{},[159,1427,1325],{},[200,1429,1430],{},[159,1431,1432],{},"/api/admin/agents/:id",[200,1434,1435],{},"Get agent details",[182,1437,1438,1443,1447],{},[200,1439,1440],{},[159,1441,1442],{},"PUT",[200,1444,1445],{},[159,1446,1432],{},[200,1448,1449],{},"Update agent",[182,1451,1452,1456,1460],{},[200,1453,1454],{},[159,1455,1354],{},[200,1457,1458],{},[159,1459,1432],{},[200,1461,1462],{},"Delete agent",[251,1464,1466],{"id":1465},"sessions","Sessions",[176,1468,1469,1479],{},[179,1470,1471],{},[182,1472,1473,1475,1477],{},[185,1474,187],{},[185,1476,1314],{},[185,1478,376],{},[195,1480,1481,1495,1509],{},[182,1482,1483,1487,1492],{},[200,1484,1485],{},[159,1486,1325],{},[200,1488,1489],{},[159,1490,1491],{},"/api/admin/sessions",[200,1493,1494],{},"List sessions",[182,1496,1497,1501,1506],{},[200,1498,1499],{},[159,1500,1354],{},[200,1502,1503],{},[159,1504,1505],{},"/api/admin/sessions/:familyId",[200,1507,1508],{},"Delete session by family ID",[182,1510,1511,1515,1520],{},[200,1512,1513],{},[159,1514,1354],{},[200,1516,1517],{},[159,1518,1519],{},"/api/admin/sessions/user/:email",[200,1521,1522],{},"Delete all sessions for user",[251,1524,1526],{"id":1525},"registration-urls","Registration URLs",[176,1528,1529,1539],{},[179,1530,1531],{},[182,1532,1533,1535,1537],{},[185,1534,187],{},[185,1536,1314],{},[185,1538,376],{},[195,1540,1541,1555,1568],{},[182,1542,1543,1547,1552],{},[200,1544,1545],{},[159,1546,1325],{},[200,1548,1549],{},[159,1550,1551],{},"/api/admin/registration-urls",[200,1553,1554],{},"List registration URLs",[182,1556,1557,1561,1565],{},[200,1558,1559],{},[159,1560,1340],{},[200,1562,1563],{},[159,1564,1551],{},[200,1566,1567],{},"Create registration URL",[182,1569,1570,1574,1579],{},[200,1571,1572],{},[159,1573,1354],{},[200,1575,1576],{},[159,1577,1578],{},"/api/admin/registration-urls/:token",[200,1580,1581],{},"Delete registration URL",[168,1583,1585],{"id":1584},"idp-oauth-oidc-endpoints","IdP — OAuth / OIDC Endpoints",[176,1587,1588,1598],{},[179,1589,1590],{},[182,1591,1592,1594,1596],{},[185,1593,187],{},[185,1595,1314],{},[185,1597,376],{},[195,1599,1600,1614,1628,1642,1656,1670],{},[182,1601,1602,1606,1611],{},[200,1603,1604],{},[159,1605,1325],{},[200,1607,1608],{},[159,1609,1610],{},"/authorize",[200,1612,1613],{},"OAuth authorization endpoint",[182,1615,1616,1620,1625],{},[200,1617,1618],{},[159,1619,1340],{},[200,1621,1622],{},[159,1623,1624],{},"/token",[200,1626,1627],{},"Token exchange",[182,1629,1630,1634,1639],{},[200,1631,1632],{},[159,1633,1340],{},[200,1635,1636],{},[159,1637,1638],{},"/revoke",[200,1640,1641],{},"Token revocation",[182,1643,1644,1648,1653],{},[200,1645,1646],{},[159,1647,1325],{},[200,1649,1650],{},[159,1651,1652],{},"/userinfo",[200,1654,1655],{},"User info",[182,1657,1658,1662,1667],{},[200,1659,1660],{},[159,1661,1325],{},[200,1663,1664],{},[159,1665,1666],{},"/.well-known/jwks.json",[200,1668,1669],{},"JSON Web Key Set",[182,1671,1672,1676,1681],{},[200,1673,1674],{},[159,1675,1325],{},[200,1677,1678],{},[159,1679,1680],{},"/.well-known/openid-configuration",[200,1682,1683],{},"OIDC discovery document",[168,1685,1687],{"id":1686},"idp-auth-endpoints","IdP — Auth Endpoints",[176,1689,1690,1700],{},[179,1691,1692],{},[182,1693,1694,1696,1698],{},[185,1695,187],{},[185,1697,1314],{},[185,1699,376],{},[195,1701,1702,1716,1730,1744,1758,1772,1786,1800,1814,1828],{},[182,1703,1704,1708,1713],{},[200,1705,1706],{},[159,1707,1340],{},[200,1709,1710],{},[159,1711,1712],{},"/api/logout",[200,1714,1715],{},"End session",[182,1717,1718,1722,1727],{},[200,1719,1720],{},[159,1721,1325],{},[200,1723,1724],{},[159,1725,1726],{},"/api/me",[200,1728,1729],{},"Get current user",[182,1731,1732,1736,1741],{},[200,1733,1734],{},[159,1735,1340],{},[200,1737,1738],{},[159,1739,1740],{},"/api/webauthn/register/options",[200,1742,1743],{},"Get registration options",[182,1745,1746,1750,1755],{},[200,1747,1748],{},[159,1749,1340],{},[200,1751,1752],{},[159,1753,1754],{},"/api/webauthn/register/verify",[200,1756,1757],{},"Verify registration",[182,1759,1760,1764,1769],{},[200,1761,1762],{},[159,1763,1340],{},[200,1765,1766],{},[159,1767,1768],{},"/api/webauthn/login/options",[200,1770,1771],{},"Get login options",[182,1773,1774,1778,1783],{},[200,1775,1776],{},[159,1777,1340],{},[200,1779,1780],{},[159,1781,1782],{},"/api/webauthn/login/verify",[200,1784,1785],{},"Verify login",[182,1787,1788,1792,1797],{},[200,1789,1790],{},[159,1791,1325],{},[200,1793,1794],{},[159,1795,1796],{},"/api/webauthn/credentials",[200,1798,1799],{},"List credentials",[182,1801,1802,1806,1811],{},[200,1803,1804],{},[159,1805,1340],{},[200,1807,1808],{},[159,1809,1810],{},"/api/webauthn/credentials/add/options",[200,1812,1813],{},"Get options for adding credential",[182,1815,1816,1820,1825],{},[200,1817,1818],{},[159,1819,1340],{},[200,1821,1822],{},[159,1823,1824],{},"/api/webauthn/credentials/add/verify",[200,1826,1827],{},"Verify added credential",[182,1829,1830,1834,1839],{},[200,1831,1832],{},[159,1833,1354],{},[200,1835,1836],{},[159,1837,1838],{},"/api/webauthn/credentials/:id",[200,1840,1841],{},"Delete credential",[168,1843,1845],{"id":1844},"idp-federation-endpoints","IdP — Federation Endpoints",[176,1847,1848,1858],{},[179,1849,1850],{},[182,1851,1852,1854,1856],{},[185,1853,187],{},[185,1855,1314],{},[185,1857,376],{},[195,1859,1860,1874,1888],{},[182,1861,1862,1866,1871],{},[200,1863,1864],{},[159,1865,1325],{},[200,1867,1868],{},[159,1869,1870],{},"/auth/federated/:providerId",[200,1872,1873],{},"Initiate federated login",[182,1875,1876,1880,1885],{},[200,1877,1878],{},[159,1879,1325],{},[200,1881,1882],{},[159,1883,1884],{},"/auth/federated/:providerId/callback",[200,1886,1887],{},"Handle federation callback",[182,1889,1890,1894,1899],{},[200,1891,1892],{},[159,1893,1325],{},[200,1895,1896],{},[159,1897,1898],{},"/api/federation/providers",[200,1900,1901],{},"List configured federation providers",[168,1903,1905],{"id":1904},"sp-endpoints","SP Endpoints",[176,1907,1908,1918],{},[179,1909,1910],{},[182,1911,1912,1914,1916],{},[185,1913,187],{},[185,1915,1314],{},[185,1917,376],{},[195,1919,1920,1938,1952,1964,1976,1990,2004],{},[182,1921,1922,1926,1931],{},[200,1923,1924],{},[159,1925,1340],{},[200,1927,1928],{},[159,1929,1930],{},"/api/login",[200,1932,1933,1934,1937],{},"Start login (accepts ",[159,1935,1936],{},"{ email }",", returns redirect URL)",[182,1939,1940,1944,1949],{},[200,1941,1942],{},[159,1943,1325],{},[200,1945,1946],{},[159,1947,1948],{},"/api/callback",[200,1950,1951],{},"OAuth callback",[182,1953,1954,1958,1962],{},[200,1955,1956],{},[159,1957,1340],{},[200,1959,1960],{},[159,1961,1712],{},[200,1963,1715],{},[182,1965,1966,1970,1974],{},[200,1967,1968],{},[159,1969,1325],{},[200,1971,1972],{},[159,1973,1726],{},[200,1975,1729],{},[182,1977,1978,1982,1987],{},[200,1979,1980],{},[159,1981,1325],{},[200,1983,1984],{},[159,1985,1986],{},"/.well-known/oauth-client-metadata",[200,1988,1989],{},"OAuth client metadata",[182,1991,1992,1996,2001],{},[200,1993,1994],{},[159,1995,1325],{},[200,1997,1998],{},[159,1999,2000],{},"/.well-known/auth.md",[200,2002,2003],{},"Machine-readable auth spec",[182,2005,2006,2010,2015],{},[200,2007,2008],{},[159,2009,1325],{},[200,2011,2012],{},[159,2013,2014],{},"/.well-known/openape.json",[200,2016,2017],{},"Service manifest",[2019,2020,2021],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":266,"searchDepth":311,"depth":294,"links":2023},[2024,2025,2030,2042,2048,2054,2055,2056,2057],{"id":170,"depth":294,"text":171},{"id":248,"depth":294,"text":249,"children":2026},[2027,2028,2029],{"id":253,"depth":311,"text":256},{"id":462,"depth":311,"text":465},{"id":525,"depth":311,"text":528},{"id":612,"depth":294,"text":613,"children":2031},[2032,2033,2034,2035,2036,2037,2038,2039,2040,2041],{"id":616,"depth":311,"text":619},{"id":879,"depth":311,"text":882},{"id":900,"depth":311,"text":903},{"id":924,"depth":311,"text":927},{"id":1038,"depth":311,"text":1041},{"id":1047,"depth":311,"text":1050},{"id":1056,"depth":311,"text":1059},{"id":1074,"depth":311,"text":1077},{"id":1107,"depth":311,"text":1110},{"id":1170,"depth":311,"text":1173},{"id":1179,"depth":294,"text":1180,"children":2043},[2044,2045,2046,2047],{"id":1183,"depth":311,"text":1186},{"id":1268,"depth":311,"text":1271},{"id":1277,"depth":311,"text":1280},{"id":1286,"depth":311,"text":1289},{"id":1295,"depth":294,"text":1296,"children":2049},[2050,2051,2052,2053],{"id":1302,"depth":311,"text":1303},{"id":1379,"depth":311,"text":1380},{"id":1465,"depth":311,"text":1466},{"id":1525,"depth":311,"text":1526},{"id":1584,"depth":294,"text":1585},{"id":1686,"depth":294,"text":1687},{"id":1844,"depth":294,"text":1845},{"id":1904,"depth":294,"text":1905},"Complete API reference for IdP and SP endpoints.","md",null,{},true,{"title":116,"description":2058},"TLUC1NBs254J3N0E6lSnISyC4ievZCex186_iIHeBpM",[2066,2068],{"title":112,"path":113,"stem":114,"description":2067,"children":-1},"Complete configuration reference for @openape/nuxt-auth-sp.",{"title":120,"path":121,"stem":122,"description":2069,"children":-1},"Configuration reference for /etc/openape/config.toml.",1774221117377]