APIs and advanced
Advanced developers - you should be comfortable with the fundamentals before using this section. IT administrators may need the Endpoints reference for firewall and proxy configuration; everything else here is code-level.
What this section covers
Extended LuxID capabilities beyond a standard OIDC Authorization Code flow: querying live user data, validating tokens server-side, programmatic logout, reacting to identity events, delegating permissions across services, and cross-border eID sign-in.
This section covers the technical capabilities that go beyond a standard OIDC Authorization Code flow. If you have completed a basic sign-in integration and now need to query live user data, validate tokens on a resource server, handle logout programmatically, react to identity events, delegate permissions across services, or support cross-border eID sign-in, this is where to start.
The pages here are aimed at advanced developers - you should already be comfortable with the fundamentals covered in Concepts and fundamentals, OpenID Connect, and OAuth 2.0 for APIs before using this section.
All examples use the production endpoints at https://login.luxid.lu. For UAT, replace login.luxid.lu with login-uat.luxid.lu.
Pages in this section
UserInfo endpoint
Call the OIDC UserInfo endpoint (https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo) to retrieve the most current profile claims for an authenticated user. Covers when to prefer UserInfo over reading claims from the ID token, caching guidance, and error handling.
Token introspection
Use the RFC 7662 introspection endpoint (https://login.luxid.lu/mga/sps/oauth/oauth20/introspect) to validate opaque access tokens or refresh tokens server-side. Covers authentication methods, response structure, and caching strategies for resource servers.
Endpoints reference
The canonical list of LuxID OIDC, SAML and supporting endpoints for production and UAT, derived from the discovery document - one place to look up every URL, including the user-driven sign-out URL.
Token revocation (moved to secure)
Token revocation (RFC 7009) is part of the logout and incident-response flow, so it now lives in the Secure section: see Token revocation.
Webhooks and events API
Consume LuxID identity events. Today the Event Hub emits a single event type (ClaimValuesChanged) over a pull model; webhook push, subscription management, and the broader event catalogue are planned but not yet available. Covers the current pull model plus the planned programmatic webhook subscription management, payload signing and verification, delivery semantics, and replay protection.
Delegated authorisation
Patterns for one application acting on behalf of a user at another service: user-delegated access tokens, token exchange (RFC 8693), refresh token scoping rules, and on-behalf-of flows for backend services.
Cross-border federation (roadmap)
LuxID's planned interoperability with cross-border eID systems under eIDAS Regulation (EU) 910/2014 - inbound foreign eID sign-in, outbound Luxembourg user sign-in to foreign services, assurance level mapping, and the eIDAS minimum data set. This capability is on the roadmap and not yet available; its documentation page will be published when the integration launches.
Partner API
The LuxID Partner API provides server-to-server access to user management, subscription management, consent queries, and the Event Hub. Documented in 07 Partner API - separate area.
Quick endpoint reference
| Endpoint | URL | Standard |
|---|---|---|
| UserInfo | https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo | OIDC Core 1.0 §5.3 |
| Introspection | https://login.luxid.lu/mga/sps/oauth/oauth20/introspect | RFC 7662 |
| Revocation | https://login.luxid.lu/mga/sps/oauth/oauth20/revoke | RFC 7009 |
| Token | https://login.luxid.lu/mga/sps/oauth/oauth20/token | RFC 6749 |
| Authorization | https://login.luxid.lu/mga/sps/oauth/oauth20/authorize | RFC 6749 |
| JWKS | https://login.luxid.lu/mga/sps/oauth/oauth20/jwks/OIDC-LUXID | OIDC Core 1.0 |
| Device Authorize | https://login.luxid.lu/mga/sps/oauth/oauth20/device_authorize | RFC 8628 |
| Discovery | https://login.luxid.lu/.well-known/openid-configuration | OIDC Discovery 1.0 |
Related sections
- Session management - session lifecycle, silent renewal, back-channel logout
- Advanced security options - PAR, JAR, FAPI alignment
- Events and Event Hub - event catalogue and payload shapes
- Logs and audit trails - Console-side visibility
- OAuth and OIDC error codes - error reference