{"issuer":"https://auth.malakore.cc","service":"malakore-auth","service_version":"1.9.2","contract_version":"1.9.0","malakore_profile":"identity-api-v1","malakore_oidc_conformance":false,"malakore_conformance_note":"No authorization_endpoint, token_endpoint or userinfo_endpoint is implemented. Do not configure this issuer in an OIDC client library. Conformance is an open decision; see docs/OIDC_ROADMAP.md.","malakore_endpoints":{"health":"https://auth.malakore.cc/health","readiness":"https://auth.malakore.cc/health/ready","discovery":"https://auth.malakore.cc/.well-known/openid-configuration","login":"https://auth.malakore.cc/v1/auth/login","refresh":"https://auth.malakore.cc/v1/auth/refresh","logout":"https://auth.malakore.cc/v1/auth/logout","register":"https://auth.malakore.cc/v1/auth/register","introspect":"https://auth.malakore.cc/v1/auth/introspect","events":"https://auth.malakore.cc/v1/auth/events","passwordResetRequest":"https://auth.malakore.cc/v1/auth/password/reset/request","passwordResetConfirm":"https://auth.malakore.cc/v1/auth/password/reset/confirm","emailVerifyRequest":"https://auth.malakore.cc/v1/auth/email/verify/request","emailVerifyConfirm":"https://auth.malakore.cc/v1/auth/email/verify/confirm","sessions":"https://auth.malakore.cc/v1/auth/sessions","sessionRevoke":"https://auth.malakore.cc/v1/auth/sessions/revoke","sessionRevokeOthers":"https://auth.malakore.cc/v1/auth/sessions/revoke-others","mfaEnroll":"https://auth.malakore.cc/v1/auth/mfa/enroll","mfaActivate":"https://auth.malakore.cc/v1/auth/mfa/activate","mfaVerify":"https://auth.malakore.cc/v1/auth/mfa/verify","mfaDisable":"https://auth.malakore.cc/v1/auth/mfa/disable","authorize":"https://auth.malakore.cc/v1/auth/authorize","policy":"https://auth.malakore.cc/v1/auth/policy","myPermissions":"https://auth.malakore.cc/v1/auth/me/permissions","myMemberships":"https://auth.malakore.cc/v1/auth/me/memberships","jwks":"https://auth.malakore.cc/.well-known/jwks.json"},"malakore_registration_enabled":false,"jwks_uri":"https://auth.malakore.cc/.well-known/jwks.json","malakore_token_validation":{"method":"jwks","jwks_uri":"https://auth.malakore.cc/.well-known/jwks.json","algorithm":"RS256","key_id":"2026-10","key_ids":["2026-10"],"requires_shared_secret":false,"relying_party_must_validate":["signature","iss","aud","exp","nbf"],"guidance":"Fetch jwks_uri, select the key whose kid matches the token's protected header, verify the signature locally, then require iss to equal this issuer and aud to equal your own audience. No auth-malakore secret is needed. Cache the JWKS by kid; during a rotation two keys are published."},"id_token_signing_alg_values_supported":["RS256"],"response_types_supported":[],"scopes_supported":[],"subject_types_supported":["public"],"token_endpoint_auth_methods_supported":[],"grant_types_supported":[],"claims_supported":["iss","sub","aud","iat","nbf","exp","jti","sid","email","emailVerified","name","role","tenantId"],"malakore_claims":{"subject":{"name":"sub","format":"usr_<uuid v4>","stability":"stable for the lifetime of the identity"},"tenant":{"name":"tenantId","semantics":"the identity's home organisation; opaque, compared exactly, case-sensitive"},"role":{"name":"role","shape":"single string","values":["admin","operator","developer","viewer"],"semantics":"one role per identity; this service issues it and does NOT enforce it"},"email_verified":{"name":"emailVerified","semantics":"true only after the user opened a single-use link sent to the address (or an operator attested it)"},"session":{"name":"sid","semantics":"session id; use introspect to check whether it is still alive"}},"malakore_token_audience":"malakore-ai-gateway","malakore_access_token_ttl_seconds":900,"malakore_refresh_token_ttl_seconds":2592000,"malakore_capabilities":{"password_recovery":false,"email_verification":false,"email_delivery":"resend","throttle_shared":true,"session_management":true,"memberships":true,"mfa_totp":true,"mfa_required_roles":["admin"],"mfa_secret_storage":"aes-256-gcm","trusted_proxy_headers":false,"store_backend":"platform:postgrest","shared_state":true},"malakore_authorization":{"model":"policy","policy_version":"594fc07278b035d1","decision_endpoint":"/v1/auth/authorize","policy_endpoint":"/v1/auth/policy","deny_by_default":true,"cross_tenant_roles":[],"source":"built-in"},"malakore_service_auth":{"scheme":"Basic","note":"client_id + client_secret, required by /v1/auth/introspect and /v1/auth/events only. Not needed for token validation.","scopes":["identity:read","identity:write","audit:read","token:introspect","authorization:decide","policy:read"]}}