EGREEDIdentity

Documentation

Integrate with EGREED Identity: OAuth 2.1 / OIDC endpoints, scopes, API keys and platform architecture.

Platform surfaces

  • id.egreedtech.orgAccount and sign-in experience
  • admin.id.egreedtech.orgTenant and platform administration
  • developer.id.egreedtech.orgOAuth clients, API keys and SDKs
  • docs.id.egreedtech.orgReference and guides
  • api.id.egreedtech.orgVersioned REST and OIDC endpoints
  • status.id.egreedtech.orgAvailability and incident history

OAuth 2.1 / OIDC endpoints

Base URL: https://id.egreedtech.org

  • GET /.well-known/openid-configuration

    Discovery document

  • GET /api/public/oauth/jwks

    Public signing keys (RS256) for ID token verification

  • GET /oauth/authorize

    Authorization request (PKCE S256 required for public clients)

  • POST /api/public/oauth/token

    Token exchange, refresh rotation and client credentials

  • GET /api/public/oauth/userinfo

    OIDC claims for the current access token

  • POST /api/public/oauth/introspect

    Validate a token (confidential clients)

  • POST /api/public/oauth/revoke

    Revoke an access or refresh token

OAuth scopes

  • openid
  • profile
  • email
  • phone
  • offline_access
  • organizations:read

API key scopes

  • identity:read
  • identity:write
  • sessions:read
  • sessions:revoke
  • organizations:read
  • organizations:write
  • audit:read

Identity REST API

Every call accepts either an OAuth access token or an API key in theAuthorization header. Requests outside the granted scopes are refused with 403 and an entry in your integration access log.

  • GET /api/public/v1/me

    Profile, email and verification status

    scope: identity:read or profile

  • PATCH /api/public/v1/me

    Update name, job title, locale and timezone

    scope: identity:write

  • GET /api/public/v1/organizations

    Memberships and roles for RBAC

    scope: organizations:read

  • GET /api/public/v1/sessions

    Known devices and trust state

    scope: sessions:read

  • DELETE /api/public/v1/sessions?device_id=

    Remove trust from a device

    scope: sessions:revoke

  • GET /api/public/v1/audit

    Security and account events for SIEM forwarding

    scope: audit:read

Authenticating a request

curl https://id.egreedtech.org/api/public/v1/me \
  -H "Authorization: Bearer egr_live_..." \
  -H "Accept: application/json"

Staying signed in

Request offline_access to receive a refresh token. Refresh tokens rotate on every use — the previous one is invalidated, and reusing it revokes the whole chain.

curl -X POST https://id.egreedtech.org/api/public/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=..." \
  -d "client_id=egr_client_..."