> For the complete documentation index, see [llms.txt](https://docs.developer.singpass.gov.sg/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.developer.singpass.gov.sg/docs/singpass-developer-docs/corppass-and-myinfo-business/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/0.-well-known-endpoints/openid-discovery-endpoint.md).

# OpenID Discovery Endpoint

The **OpenID Discovery Endpoint** provides essential metadata about OpenID Provider (OP) - in this case, Corppass - configuration. This JSON document allows Relying Parties (RPs) to dynamically configure their interactions, ensuring they always use the correct endpoints, cryptographic algorithms, and supported features.

## Request

```http
GET /.well-known/openid-configuration
```

## Response

The response is a JSON object containing the OpenID Provider (OP) metadata.

{% hint style="info" %}
**Performance Note: Caching**

Responses from the OpenID Discovery Endpoint should be cached for at least 1 hour to minimize repeated requests during OIDC / OAuth2 operations.
{% endhint %}

<table data-full-width="true"><thead><tr><th width="443.17578125">Field</th><th width="101.09375">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>issuer</code></td><td>String</td><td>The URL identifying the OpenID Provider (OP) as the issuer of tokens. Defined in <a href="https://tools.ietf.org/html/rfc7519#section-4.1.1">RFC 7519, Section 4.1.1</a>.</td></tr><tr><td><code>jwks_uri</code></td><td>String</td><td>The URL of the OP's JSON Web Key Set (JWKS) endpoint. Clients use this endpoint to retrieve public keys for validating token signatures. Refer to <a href="https://tools.ietf.org/html/rfc7517#section-4">RFC 7517, Section 4</a>.</td></tr><tr><td><code>scopes_supported</code></td><td>Array</td><td>JSON array listing the OAuth 2.0 <code>scope</code> values that the OP supports, such as <code>openid</code>, which is mandatory for OpenID Connect flows.</td></tr><tr><td><code>claims_supported</code></td><td>Array</td><td>JSON array containing a list of Claim Names the OP may supply in tokens or the UserInfo response. Defined in <a href="https://openid.net/specs/openid-connect-core-1_0.html#Claims">OpenID Connect Core 1.0, Section 5.1</a>.</td></tr><tr><td><code>claim_types_supported</code></td><td>Array</td><td>JSON array listing the Claim Types supported by the OP, such as <code>normal</code>, <code>aggregated</code>, or <code>distributed</code>. Defined in <a href="https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests">OpenID Connect Core 1.0, Section 5.6</a>.</td></tr><tr><td><code>claims_parameter_supported</code></td><td>Boolean</td><td>Boolean value indicating whether the OP supports the <code>claims</code> parameter to request specific claims. If omitted, the default value is <code>false</code>. Refer to <a href="https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests">OpenID Connect Core 1.0, Section 5.5</a>.</td></tr><tr><td><code>subject_types_supported</code></td><td>Array</td><td>JSON array containing a list of Subject Identifier types that the OP supports, such as <code>public</code> or <code>pairwise</code>. Refer to <a href="https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes">OpenID Connect Core 1.0, Section 8</a>.</td></tr><tr><td><code>code_challenge_methods_supported</code></td><td>Array</td><td>JSON array listing the Proof Key for Code Exchange (PKCE) <code>code_challenge</code> methods supported by the OP, such as <code>S256</code>. Defined in <a href="https://tools.ietf.org/html/rfc7636#section-4.3">RFC 7636, Section 4.3</a>.</td></tr><tr><td><code>grant_types_supported</code></td><td>Array</td><td>JSON array listing the OAuth 2.0 <code>grant_type</code> values supported by the OP, such as <code>authorization_code</code> or <code>refresh_token</code>. Refer to RFC 6749, Section 4.</td></tr><tr><td><code>request_parameter_supported</code></td><td>Boolean</td><td>Boolean indicating whether the OP supports the <code>request</code> parameter for JWT-based requests. Default is <code>false</code> if omitted.</td></tr><tr><td><code>request_uri_parameter_supported</code></td><td>Boolean</td><td>Boolean indicating whether the OP supports the <code>request_uri</code> parameter. Default is <code>true</code> if omitted.</td></tr><tr><td><code>response_types_supported</code></td><td>Array</td><td>JSON array containing a list of OAuth 2.0 <code>response_type</code> values that the OP supports. Defined in OAuth 2.0 Multiple Response Type Encoding Practices.</td></tr><tr><td><code>response_modes_supported</code></td><td>Array</td><td>JSON array listing OAuth 2.0 <code>response_mode</code> values supported by the OP, such as <code>query</code> or <code>fragment</code>. Defined in OAuth 2.0 Multiple Response Type Encoding Practices.</td></tr><tr><td><code>authorization_endpoint</code></td><td>String</td><td>The URL of the OP's OAuth 2.0 Authorization Endpoint, where users authenticate and provide consent. Refer to <a href="https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint">OpenID Connect Core 1.0, Section 3.1.2</a>.</td></tr><tr><td><code>authorization_response_iss_parameter_supported</code></td><td>Boolean</td><td>Boolean indicating whether the OP includes the <code>iss</code> parameter in the authorization response. This is set to <code>true</code>. If you are using an OpenID/OAuth2 client, this instructs the library to expect and validate the <code>iss</code> parameter in the authorization responses.</td></tr><tr><td><code>token_endpoint</code></td><td>String</td><td>The URL of the OP's OAuth 2.0 Token Endpoint. Clients exchange an authorization code for tokens at this endpoint.</td></tr><tr><td><code>token_endpoint_auth_methods_supported</code></td><td>Array</td><td>JSON array listing the client authentication methods supported by the Token Endpoint, such as <code>private_key_jwt</code>. Refer to <a href="https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OpenID Connect Core 1.0, Section 9</a>.</td></tr><tr><td><code>token_endpoint_auth_signing_alg_values_supported</code></td><td>Array</td><td>JSON array listing the JWS signing algorithms (<code>alg</code> values) supported by the Token Endpoint for JWT authentication. Refer to <a href="https://tools.ietf.org/html/rfc7518#section-3.1">RFC 7518, Section 3.1</a>.</td></tr><tr><td><code>id_token_signing_alg_values_supported</code></td><td>Array</td><td>JSON array listing the JWS signing algorithms (<code>alg</code> values) supported by the OP for signing ID Tokens. Defined in <a href="https://tools.ietf.org/html/rfc7518#section-3.1">RFC 7518, Section 3.1</a>.</td></tr><tr><td><code>id_token_encryption_alg_values_supported</code></td><td>Array</td><td>JSON array listing the JWE encryption algorithms (<code>alg</code> values) supported by the OP for encrypting ID Tokens. Defined in <a href="https://tools.ietf.org/html/rfc7516#section-4.1.1">RFC 7516, Section 4.1.1</a>.</td></tr><tr><td><code>id_token_encryption_enc_values_supported</code></td><td>Array</td><td>JSON array listing the JWE encryption algorithms (<code>enc</code> values) supported by the OP for encrypting ID Tokens. Defined in <a href="https://tools.ietf.org/html/rfc7516#section-4.1.2">RFC 7516, Section 4.1.2</a>.</td></tr><tr><td><code>userinfo_endpoint</code></td><td>String</td><td>The URL of the OP's UserInfo Endpoint, used to retrieve claims about the authenticated user. Defined in <a href="https://openid.net/specs/openid-connect-core-1_0.html#UserInfo">OpenID Connect Core 1.0, Section 5.3</a>.</td></tr><tr><td><code>userinfo_signing_alg_values_supported</code></td><td>Array</td><td>JSON array listing JWS signing algorithms (<code>alg</code> values) supported by the UserInfo Endpoint for encoding claims in a JWT. Defined in <a href="https://tools.ietf.org/html/rfc7515#section-4">RFC 7515, Section 4</a>.</td></tr><tr><td><code>userinfo_encryption_alg_values_supported</code></td><td>Array</td><td>JSON array listing JWE encryption algorithms (<code>alg</code> values) supported by the UserInfo Endpoint for encrypting claims in a JWT. Defined in <a href="https://tools.ietf.org/html/rfc7516#section-4.1.1">RFC 7516, Section 4.1.1</a>.</td></tr><tr><td><code>userinfo_encryption_enc_values_supported</code></td><td>Array</td><td>JSON array listing JWE encryption algorithms (<code>enc</code> values) supported by the UserInfo Endpoint for encrypting claims in a JWT. Defined in <a href="https://tools.ietf.org/html/rfc7516#section-4.1.2">RFC 7516, Section 4.1.2</a>.</td></tr><tr><td><code>userinfo_signing_alg_values_supported</code></td><td>Array</td><td>JSON array listing JWS signing algorithms (<code>alg</code> values) supported by the UserInfo Endpoint for encoding claims in a JWT. Defined in <a href="https://tools.ietf.org/html/rfc7515#section-4">RFC 7515, Section 4</a>.</td></tr></tbody></table>

### Sample Response

```http
HTTP/2 200
content-type: application/json; charset=utf-8
content-length: 1667  

{
  "name": "corppass",
  "issuer": "https://id.corppass.gov.sg",
  "jwks_uri": "https://id.corppass.gov.sg/.well-known/keys",
  "scopes_supported": [...],
  "claims_supported": [...],
  "claim_types_supported": [...],
  "claims_parameter_supported": false,
  "subject_types_supported": [...],
  "code_challenge_methods_supported": [...],
  "grant_types_supported": [...],
  "request_parameter_supported": false,
  "request_uri_parameter_supported": false,
  "response_types_supported": [...],
  "response_modes_supported": [...],
  "pushed_authorization_request_endpoint": "https://id.corppass.gov.sg/request",
  "authorization_endpoint": "https://id.corppass.gov.sg/mga/sps/oauth/oauth20/authorize",
  "authorization_response_iss_parameter_supported": true,
  "token_endpoint": "https://id.corppass.gov.sg/mga/sps/oauth/oauth20/token",
  "token_endpoint_auth_methods_supported": [...],
  "token_endpoint_auth_signing_alg_values_supported": [...],
  "id_token_signing_alg_values_supported": [...],
  "id_token_encryption_alg_values_supported": [...],
  "id_token_encryption_enc_values_supported": [...],
  "userinfo_endpoint": "https://id.corppass.gov.sg/userinfo",
  "userinfo_signing_alg_values_supported": [...],
  "userinfo_encryption_alg_values_supported": [...],
  "userinfo_encryption_enc_values_supported": [...]
}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.developer.singpass.gov.sg/docs/singpass-developer-docs/corppass-and-myinfo-business/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/0.-well-known-endpoints/openid-discovery-endpoint.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.