Complete OAuth2 and REST API endpoint documentation
https://your-thalamus-instance.com
/oauth/authorize
OAuth2 authorization endpoint - redirects users to login and returns authorization code.
/oauth/token
Exchange authorization code, client credentials, or refresh token for access tokens.
/oauth/introspect
Token introspection (RFC 7662) - validate token and retrieve metadata.
/oauth/revoke
Token revocation (RFC 7009) - revoke access or refresh token.
/oauth/userinfo
OpenID Connect userinfo endpoint - returns user profile information.
/oauth/agent-token
Generate agent token for AI agents in the agentic economy.
/api/public/health
Health check endpoint for monitoring and load balancers.
/api/public/register
Create new user account.
/api/public/login
User login (returns JWT).
Authorization: Bearer <token>
or Authorization: ApiKey <key>
/api/clients
Create OAuth2 client application.
/api/clients
List all OAuth2 clients for organization.
/api/users
List users in organization.
/api/organizations
List organizations.
/api/admin/api-keys
Create admin API key (super admin only).
| Scope | Description |
|---|---|
openid |
OpenID Connect authentication |
profile |
User profile information |
email |
User email address |
offline_access |
Request refresh token |
zea:read |
Read access to ZEA platform |
zea:write |
Write access to ZEA platform |
zea:admin |
Administrative access |
All API errors return JSON with error and error_description fields.
| HTTP Status | Error Code | Description |
|---|---|---|
| 400 | invalid_request |
Missing or invalid parameters |
| 401 | invalid_client |
Client authentication failed |
| 401 | invalid_token |
Token is invalid or expired |
| 403 | insufficient_scope |
Token lacks required permissions |
| 400 | invalid_grant |
Authorization code invalid |