Get public settings
curl --request GET \ --url http://localhost:9090/api/public/settingsThe settings the admin console reads before anyone holds a token: the app name, the UI theme, whether SMTP is configured, the issuer, the password rules, and whether users can delete their own account. This is a public endpoint that does not require authentication.
Responses
Section titled “Responses”Public settings
object
The name of the UI theme the pages use.
When true, SMTP is configured, so the auth server can send email.
The issuer the auth server writes into the iss claim of every token it signs.
When true, users can delete their own account from their account pages in the admin console. The same setting as accountDeletionEnabled in the general settings.
What the general settings’ password policy asks of a new password.
object
The minimum length, in characters.
When true, a commonly used password is refused.
When true, a password too close to the account’s email address, username or the app name is refused.
Example generated
{ "appName": "example", "uiTheme": "example", "smtpEnabled": true, "issuer": "example", "accountDeletionEnabled": true, "passwordRules": { "minLength": 1, "requiresLowercase": true, "requiresUppercase": true, "requiresNumber": true, "requiresSymbol": true, "refusesCommon": true, "refusesAccountWords": true }}The request failed inside the server, most often a storage error. error_code is INTERNAL_SERVER_ERROR: no detail about the failure, only the request id an operator can find the log line by, and retrying is reasonable. Key rotation’s 500 also answers KEY_SET_INCOMPLETE, which names its cause and no retry clears.
Admin/account API error envelope. Routing by HTTP status code: 4xx is a client-correctable failure (validation, not found, permission denied, rate limited); 5xx is a server-side problem. The body provides a stable error_code and an error_description for people to read. Protocol endpoints (/auth/token, /auth/authorize, /connect/register, /userinfo) use their RFC-defined error envelopes instead of this one.
object
Stable identifier for the failure. UPPER_SNAKE for legacy codes (e.g. VALIDATION_ERROR), dotted lowercase for codes named after the sentence’s catalog key (e.g. validator.email.required). Never translated, whatever the request’s language.
A sentence for people to read: in the request’s language, from the ui_locales query parameter or else the Accept-Language header, when the server has the sentence in that language, and in English otherwise. Route on error_code, not on this text.
Example generated
{ "error_code": "example", "error_description": "example"}