Ory Sh Ory APIs

Name: Ory APIs
Brand: Ory APIs
Availability: InStock

✓ Official Vendor SpecIdentity AuthAuthenticationoauth2, bearer, basic146 EndpointsREST

For Agents

Run identity, OAuth 2.0, OpenID Connect, and Zanzibar-style permission checks against Ory Network. Agents can manage users, sessions, OAuth clients, and access policies through a single API.

Use for: Register a new user with email and password, Verify a user's session token is still valid, Issue an OAuth 2.0 access token for a confidential client, List all OAuth 2.0 clients in an Ory project

Not supported: Does not handle payment processing, CRM, or general user analytics - use for identity, OAuth 2.0, OpenID Connect, and Zanzibar permissions only.

Ory APIs provide a unified surface over Ory Network's identity, session, OAuth 2.0, OpenID Connect, and permission services. Developers can register and authenticate users, run self-service flows for login, registration, recovery, verification, and settings, issue and introspect OAuth 2.0 tokens, and evaluate fine-grained permissions backed by Google Zanzibar. With 146 endpoints across identity, frontend, courier, oAuth2, OIDC, permission, and project management, Ory replaces a stack of bespoke auth code for SaaS and B2B platforms.

Jentic One on Github View OpenAPI Document

Install Jentic One Beta

Connect the Ory APIs to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Ory APIs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fory.sh%2Fory" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fory.sh%2Fory" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Ory APIs.

Run self-service login, registration, recovery, and settings flows for end users

Manage OAuth 2.0 clients, authorisation requests, and token introspection

Issue and revoke user sessions, including impersonation and refresh handling

Define identity schemas and create or look up identities by trait

Evaluate Zanzibar-style permission checks against Ory Keto relations

GET STARTED

Start building with Ory APIs

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Ory APIs for, with concrete tasks.

★ Customer Identity for SaaS Applications

SaaS teams use Ory to ship login, registration, MFA, and account recovery without building auth from scratch. The frontend self-service flows handle browser and native clients, while the identity admin endpoints let backend services list, update, and deactivate users. A typical embedded login page goes live in 1-2 days using the prebuilt Ory Account Experience or in a week with a fully custom UI.

Initialise a registration flow with GET /self-service/registration/api, then submit the user's email and password to the returned action URL and capture the resulting session token.

OAuth 2.0 Authorisation Server

Platforms that expose third-party APIs use Ory Hydra (surfaced via /admin/clients and /oauth2/*) as their OAuth 2.0 and OpenID Connect provider. Endpoints cover the full authorisation code, client credentials, and refresh token flows, plus token introspection and revocation. Hydra handles consent UI hand-off, so teams keep their own login experience while delegating protocol compliance.

Create a new confidential OAuth client by POSTing to /admin/clients with client_name, redirect_uris, and grant_types ['authorization_code','refresh_token'].

Fine-Grained Authorisation with Keto

Applications that need per-resource permission checks (who can read which document, who can edit which project) use Ory's permission API to evaluate Zanzibar-style relation tuples. Endpoints under /relation-tuples and /permissions answer 'subject X has permission Y on resource Z' in milliseconds, letting agents enforce ACLs without hard-coding role checks in application code.

Check whether user 'alice@example.com' has 'editor' permission on document 'doc-42' by calling GET /relation-tuples/check with subject and object query params.

AI Agent Identity Plumbing via Jentic

Agents that act on behalf of human users need session validation, OAuth token issuance, and permission checks at runtime. Through Jentic, an agent searches for 'check user permission' and Ory's permission endpoints surface with their schemas. The agent can then enforce per-call authorisation without the developer wiring a bespoke Ory client into the agent loop.

Use Jentic to search 'verify a session token', load the GET /sessions/whoami schema, and execute it with the session cookie supplied by the calling user.

Key Endpoints

146 endpoints — ory apis provide a unified surface over ory network's identity, session, oauth 2.

METHOD

PATH

DESCRIPTION

GET

/sessions/whoami

Return the current user's session

GET

/admin/identities

List identities in the project

POST

/admin/identities

Create a new identity

POST

/admin/clients

POST

/oauth2/token

Issue an OAuth 2.0 token

POST

/oauth2/introspect

Introspect an OAuth 2.0 access or refresh token

GET

/relation-tuples/check

Check a permission relation tuple

GET

/.well-known/openid-configuration

OpenID Connect discovery document

GET

/sessions/whoami

Return the current user's session

GET

/admin/identities

List identities in the project

POST

/admin/identities

Create a new identity

POST

/admin/clients

POST

/oauth2/token

Issue an OAuth 2.0 token

POST

/oauth2/introspect

Introspect an OAuth 2.0 access or refresh token

GET

/relation-tuples/check

Check a permission relation tuple

GET

/.well-known/openid-configuration

OpenID Connect discovery document

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the Ory APIs by hand means choosing among OAuth2, bearer, and basic auth across identity, OAuth 2.0, and permission surfaces, resolving your {project_slug}.projects.oryapis.com host, and mapping the routes yourself. Through Jentic you install once, import Ory from the API Directory, store the credential once, and your agent calls it.

Permission scoping

You choose which Ory operations the agent may call, so you can limit it to the operations it needs, such as checking a session with whoami or a relation-tuple permission, while admin operations like creating identities or OAuth clients stay out of the allowed set unless you add them.

Credential isolation

Your Ory access tokens, OAuth client secrets, and workspace API keys are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'check a user permission' or 'introspect an OAuth token', and Jentic returns the matching Ory operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

FAQs

Specific to using Ory APIs through Jentic.

What authentication does the Ory API use?

Ory APIs accept multiple schemes depending on the operation: OAuth 2.0 access tokens for protected user data, an Ory access token (Bearer) for project-admin actions, an Ory workspace API key for cross-project operations, and HTTP Basic for legacy OAuth client endpoints. Through Jentic the appropriate credential for each operation is held in your Jentic One instance and injected at call time.

Can I issue OAuth 2.0 tokens with the Ory API?

Yes. POST /oauth2/token implements the standard OAuth 2.0 token endpoint and supports authorization_code, client_credentials, and refresh_token grants. Companion endpoints /oauth2/introspect and /oauth2/revoke handle introspection and revocation.

What are the rate limits for the Ory API?

Ory Network applies plan-based rate limits per project, but specific limits are not encoded in the OpenAPI spec. The API returns a 429 with a Retry-After header when a project exceeds its quota. Self-hosted deployments of Ory Kratos, Hydra, and Keto have no built-in rate limits.

How do I check a user's permission through Jentic?

Through Jentic, search for 'check user permission', load the GET /relation-tuples/check schema, and execute it with namespace, object, relation, and subject_id query parameters. Jentic injects the project's Ory access token automatically.

How do I run a self-service login flow with the Ory API?

Initialise the flow with GET /self-service/login/api or /self-service/login/browser, follow the action URL returned in the flow body, and submit the user's credentials. On success the response contains a session token (API flow) or sets a session cookie (browser flow).

Is the Ory API free to use?

Ory Network has a free Developer plan with limited monthly active users; production tiers are usage-priced based on MAUs and add-ons. The underlying Ory Kratos, Hydra, and Keto projects are open source and free to self-host.

Can I limit what my agent is allowed to do with the Ory API?

Yes. Because you run your own self-hosted Jentic One instance, your rules decide which Ory operations and credentials the agent may use. You can allow it only the operations it needs, such as GET /sessions/whoami to verify a session or GET /relation-tuples/check to evaluate a permission, while admin operations like POST /admin/identities or POST /admin/clients stay out of the allowed set unless you add them. This keeps the agent scoped to read-level identity and permission checks rather than creating identities or OAuth clients.

Ory Sh Ory APIs

Connect the Ory APIs to your agent

Capabilities

Start building with Ory APIs

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs