Mingoll.OpenIddict.Management.Endpoints 2.0.0

OpenIddict.Management.Endpoints

OpenIddict.Management.Endpoints (Mingoll.OpenIddict.Management.Endpoints) delivers pre-packaged ASP.NET Core Minimal API endpoint route groups for managing OpenIddict client applications, scopes, tokens, authorizations, active user sessions, audit logs, full configuration export/import, and background token cleanup jobs.

Install this package when you need a standardized, secured RESTful management API to power a frontend Single Page Application (React, Angular, Vue, Blazor), an external administrative portal, CLI management tools, or automated infrastructure provisioning scripts.

Installation

Install via the .NET CLI:

dotnet add package Mingoll.OpenIddict.Management.Endpoints

Or via the Visual Studio Package Manager Console:

Install-Package Mingoll.OpenIddict.Management.Endpoints

Prerequisites & Dependencies

Supported Frameworks

• .NET 8.0 (LTS)
• .NET 9.0 (STS)
• .NET 10.0

Required Package Dependencies

• Microsoft.AspNetCore.App (Shared Framework)
• Mingoll.OpenIddict.Management.Core (Abstractions, models, contracts, validation)

Companion Persistence Packages

This package requires an implementation of the management service contracts registered in your Dependency Injection container. Most applications pair this with Mingoll.OpenIddict.Management.Storage.EfCore.

Configuration & Setup

Map all management endpoint groups using MapOpenIddictManagementEndpoints() on WebApplication or any IEndpointRouteBuilder.

Service Registration & Endpoint Mapping (Program.cs)

using Microsoft.EntityFrameworkCore;
using OpenIddict.Management.Endpoints;
using OpenIddict.Management.Endpoints.Extensions;
using OpenIddict.Management.Storage.EfCore.Extensions;

var builder = WebApplication.CreateBuilder(args);

// 1. Configure Authentication & Authorization policies
builder.Services.AddAuthentication("Bearer")
    .AddJwtBearer("Bearer", options => { /* Configure token validation */ });

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("IdentityAdminPolicy", policy =>
    {
        policy.RequireAuthenticatedUser();
        policy.RequireRole("Administrator");
    });
});

// 2. Register storage and Core services with options
builder.Services.AddDbContext<ApplicationDbContext>(options =>
{
    options.UseSqlServer(builder.Configuration.GetConnectionString("DefaultConnection"));
});

builder.Services.AddOpenIddictManagement<ApplicationDbContext>(options =>
{
    options.EnableAuditLogging = true;
});

// 3. Register Health Check (optional)
builder.Services.AddHealthChecks()
    .AddOpenIddictCleanupHealthCheck();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

// 4. Map all OpenIddict Management Minimal API endpoints
app.MapOpenIddictManagementEndpoints(options =>
{
    options.RoutePrefix = "/api/management";
    options.AuthorizationPolicy = "IdentityAdminPolicy";
    options.RequireAuthorization = true;
    options.Tags = ["OpenIddict Management API"];
});

app.MapHealthChecks("/health");

app.Run();

Configuration via appsettings.json

Settings can be stored in configuration files and bound to ManagementEndpointOptions:

{
  "ManagementEndpoints": {
    "RoutePrefix": "/api/management",
    "AuthorizationPolicy": "IdentityAdminPolicy",
    "RequireAuthorization": true,
    "Tags": ["OpenIddict Management API"]
  }
}

Bind in Program.cs:

builder.Services.Configure<ManagementEndpointOptions>(
    builder.Configuration.GetSection("ManagementEndpoints"));

// Uses bound options automatically when configure delegate is omitted or null
app.MapOpenIddictManagementEndpoints();

Mapped Endpoint Catalog

When mapped, the package exposes the following REST route groups under the configured RoutePrefix:

Applications (/applications)

Scopes (/scopes)

Configuration Export & Import (/configuration)

Audit Trail (/audit)

Tokens & Analytics (/tokens)

Revocation & Sessions (/revocation, /sessions)

Overview & Token Cleanup (/overview, /cleanup)

Usage Examples

1. Export Configuration via HTTP

GET /api/management/configuration/export HTTP/1.1
Host: localhost:5001
Authorization: Bearer <ADMIN_JWT_TOKEN>
Accept: application/json

Response:

{
  "version": "2.0.0",
  "exportedAt": "2026-09-18T00:00:00Z",
  "applications": [ ... ],
  "scopes": [ ... ],
  "openIddictServer": {
    "issuer": "https://auth.example.com/",
    "requireProofKeyForCodeExchange": true,
    "accessTokenLifetime": "01:00:00"
  },
  "management": {
    "routePrefix": "/api/management",
    "requireHttps": true,
    "enableAuditLogging": true
  }
}

2. Bulk Delete Applications via HTTP

POST /api/management/applications/bulk-delete HTTP/1.1
Host: localhost:5001
Authorization: Bearer <ADMIN_JWT_TOKEN>
Content-Type: application/json

[
  "c6a8f192-3d84-46c5-8495-2a81831c4f52",
  "b8e76a14-8742-4911-9a13-8a35c911a3b1"
]

Response:

{
  "totalProcessed": 2,
  "successfulCount": 2,
  "failedCount": 0,
  "errors": []
}

Related Packages