AXIAM PHP SDK

__construct()

Parameters

$issuer : string

The authorization server's issuer identifier — the value an ID token's iss claim must equal exactly.

$authorization_endpoint : string

The authorization endpoint oidcBegin builds its redirect URL from.

$token_endpoint : string

The token endpoint used by oidcExchange, oidcRefresh and loginClientCredentials.

$userinfo_endpoint : string

The userinfo endpoint. Advertised by the server but deliberately NOT called by this SDK (§12.3 rule 5).

$jwks_uri : string

URI of the JWKS document whose keys verify ID-token signatures (§12.4 rule 2).

$revocation_endpoint : string

The RFC 7009 revocation endpoint used by revoke.

$introspection_endpoint : string

The RFC 7662 introspection endpoint used by introspect.

$response_types_supported : array<int, string>

OAuth2 response_type values the server supports.

$subject_types_supported : array<int, string>

Subject identifier types the server supports.

$id_token_signing_alg_values_supported : array<int, string>

ID-token signing algorithms the server advertises. Informational only: §12.4 rule 1 pins verification to EdDSA regardless of what appears here.

$scopes_supported : array<int, string>

Scopes the server supports.

$token_endpoint_auth_methods_supported : array<int, string>

Client-authentication methods the token endpoint supports (client_secret_post, §12.1 note 3).

$claims_supported : array<int, string>

Claims the server may include in an ID token.

$grant_types_supported : array<int, string>

Grant types the token endpoint supports.

$device_authorization_endpoint : string|null = null

RFC 8628 device authorization endpoint, used by deviceAuthorize (§14.1). null when the server does not implement the device grant, or when the document came from a non-AXIAM OP — its absence is an error at call time, never a cue to build the URL by concatenation.

$pushed_authorization_request_endpoint : string|null = null

RFC 9126 pushed authorization request endpoint, used by oidcPar (§26.1). null when the server does not implement PAR — its absence is an error at call time, never a cue to build the URL by concatenation, and for a FAPI 2.0 client it is fatal rather than a fallback since §21.1 refuses a fapi2 registration that does not set require_par.

$end_session_endpoint : string|null = null

OIDC RP-Initiated Logout 1.0 endpoint, used by logoutUrl (§12.7.2 rule 1). null for the same reason, and the rule is stricter here: §12.7.2 rule 1 forbids synthesising this URL from the issuer.

$backchannel_logout_supported : bool = false

Whether the OP sends back-channel logout tokens.

$backchannel_logout_session_supported : bool = false

Whether those logout tokens carry sid. AXIAM always sends it.

$mtls_endpoint_aliases : MtlsEndpointAliases|null = null

RFC 8705 §5 endpoint aliases for a deployment that terminates mutual TLS on a host other than the issuer's own (contract 1.40, §21.3 rule 2). null means "no separate host", not "mTLS unsupported": a deployment running client_auth = optional on one listener serves both populations at the conventional endpoints and correctly publishes nothing here, so a client treating absence as an error would refuse the most common mTLS topology AXIAM ships.

$code_challenge_methods_supported : array<int, string>|null = null

PKCE code-challenge methods the server supports (RFC 8414 §2 / RFC 7636 §4.3; AXIAM advertises ["S256"] as of contract 1.42). Modelled optional even though the AXIAM schema marks it required: RFC 8414 defines no default for this member, so its absence does not mean S256 (CONTRACT.md §21.5) — it means a conforming client cannot establish that PKCE is available at all, and a discovery document from a non-AXIAM OP that omits it must still parse rather than be rejected.

$token_endpoint_auth_signing_alg_values_supported : array<int, string>|null = null

JWS algorithms the token endpoint accepts on a private_key_jwt client assertion (RFC 8414 §2; AXIAM advertises ["PS256", "ES256", "EdDSA"] as of contract 1.42). Optional for the same reason as the member above, and informational either way: §12.1 note 3 pins this SDK to client_secret_post, so it never signs a client assertion.

$backchannel_authentication_endpoint : string|null = null

CIBA Core §4 / CONTRACT.md §33.1 (contract 1.58): the endpoint cibaInitiate posts to. null when the server does not offer CIBA — an error at call time, never a cue to build the URL.

$backchannel_token_delivery_modes_supported : array<int, string>|null = null

The CIBA delivery modes the SERVER offers (AXIAM: ["poll", "ping"]). A statement about the server, not about any client's registration.

$backchannel_user_code_parameter_supported : bool|null = null

Whether the server accepts a CIBA user_code (AXIAM: false; this SDK never sends one).

$backchannel_authentication_request_signing_alg_values_supported : array<int, string>|null = null

The algorithms a signed CIBA request may use (AXIAM: ["PS256", "ES256", "EdDSA"]).

$revocation_endpoint_auth_methods_supported : array<int, string>|null = null

Client-authentication methods the revocation endpoint accepts (RFC 8414 §2; contract 1.60, §21.5). Optional: a server before 1.0.0 omits it. Informational — revoke keeps authenticating with the method this client was configured with either way.

$introspection_endpoint_auth_methods_supported : array<int, string>|null = null

Client-authentication methods the introspection endpoint accepts (contract 1.60, §21.5): the token endpoint's list without none, since introspection refuses a public client. Optional, informational.

$revocation_endpoint_auth_signing_alg_values_supported : array<int, string>|null = null

JWS algorithms the revocation endpoint accepts on a client assertion (contract 1.60, §21.5). Optional, informational.

$introspection_endpoint_auth_signing_alg_values_supported : array<int, string>|null = null

JWS algorithms the introspection endpoint accepts on a client assertion (contract 1.60, §21.5). Optional, informational.