How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

FusionAuth Jwt API

The Jwt API from FusionAuth — 7 operation(s) for jwt.

FusionAuth Jwt API is one of 37 APIs that FusionAuth publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include JWT. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.

This API exposes 10 operations across 7 paths, and defines 37 schemas. It is described by OpenAPI 3.2.0, at version 1.66.0.

Requests are made against 2 base URLs: http://localhost:9011, https://sandbox.fusionauth.io.

10 operations 7 paths 37 schemas 2 DELETE5 GET3 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.66.0
Base URL
https://sandbox.fusionauth.io
Authentication
API Key, HTTP Bearer
License
Apache2
Resource Areas
1

Authentication & Security 2

FusionAuth Jwt API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (ApiKeyAuth). It accepts HTTP bearer tokens (JWT) (BearerAuth). By default, every request must be authenticated.

Paths & Operations 10

Across 7 paths, the API surfaces 10 operations — 2 DELETE, 5 GET, 3 POST. Each is listed below with its method, path, parameters, and response codes.

Jwt 10
GET
/api/jwt/issue
Issue a new access token (JWT) for the requested Application after ensuring the provided JWT is valid. A valid access token is properly signed and not expired. This API may be used in an SSO configur…
issueJWTWithId 2 params → 200default
GET
/api/jwt/public-key
Retrieves the Public Key configured for verifying the JSON Web Tokens (JWT) issued by the Login API by the Application Id. OR Retrieves the Public Key configured for verifying JSON Web Tokens (JWT) b…
retrieveJwtPublicKey 2 params → 200default
POST
/api/jwt/reconcile
Reconcile a User to FusionAuth using JWT issued from another Identity Provider.
reconcileJWTWithId body → 200default
POST
/api/jwt/refresh
Exchange a refresh token for a new JWT.
exchangeRefreshTokenForJWTWithId body → 200default
GET
/api/jwt/refresh
Retrieves the refresh tokens that belong to the user with the given Id.
retrieveRefreshTokensWithId 1 param → 200default
DELETE
/api/jwt/refresh
Revokes refresh tokens using the information in the JSON body. The handling for this method is the same as the revokeRefreshToken method and is based on the information you provide in the RefreshDele…
deleteJwtRefresh 3 params body → 200default
GET
/api/jwt/refresh/{tokenId}
Retrieves a single refresh token by unique Id. This is not the same thing as the string value of the refresh token. If you have that, you already have what you need.
retrieveRefreshTokenByIdWithId 1 param → 200default
DELETE
/api/jwt/refresh/{tokenId}
Revokes a single refresh token by the unique Id. The unique Id is not sensitive as it cannot be used to obtain another JWT.
revokeRefreshTokenByIdWithId 1 param → 200default
GET
/api/jwt/validate
Validates the provided JWT (encoded JWT string) to ensure the token is valid. A valid access token is properly signed and not expired. This API may be used to verify the JWT as well as decode the enc…
validateJWTWithId → 200default
POST
/api/jwt/vend
It's a JWT vending machine! Issue a new access token (JWT) with the provided claims in the request. This JWT is not scoped to a tenant or user, it is a free form token that will contain what claims y…
vendJWTWithId body → 200default

Schemas 37

The contract defines 37 schemas that model the data the API accepts and returns. The most detailed are User (40 properties), LoginResponse (19 properties), UserRegistration (16 properties), UserIdentity (11 properties). Each schema is shown below with its type and property counts.

Errors
object
Standard error domain object that can also be used as the response from an API call.
2 properties
User
object
The public, global view of a User. This object contains all global information about the user including birthdate, registration information preferred languages…
40 properties
ContentStatus
string
Status for content like usernames, profile attributes, etc.
UserRegistration
object
User registration information for a single application.
16 properties
MetaData
object
3 properties
GroupMember
object
A User's membership into a Group
5 properties
RefreshTokenResponse
object
API response for retrieving Refresh Tokens
2 properties
Location
object
Location information. Useful for IP addresses and other displayable data objects.
7 properties
PublicKeyResponse
object
JWT Public Key Response Object
2 properties
BreachedPasswordStatus
string
JWTVendRequest
object
3 properties
LoginResponse
object
19 properties
ZonedDateTime
integer
The number of milliseconds since the unix epoch: January 1, 1970 00:00:00 UTC. This value is always in UTC.
DeviceInfo
object
5 properties
Locale
string
A Locale object represents a specific geographical, political, or cultural region.
JWTVendResponse
object
1 property
IssueResponse
object
2 properties
UserIdentity
object
11 properties
IdentityProviderLoginRequest
object
Login API request object used for login to third-party systems (i.e. Login with Facebook).
10 properties
Error
object
Defines an error.
3 properties
ZoneId
string
Timezone Identifier
EventInfo
object
Information about a user event (login, register, etc) that helps identify the source of the event (location, device type, OS, etc).
8 properties
LocalDate
string
A date without a time-zone in the ISO-8601 calendar system, such as 2007-12-03.
RefreshRequest
object
4 properties
JWT
object
JSON Web Token (JWT) as defined by RFC 7519. From RFC 7519 Section 1. Introduction: The suggested pronunciation of JWT is the same as the English word "jot". T…
8 properties
ValidateResponse
object
1 property
JWTRefreshResponse
object
API response for refreshing a JWT with a Refresh Token. Using a different response object from RefreshTokenResponse because the retrieve response will return a…
3 properties
RefreshToken
object
Models a JWT Refresh Token.
9 properties
LoginPreventedResponse
object
The summary of the action that is preventing login to be returned on the login response.
10 properties
TOTPAlgorithm
string
IdentityType
object
Model identity types provided by FusionAuth.
1 property
AuthenticatorConfiguration
object
3 properties
ChangePasswordReason
string
RefreshTokenRevokeRequest
object
Request for the Refresh Token API to revoke a refresh token rather than using the URL parameters.
4 properties
UserTwoFactorConfiguration
object
2 properties
TwoFactorMethod
object
7 properties
IdentityVerifiedReason
string
Models the reason that {@link UserIdentityverified} was set to true or false.

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

fusionauth-jwt-api-openapi.yml Raw ↑

Other APIs FusionAuth publishes across the network.

FusionAuth Api Key API
FusionAuth Application API
FusionAuth Connector API
FusionAuth Consent API
FusionAuth Email API
FusionAuth Entity API
FusionAuth Form API
FusionAuth Group API
FusionAuth Health API
FusionAuth Identity API
FusionAuth Identity Provider API
FusionAuth Integration API
Where this information came from

This is an independent, third-party profile of FusionAuth Jwt API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.