{ "openapi": "3.0.1", "info": { "title": "OAuth and OIDC Provider Metadata Vendor-Intake Gate", "description": "Writes the security opinion that a vendor-intake review needs before a company connects to a SaaS vendor, an identity provider or a remote MCP server. For each issuer that you name, the Actor reads the public OpenID Connect Discovery or RFC 8414 metadata ", "version": "0.1", "x-build-id": "nwgfb9ZalE8aCF7HZ" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/kingii98~oauth-and-oidc-provider-metadata-vendor-intake-gate/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-kingii98-oauth-and-oidc-provider-metadata-vendor-intake-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/kingii98~oauth-and-oidc-provider-metadata-vendor-intake-gate/runs": { "post": { "operationId": "runs-sync-kingii98-oauth-and-oidc-provider-metadata-vendor-intake-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/kingii98~oauth-and-oidc-provider-metadata-vendor-intake-gate/run-sync": { "post": { "operationId": "run-sync-kingii98-oauth-and-oidc-provider-metadata-vendor-intake-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "issuers", "checks", "requestTimeoutSeconds" ], "properties": { "issuers": { "title": "Issuer base URLs", "minItems": 1, "maxItems": 200, "type": "array", "description": "1 to 200 issuer base URLs, for example https://accounts.google.com, or full .well-known metadata URLs. The Actor does not crawl. For a base URL it tries the OpenID Connect Discovery path and the RFC 8414 path in turn and keeps the first document that parses. HTTPS only. A line that is not a public HTTPS target, for example an http:// URL, a URL with credentials or a host that resolves to a loopback, private or reserved address, is refused. A refused line gets its own dataset row with the finding OIDC-DISCOVERY-UNREACHABLE, it is not charged, and the run still audits every other line.", "default": [ "https://accounts.google.com", "https://appleid.apple.com", "https://token.actions.githubusercontent.com" ], "items": { "type": "string" } }, "checks": { "title": "Check groups to apply", "minItems": 1, "maxItems": 9, "type": "array", "description": "The groups of rules that the audit applies. Leave every group selected for a full vendor-intake opinion. The metadata group is always on, because every other group reads the fields of the discovery document. Switching a group off also stops the requests that only that group needs: jwks stops the key-set read, registration stops the read-only registration probe, and resource_metadata stops the protected-resource metadata read.", "items": { "type": "string", "enum": [ "metadata", "transport", "pkce", "grants", "client_auth", "jwks", "registration", "resource_metadata", "endpoints" ], "enumTitles": [ "metadata: document reachable, valid JSON, issuer field matches the URL", "transport: every endpoint is HTTPS, TLS is 1.2 or later", "pkce: S256 declared, weak plain method not offered", "grants: implicit and hybrid flows not offered", "client_auth: the none token-endpoint method not offered", "jwks: key set reachable, no weak, private or expired key material", "registration: dynamic client registration endpoint answers a stranger", "resource_metadata: RFC 9728 protected-resource metadata published", "endpoints: authorization, token, revocation and introspection named" ] }, "default": [ "metadata", "transport", "pkce", "grants", "client_auth", "jwks", "registration", "resource_metadata", "endpoints" ] }, "baselineKey": { "title": "Baseline name", "type": "string", "description": "Optional name of a stored snapshot, for example \"Q3 vendor review\". The run compares each issuer against the snapshot of the same name and sets changed_since_baseline, then it writes the snapshot back for the next review. Leave this empty to run a single audit with no stored state; changed_since_baseline is then null. Any name works: the run replaces every character that is not a letter, a digit, a dot, a dash or an underscore with a dash, and keeps the first 60 characters. The summary row reports the name that the run used, so give the same name again at the next review.", "default": "" }, "requestTimeoutSeconds": { "title": "Request timeout in seconds", "minimum": 5, "maximum": 60, "type": "integer", "description": "How long one HTTPS request may take before the Actor gives up on it and reports the issuer as unreachable. Each issuer costs about 6 to 10 small GET requests.", "default": 15 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }