OpenID ConnectとOAuth 2.0の仕様とエンドポイント・パラメータ総まとめ（途中）

## 目的

OpenID Connect (略してOIDC) の活用方法を調べていて、たくさん存在している仕様文書に埋もれて迷子になってしまったので、自分用にまとめておきます。特に、エンドポイントごとに、どういったパラメータが存在しているのかは、一覧としてまとまっている物が ~~見当たらなかったので、~~ まとめてみました。時間をかけて少しずつ付け足して行ければと思います。

なお、パラメータは、必須のもの、推奨のもの、任意のものとありますが、それぞれ、フローやプロファイルによって、必須、不要など変わってくるので、一律記載することはしません。

#### そもそも作る必要が無かった可能性

[OAuth Parameters](https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#parameters "OAuth Parameters") にほぼ全部載ってた。（大体まとめ終わった後で気付いた）

とはいえOIDC固有のものとか、Draft状態のものとか、一部載っていない物もあるので、ここにまとめる価値も少しはあると信じて。
少なくとも自分の勉強にはなりました。

### 一応目次（右にもあるけど）

※ 括弧書きで典型的なendpointのpathを記載していますが、実際には[Metadata](#authorization-server-metadata-well-knownoauth-authorization-server)で自由に指定できる物がほとんど。

* [Authorization Endpoint (/authorize)](#authorization-endpoint-authorize)
* [Token Endpoint \(/token\)](#token-endpoint-token)
* [Userinfo Endpoint \(/userinfo\)](#userinfo-endpoint-userinfo)
* [IDトークン \(id\_token\)](#id%E3%83%88%E3%83%BC%E3%82%AF%E3%83%B3-id_token)
* [Authorization Server Metadata \(/\.well\-known/oauth\-authorization\-server\)](#authorization-server-metadata-well-knownoauth-authorization-server)
* [Client Registration Endpoint \(/register\)](#client-registration-endpoint-register)
* [Token Introspection Endpoint \(/introspect\)](#token-introspection-endpoint-introspect)
* [Front\-Channel Logout \(/frontchannel\_logout\)](#front-channel-logout-frontchannel_logout)
* [Back\-Channel Logout \(/backchannel\_logout\)](#back-channel-logout-backchannel_logout)
* [RP\-Initiated Logout \(/logout\)](#rp-initiated-logout-logout)
* [Federation Entity Configuration \(/\.well\-known/openid\-federation\)](#federation-entity-configuration-well-knownopenid-federation)
* [Federation API Endpoint \(/federation\_api\_endpoint\)](#federation-api-endpoint-federation_api_endpoint)
* [Porting data API Endpoint \(/connect/port\_data/me\)](#porting-data-api-endpoint-connectport_datame)
* [Porting check API Endpoint \(/connect/port\_check\)](#porting-check-api-endpoint-connectport_check)


### 参考文書

OAuth 2.0や、OpenID Connectが何たるかは、 @TakahikoKawasaki 先生のエントリを参考にしてください。私も延べ100回ぐらいは読み返していると思います。

https://qiita.com/TakahikoKawasaki/items/90ef63fc4f267b33d46d

## OAuth 2.0 の仕様一覧 (IETF)

IETF OAuth WGで策定されている仕様は、 @ritou 先生がまとめてくださっているので、そちらを参照してください。

https://qiita.com/ritou/items/bbf7ffd001f30ec6facc

## OpenID Connect の仕様一覧

* [OpenID Connect Core 1\.0](https://openid.net/specs/openid-connect-core-1_0.html "Final: OpenID Connect Core 1.0 incorporating errata set 1")
 * 本家本元のOIDC仕様。
* [OpenID Connect Discovery 1\.0 incorporating errata set 1](https://openid.net/specs/openid-connect-discovery-1_0.html "Final: OpenID Connect Discovery 1.0 incorporating errata set 1")
 * OP(OpenID Provider, もしくはIdP - ID ProviderとかAuthorization Serverとか) の情報(Metadata)を公開・取得する
* [OpenID Connect Dynamic Client Registration 1\.0 incorporating errata set 1](https://openid.net/specs/openid-connect-registration-1_0.html "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1")
 * OPに対してRP(Relying Party, もしくはService Providerとか）を登録して、``client_id`` や ``client_secret`` 等をもらうための仕様
* [Draft: OpenID Connect Session Management 1\.0 \- draft 30](https://openid.net/specs/openid-connect-session-1_0.html "Draft: OpenID Connect Session Management 1.0 - draft 30")
 * RPがOPに対してエンドユーザーのログイン状態を継続的に監視し、状態変更を検知するための仕様 
* [OpenID Connect Front\-Channel Logout 1\.0 \- draft 04](https://openid.net/specs/openid-connect-frontchannel-1_0.html "Draft: OpenID Connect Front-Channel Logout 1.0 - draft 04")
 * OPからRPに対してブラウザ経由 (Front-channel)でログアウトするための仕様
* [OpenID Connect Back\-Channel Logout 1\.0 \- draft 06](https://openid.net/specs/openid-connect-backchannel-1_0.html "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06")
 * OPからRPに対して直接通信(Back-channel)でログアウトを要求するための仕様
* [OpenID Connect RP\-Initiated Logout 1\.0 \- draft 01](https://openid.net/specs/openid-connect-rpinitiated-1_0.html "Draft: OpenID Connect RP-Initiated Logout 1.0 - draft 01")
 * RPからOPに対してブラウザのリダイレクトでログアウトを要求するための仕様
* [OpenID Connect Federation 1\.0 \- draft 14](https://openid.net/specs/openid-connect-federation-1_0.html "OpenID Connect Federation 1.0 - draft 14")
* [OpenID Connect MODRNA Authentication Profile 1\.0](https://openid.net/specs/openid-connect-modrna-authentication-1_0.html "OpenID Connect MODRNA Authentication Profile 1.0")
 * 携帯キャリアが確認したユーザの携帯電話番号を ``login_hint_token`` に含めて送ることでログインを簡単にできるようにするための仕様
* [OpenID Connect Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html "OpenID Connect Account Porting")
 * OPから別のOPにアカウントを移行するための仕様　（例えば、Facebookログインしていたサービスを、Twitterログインで使えるように移行できる）
* [OpenID Connect User Questioning API 1\.0](https://openid.net/specs/openid-connect-user-questioning-api-1_0.html "OpenID Connect User Questioning API 1.0")
* [OpenID Connect Client Initiated Backchannel Authentication Flow \- Core 1\.0 draft\-03](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html "OpenID Connect Client Initiated Backchannel Authentication Flow - Core 1.0 draft-03")
 * 通称 CIBA (シーバ)。ユーザが認証するデバイスと、ユーザがサービスを利用するデバイスが異なる場合に認証するための仕様
* [OpenID Connect for Identity Assurance 1\.0](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html "OpenID Connect for Identity Assurance 1.0")
 * 「本人確認」済みの情報を提供するための仕組み。本人確認方法や確認した文書などを表現できる

## OpenID Foundationが策定しているOAuth 2.0 の拡張仕様一覧

* [OAuth 2\.0 Multiple Response Type Encoding Practices](https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html "Final: OAuth 2.0 Multiple Response Type Encoding Practices")
* [OAuth 2\.0 Form Post Response Mode](https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html "Final: OAuth 2.0 Form Post Response Mode")
* [Financial\-grade API Security Profile 1\.0 \- Part 1: Baseline](https://openid.net/specs/openid-financial-api-part-1-1_0.html "Final: Financial-grade API Security Profile 1.0 - Part 1: Baseline") / [Part 2: Advanced](https://openid.net/specs/openid-financial-api-part-2-1_0.html "Final: Financial-grade API Security Profile 1.0 - Part 2: Advanced")
    * 「金融グレード」な、重要な情報などをやりとりするAPIでもOAuthを安全に使えるようにセキュリティレベルを取り決めたもの。

## 補足 仕様文書の種類

文書化された定義が見つからなくて、もしご存じの方がいたら教えて頂きたいのですが、私の理解では、大きく分けて下記4種類の仕様文書があると思います。

<dl>
  <dt>Core 仕様</dt>
  <dd>RFC6749やOIDC Coreのように、本家本元の仕様</dd>
  <dt>拡張仕様 (Extension) </dt>
  <dd>本家本元の仕様にパラメータなどを追加して機能を拡張する仕様<br />
※まぁOIDCもRFC6749の拡張ではある</dd>
  <dt>プロファイル (Profile) </dt>
  <dd>FAPIのように、既存の仕様（Extension含む）の設定値を取り決めたもの。OAuthやOIDCには多種多様なフロー、任意のパラメータが存在している。それらに制約を入れることで、相互接続性を向上させたり、セキュリティを強化する効果がある。</dd>
  <dt>非仕様文書</dt>
  <dd>ベストプラクティスや攻撃モデルなど、実装に当たり参考にすべきもの</dd>
</dl>
    

## エンドポイントの一覧

### Authorization Endpoint (/authorize)

#### リクエスト

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``response_type`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | ```code```  ```token``` など |
| ``client_id`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |         |
| ``redirect_uri`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | OIDCでは必須 |
| ``scope`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |         |
| ``state`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |         |
| ``response_mode `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest "Final: OpenID Connect Core 1.0 incorporating errata set 1") | [OAuth 2\.0 Multiple Response Type Encoding Practices](https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html "Final: OAuth 2.0 Multiple Response Type Encoding Practices") としてOAuthを拡張 |
| ``nonce `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``display `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``prompt `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``max_age `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``ui_locales `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``login_hint `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``claims `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``acr_values`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#acrSemantics "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``request`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#JWTRequests "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``request_uri`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#JWTRequests "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``registration `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#RegistrationParameter "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``code_challenge `` | [RFC 7636](https://tools.ietf.org/html/rfc7636#section-4.3 "RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients") | いまどき必須なPKCE |
| ``code_challenge_method `` | [RFC 7636](https://tools.ietf.org/html/rfc7636#section-4.3 "RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients") | いまどき必須なPKCE |
| ``resource `` | [RFC 8707](https://tools.ietf.org/html/rfc8707#section-2 "RFC 8707 - Resource Indicators for OAuth 2.0") |  |
| ``login_hint_token `` | [OIDC MODRNA](https://openid.net/specs/openid-connect-modrna-authentication-1_0.html#auth_request "OpenID Connect MODRNA Authentication Profile 1.0") |  |
| ``binding_message `` | [OIDC MODRNA](https://openid.net/specs/openid-connect-modrna-authentication-1_0.html#auth_request "OpenID Connect MODRNA Authentication Profile 1.0") |  |

#### レスポンス(正常)

※ レスポンスは ```redirect_uri``` に付加されたクエリパラメータやフラグメントとして返却される

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``code`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |
| ``state`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |         |
| ``access_token`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | implicit flow の場合 |
| ``token_type `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | implicit flow の場合 |
| ``expires_in `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | implicit flow の場合 |
| ``scope `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | implicit flow の場合 |
| ``session_state `` | [OIDC Session Management](https://openid.net/specs/openid-connect-session-1_0.html#CreatingUpdatingSessions "Draft: OpenID Connect Session Management 1.0 - draft 30") |  |


#### レスポンス(エラー)

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``error`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |
| ``error_description`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |         |
| ``error_uri`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |         |
| ``state`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |         |
| ``interaction_required `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthError "Final: OpenID Connect Core 1.0 incorporating errata set 1") | ``prompt=none`` の場合 |
| ``login_required `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthError "Final: OpenID Connect Core 1.0 incorporating errata set 1") | ``prompt=none`` の場合 |
| ``account_selection_required `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthError "Final: OpenID Connect Core 1.0 incorporating errata set 1") | ``prompt=none`` の場合 |
| ``consent_required `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthError "Final: OpenID Connect Core 1.0 incorporating errata set 1") | ``prompt=none`` の場合 |
| ``invalid_request_uri `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthError "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``invalid_request_object `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthError "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``request_not_supported `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthError "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``request_uri_not_supported `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthError "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``registration_not_supported `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthError "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |


---------------------------------------

### Token Endpoint (/token)

#### リクエスト

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``grant_type`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | |
| ``code `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | |
| ``redirect_uri `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | |
| ``client_id`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | |
| ``client_secret `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") | 通常はAuthorizationヘッダーを使う |
| ``username`` | [RFC 6749](https://tools.ietf.org/html/rfc6749#section-4.3.2 "RFC 6749 - The OAuth 2.0 Authorization Framework") | Resource Owner Password Credentials Flow の場合 |
| ``password`` | [RFC 6749](https://tools.ietf.org/html/rfc6749#section-4.3.2 "RFC 6749 - The OAuth 2.0 Authorization Framework") | Resource Owner Password Credentials Flow の場合 |
| ``scope`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |
| ``refresh_token`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |
| ``assertion`` | [RFC 7521](https://tools.ietf.org/html/rfc7521#section-4.1 "RFC 7521 - Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants") | [RFC 6749](https://tools.ietf.org/html/rfc6749#section-4.5 "RFC 6749 - The OAuth 2.0 Authorization Framework") にも言及はあり |
| ``client_assertion_type`` | [RFC 7521](https://tools.ietf.org/html/rfc7521#section-4.2 "RFC 7521 - Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants") |  |
| ``client_assertion `` | [RFC 7521](https://tools.ietf.org/html/rfc7521#section-4.2 "RFC 7521 - Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants") |  |
| ``client_assertion_type`` | [RFC 7521](https://tools.ietf.org/html/rfc7521#section-4.2 "RFC 7521 - Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants") |  |
| ``code_verifier `` | [RFC 7636](https://tools.ietf.org/html/rfc7636#section-4.5 "RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients") | いまどき必須なPKCE |
| ``resource `` | [RFC 8707](https://tools.ietf.org/html/rfc8707#section-2 "RFC 8707 - Resource Indicators for OAuth 2.0") |  |
| ``audience `` | [RFC 8693](https://tools.ietf.org/html/rfc8693#section-2.1 "RFC 8693 - OAuth 2.0 Token Exchange") |  |
| ``requested_token_type `` | [RFC 8693](https://tools.ietf.org/html/rfc8693#section-2.1 "RFC 8693 - OAuth 2.0 Token Exchange") |  |
| ``subject_token `` | [RFC 8693](https://tools.ietf.org/html/rfc8693#section-2.1 "RFC 8693 - OAuth 2.0 Token Exchange") |  |
| ``subject_token_type `` | [RFC 8693](https://tools.ietf.org/html/rfc8693#section-2.1 "RFC 8693 - OAuth 2.0 Token Exchange") |  |
| ``actor_token `` | [RFC 8693](https://tools.ietf.org/html/rfc8693#section-2.1 "RFC 8693 - OAuth 2.0 Token Exchange") |  |
| ``actor_token_type `` | [RFC 8693](https://tools.ietf.org/html/rfc8693#section-2.1 "RFC 8693 - OAuth 2.0 Token Exchange") |  |
| ``issued_token_type `` | [RFC 8693](https://tools.ietf.org/html/rfc8693#section-2.1 "RFC 8693 - OAuth 2.0 Token Exchange") |  |


#### レスポンス(正常)

※ レスポンスは通常JSONとして返却される

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``access_token `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |
| ``token_type `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |
| ``expires_in `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |
| ``refresh_token `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |
| ``scope `` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |


#### レスポンス(エラー)

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``error`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |  |
| ``error_description`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |         |
| ``error_uri`` | [RFC 6749](https://tools.ietf.org/html/rfc6749 "RFC 6749 - The OAuth 2.0 Authorization Framework") |         |

---------------------------------------

### Userinfo Endpoint (/userinfo)

#### リクエスト

[RFC 6750](https://tools.ietf.org/html/rfc6750 "RFC 6750 - The OAuth 2.0 Authorization Framework: Bearer Token Usage") に従い、 ```access_token``` を Authorization ヘッダーにつけてリクエストする。そのほかのパラメータは不要。

#### レスポンス(正常)

※ レスポンスは通常JSONまたはJWTとして返却される
中身(claim)は ```id_token``` とほぼ同様。

#### レスポンス(エラー)

* [RFC 6750](https://tools.ietf.org/html/rfc6750 "RFC 6750 - The OAuth 2.0 Authorization Framework: Bearer Token Usage") に従い、 WWW-Authenticate ヘッダーに記載される

---------------------------------------

### IDトークン (```id_token```)

エンドポイントではないが、IDトークンも重要な情報なのでまとめておきます。
IDトークンの中身は、それぞれクレーム(claim)と呼ばれます。
中身の解説は [IDトークンが分かれば OpenID Connect が分かる \- Qiita](https://qiita.com/TakahikoKawasaki/items/8f0e422c7edd2d220e06 "IDトークンが分かれば OpenID Connect が分かる - Qiita") を参照してください。

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``iss`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``sub`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``aud`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``exp`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``iat`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``auth_time`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``nonce`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``acr`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``amr`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``azp`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#IDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``at_hash`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``c_hash`` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``_claim_names `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AggregatedExample "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``_claim_sources `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AggregatedExample "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``given_name `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``family_name `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``middle_name `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``nickname `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``preferred_username `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``profile `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``picture `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``website `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``email `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``email_verified `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``gender `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``birthdate `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``zoneinfo `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``locale `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``phone_number `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``phone_number_verified `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``address `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") | StringではなくJSONなので注意 |
| ``updated_at `` | [OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims "Final: OpenID Connect Core 1.0 incorporating errata set 1") |  |
| ``sid `` | [OIDC Front\-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html#OPLogout "Draft: OpenID Connect Front-Channel Logout 1.0 - draft 04") | session ID ログアウト時に利用 |
| ``place_of_birth `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-4.1 "OpenID Connect for Identity Assurance 1.0") |  |
| ``nationalities `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-4.1 "OpenID Connect for Identity Assurance 1.0") |  |
| ``birth_family_name `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-4.1 "OpenID Connect for Identity Assurance 1.0") |  |
| ``birth_given_name `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-4.1 "OpenID Connect for Identity Assurance 1.0") |  |
| ``birth_middle_name `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-4.1 "OpenID Connect for Identity Assurance 1.0") |  |
| ``salutation `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-4.1 "OpenID Connect for Identity Assurance 1.0") |  |
| ``title `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-4.1 "OpenID Connect for Identity Assurance 1.0") |  |
| ``msisdn `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-4.1 "OpenID Connect for Identity Assurance 1.0") | 携帯電話番号 |
| ``verified_claims `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-5 "OpenID Connect for Identity Assurance 1.0") | |
| ``aka `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#aka "OpenID Connect Account Porting") | |

---------------------------------------

### Authorization Server Metadata (/.well-known/oauth-authorization-server)

[OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html "Final: OpenID Connect Discovery 1.0 incorporating errata set 1")  が先に出てきて、あとからOAuth 2.0 ([RFC 8414](https://tools.ietf.org/html/rfc8414 "RFC 8414 - OAuth 2.0 Authorization Server Metadata"))に取り込まれたタイプ。

OIDC に対応するサーバは /.well-known/openid-configuration で公開する場合もあるが、コレも[RFC 8414](https://tools.ietf.org/html/rfc8414#section-3 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") の規定の範囲内

あとOIDCだと/.well-knownの前にパスが含まれる事も許容される。

#### リクエスト

普通に GET する

#### レスポンス(正常)

※ レスポンスは通常JSONまたはJWTとして返却される

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``issuer `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``authorization_endpoint `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``token_endpoint `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``jwks_uri `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``registration_endpoint `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``scopes_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``response_types_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``response_modes_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``grant_types_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``token_endpoint_auth_methods_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``token_endpoint_auth_signing_alg_values_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``service_documentation `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``ui_locales_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``op_policy_uri `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``op_tos_uri `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``revocation_endpoint `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``revocation_endpoint_auth_methods_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``revocation_endpoint_auth_signing_alg_values_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``introspection_endpoint `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``introspection_endpoint_auth_methods_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``introspection_endpoint_auth_signing_alg_values_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``code_challenge_methods_supported `` | [RFC 8414](https://tools.ietf.org/html/rfc8414#section-2 "RFC 8414 - OAuth 2.0 Authorization Server Metadata") |  |
| ``userinfo_endpoint `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``acr_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``subject_types_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``id_token_signing_alg_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``id_token_encryption_alg_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``id_token_encryption_enc_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``userinfo_signing_alg_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``userinfo_encryption_alg_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``userinfo_encryption_enc_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``request_object_signing_alg_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``request_object_encryption_alg_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``request_object_encryption_enc_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``display_values_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``claim_types_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``claims_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``claims_locales_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``claims_parameter_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``request_parameter_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``request_uri_parameter_supported `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``require_request_uri_registration `` | [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata "Final: OpenID Connect Discovery 1.0 incorporating errata set 1") |  |
| ``frontchannel_logout_supported `` | [OIDC Front\-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html#OPLogout "Draft: OpenID Connect Front-Channel Logout 1.0 - draft 04") |  |
| ``frontchannel_logout_session_supported `` | [OIDC Front\-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html#OPLogout "Draft: OpenID Connect Front-Channel Logout 1.0 - draft 04") |  |
| ``backchannel_logout_supported `` | [OIDC Back\-Channel Logout ](https://openid.net/specs/openid-connect-backchannel-1_0.html#BCSupport "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06") |  |
| ``backchannel_logout_session_supported `` | [OIDC Back\-Channel Logout ](https://openid.net/specs/openid-connect-backchannel-1_0.html#BCSupport "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06") |  |
| ``end_session_endpoint `` | [OIDC RP\-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html#OPMetadata "Draft: OpenID Connect RP-Initiated Logout 1.0 - draft 01") |  |
| ``verified_claims_supported `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-5 "OpenID Connect for Identity Assurance 1.0") |  |
| ``trust_frameworks_supported `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-5 "OpenID Connect for Identity Assurance 1.0") |  |
| ``evidence_supported `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-5 "OpenID Connect for Identity Assurance 1.0") |  |
| ``id_documents_supported `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-5 "OpenID Connect for Identity Assurance 1.0") |  |
| ``id_documents_verification_methods_supported `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-5 "OpenID Connect for Identity Assurance 1.0") |  |
| ``claims_in_verified_claims_supported `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-5 "OpenID Connect for Identity Assurance 1.0") |  |
| ``verified_claims_supported `` | [OIDC eKYC-IDA](https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#section-5 "OpenID Connect for Identity Assurance 1.0") |  |
| ``client_registration_types_supported ``| [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.3.2 "OpenID Connect Federation 1.0 - draft 14")|  |
| ``organization_name ``| [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.3.2 "OpenID Connect Federation 1.0 - draft 14")|  |
| ``federation_registration_endpoint ``| [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.3.2 "OpenID Connect Federation 1.0 - draft 14")|  |
| ``request_authentication_methods_supported ``| [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.3.2 "OpenID Connect Federation 1.0 - draft 14")|  |
| ``port_data_endpoint `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#discovery "OpenID Connect Account Porting") | |
| ``port_check_endpoint `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#discovery "OpenID Connect Account Porting") | |
| ``port_enc_values_supported `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#discovery "OpenID Connect Account Porting") | |





---------------------------------------

### Client Registration Endpoint (/register)

これも、[OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html"Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") が先に出てきて、あとからOAuth 2.0 ([RFC 7591](https://tools.ietf.org/html/rfc7591 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol"))に取り込まれたタイプ。

#### リクエスト

JSONで送る

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``redirect_uris ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``token_endpoint_auth_method ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol")  |  |
| ``response_types ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol")  |  |
| ``grant_types ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol")  |  |
| ``application_type``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``contacts ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``client_name ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``logo_uri ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``scope ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``client_uri ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol")|  |
| ``policy_uri ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``tos_uri ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``jwks_uri ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``jwks ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``sector_identifier_uri ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``subject_type ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``id_token_signed_response_alg ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``id_token_encrypted_response_alg ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``id_token_encrypted_response_enc ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``userinfo_signed_response_alg ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``userinfo_encrypted_response_alg ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``userinfo_encrypted_response_enc ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``request_object_signing_alg ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``request_object_encryption_alg ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``request_object_encryption_enc ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``token_endpoint_auth_signing_alg ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``default_max_age ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``require_auth_time ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``default_acr_values ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``initiate_login_uri ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``request_uris ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``software_id ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``software_version ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``software_statement ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-3.1.1 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``frontchannel_logout_uri ``| [OIDC Front-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html#RPLogout "Draft: OpenID Connect Front-Channel Logout 1.0 - draft 04")|  |
| ``frontchannel_logout_session_required ``| [OIDC Front-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html#RPLogout "Draft: OpenID Connect Front-Channel Logout 1.0 - draft 04")|  |
| ``backchannel_logout_uri ``| [OIDC Back\-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html#BCRegistration "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06")|  |
| ``backchannel_logout_session_required ``| [OIDC Back\-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html#BCRegistration "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06")|  |
| ``post_logout_redirect_uris ``| [OIDC RP\-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html#ClientMetadata "Draft: OpenID Connect RP-Initiated Logout 1.0 - draft 01")|  |
| ``client_registration_types ``| [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.3.1 "OpenID Connect Federation 1.0 - draft 14")|  |
| ``organization_name ``| [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.3.1 "OpenID Connect Federation 1.0 - draft 14")|  |



#### レスポンス

JSONで返却される。リクエストの内容もレスポンスに含む場合がある

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``client_id ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``client_secret ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``registration_access_token ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``registration_client_uri ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``client_id_issued_at ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |
| ``client_secret_expires_at ``| [OIDC Registration](https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse "Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1") |  |

#### レスポンス(エラー)

JSONで返却される

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``error`` | [RFC 7591](https://tools.ietf.org/html/rfc7591#section-3.2.2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol")|  |
| ``error_description `` | [RFC 7591](https://tools.ietf.org/html/rfc7591#section-3.2.2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``invalid_redirect_uri `` | [RFC 7591](https://tools.ietf.org/html/rfc7591#section-3.2.2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``invalid_client_metadata `` | [RFC 7591](https://tools.ietf.org/html/rfc7591#section-3.2.2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``invalid_software_statement ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-3.2.2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |
| ``unapproved_software_statement ``| [RFC 7591](https://tools.ietf.org/html/rfc7591#section-3.2.2 "RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol") |  |

---------------------------------------

### Token Introspection Endpoint (/introspect)

#### リクエスト

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``token `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.1 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``token_type_hint `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.1 "RFC 7662 - OAuth 2.0 Token Introspection") | |

#### レスポンス

JSONで返却される

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``active `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``scope `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``client_id `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``username `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``token_type `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``exp `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``iat `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``nbf `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``sub `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``aud `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``iss `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |
| ``jti `` | [RFC 7662](https://tools.ietf.org/html/rfc7662#section-2.2 "RFC 7662 - OAuth 2.0 Token Introspection") | |


---------------------------------------

### Front-Channel Logout (/frontchannel_logout)

#### リクエスト

iframeでURLを埋め込む

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``iss `` | [OIDC Front\-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html#ExampleFrontchannel "Draft: OpenID Connect Front-Channel Logout 1.0 - draft 04") | |
| ``sid `` | [OIDC Front\-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html#ExampleFrontchannel "Draft: OpenID Connect Front-Channel Logout 1.0 - draft 04") | |


---------------------------------------

### Back-Channel Logout (/backchannel_logout)

#### リクエスト

IDトークン形式で ``logout_token``を作ってPOSTで送信する

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``iss `` | [OIDC Back\-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06") | |
| ``sub `` | [OIDC Back\-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06") | |
| ``aud `` | [OIDC Back\-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06") | |
| ``iat `` | [OIDC Back\-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06") | |
| ``jti `` | [OIDC Back\-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06") | |
| ``events `` | [OIDC Back\-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06") | |
| ``sid `` | [OIDC Back\-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken "Draft: OpenID Connect Back-Channel Logout 1.0 - draft 06") | |

---------------------------------------

### RP-Initiated Logout (/logout)

#### リクエスト

IDトークン形式で ``logout_token``を作ってPOSTで送信する

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``id_token_hint `` | [OIDC RP\-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout "Draft: OpenID Connect RP-Initiated Logout 1.0 - draft 01")| |
| ``post_logout_redirect_uri `` | [OIDC RP\-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout "Draft: OpenID Connect RP-Initiated Logout 1.0 - draft 01")| |
| ``state `` | [OIDC RP\-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout "Draft: OpenID Connect RP-Initiated Logout 1.0 - draft 01")| |
| ``ui_locales `` | [OIDC RP\-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout "Draft: OpenID Connect RP-Initiated Logout 1.0 - draft 01")| |
| ``XXX `` | [OIDC RP\-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout "Draft: OpenID Connect RP-Initiated Logout 1.0 - draft 01")| |

---------------------------------------

### Federation Entity Configuration (/.well-known/openid-federation)

#### リクエスト

普通に GET する

#### レスポンス(正常)

※ レスポンスはJOSEとして返却される

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``iss `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``sub `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``iat `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``exp `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``jwks `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``aud `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``authority_hints `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``metadata `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``metadata_policy `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``constraints `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``crit `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``policy_language_crit `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``trust_marks `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``trust_anchor_id `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.2.1 "OpenID Connect Federation 1.0 - draft 14") |  |


---------------------------------------

### Federation API Endpoint (/federation_api_endpoint)

#### リクエスト

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``operation `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.1.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``iss `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.1.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``sub `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.1.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``aud `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.1.1 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``respondent `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.2.2 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``peer `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.2.2 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``type `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.2.2 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``anchor `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.2.2 "OpenID Connect Federation 1.0 - draft 14") |  |
| ``is_leaf `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.3.1 "OpenID Connect Federation 1.0 - draft 14") |  |

#### レスポンス（正常）

##### Fetching Entity Statements

※ レスポンスはJOSEとして返却される。中身はFederation Entity Configurationと同様。

##### Trust Negotiation 

※ レスポンスはJSONとして返却される。中身はMetadataと同様。

##### Entity Listing 

※ レスポンスはJSONとして返却される。

#### レスポンス(エラー)

JSONで返却される

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``operation `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.4 "OpenID Connect Federation 1.0 - draft 14")|  |
| ``error`` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.4 "OpenID Connect Federation 1.0 - draft 14")|  |
| ``error_description `` | [OIDC Federation](https://openid.net/specs/openid-connect-federation-1_0.html#rfc.section.6.4 "OpenID Connect Federation 1.0 - draft 14")|  |


---------------------------------------

### Porting data API Endpoint (/connect/port_data/me)

アカウント移行前の旧OPが提供し、移行後の新OPがアクセスする

#### リクエスト

GETリクエスト
新OPは、事前に旧OPに対しOAuth 2.0 (Authorization Code flow)でユーザの許諾を得てアクセストークンを取得しておく。

#### レスポンス

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``port_token `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#port_data "OpenID Connect Account Porting")|  |



---------------------------------------

### Porting check API Endpoint (/connect/port_check)

アカウント移行前の旧OPが提供し、RPがアクセスする

#### リクエスト

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``iss `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#port_check "OpenID Connect Account Porting")|  |
| ``enc_port_token `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#port_check "OpenID Connect Account Porting")|  |

#### レスポンス

| パラメータ | 仕様 | 備考 |
|:-----------|:------------|:------------|
| ``sub `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#port_check "OpenID Connect Account Porting")|  |
| ``aka `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#port_check "OpenID Connect Account Porting")|  |
| ``remove `` | [OIDC Account Porting](https://openid.net/specs/openid-connect-account-porting-1_0.html#port_check "OpenID Connect Account Porting")|  |