Discover auth configuration

GET

///apis/auth/discovery

GET

/apis/auth/discovery

curl /apis/auth/discovery

200Retrieved

{
  "auth_enabled": true,
  "oidc": {
    "issuer": "string",
    "userinfo_endpoint": "string",
    "clients": [
      {
        "name": "public",
        "client_id": "string",
        "default": true,
        "authorization_endpoint": "string",
        "authorization_start_endpoint": "string",
        "bearer_token_source": "access_token",
        "broker_token_endpoint": "string",
        "client_authentication": "public",
        "default_scopes": "openid profile email offline_access",
        "device_authorization_display_name": "string",
        "device_authorization_endpoint": "string",
        "device_authorization_requires_device_id": false,
        "device_token_request_includes_scope": true,
        "scope_prefix": "string",
        "server_side_sessions": false,
        "token_endpoint": "string"
      }
    ],
    "workload_token_exchange_enabled": false,
    "workload_client_id": "string",
    "workload_token_endpoint": "string",
    "workload_audience": "string",
    "workload_scope": "string"
  }
}

Return authentication configuration for CLI/SDK discovery.

This endpoint is unauthenticated and returns the information clients need to authenticate with this NeMo Helix deployment.

Response fields:

auth_enabled: Whether authentication is enabled on this cluster
oidc: OIDC configuration (only present when OIDC is enabled)
- issuer: The OIDC issuer URL
- userinfo_endpoint: UserInfo endpoint
- clients: Complete public and confidential user-login client contracts. Exactly one is the default.
- workload_token_exchange_enabled: Whether SDK workload identity token exchange is enabled
- workload_client_id: OAuth client ID to use for workload identity token exchange
- workload_token_endpoint: Token endpoint to use only for workload identity token exchange
- workload_audience: RFC 8693 audience for exchanged workload tokens
- workload_scope: OAuth scopes for exchanged workload tokens

Return authentication configuration for CLI/SDK discovery. This endpoint is unauthenticated and returns the information clients need to authenticate with this NeMo Helix deployment. **Response fields:** - `auth_enabled`: Whether authentication is enabled on this cluster - `oidc`: OIDC configuration (only present when OIDC is enabled) - `issuer`: The OIDC issuer URL - `userinfo_endpoint`: UserInfo endpoint - `clients`: Complete public and confidential user-login client contracts. Exactly one is the default. - `workload_token_exchange_enabled`: Whether SDK workload identity token exchange is enabled - `workload_client_id`: OAuth client ID to use for workload identity token exchange - `workload_token_endpoint`: Token endpoint to use only for workload identity token exchange - `workload_audience`: RFC 8693 audience for exchanged workload tokens - `workload_scope`: OAuth scopes for exchanged workload tokens

Response

Successful Response

auth_enabledboolean

oidcobjectOptional

OIDC discovery response returned by the auth discovery endpoint.