---
title: "Create a OpenidConnect plugin"
method: POST
path: "/plugins#OpenidConnect"
tags: ["Plugins"]
---

# Create a OpenidConnect plugin

`POST /plugins#OpenidConnect`

Create a OpenidConnect plugin

## Request body

- CreateOpenidConnectPlugin
  - `config` object — The configuration properties for the Plugin which can be found on the plugins documentation page in the [Kong Hub](https://docs.konghq.com/hub/).
    - `anonymous` string — An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a `4xx` HTTP status code. This value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.
    - `audience` string[] — The audience passed to the authorization endpoint.
    - `audience_claim` string[] — The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `audience_required` string[] — The audiences (`audience_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.
    - `auth_methods` string[] — Types of credentials/grants to enable.
    - `authenticated_groups_claim` string[] — The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `authorization_cookie_domain` string — The authorization cookie Domain flag.
    - `authorization_cookie_http_only` boolean — Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.
    - `authorization_cookie_name` string — The authorization cookie name.
    - `authorization_cookie_path` string — The authorization cookie Path flag.
    - `authorization_cookie_same_site` 'Strict' | 'Lax' | 'None' | 'Default' — Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.
    - `authorization_cookie_secure` boolean — Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
    - `authorization_endpoint` string — The authorization endpoint. If set it overrides the value in `authorization_endpoint` returned by the discovery endpoint.
    - `authorization_query_args_client` string[] — Extra query arguments passed from the client to the authorization endpoint.
    - `authorization_query_args_names` string[] — Extra query argument names passed to the authorization endpoint.
    - `authorization_query_args_values` string[] — Extra query argument values passed to the authorization endpoint.
    - `authorization_rolling_timeout` number — Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.
    - `bearer_token_cookie_name` string — The name of the cookie in which the bearer token is passed.
    - `bearer_token_param_type` string[] — Where to look for the bearer token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body - `cookie`: search the HTTP request cookies specified with `config.bearer_token_cookie_name`.
    - `by_username_ignore_case` boolean — If `consumer_by` is set to `username`, specify whether `username` can match consumers case-insensitively.
    - `cache_introspection` boolean — Cache the introspection endpoint requests.
    - `cache_token_exchange` boolean — Cache the token exchange endpoint requests.
    - `cache_tokens` boolean — Cache the token endpoint requests.
    - `cache_tokens_salt` string — Salt used for generating the cache key that is used for caching the token endpoint requests.
    - `cache_ttl` number — The default cache ttl in seconds that is used in case the cached object does not specify the expiry.
    - `cache_ttl_max` number — The maximum cache ttl in seconds (enforced).
    - `cache_ttl_min` number — The minimum cache ttl in seconds (enforced).
    - `cache_ttl_neg` number — The negative cache ttl in seconds.
    - `cache_ttl_resurrect` number — The resurrection ttl in seconds.
    - `cache_user_info` boolean — Cache the user info requests.
    - `claims_forbidden` string[] — If given, these claims are forbidden in the token payload.
    - `client_alg` string[] — The algorithm to use for client_secret_jwt (only HS***) or private_key_jwt authentication.
    - `client_arg` string — The client to use for this request (the selection is made with a request parameter with the same name).
    - `client_auth` string[] — The default OpenID Connect client authentication method is 'client_secret_basic' (using 'Authorization: Basic' header), 'client_secret_post' (credentials in body), 'client_secret_jwt' (signed client assertion in body), 'private_key_jwt' (private key-signed assertion), 'tls_client_auth' (client certificate), 'self_signed_tls_client_auth' (self-signed client certificate), and 'none' (no authentication).
    - `client_credentials_param_type` string[] — Where to look for the client credentials: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search from the HTTP request body.
    - `client_id` string[] — The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.
    - `client_jwk` object[] — The JWK used for the private_key_jwt authentication.
      - `alg` string
      - `crv` string
      - `d` string
      - `dp` string
      - `dq` string
      - `e` string
      - `issuer` string
      - `k` string
      - `key_ops` string[]
      - `kid` string
      - `kty` string
      - `n` string
      - `oth` string
      - `p` string
      - `q` string
      - `qi` string
      - `r` string
      - `t` string
      - `use` string
      - `x` string
      - `x5c` string[]
      - `x5t` string
      - `x5t#S256` string
      - `x5u` string
      - `y` string
    - `client_secret` string[] — The client secret.
    - `cluster_cache_redis` object
      - `cluster_max_redirections` integer — Maximum retry attempts for redirection.
      - `cluster_nodes` object[] — Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
        - `ip` string — A string representing a host name, such as example.com.
        - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `connect_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `connection_is_proxied` boolean — If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.
      - `database` integer — Database to use for the Redis connection when using the `redis` strategy
      - `host` string — A string representing a host name, such as example.com.
      - `keepalive_backlog` integer — Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.
      - `keepalive_pool_size` integer — The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.
      - `password` string — Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
      - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `read_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `send_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `sentinel_master` string — Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
      - `sentinel_nodes` object[] — Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.
        - `host` string — A string representing a host name, such as example.com.
        - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `sentinel_password` string — Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
      - `sentinel_role` 'master' | 'slave' | 'any' — Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.
      - `sentinel_username` string — Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
      - `server_name` string — A string representing an SNI (server name indication) value for TLS.
      - `ssl` boolean — If set to true, uses SSL to connect to Redis.
      - `ssl_verify` boolean — If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.
      - `username` string — Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.
    - `cluster_cache_strategy` 'off' | 'redis' — The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared.
    - `consumer_by` string[] — Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.
    - `consumer_claim` string[] — The claim used for consumer mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `consumer_optional` boolean — Do not terminate the request if consumer mapping fails.
    - `credential_claim` string[] — The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `disable_session` string[] — Disable issuing the session cookie with the specified grants.
    - `discovery_headers_names` string[] — Extra header names passed to the discovery endpoint.
    - `discovery_headers_values` string[] — Extra header values passed to the discovery endpoint.
    - `display_errors` boolean — Display errors on failure responses.
    - `domains` string[] — The allowed values for the `hd` claim.
    - `downstream_access_token_header` string — The downstream access token header.
    - `downstream_access_token_jwk_header` string — The downstream access token JWK header.
    - `downstream_headers_claims` string[] — The downstream header claims. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `downstream_headers_names` string[] — The downstream header names for the claim values.
    - `downstream_id_token_header` string — The downstream id token header.
    - `downstream_id_token_jwk_header` string — The downstream id token JWK header.
    - `downstream_introspection_header` string — The downstream introspection header.
    - `downstream_introspection_jwt_header` string — The downstream introspection JWT header.
    - `downstream_refresh_token_header` string — The downstream refresh token header.
    - `downstream_session_id_header` string — The downstream session id header.
    - `downstream_user_info_header` string — The downstream user info header.
    - `downstream_user_info_jwt_header` string — The downstream user info JWT header (in case the user info returns a JWT response).
    - `dpop_proof_lifetime` number — Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise.
    - `dpop_use_nonce` boolean — Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime.
    - `enable_hs_signatures` boolean — Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted).
    - `end_session_endpoint` string — The end session endpoint. If set it overrides the value in `end_session_endpoint` returned by the discovery endpoint.
    - `expose_error_code` boolean — Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to `false` to disable.
    - `extra_jwks_uris` string[] — JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).
    - `forbidden_destroy_session` boolean — Destroy any active session for the forbidden requests.
    - `forbidden_error_message` string — The error message for the forbidden requests (when not using the redirection).
    - `forbidden_redirect_uri` string[] — Where to redirect the client on forbidden requests.
    - `groups_claim` string[] — The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `groups_required` string[] — The groups (`groups_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.
    - `hide_credentials` boolean — Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication.
    - `http_proxy` string — The HTTP proxy.
    - `http_proxy_authorization` string — The HTTP proxy authorization.
    - `http_version` number — The HTTP version used for the requests by this plugin: - `1.1`: HTTP 1.1 (the default) - `1.0`: HTTP 1.0.
    - `https_proxy` string — The HTTPS proxy.
    - `https_proxy_authorization` string — The HTTPS proxy authorization.
    - `id_token_param_name` string — The name of the parameter used to pass the id token.
    - `id_token_param_type` string[] — Where to look for the id token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.
    - `ignore_signature` string[] — Skip the token signature verification on certain grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.
    - `introspect_jwt_tokens` boolean — Specifies whether to introspect the JWT access tokens (can be used to check for revocations).
    - `introspection_accept` 'application/json' | 'application/token-introspection+jwt' | 'application/jwt' — The value of `Accept` header for introspection requests: - `application/json`: introspection response as JSON - `application/token-introspection+jwt`: introspection response as JWT (from the current IETF draft document) - `application/jwt`: introspection response as JWT (from the obsolete IETF draft document).
    - `introspection_check_active` boolean — Check that the introspection response has an `active` claim with a value of `true`.
    - `introspection_endpoint` string — The introspection endpoint. If set it overrides the value in `introspection_endpoint` returned by the discovery endpoint.
    - `introspection_endpoint_auth_method` 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'tls_client_auth' | 'self_signed_tls_client_auth' | 'none' — The introspection endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate
    - `introspection_headers_client` string[] — Extra headers passed from the client to the introspection endpoint.
    - `introspection_headers_names` string[] — Extra header names passed to the introspection endpoint.
    - `introspection_headers_values` string[] — Extra header values passed to the introspection endpoint.
    - `introspection_hint` string — Introspection hint parameter value passed to the introspection endpoint.
    - `introspection_post_args_client` string[] — Extra post arguments passed from the client to the introspection endpoint.
    - `introspection_post_args_names` string[] — Extra post argument names passed to the introspection endpoint.
    - `introspection_post_args_values` string[] — Extra post argument values passed to the introspection endpoint.
    - `introspection_token_param_name` string — Designate token's parameter name for introspection.
    - `issuer` string — The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure `config.using_pseudo_issuer=true`.
    - `issuers_allowed` string[] — The issuers allowed to be present in the tokens (`iss` claim).
    - `jwt_session_claim` string — The claim to match against the JWT session cookie.
    - `jwt_session_cookie` string — The name of the JWT session cookie.
    - `keepalive` boolean — Use keepalive with the HTTP client.
    - `leeway` number — Defines leeway time (in seconds) for `auth_time`, `exp`, `iat`, and `nbf` claims
    - `login_action` 'upstream' | 'response' | 'redirect' — What to do after successful login: - `upstream`: proxy request to upstream service - `response`: terminate request with a response - `redirect`: redirect to a different location.
    - `login_methods` string[] — Enable login functionality with specified grants.
    - `login_redirect_mode` 'query' | 'fragment' — Where to place `login_tokens` when using `redirect` `login_action`: - `query`: place tokens in query string - `fragment`: place tokens in url fragment (not readable by servers).
    - `login_redirect_uri` string[] — Where to redirect the client when `login_action` is set to `redirect`.
    - `login_tokens` string[] — What tokens to include in `response` body or `redirect` query string or fragment: - `id_token`: include id token - `access_token`: include access token - `refresh_token`: include refresh token - `tokens`: include the full token endpoint response - `introspection`: include introspection response.
    - `logout_methods` string[] — The request methods that can activate the logout: - `POST`: HTTP POST method - `GET`: HTTP GET method - `DELETE`: HTTP DELETE method.
    - `logout_post_arg` string — The request body argument that activates the logout.
    - `logout_query_arg` string — The request query argument that activates the logout.
    - `logout_redirect_uri` string[] — Where to redirect the client after the logout.
    - `logout_revoke` boolean — Revoke tokens as part of the logout. For more granular token revocation, you can also adjust the `logout_revoke_access_token` and `logout_revoke_refresh_token` parameters.
    - `logout_revoke_access_token` boolean — Revoke the access token as part of the logout. Requires `logout_revoke` to be set to `true`.
    - `logout_revoke_refresh_token` boolean — Revoke the refresh token as part of the logout. Requires `logout_revoke` to be set to `true`.
    - `logout_uri_suffix` string — The request URI suffix that activates the logout.
    - `max_age` number — The maximum age (in seconds) compared to the `auth_time` claim.
    - `mtls_introspection_endpoint` string — Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.
    - `mtls_revocation_endpoint` string — Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.
    - `mtls_token_endpoint` string — Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.
    - `no_proxy` string — Do not use proxy with these hosts.
    - `password_param_type` string[] — Where to look for the username and password: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.
    - `preserve_query_args` boolean — With this parameter, you can preserve request query arguments even when doing authorization code flow.
    - `proof_of_possession_auth_methods_validation` boolean — If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP.
    - `proof_of_possession_dpop` 'off' | 'strict' | 'optional' — Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof.
    - `proof_of_possession_mtls` 'off' | 'strict' | 'optional' — Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401.
    - `pushed_authorization_request_endpoint` string — The pushed authorization endpoint. If set it overrides the value in `pushed_authorization_request_endpoint` returned by the discovery endpoint.
    - `pushed_authorization_request_endpoint_auth_method` 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'tls_client_auth' | 'self_signed_tls_client_auth' | 'none' — The pushed authorization request endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate
    - `redirect_uri` string[] — The redirect URI passed to the authorization and token endpoints.
    - `redis` object
      - `cluster_max_redirections` integer — Maximum retry attempts for redirection.
      - `cluster_nodes` object[] — Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
        - `ip` string — A string representing a host name, such as example.com.
        - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `connect_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `connection_is_proxied` boolean — If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.
      - `database` integer — Database to use for the Redis connection when using the `redis` strategy
      - `host` string — A string representing a host name, such as example.com.
      - `keepalive_backlog` integer — Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.
      - `keepalive_pool_size` integer — The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.
      - `password` string — Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
      - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `prefix` string — The Redis session key prefix.
      - `read_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `send_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `sentinel_master` string — Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
      - `sentinel_nodes` object[] — Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.
        - `host` string — A string representing a host name, such as example.com.
        - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `sentinel_password` string — Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
      - `sentinel_role` 'master' | 'slave' | 'any' — Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.
      - `sentinel_username` string — Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
      - `server_name` string — A string representing an SNI (server name indication) value for TLS.
      - `socket` string — The Redis unix socket path.
      - `ssl` boolean — If set to true, uses SSL to connect to Redis.
      - `ssl_verify` boolean — If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.
      - `username` string — Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.
    - `rediscovery_lifetime` number — Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis.
    - `refresh_token_param_name` string — The name of the parameter used to pass the refresh token.
    - `refresh_token_param_type` string[] — Where to look for the refresh token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.
    - `refresh_tokens` boolean — Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a `refresh_token` available.
    - `require_proof_key_for_code_exchange` boolean — Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of `code_challenge_methods_supported`, and enabled automatically (in case the `code_challenge_methods_supported` is missing, the PKCE will not be enabled).
    - `require_pushed_authorization_requests` boolean — Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of `require_pushed_authorization_requests` (which defaults to `false`).
    - `require_signed_request_object` boolean — Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of `require_signed_request_object`, and enabled automatically (in case the `require_signed_request_object` is missing, the feature will not be enabled).
    - `resolve_distributed_claims` boolean — Distributed claims are represented by the `_claim_names` and `_claim_sources` members of the JSON object containing the claims. If this parameter is set to `true`, the plugin explicitly resolves these distributed claims.
    - `response_mode` 'query' | 'form_post' | 'fragment' | 'query.jwt' | 'form_post.jwt' | 'fragment.jwt' | 'jwt' — Response mode passed to the authorization endpoint: - `query`: for parameters in query string - `form_post`: for parameters in request body - `fragment`: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) - `query.jwt`, `form_post.jwt`, `fragment.jwt`: similar to `query`, `form_post` and `fragment` but the parameters are encoded in a JWT - `jwt`: shortcut that indicates the default encoding for the requested response type.
    - `response_type` string[] — The response type passed to the authorization endpoint.
    - `reverify` boolean — Specifies whether to always verify tokens stored in the session.
    - `revocation_endpoint` string — The revocation endpoint. If set it overrides the value in `revocation_endpoint` returned by the discovery endpoint.
    - `revocation_endpoint_auth_method` 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'tls_client_auth' | 'self_signed_tls_client_auth' | 'none' — The revocation endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate
    - `revocation_token_param_name` string — Designate token's parameter name for revocation.
    - `roles_claim` string[] — The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `roles_required` string[] — The roles (`roles_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.
    - `run_on_preflight` boolean — Specifies whether to run this plugin on pre-flight (`OPTIONS`) requests.
    - `scopes` string[] — The scopes passed to the authorization and token endpoints.
    - `scopes_claim` string[] — The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `scopes_required` string[] — The scopes (`scopes_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.
    - `search_user_info` boolean — Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers.
    - `session_absolute_timeout` number — Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks.
    - `session_audience` string — The session audience, which is the intended target application. For example `"my-application"`.
    - `session_cookie_domain` string — The session cookie Domain flag.
    - `session_cookie_http_only` boolean — Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.
    - `session_cookie_name` string — The session cookie name.
    - `session_cookie_path` string — The session cookie Path flag.
    - `session_cookie_same_site` 'Strict' | 'Lax' | 'None' | 'Default' — Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.
    - `session_cookie_secure` boolean — Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
    - `session_enforce_same_subject` boolean — When set to `true`, audiences are forced to share the same subject.
    - `session_hash_storage_key` boolean — When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.
    - `session_hash_subject` boolean — When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.
    - `session_idling_timeout` number — Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching.
    - `session_memcached_host` string — The memcached host.
    - `session_memcached_port` integer — The memcached port.
    - `session_memcached_prefix` string — The memcached session key prefix.
    - `session_memcached_socket` string — The memcached unix socket path.
    - `session_remember` boolean — Enables or disables persistent sessions.
    - `session_remember_absolute_timeout` number — Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks.
    - `session_remember_cookie_name` string — Persistent session cookie name. Use with the `remember` configuration parameter.
    - `session_remember_rolling_timeout` number — Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling.
    - `session_request_headers` string[] — Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ "id", "timeout" ]` will set Session-Id and Session-Timeout request headers.
    - `session_response_headers` string[] — Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ "id", "timeout" ]` will set Session-Id and Session-Timeout response headers.
    - `session_rolling_timeout` number — Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.
    - `session_secret` string — The session secret.
    - `session_storage` 'cookie' | 'memcache' | 'memcached' | 'redis' — The session storage for session data: - `cookie`: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) - `memcache`: stores session data in memcached - `redis`: stores session data in Redis.
    - `session_store_metadata` boolean — Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject.
    - `ssl_verify` boolean — Verify identity provider server certificate. If set to `true`, the plugin uses the CA certificate set in the `kong.conf` config parameter `lua_ssl_trusted_certificate`.
    - `timeout` number — Network IO timeout in milliseconds.
    - `tls_client_auth_cert_id` string — ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.
    - `tls_client_auth_ssl_verify` boolean — Verify identity provider server certificate during mTLS client authentication.
    - `token_cache_key_include_scope` boolean — Include the scope in the token cache key, so token with different scopes are considered diffrent tokens.
    - `token_endpoint` string — The token endpoint. If set it overrides the value in `token_endpoint` returned by the discovery endpoint.
    - `token_endpoint_auth_method` 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'tls_client_auth' | 'self_signed_tls_client_auth' | 'none' — The token endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate
    - `token_exchange_endpoint` string — The token exchange endpoint.
    - `token_headers_client` string[] — Extra headers passed from the client to the token endpoint.
    - `token_headers_grants` string[] — Enable the sending of the token endpoint response headers only with certain grants: - `password`: with OAuth password grant - `client_credentials`: with OAuth client credentials grant - `authorization_code`: with authorization code flow - `refresh_token` with refresh token grant.
    - `token_headers_names` string[] — Extra header names passed to the token endpoint.
    - `token_headers_prefix` string — Add a prefix to the token endpoint response headers before forwarding them to the downstream client.
    - `token_headers_replay` string[] — The names of token endpoint response headers to forward to the downstream client.
    - `token_headers_values` string[] — Extra header values passed to the token endpoint.
    - `token_post_args_client` string[] — Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with `scope` values, like this: `config.token_post_args_client=scope` In this case, the token would take the `scope` value from the query parameter or from the request body or from the header and send it to the token endpoint.
    - `token_post_args_names` string[] — Extra post argument names passed to the token endpoint.
    - `token_post_args_values` string[] — Extra post argument values passed to the token endpoint.
    - `unauthorized_destroy_session` boolean — Destroy any active session for the unauthorized requests.
    - `unauthorized_error_message` string — The error message for the unauthorized requests (when not using the redirection).
    - `unauthorized_redirect_uri` string[] — Where to redirect the client on unauthorized requests.
    - `unexpected_redirect_uri` string[] — Where to redirect the client when unexpected errors happen with the requests.
    - `upstream_access_token_header` string — The upstream access token header.
    - `upstream_access_token_jwk_header` string — The upstream access token JWK header.
    - `upstream_headers_claims` string[] — The upstream header claims. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `upstream_headers_names` string[] — The upstream header names for the claim values.
    - `upstream_id_token_header` string — The upstream id token header.
    - `upstream_id_token_jwk_header` string — The upstream id token JWK header.
    - `upstream_introspection_header` string — The upstream introspection header.
    - `upstream_introspection_jwt_header` string — The upstream introspection JWT header.
    - `upstream_refresh_token_header` string — The upstream refresh token header.
    - `upstream_session_id_header` string — The upstream session id header.
    - `upstream_user_info_header` string — The upstream user info header.
    - `upstream_user_info_jwt_header` string — The upstream user info JWT header (in case the user info returns a JWT response).
    - `userinfo_accept` 'application/json' | 'application/jwt' — The value of `Accept` header for user info requests: - `application/json`: user info response as JSON - `application/jwt`: user info response as JWT (from the obsolete IETF draft document).
    - `userinfo_endpoint` string — The user info endpoint. If set it overrides the value in `userinfo_endpoint` returned by the discovery endpoint.
    - `userinfo_headers_client` string[] — Extra headers passed from the client to the user info endpoint.
    - `userinfo_headers_names` string[] — Extra header names passed to the user info endpoint.
    - `userinfo_headers_values` string[] — Extra header values passed to the user info endpoint.
    - `userinfo_query_args_client` string[] — Extra query arguments passed from the client to the user info endpoint.
    - `userinfo_query_args_names` string[] — Extra query argument names passed to the user info endpoint.
    - `userinfo_query_args_values` string[] — Extra query argument values passed to the user info endpoint.
    - `using_pseudo_issuer` boolean — If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with `config.issuer`.
    - `verify_claims` boolean — Verify tokens for standard claims.
    - `verify_nonce` boolean — Verify nonce on authorization code flow.
    - `verify_parameters` boolean — Verify plugin configuration against discovery.
    - `verify_signature` boolean — Verify signature of tokens.
  - `created_at` integer — Unix epoch when the resource was created.
  - `enabled` boolean — Whether the plugin is applied.
  - `id` string
  - `instance_name` string
  - `name` 'openid-connect' — The name of the Plugin that's going to be added. Currently, the Plugin must be installed in every Kong instance separately.
  - `ordering` object
    - `after` object
      - `access` string[]
    - `before` object
      - `access` string[]
  - `protocols` string[] — A list of the request protocols that will trigger this plugin. The default value, as well as the possible values allowed on this field, may change depending on the plugin type. For example, plugins that only work in stream mode will only support `"tcp"` and `"tls"`.
  - `tags` string[] — An optional set of strings associated with the Plugin for grouping and filtering.
  - `updated_at` integer — Unix epoch when the resource was last updated.
  - `consumer` object — If set, the plugin will activate only for requests where the specified has been authenticated. (Note that some plugins can not be restricted to consumers this way.). Leave unset for the plugin to activate regardless of the authenticated Consumer.
    - `id` string
  - `consumer_group` object
    - `id` string
  - `route` object — If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the Route being used.
    - `id` string
  - `service` object — If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    - `id` string

## Response `201`

Created OpenidConnect plugin

- OpenidConnectPlugin
  - `config` object — The configuration properties for the Plugin which can be found on the plugins documentation page in the [Kong Hub](https://docs.konghq.com/hub/).
    - `anonymous` string — An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a `4xx` HTTP status code. This value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.
    - `audience` string[] — The audience passed to the authorization endpoint.
    - `audience_claim` string[] — The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `audience_required` string[] — The audiences (`audience_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.
    - `auth_methods` string[] — Types of credentials/grants to enable.
    - `authenticated_groups_claim` string[] — The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `authorization_cookie_domain` string — The authorization cookie Domain flag.
    - `authorization_cookie_http_only` boolean — Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.
    - `authorization_cookie_name` string — The authorization cookie name.
    - `authorization_cookie_path` string — The authorization cookie Path flag.
    - `authorization_cookie_same_site` 'Strict' | 'Lax' | 'None' | 'Default' — Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.
    - `authorization_cookie_secure` boolean — Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
    - `authorization_endpoint` string — The authorization endpoint. If set it overrides the value in `authorization_endpoint` returned by the discovery endpoint.
    - `authorization_query_args_client` string[] — Extra query arguments passed from the client to the authorization endpoint.
    - `authorization_query_args_names` string[] — Extra query argument names passed to the authorization endpoint.
    - `authorization_query_args_values` string[] — Extra query argument values passed to the authorization endpoint.
    - `authorization_rolling_timeout` number — Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.
    - `bearer_token_cookie_name` string — The name of the cookie in which the bearer token is passed.
    - `bearer_token_param_type` string[] — Where to look for the bearer token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body - `cookie`: search the HTTP request cookies specified with `config.bearer_token_cookie_name`.
    - `by_username_ignore_case` boolean — If `consumer_by` is set to `username`, specify whether `username` can match consumers case-insensitively.
    - `cache_introspection` boolean — Cache the introspection endpoint requests.
    - `cache_token_exchange` boolean — Cache the token exchange endpoint requests.
    - `cache_tokens` boolean — Cache the token endpoint requests.
    - `cache_tokens_salt` string — Salt used for generating the cache key that is used for caching the token endpoint requests.
    - `cache_ttl` number — The default cache ttl in seconds that is used in case the cached object does not specify the expiry.
    - `cache_ttl_max` number — The maximum cache ttl in seconds (enforced).
    - `cache_ttl_min` number — The minimum cache ttl in seconds (enforced).
    - `cache_ttl_neg` number — The negative cache ttl in seconds.
    - `cache_ttl_resurrect` number — The resurrection ttl in seconds.
    - `cache_user_info` boolean — Cache the user info requests.
    - `claims_forbidden` string[] — If given, these claims are forbidden in the token payload.
    - `client_alg` string[] — The algorithm to use for client_secret_jwt (only HS***) or private_key_jwt authentication.
    - `client_arg` string — The client to use for this request (the selection is made with a request parameter with the same name).
    - `client_auth` string[] — The default OpenID Connect client authentication method is 'client_secret_basic' (using 'Authorization: Basic' header), 'client_secret_post' (credentials in body), 'client_secret_jwt' (signed client assertion in body), 'private_key_jwt' (private key-signed assertion), 'tls_client_auth' (client certificate), 'self_signed_tls_client_auth' (self-signed client certificate), and 'none' (no authentication).
    - `client_credentials_param_type` string[] — Where to look for the client credentials: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search from the HTTP request body.
    - `client_id` string[] — The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.
    - `client_jwk` object[] — The JWK used for the private_key_jwt authentication.
      - `alg` string
      - `crv` string
      - `d` string
      - `dp` string
      - `dq` string
      - `e` string
      - `issuer` string
      - `k` string
      - `key_ops` string[]
      - `kid` string
      - `kty` string
      - `n` string
      - `oth` string
      - `p` string
      - `q` string
      - `qi` string
      - `r` string
      - `t` string
      - `use` string
      - `x` string
      - `x5c` string[]
      - `x5t` string
      - `x5t#S256` string
      - `x5u` string
      - `y` string
    - `client_secret` string[] — The client secret.
    - `cluster_cache_redis` object
      - `cluster_max_redirections` integer — Maximum retry attempts for redirection.
      - `cluster_nodes` object[] — Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
        - `ip` string — A string representing a host name, such as example.com.
        - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `connect_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `connection_is_proxied` boolean — If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.
      - `database` integer — Database to use for the Redis connection when using the `redis` strategy
      - `host` string — A string representing a host name, such as example.com.
      - `keepalive_backlog` integer — Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.
      - `keepalive_pool_size` integer — The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.
      - `password` string — Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
      - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `read_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `send_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `sentinel_master` string — Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
      - `sentinel_nodes` object[] — Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.
        - `host` string — A string representing a host name, such as example.com.
        - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `sentinel_password` string — Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
      - `sentinel_role` 'master' | 'slave' | 'any' — Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.
      - `sentinel_username` string — Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
      - `server_name` string — A string representing an SNI (server name indication) value for TLS.
      - `ssl` boolean — If set to true, uses SSL to connect to Redis.
      - `ssl_verify` boolean — If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.
      - `username` string — Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.
    - `cluster_cache_strategy` 'off' | 'redis' — The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared.
    - `consumer_by` string[] — Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.
    - `consumer_claim` string[] — The claim used for consumer mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `consumer_optional` boolean — Do not terminate the request if consumer mapping fails.
    - `credential_claim` string[] — The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `disable_session` string[] — Disable issuing the session cookie with the specified grants.
    - `discovery_headers_names` string[] — Extra header names passed to the discovery endpoint.
    - `discovery_headers_values` string[] — Extra header values passed to the discovery endpoint.
    - `display_errors` boolean — Display errors on failure responses.
    - `domains` string[] — The allowed values for the `hd` claim.
    - `downstream_access_token_header` string — The downstream access token header.
    - `downstream_access_token_jwk_header` string — The downstream access token JWK header.
    - `downstream_headers_claims` string[] — The downstream header claims. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `downstream_headers_names` string[] — The downstream header names for the claim values.
    - `downstream_id_token_header` string — The downstream id token header.
    - `downstream_id_token_jwk_header` string — The downstream id token JWK header.
    - `downstream_introspection_header` string — The downstream introspection header.
    - `downstream_introspection_jwt_header` string — The downstream introspection JWT header.
    - `downstream_refresh_token_header` string — The downstream refresh token header.
    - `downstream_session_id_header` string — The downstream session id header.
    - `downstream_user_info_header` string — The downstream user info header.
    - `downstream_user_info_jwt_header` string — The downstream user info JWT header (in case the user info returns a JWT response).
    - `dpop_proof_lifetime` number — Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise.
    - `dpop_use_nonce` boolean — Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime.
    - `enable_hs_signatures` boolean — Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted).
    - `end_session_endpoint` string — The end session endpoint. If set it overrides the value in `end_session_endpoint` returned by the discovery endpoint.
    - `expose_error_code` boolean — Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to `false` to disable.
    - `extra_jwks_uris` string[] — JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).
    - `forbidden_destroy_session` boolean — Destroy any active session for the forbidden requests.
    - `forbidden_error_message` string — The error message for the forbidden requests (when not using the redirection).
    - `forbidden_redirect_uri` string[] — Where to redirect the client on forbidden requests.
    - `groups_claim` string[] — The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `groups_required` string[] — The groups (`groups_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.
    - `hide_credentials` boolean — Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication.
    - `http_proxy` string — The HTTP proxy.
    - `http_proxy_authorization` string — The HTTP proxy authorization.
    - `http_version` number — The HTTP version used for the requests by this plugin: - `1.1`: HTTP 1.1 (the default) - `1.0`: HTTP 1.0.
    - `https_proxy` string — The HTTPS proxy.
    - `https_proxy_authorization` string — The HTTPS proxy authorization.
    - `id_token_param_name` string — The name of the parameter used to pass the id token.
    - `id_token_param_type` string[] — Where to look for the id token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.
    - `ignore_signature` string[] — Skip the token signature verification on certain grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.
    - `introspect_jwt_tokens` boolean — Specifies whether to introspect the JWT access tokens (can be used to check for revocations).
    - `introspection_accept` 'application/json' | 'application/token-introspection+jwt' | 'application/jwt' — The value of `Accept` header for introspection requests: - `application/json`: introspection response as JSON - `application/token-introspection+jwt`: introspection response as JWT (from the current IETF draft document) - `application/jwt`: introspection response as JWT (from the obsolete IETF draft document).
    - `introspection_check_active` boolean — Check that the introspection response has an `active` claim with a value of `true`.
    - `introspection_endpoint` string — The introspection endpoint. If set it overrides the value in `introspection_endpoint` returned by the discovery endpoint.
    - `introspection_endpoint_auth_method` 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'tls_client_auth' | 'self_signed_tls_client_auth' | 'none' — The introspection endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate
    - `introspection_headers_client` string[] — Extra headers passed from the client to the introspection endpoint.
    - `introspection_headers_names` string[] — Extra header names passed to the introspection endpoint.
    - `introspection_headers_values` string[] — Extra header values passed to the introspection endpoint.
    - `introspection_hint` string — Introspection hint parameter value passed to the introspection endpoint.
    - `introspection_post_args_client` string[] — Extra post arguments passed from the client to the introspection endpoint.
    - `introspection_post_args_names` string[] — Extra post argument names passed to the introspection endpoint.
    - `introspection_post_args_values` string[] — Extra post argument values passed to the introspection endpoint.
    - `introspection_token_param_name` string — Designate token's parameter name for introspection.
    - `issuer` string — The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure `config.using_pseudo_issuer=true`.
    - `issuers_allowed` string[] — The issuers allowed to be present in the tokens (`iss` claim).
    - `jwt_session_claim` string — The claim to match against the JWT session cookie.
    - `jwt_session_cookie` string — The name of the JWT session cookie.
    - `keepalive` boolean — Use keepalive with the HTTP client.
    - `leeway` number — Defines leeway time (in seconds) for `auth_time`, `exp`, `iat`, and `nbf` claims
    - `login_action` 'upstream' | 'response' | 'redirect' — What to do after successful login: - `upstream`: proxy request to upstream service - `response`: terminate request with a response - `redirect`: redirect to a different location.
    - `login_methods` string[] — Enable login functionality with specified grants.
    - `login_redirect_mode` 'query' | 'fragment' — Where to place `login_tokens` when using `redirect` `login_action`: - `query`: place tokens in query string - `fragment`: place tokens in url fragment (not readable by servers).
    - `login_redirect_uri` string[] — Where to redirect the client when `login_action` is set to `redirect`.
    - `login_tokens` string[] — What tokens to include in `response` body or `redirect` query string or fragment: - `id_token`: include id token - `access_token`: include access token - `refresh_token`: include refresh token - `tokens`: include the full token endpoint response - `introspection`: include introspection response.
    - `logout_methods` string[] — The request methods that can activate the logout: - `POST`: HTTP POST method - `GET`: HTTP GET method - `DELETE`: HTTP DELETE method.
    - `logout_post_arg` string — The request body argument that activates the logout.
    - `logout_query_arg` string — The request query argument that activates the logout.
    - `logout_redirect_uri` string[] — Where to redirect the client after the logout.
    - `logout_revoke` boolean — Revoke tokens as part of the logout. For more granular token revocation, you can also adjust the `logout_revoke_access_token` and `logout_revoke_refresh_token` parameters.
    - `logout_revoke_access_token` boolean — Revoke the access token as part of the logout. Requires `logout_revoke` to be set to `true`.
    - `logout_revoke_refresh_token` boolean — Revoke the refresh token as part of the logout. Requires `logout_revoke` to be set to `true`.
    - `logout_uri_suffix` string — The request URI suffix that activates the logout.
    - `max_age` number — The maximum age (in seconds) compared to the `auth_time` claim.
    - `mtls_introspection_endpoint` string — Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.
    - `mtls_revocation_endpoint` string — Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.
    - `mtls_token_endpoint` string — Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint.
    - `no_proxy` string — Do not use proxy with these hosts.
    - `password_param_type` string[] — Where to look for the username and password: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.
    - `preserve_query_args` boolean — With this parameter, you can preserve request query arguments even when doing authorization code flow.
    - `proof_of_possession_auth_methods_validation` boolean — If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP.
    - `proof_of_possession_dpop` 'off' | 'strict' | 'optional' — Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof.
    - `proof_of_possession_mtls` 'off' | 'strict' | 'optional' — Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401.
    - `pushed_authorization_request_endpoint` string — The pushed authorization endpoint. If set it overrides the value in `pushed_authorization_request_endpoint` returned by the discovery endpoint.
    - `pushed_authorization_request_endpoint_auth_method` 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'tls_client_auth' | 'self_signed_tls_client_auth' | 'none' — The pushed authorization request endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate
    - `redirect_uri` string[] — The redirect URI passed to the authorization and token endpoints.
    - `redis` object
      - `cluster_max_redirections` integer — Maximum retry attempts for redirection.
      - `cluster_nodes` object[] — Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.
        - `ip` string — A string representing a host name, such as example.com.
        - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `connect_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `connection_is_proxied` boolean — If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.
      - `database` integer — Database to use for the Redis connection when using the `redis` strategy
      - `host` string — A string representing a host name, such as example.com.
      - `keepalive_backlog` integer — Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`.
      - `keepalive_pool_size` integer — The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.
      - `password` string — Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
      - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `prefix` string — The Redis session key prefix.
      - `read_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `send_timeout` integer — An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.
      - `sentinel_master` string — Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
      - `sentinel_nodes` object[] — Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.
        - `host` string — A string representing a host name, such as example.com.
        - `port` integer — An integer representing a port number between 0 and 65535, inclusive.
      - `sentinel_password` string — Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
      - `sentinel_role` 'master' | 'slave' | 'any' — Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel.
      - `sentinel_username` string — Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
      - `server_name` string — A string representing an SNI (server name indication) value for TLS.
      - `socket` string — The Redis unix socket path.
      - `ssl` boolean — If set to true, uses SSL to connect to Redis.
      - `ssl_verify` boolean — If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.
      - `username` string — Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.
    - `rediscovery_lifetime` number — Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis.
    - `refresh_token_param_name` string — The name of the parameter used to pass the refresh token.
    - `refresh_token_param_type` string[] — Where to look for the refresh token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.
    - `refresh_tokens` boolean — Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a `refresh_token` available.
    - `require_proof_key_for_code_exchange` boolean — Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of `code_challenge_methods_supported`, and enabled automatically (in case the `code_challenge_methods_supported` is missing, the PKCE will not be enabled).
    - `require_pushed_authorization_requests` boolean — Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of `require_pushed_authorization_requests` (which defaults to `false`).
    - `require_signed_request_object` boolean — Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of `require_signed_request_object`, and enabled automatically (in case the `require_signed_request_object` is missing, the feature will not be enabled).
    - `resolve_distributed_claims` boolean — Distributed claims are represented by the `_claim_names` and `_claim_sources` members of the JSON object containing the claims. If this parameter is set to `true`, the plugin explicitly resolves these distributed claims.
    - `response_mode` 'query' | 'form_post' | 'fragment' | 'query.jwt' | 'form_post.jwt' | 'fragment.jwt' | 'jwt' — Response mode passed to the authorization endpoint: - `query`: for parameters in query string - `form_post`: for parameters in request body - `fragment`: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) - `query.jwt`, `form_post.jwt`, `fragment.jwt`: similar to `query`, `form_post` and `fragment` but the parameters are encoded in a JWT - `jwt`: shortcut that indicates the default encoding for the requested response type.
    - `response_type` string[] — The response type passed to the authorization endpoint.
    - `reverify` boolean — Specifies whether to always verify tokens stored in the session.
    - `revocation_endpoint` string — The revocation endpoint. If set it overrides the value in `revocation_endpoint` returned by the discovery endpoint.
    - `revocation_endpoint_auth_method` 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'tls_client_auth' | 'self_signed_tls_client_auth' | 'none' — The revocation endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate
    - `revocation_token_param_name` string — Designate token's parameter name for revocation.
    - `roles_claim` string[] — The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `roles_required` string[] — The roles (`roles_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.
    - `run_on_preflight` boolean — Specifies whether to run this plugin on pre-flight (`OPTIONS`) requests.
    - `scopes` string[] — The scopes passed to the authorization and token endpoints.
    - `scopes_claim` string[] — The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `scopes_required` string[] — The scopes (`scopes_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases.
    - `search_user_info` boolean — Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers.
    - `session_absolute_timeout` number — Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks.
    - `session_audience` string — The session audience, which is the intended target application. For example `"my-application"`.
    - `session_cookie_domain` string — The session cookie Domain flag.
    - `session_cookie_http_only` boolean — Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.
    - `session_cookie_name` string — The session cookie name.
    - `session_cookie_path` string — The session cookie Path flag.
    - `session_cookie_same_site` 'Strict' | 'Lax' | 'None' | 'Default' — Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.
    - `session_cookie_secure` boolean — Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
    - `session_enforce_same_subject` boolean — When set to `true`, audiences are forced to share the same subject.
    - `session_hash_storage_key` boolean — When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.
    - `session_hash_subject` boolean — When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.
    - `session_idling_timeout` number — Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching.
    - `session_memcached_host` string — The memcached host.
    - `session_memcached_port` integer — The memcached port.
    - `session_memcached_prefix` string — The memcached session key prefix.
    - `session_memcached_socket` string — The memcached unix socket path.
    - `session_remember` boolean — Enables or disables persistent sessions.
    - `session_remember_absolute_timeout` number — Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks.
    - `session_remember_cookie_name` string — Persistent session cookie name. Use with the `remember` configuration parameter.
    - `session_remember_rolling_timeout` number — Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling.
    - `session_request_headers` string[] — Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ "id", "timeout" ]` will set Session-Id and Session-Timeout request headers.
    - `session_response_headers` string[] — Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ "id", "timeout" ]` will set Session-Id and Session-Timeout response headers.
    - `session_rolling_timeout` number — Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.
    - `session_secret` string — The session secret.
    - `session_storage` 'cookie' | 'memcache' | 'memcached' | 'redis' — The session storage for session data: - `cookie`: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) - `memcache`: stores session data in memcached - `redis`: stores session data in Redis.
    - `session_store_metadata` boolean — Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject.
    - `ssl_verify` boolean — Verify identity provider server certificate. If set to `true`, the plugin uses the CA certificate set in the `kong.conf` config parameter `lua_ssl_trusted_certificate`.
    - `timeout` number — Network IO timeout in milliseconds.
    - `tls_client_auth_cert_id` string — ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.
    - `tls_client_auth_ssl_verify` boolean — Verify identity provider server certificate during mTLS client authentication.
    - `token_cache_key_include_scope` boolean — Include the scope in the token cache key, so token with different scopes are considered diffrent tokens.
    - `token_endpoint` string — The token endpoint. If set it overrides the value in `token_endpoint` returned by the discovery endpoint.
    - `token_endpoint_auth_method` 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'tls_client_auth' | 'self_signed_tls_client_auth' | 'none' — The token endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate
    - `token_exchange_endpoint` string — The token exchange endpoint.
    - `token_headers_client` string[] — Extra headers passed from the client to the token endpoint.
    - `token_headers_grants` string[] — Enable the sending of the token endpoint response headers only with certain grants: - `password`: with OAuth password grant - `client_credentials`: with OAuth client credentials grant - `authorization_code`: with authorization code flow - `refresh_token` with refresh token grant.
    - `token_headers_names` string[] — Extra header names passed to the token endpoint.
    - `token_headers_prefix` string — Add a prefix to the token endpoint response headers before forwarding them to the downstream client.
    - `token_headers_replay` string[] — The names of token endpoint response headers to forward to the downstream client.
    - `token_headers_values` string[] — Extra header values passed to the token endpoint.
    - `token_post_args_client` string[] — Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with `scope` values, like this: `config.token_post_args_client=scope` In this case, the token would take the `scope` value from the query parameter or from the request body or from the header and send it to the token endpoint.
    - `token_post_args_names` string[] — Extra post argument names passed to the token endpoint.
    - `token_post_args_values` string[] — Extra post argument values passed to the token endpoint.
    - `unauthorized_destroy_session` boolean — Destroy any active session for the unauthorized requests.
    - `unauthorized_error_message` string — The error message for the unauthorized requests (when not using the redirection).
    - `unauthorized_redirect_uri` string[] — Where to redirect the client on unauthorized requests.
    - `unexpected_redirect_uri` string[] — Where to redirect the client when unexpected errors happen with the requests.
    - `upstream_access_token_header` string — The upstream access token header.
    - `upstream_access_token_jwk_header` string — The upstream access token JWK header.
    - `upstream_headers_claims` string[] — The upstream header claims. If multiple values are set, it means the claim is inside a nested object of the token payload.
    - `upstream_headers_names` string[] — The upstream header names for the claim values.
    - `upstream_id_token_header` string — The upstream id token header.
    - `upstream_id_token_jwk_header` string — The upstream id token JWK header.
    - `upstream_introspection_header` string — The upstream introspection header.
    - `upstream_introspection_jwt_header` string — The upstream introspection JWT header.
    - `upstream_refresh_token_header` string — The upstream refresh token header.
    - `upstream_session_id_header` string — The upstream session id header.
    - `upstream_user_info_header` string — The upstream user info header.
    - `upstream_user_info_jwt_header` string — The upstream user info JWT header (in case the user info returns a JWT response).
    - `userinfo_accept` 'application/json' | 'application/jwt' — The value of `Accept` header for user info requests: - `application/json`: user info response as JSON - `application/jwt`: user info response as JWT (from the obsolete IETF draft document).
    - `userinfo_endpoint` string — The user info endpoint. If set it overrides the value in `userinfo_endpoint` returned by the discovery endpoint.
    - `userinfo_headers_client` string[] — Extra headers passed from the client to the user info endpoint.
    - `userinfo_headers_names` string[] — Extra header names passed to the user info endpoint.
    - `userinfo_headers_values` string[] — Extra header values passed to the user info endpoint.
    - `userinfo_query_args_client` string[] — Extra query arguments passed from the client to the user info endpoint.
    - `userinfo_query_args_names` string[] — Extra query argument names passed to the user info endpoint.
    - `userinfo_query_args_values` string[] — Extra query argument values passed to the user info endpoint.
    - `using_pseudo_issuer` boolean — If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with `config.issuer`.
    - `verify_claims` boolean — Verify tokens for standard claims.
    - `verify_nonce` boolean — Verify nonce on authorization code flow.
    - `verify_parameters` boolean — Verify plugin configuration against discovery.
    - `verify_signature` boolean — Verify signature of tokens.
  - `created_at` integer — Unix epoch when the resource was created.
  - `enabled` boolean — Whether the plugin is applied.
  - `id` string
  - `instance_name` string
  - `name` 'openid-connect' — The name of the Plugin that's going to be added. Currently, the Plugin must be installed in every Kong instance separately.
  - `ordering` object
    - `after` object
      - `access` string[]
    - `before` object
      - `access` string[]
  - `protocols` string[] — A list of the request protocols that will trigger this plugin. The default value, as well as the possible values allowed on this field, may change depending on the plugin type. For example, plugins that only work in stream mode will only support `"tcp"` and `"tls"`.
  - `tags` string[] — An optional set of strings associated with the Plugin for grouping and filtering.
  - `updated_at` integer — Unix epoch when the resource was last updated.
  - `consumer` object — If set, the plugin will activate only for requests where the specified has been authenticated. (Note that some plugins can not be restricted to consumers this way.). Leave unset for the plugin to activate regardless of the authenticated Consumer.
    - `id` string
  - `consumer_group` object
    - `id` string
  - `route` object — If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the Route being used.
    - `id` string
  - `service` object — If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    - `id` string

## Other responses

- `401` — Unauthorized

## Changes

> 3 revisions in range; 1 not diffed.

- **2024-09-11** `5bd52189d290` — 28 warning, 12 info
  - removed the request property `allOf[#/components/schemas/OpenidConnectPluginConfig]/config/session_redis_cluster_max_redirections`
  - removed the request property `allOf[#/components/schemas/OpenidConnectPluginConfig]/config/session_redis_cluster_nodes`
  - removed the request property `allOf[#/components/schemas/OpenidConnectPluginConfig]/config/session_redis_connect_timeout`
  - removed the request property `allOf[#/components/schemas/OpenidConnectPluginConfig]/config/session_redis_host`
  - …36 more

[Change history](https://skmtc.dev/kong/apis/kong-enterprise-admin-api/changes/plugins#OpenidConnect/post.md)

---

[API](https://skmtc.dev/kong/apis/kong-enterprise-admin-api.md) · [All operations](https://skmtc.dev/kong/apis/kong-enterprise-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kong/kong-enterprise-admin-api/revisions/5bd52189d290/schema)