Endpoints and discovery

All production URLs use the permanent issuer https://id.trustnet.app. Staging substitutes id.stg.trustnet.test, rp.stg.trustnet.test and me.stg.trustnet.test.

Discovery

GET https://id.trustnet.app/.well-known/openid-configuration

Use it to discover the authorization, token, UserInfo, JWKS, revocation and end-session endpoints, and the supported algorithms. The issuer value is https://id.trustnet.app and must match the iss claim exactly.

Authorization endpoint

GET https://id.trustnet.app/oauth2/auth

Parameter	Required	Notes
`response_type`	yes	`code`.
`client_id`	yes	The `client_id` from registration.
`redirect_uri`	yes	Must exactly match a registered redirect URI.
`scope`	yes	`openid`, optionally `offline_access`.
`state`	recommended	Opaque; validated on the callback.
`nonce`	recommended	Bound into the ID token; validated after the exchange.
`code_challenge`	recommended	PKCE challenge (S256).
`code_challenge_method`	recommended	`S256`.
`claims`	as needed	JSON requesting declared claims.
`prompt`	optional	`login`, `consent` or `select_account`; see below.
`login_hint`	optional	May pre-select a persona.

prompt semantics in TrustNet:

consent forces full consent review even when a remembered decision exists.
login concerns the login half only; it does not by itself force a new consent review.
select_account is implemented by the consent screen's persona picker; there is no separate login persona picker.

The response is a redirect to your exact redirect_uri with code and state, or with error, error_description and state. See the authorization error set.

Token endpoint

POST https://id.trustnet.app/oauth2/token
Content-Type: application/x-www-form-urlencoded

Client authentication is client_secret_basic for registered RPs. The endpoint also supports client_secret_post at the protocol level, but use the method your client was registered with.

Authorization code grant

Parameter	Required	Notes
`grant_type`	yes	`authorization_code`.
`code`	yes	The code from the callback; single use, 10-minute lifetime.
`redirect_uri`	yes	Must equal the value used in the authorization request.
`code_verifier`	if PKCE was used	The verifier for the challenge.

Refresh token grant

Parameter	Required	Notes
`grant_type`	yes	`refresh_token`.
`refresh_token`	yes	The refresh token from the original response.

Response

{
  "access_token": "<opaque>",
  "token_type": "Bearer",
  "expires_in": 1800,
  "refresh_token": "<present when offline_access was granted>",
  "id_token": "<JWT>",
  "scope": "openid offline_access"
}

The access token is opaque. The ID token is a signed JWT; validate it before use. See token errors.

UserInfo

OIDC UserInfo

GET https://id.trustnet.app/userinfo
Authorization: Bearer <access_token>

Returns sub and the approved claims, plus standard metadata such as iss, aud, iat and auth_time.

RP machine plane UserInfo

GET https://rp.trustnet.app/api/rp/v1/userinfo
Authorization: Bearer <access_token>

Returns sub and the approved claims. Requires an active token with the openid scope. Every successful read is recorded as a disclosure event (claim names only).

The machine plane requires a bearer token on every path, including GET /api/rp/v1/healthz; cookies are ignored. It never sets CORS headers.

JWKS

GET https://id.trustnet.app/.well-known/jwks.json

ID-token signing keys (RS256), selected by kid. The webhook signing keys are separate and served on the machine plane:

GET https://rp.trustnet.app/api/v1/webhook/jwks

Those are Ed25519 (EdDSA) keys for the erasure/revocation webhook.

Revocation

POST https://id.trustnet.app/oauth2/revoke
Content-Type: application/x-www-form-urlencoded

Parameter	Required	Notes
`token`	yes	The access or refresh token.
`token_type_hint`	optional	`access_token` or `refresh_token`.

Authenticate with the client credentials. A successful revocation returns 200; the token is inactive immediately and the call is idempotent.

RP-initiated logout

GET https://id.trustnet.app/oauth2/sessions/logout

Parameter	Required	Notes
`id_token_hint`	recommended	The ID token for the session.
`post_logout_redirect_uri`	optional	Must be registered.
`state`	optional	Returned to the redirect URI.

Back-channel logout (your endpoint)

Register a backchannel_logout_uri (required). TrustNet POSTs application/x-www-form-urlencoded with logout_token=<JWT>:

signed RS256 with the issuer JWKS;
iss = your issuer, aud contains your client_id;
events contains http://schemas.openid.net/event/backchannel-logout;
sid present, nonce absent;
no sub (match the sid stored from the ID token).

Return any 2xx. See Log out.

RP portal (management) API

Base: https://me.trustnet.app. These are first-party, owner-facing endpoints: they use the portal session cookie, require AAL2 and a fresh step-up, and state-changing calls require the portal's origin/CSRF checks. They do not accept an RP client secret.

Area	Endpoints
Tenants	`GET/POST /api/v1/rp/tenants`
RPs	`GET/POST /api/v1/rp/rps`; `GET/PATCH /api/v1/rp/rps/{rp_id}`
Lifecycle	`POST .../suspend`, `.../reinstate`, `.../delete`
Secret	`POST .../secret/reissue`
Export	`GET .../export`
Domains	`GET/POST /api/v1/rp/domains`; `POST /api/v1/rp/domains/{domain_id}/verify`
Logos	`POST /api/v1/rp/logo`
Terms	`GET /api/v1/rp/terms`; `GET .../status`; `POST .../reacceptance`

The full request/response schemas are in the generated portal reference.