Ory Sh Ory APIs
61
AI ReadinessAI-Aware (B-)61/100
Official vendor OpenAPI document · agent-readyIdentity AuthAuthenticationoauth2, bearer, basic146 EndpointsREST
For Agents
Run identity, OAuth 2.0, OpenID Connect, and Zanzibar-style permission checks against Ory Network. Agents can manage users, sessions, OAuth clients, and access policies through a single API.
Use for: Register a new user with email and password, Verify a user's session token is still valid, Issue an OAuth 2.0 access token for a confidential client, List all OAuth 2.0 clients in an Ory project
Not supported: Does not handle payment processing, CRM, or general user analytics - use for identity, OAuth 2.0, OpenID Connect, and Zanzibar permissions only.
Ory APIs provide a unified surface over Ory Network's identity, session, OAuth 2.0, OpenID Connect, and permission services. Developers can register and authenticate users, run self-service flows for login, registration, recovery, verification, and settings, issue and introspect OAuth 2.0 tokens, and evaluate fine-grained permissions backed by Google Zanzibar. With 146 endpoints across identity, frontend, courier, oAuth2, OIDC, permission, and project management, Ory replaces a stack of bespoke auth code for SaaS and B2B platforms.
Install Jentic One Beta
Connect the Ory APIs to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Ory APIs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fory.sh%2Fory" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fory.sh%2Fory" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Ory APIs.
Run self-service login, registration, recovery, and settings flows for end users
Manage OAuth 2.0 clients, authorisation requests, and token introspection
Issue and revoke user sessions, including impersonation and refresh handling
Define identity schemas and create or look up identities by trait
Evaluate Zanzibar-style permission checks against Ory Keto relations
Send transactional courier messages tied to identity flows such as recovery and verification
Provision and configure Ory Network projects, namespaces, and workspaces
Use Cases
Patterns agents use Ory APIs for, with concrete tasks.
★ Customer Identity for SaaS Applications
SaaS teams use Ory to ship login, registration, MFA, and account recovery without building auth from scratch. The frontend self-service flows handle browser and native clients, while the identity admin endpoints let backend services list, update, and deactivate users. A typical embedded login page goes live in 1-2 days using the prebuilt Ory Account Experience or in a week with a fully custom UI.
Initialise a registration flow with GET /self-service/registration/api, then submit the user's email and password to the returned action URL and capture the resulting session token.
OAuth 2.0 Authorisation Server
Platforms that expose third-party APIs use Ory Hydra (surfaced via /admin/clients and /oauth2/*) as their OAuth 2.0 and OpenID Connect provider. Endpoints cover the full authorisation code, client credentials, and refresh token flows, plus token introspection and revocation. Hydra handles consent UI hand-off, so teams keep their own login experience while delegating protocol compliance.
Create a new confidential OAuth client by POSTing to /admin/clients with client_name, redirect_uris, and grant_types ['authorization_code','refresh_token'].
Fine-Grained Authorisation with Keto
Applications that need per-resource permission checks (who can read which document, who can edit which project) use Ory's permission API to evaluate Zanzibar-style relation tuples. Endpoints under /relation-tuples and /permissions answer 'subject X has permission Y on resource Z' in milliseconds, letting agents enforce ACLs without hard-coding role checks in application code.
Check whether user 'alice@example.com' has 'editor' permission on document 'doc-42' by calling GET /relation-tuples/check with subject and object query params.
AI Agent Identity Plumbing via Jentic
Agents that act on behalf of human users need session validation, OAuth token issuance, and permission checks at runtime. Through Jentic, an agent searches for 'check user permission' and Ory's permission endpoints surface with their schemas. The agent can then enforce per-call authorisation without the developer wiring a bespoke Ory client into the agent loop.
Use Jentic to search 'verify a session token', load the GET /sessions/whoami schema, and execute it with the session cookie supplied by the calling user.
Key Endpoints
146 endpoints — ory apis provide a unified surface over ory network's identity, session, oauth 2.
METHOD
PATH
DESCRIPTION
GET
/sessions/whoami
Return the current user's session
GET
/admin/identities
List identities in the project
POST
/admin/identities
Create a new identity
POST
/admin/clients
Register an OAuth 2.0 client
POST
/oauth2/token
Issue an OAuth 2.0 token
POST
/oauth2/introspect
Introspect an OAuth 2.0 access or refresh token
GET
/relation-tuples/check
Check a permission relation tuple
GET
/.well-known/openid-configuration
OpenID Connect discovery document
GET
/sessions/whoami
Return the current user's session
GET
/admin/identities
List identities in the project
POST
/admin/identities
Create a new identity
POST
/admin/clients
Register an OAuth 2.0 client
POST
/oauth2/token
Issue an OAuth 2.0 token
POST
/oauth2/introspect
Introspect an OAuth 2.0 access or refresh token
GET
/relation-tuples/check
Check a permission relation tuple
GET
/.well-known/openid-configuration
OpenID Connect discovery document
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
O
Ory APIs
- AI-Aware (B-)61/100
48
Foundational Compliance66
Developer Experience & Jentic Compatibility57
AI-Readiness & Agent Experience69
Agent Usability56
Security100
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
48
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: D+Signals: 4
93%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
0%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
66
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: BSignals: 4
7%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
66%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
93%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
57
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: CSignals: 4
70%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
100%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
58%
Summary Coverage
Coverage of summaries across operations/tags/info.
69
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: B+Signals: 1
69%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
56
Security
Trust, risk posture, and security compliance.
Grade: CSignals: 1
56%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
100
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A+Signals: 1
100%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Ory APIs by hand means choosing among OAuth2, bearer, and basic auth across identity, OAuth 2.0, and permission surfaces, resolving your {project_slug}.projects.oryapis.com host, and mapping the routes yourself. Through Jentic you install once, import Ory from the API Directory, store the credential once, and your agent calls it.
Permission scoping
You choose which Ory operations the agent may call, so you can limit it to the operations it needs, such as checking a session with whoami or a relation-tuple permission, while admin operations like creating identities or OAuth clients stay out of the allowed set unless you add them.
Credential isolation
Your Ory access tokens, OAuth client secrets, and workspace API keys are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'check a user permission' or 'introspect an OAuth token', and Jentic returns the matching Ory operation with its input schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Ory APIs through Jentic.
What authentication does the Ory API use?
Ory APIs accept multiple schemes depending on the operation: OAuth 2.0 access tokens for protected user data, an Ory access token (Bearer) for project-admin actions, an Ory workspace API key for cross-project operations, and HTTP Basic for legacy OAuth client endpoints. Through Jentic the appropriate credential for each operation is held in your Jentic One instance and injected at call time.
Can I issue OAuth 2.0 tokens with the Ory API?
Yes. POST /oauth2/token implements the standard OAuth 2.0 token endpoint and supports authorization_code, client_credentials, and refresh_token grants. Companion endpoints /oauth2/introspect and /oauth2/revoke handle introspection and revocation.
What are the rate limits for the Ory API?
Ory Network applies plan-based rate limits per project, but specific limits are not encoded in the OpenAPI spec. The API returns a 429 with a Retry-After header when a project exceeds its quota. Self-hosted deployments of Ory Kratos, Hydra, and Keto have no built-in rate limits.
How do I check a user's permission through Jentic?
Through Jentic, search for 'check user permission', load the GET /relation-tuples/check schema, and execute it with namespace, object, relation, and subject_id query parameters. Jentic injects the project's Ory access token automatically.
How do I run a self-service login flow with the Ory API?
Initialise the flow with GET /self-service/login/api or /self-service/login/browser, follow the action URL returned in the flow body, and submit the user's credentials. On success the response contains a session token (API flow) or sets a session cookie (browser flow).
Is the Ory API free to use?
Ory Network has a free Developer plan with limited monthly active users; production tiers are usage-priced based on MAUs and add-ons. The underlying Ory Kratos, Hydra, and Keto projects are open source and free to self-host.
Can I limit what my agent is allowed to do with the Ory API?
Yes. Because you run your own self-hosted Jentic One instance, your rules decide which Ory operations and credentials the agent may use. You can allow it only the operations it needs, such as GET /sessions/whoami to verify a session or GET /relation-tuples/check to evaluate a permission, while admin operations like POST /admin/identities or POST /admin/clients stay out of the allowed set unless you add them. This keeps the agent scoped to read-level identity and permission checks rather than creating identities or OAuth clients.
GET STARTED