The OpenAPI contract

The API's public contract is an OpenAPI 3.1 document kept next to the code: docs/openapi/authguard-v1.yaml, with the docs/openapi/authguard-oauth-token.json annex for the token endpoint.

What does it contain?

• Every public route, grouped by tags (for example Intents, Meta, SCIM, OIDC).
• Request and response schemas, with additionalProperties: false: unknown fields are refused.
• The shared error responses, with the {"error":{"code","message","field"}} envelope.
• The relevant headers: Idempotency-Key, Idempotent-Replayed, Retry-After, Cache-Control: no-store.

How is it maintained?

The document is validated on every change with Redocly (recommended-strict rules) and by the project's own checks that compare the contract with the server's routes. A new route without a contract does not pass continuous integration.

Can I generate a client?

Yes, with any OpenAPI 3.1 generator. For approval requests, webhooks, receipts and OIDC, prefer the SDKs: they handle idempotency, retries and the cryptographic checks. See SDKs.

Where do I get the document?

Ask your provider or partner for it, along with the service version you use. The document also describes administration routes, which require a human passkey session and are not meant for integrations.

Compatibility

Existing responses do not change shape without notice; new optional fields may appear. Build your clients to ignore unknown response fields, but do not send fields the contract does not define.