{
  "openapi": "3.0.0",
  "info": {
    "title": "n8n 公共 API",
    "version": "1.1.1"
  },
  "tags": [
    {
      "name": "SettingsSsoOidc",
      "description": "OIDC SSO 设置相关操作"
    }
  ],
  "servers": [
    {
      "url": "/api/v1",
      "description": "当前 n8n 实例（自托管版本的内置测试台）"
    },
    {
      "url": "{url}/api/v1",
      "description": "自托管 n8n 实例",
      "variables": {
        "url": {
          "default": "https://example.com"
        }
      }
    }
  ],
  "security": [
    {
      "ApiKeyAuth": []
    },
    {
      "BearerAuth": []
    },
    {
      "CookieAuth": []
    }
  ],
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-N8N-API-KEY"
      },
      "BearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT"
      },
      "CookieAuth": {
        "type": "apiKey",
        "in": "cookie",
        "name": "n8n-auth"
      }
    },
    "schemas": {
      "oidcConfigurationPublicDto.generated": {
        "type": "object",
        "properties": {
          "clientId": {
            "type": "string",
            "description": "向 OIDC 提供方注册 n8n 时获得的客户端 ID。"
          },
          "clientSecret": {
            "type": "string",
            "description": "向 OIDC 提供方注册 n8n 时获得的客户端密钥。已设置时，读取会遮蔽，绝不以明文返回。"
          },
          "discoveryEndpoint": {
            "type": "string",
            "format": "uri",
            "description": "OIDC 提供方的 well-known 发现端点。"
          },
          "loginEnabled": {
            "type": "boolean",
            "description": "是否启用 OIDC 单点登录。"
          },
          "prompt": {
            "type": "string",
            "enum": [
              "none",
              "login",
              "consent",
              "select_account",
              "create"
            ],
            "description": "向 OIDC 提供方进行身份验证时使用的 prompt 参数。"
          },
          "authenticationContextClassReference": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "授权请求中包含的 ACR 值，即 acr_values 参数，按偏好顺序排列。"
          },
          "additionalScopes": {
            "type": "string",
            "description": "请求的附加作用域，以空格分隔。n8n 始终请求 `openid`、`profile` 和 `email`。"
          },
          "emailVerifiedRequired": {
            "type": "boolean",
            "description": "接受登录之前，是否要求身份提供方断言用户邮箱已验证。关闭时，只有明确的否定断言会被拒绝。"
          },
          "rpInitiatedLogoutEnabled": {
            "type": "boolean",
            "description": "退出 n8n 时，是否同时通过 RP-Initiated Logout 结束 OIDC 提供方的会话。关闭时，仅退出 n8n 本地会话。"
          }
        },
        "required": [
          "clientId",
          "clientSecret",
          "discoveryEndpoint",
          "loginEnabled",
          "prompt",
          "authenticationContextClassReference",
          "additionalScopes",
          "emailVerifiedRequired",
          "rpInitiatedLogoutEnabled"
        ],
        "additionalProperties": false
      }
    },
    "responses": {
      "unauthorized": {
        "description": "未授权"
      },
      "forbidden": {
        "description": "禁止访问"
      }
    }
  },
  "paths": {
    "/settings/sso/oidc": {
      "get": {
        "operationId": "getOidcConfiguration",
        "tags": [
          "SettingsSsoOidc"
        ],
        "summary": "获取 OIDC SSO 配置",
        "description": "获取当前 OIDC SSO 配置，包括界面中提供的所有字段。读取时会遮蔽客户端密钥，绝不以明文返回。需要 `oidc:manage` 作用域，并获得 OIDC 功能许可。",
        "responses": {
          "200": {
            "description": "操作成功。",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/oidcConfigurationPublicDto.generated"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/forbidden"
          }
        }
      }
    }
  }
}