Discover auth configuration

GET

https://host.com/apis/auth/discovery

GET

/apis/auth/discovery

$ curl https://host.com/apis/auth/discovery \
>      -H "Content-Type: application/json"

200Retrieved

1 {
2   "auth_enabled": true,
3   "oidc": {
4     "issuer": "https://auth.nemoplatform.example.com",
5     "client_id": "nemo-platform-client",
6     "authorization_endpoint": "https://auth.nemoplatform.example.com/oauth2/authorize",
7     "token_endpoint": "https://auth.nemoplatform.example.com/oauth2/token",
8     "device_authorization_endpoint": "https://auth.nemoplatform.example.com/oauth2/device_authorize",
9     "userinfo_endpoint": "https://auth.nemoplatform.example.com/oauth2/userinfo",
10     "default_scopes": "openid profile email offline_access",
11     "scope_prefix": "nemo:",
12     "workload_token_exchange_enabled": true,
13     "workload_client_id": "nemo-workload-client",
14     "workload_token_endpoint": "https://auth.nemoplatform.example.com/oauth2/workload_token",
15     "workload_audience": "api://nemo-platform-workload",
16     "workload_scope": "nemo:workload.read nemo:workload.write"
17   }
18 }

Return authentication configuration for CLI/SDK discovery.

This endpoint is unauthenticated and returns the information clients need to authenticate with this NeMo Platform deployment.

Response fields:

auth_enabled: Whether authentication is enabled on this cluster
oidc: OIDC configuration (only present when OIDC is enabled)
- issuer: The OIDC issuer URL
- authorization_endpoint: Authorization endpoint for browser-based flows
- token_endpoint: Token exchange endpoint
- device_authorization_endpoint: Device flow authorization endpoint (for CLI)
- userinfo_endpoint: UserInfo endpoint
- client_id: OAuth client ID to use
- default_scopes: OAuth scopes to request during authentication
- scope_prefix: Prefix to prepend to custom scopes (those with ’:’ or ‘.default’)
- workload_token_exchange_enabled: Whether SDK workload identity token exchange is enabled
- workload_client_id: OAuth client ID to use for workload identity token exchange
- workload_token_endpoint: Token endpoint to use only for workload identity token exchange
- workload_audience: RFC 8693 audience for exchanged workload tokens
- workload_scope: OAuth scopes for exchanged workload tokens

Return authentication configuration for CLI/SDK discovery. This endpoint is unauthenticated and returns the information clients need to authenticate with this NeMo Platform deployment. **Response fields:** - `auth_enabled`: Whether authentication is enabled on this cluster - `oidc`: OIDC configuration (only present when OIDC is enabled) - `issuer`: The OIDC issuer URL - `authorization_endpoint`: Authorization endpoint for browser-based flows - `token_endpoint`: Token exchange endpoint - `device_authorization_endpoint`: Device flow authorization endpoint (for CLI) - `userinfo_endpoint`: UserInfo endpoint - `client_id`: OAuth client ID to use - `default_scopes`: OAuth scopes to request during authentication - `scope_prefix`: Prefix to prepend to custom scopes (those with ':' or '.default') - `workload_token_exchange_enabled`: Whether SDK workload identity token exchange is enabled - `workload_client_id`: OAuth client ID to use for workload identity token exchange - `workload_token_endpoint`: Token endpoint to use only for workload identity token exchange - `workload_audience`: RFC 8693 audience for exchanged workload tokens - `workload_scope`: OAuth scopes for exchanged workload tokens

Response

Successful Response

auth_enabledboolean

oidcobject

OIDC discovery response for CLI/SDK.