{"action":"created","comment":{"url":"https://api.github.com/repos/auth0/docs/pulls/comments/36526054","id":36526054,"diff_hunk":"@@ -0,0 +1,484 @@\n+# Tokens\n+\n+## Token Overview\n+\n+This document is designed to clarify and disambiguate the numerous types of tokens referenced in Auth0 documentation, what each is used for and how to use it.  \n+\n+First there are a couple different categories of tokens \n+\n+* JSON Web Tokens (JWT) - These are tokens that conform to the JSON Web Token standard and contain information about an identity.  They are self-contained in that it is not necessary for the recipient to call a server to validate the token.\n+* Opaque tokens - Opaque tokens are tokens in a proprietary format that typically contain some identifier to information in a server’s persistent storage.  To validate an opaque token, the recipient of the token needs to call the server that issued the token.\n+\n+There are six primary tokens used in Auth0's token based authentication scenarios and referenced in Auth0 documentation.\n+\n+* The Auth0 id_token\n+* The Auth0 access_token (Auth0 APIv1 token)\n+* Identity Provider access tokens from other providers\n+* The Auth0 refresh token\n+* A Delegation token \n+* The Auth0 APIv2 Token \n+\n+\n+(Editing question: In the logs file, (authN via SAML connection) there is an entry for “exchange” and it says exchange of “authorization code for access token” - Is the “authorization code” that is referenced there yet another “token” that should be documented here?)\n+\n+### id_token (JWT)\n+\n+The Auth0 `id_token` is a token in JSON Web Token (JWT) format, which provides a mechanism for transferring claims about a user from Identity Providers, who are authoritative sources of such information, to other relying parties, such as websites or web services, also known as service providers, who need such information.  The claims included in a JWT can be basic profile attributes such as a name or email address as well as security information such as a group membership or the support plan a user is entitled to use.\n+\n+### Auth0 access token\n+The Auth0 access token is a random, opaque string and was used to call portions of the Auth0 Management API ( APIv1) and the /userinfo endpoint within the Auth0 Authentication API.  \n+\n+### Identity Provider access tokens \n+When a user authenticates via Auth0 with another social provider's authentication service, such as Facebook or LinkedIn, the social provider will return an access token that can be used by the client program to call that social provider's API.\n+\n+### Refresh tokens\n+The Refresh token is a long-lived token that is used to obtain a new id_token after a previous one has expired.  This is useful for applications running on mobile devices that call remote APIs and do not want to require the user to log in everytime the user uses the mobile app.  \n+\n+### Delegation tokens\n+The Auth0 `id_token` can be exchanged for another token, called a Delegation token, that can be used to call either other application APIs registered as clients in the same Auth0 tenant or APIs represented by some types of application Addons registered in the same Auth0 tenant.  \n+\n+### Auth0 APIv2 token\n+The Auth0 APIv2 token is used to call v2 of the Auth0 Management API.  This allows a specific tenant in Auth0 to call Auth0 APIv2.  This APIv2 token is a JWT, and contains various scopes, such as “read users” or “update clients”, and is signed with a client API key and secret for the entire tenant. \n+\n+The following sections will discuss each token in greater detail and provide information on how to use each.\n+\n+##`id_token`\n+\n+The `id_token` is referred to by several names, including `id_token`, the JSON Web Token or abbreviated as the JWT.  It conforms to an industry standard (IETF RFC 7519) and contains three parts: A header, a body and a signature. The header contains the type of token and the hash algorithm used on the contents of the token.  The body, also called the payload, contains identity claims about a user.  There are some non-mandatory claims with registered names, for things like the issuer of the token, the subject of the token (who the claims are about), and the time of issuance.  Any number of additional claims with other names can be added, though care must be taken to keep the JWT within the browser size limitations for URLs.  The third part of the JWT is the signature which is used by the recipient of a JWT to validate the integrity of the information conveyed in the JWT.\n+\n+### How to get the `id_token`\n+The `id_token` is returned when calling any of the Auth0 functions which invoke authentication.  This includes calls to the Lock widget, to the auth0.js library, or the libraries for other languages.  In our code samples for Lock and auth0.js for example, there is a variable called `id_token` in the callback function passed to Lock and auth0.js which receives the `id_token`.\n+\n+Lock libraries:\n+https://auth0.com/docs/libraries/lock\n+https://auth0.com/docs/libraries/lock-ios\n+https://auth0.com/docs/libraries/lock-android\n+\n+Auth0.js\n+https://auth0.com/docs/libraries/auth0js\n+https://github.com/auth0/auth0.js\n+\n+Tutorials showing libraries for other languages\n+https://auth0.com/docs/tutorials\n+\n+###How to control contents of `id_token`\n+The contents of the `id_token`, specifically the claims contained within it, are controlled by the use of a parameter called `scope` which is passed to the authentication functions mentioned above.  For example, the call to the Lock widget’s `.show` function can specify optional authentication parameters as follows:\n+\n+```\n+lock.show({\n+   responseType: ‘token’,\n+   authParams: {\n+      scope: ‘openid name email’\n+    }\n+ });\n+```\n+The above sample, specifying `openid name email` will result in a JWT with claims for the name and email attributes within the user profile.  The responseType should be `token` for client-side authentication flows and `code` for server-side authentication flows as described for the /authorize endpoint here:\n+https://auth0.com/docs/auth-api\n+\n+The scope of the id_token JWT can also be altered via Rules, through the context.jwtConfiguration.scopes object as documented at:\n+https://github.com/auth0/docs/blob/32033877180affa26233b8f65cb28bd532514eab/articles/rules/index.md#context\n+\n+There is also a sample for altering scopes in a Rule at:\n+https://github.com/auth0/rules/blob/dff2a3e72f01d33af3086414be7cf115b19eea0c/rules/custom-scopes.md\n+\n+Additional information on the `id_token` is at:\n+https://auth0.com/docs/jwt\n+\n+A valid JWT can be pasted into the following website to view the contents of the JWT.\n+https://jwt.io\n+\n+A blog entry on JWT - with an explanation of why it is getting to be more popular\n+https://auth0.com/blog/2015/07/21/jwt-json-webtoken-logo/\n+\n+Additional samples using the auth0.js library are at:\n+https://github.com/auth0/auth0.js\n+\n+\n+###Validity\n+The `id_token` is valid for 10 hours (36000 seconds) by default.  The expiration of this token can be set in the `Apps/APIs` -> Settings screen using the `JWT expiration` field.\n+\n+The validity period of the token can be altered via Auth0 Rules using the context.jwtConfiguration.lifetimeInSeconds object as documented at:\n+https://github.com/auth0/docs/blob/32033877180affa26233b8f65cb28bd532514eab/articles/rules/index.md#context\n+\n+For example, the following code in a Rule would set the id_token JWT expiration to 1 hour.\n+```\n+context.jwtConfiguration.lifetimeInSeconds = 3600;\n+```\n+\n+###Renewing the token\n+\n+A new `id_token` can be obtained using an existing, unexpired `id_token` or by using a refresh token and the `/delegation` endpoint.  \n+\n+To use an existing, unexpired `id_token` to obtain a new one, use the `renewIdToken` function within auth0.js library as shown at:\n+https://github.com/auth0/auth0.js#refresh-token\n+\n+To get a new `id_token` when the existing `id_token` has expired, use a refresh token to get a new `id token`, as explained in the Refresh Token section below and also at:\n+https://auth0.com/docs/refresh-token\n+\n+The auth0.js library can also be used to refresh an `id token` as shown at:\n+https://github.com/auth0/auth0.js#refresh-token\n+\n+###Termination of tokens\n+Once issued, tokens can not be revoked in the same fashion as cookies with session id’s for server-side sessions.  As a result, tokens should be issued for relatively short periods, and then renewed periodically if the user remains active.  See the above section on renewing id tokens.\n+\n+\n+###Uses\n+The `id_token` is designed to be used to pass information about a user between websites,  web programs and APIs in an industry standard, URL-friendly fashion.  One advantage of using an `id_token` for this purpose is that the recipient can validate the token without having to make a call back to the issuer of the token.  The token is also designed to enable being passed from one web property to another, via an untrusted client, such that the client cannot alter the token without such tampering being evident to the recipient.\n+\n+The `id_token` can be used to call the /tokeninfo endpoint within the Auth0 authentication API to retrieve the user’s complete profile.\n+https://auth0.com/docs/auth-api#user-profile\n+\n+The `id_token` can also be used to call the /delegation endpoint within the Auth0 authentication API to obtain another token for another API.\n+https://auth0.com/docs/auth-api#delegated\n+\n+The `id_token` can also be used to call other APIs. \n+(Note - provide samples that illustrate best practices - should each API require a different token? e.g. in sample - Better to exchange first token to get a different token specific to the API.  )\n+\n+https://auth0.com/docs/sequence-diagrams\n+\n+Further examples of using the id_token to get tokens for another API are at:\n+https://github.com/auth0/auth0.js#delegation-token-request\n+\n+###Best practices\n+This section contains pointers on best practices related to the `id_token`.\n+\n+####Token Validation\n+Single Page Applications or mobile apps do not need to validate the JWT as they just pass it to something else.  Server side APIs that receive the JWT, however, do need to validate  it. There are server-side APIs to do such validation.  One example for node.js is:\n+https://github.com/auth0/node-jsonwebtoken\n+\n+A blog post with advice about vulnerabilities to avoid in use of JWTs.\n+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/\n+If there is any sensitive information included in the JWT, it should be encrypted, but the need for this is not common.\n+\n+\n+## Auth0 access token\n+The Auth0 access token, usually called `access_token` in the code samples, is an opaque string which is returned by calls that invoke the Auth0 authentication process and is only used to call the Auth0 API.  The Auth0 access token does not contain any claims, cannot be decoded, does not conform with any standard and is not signed. \n+   \n+https://auth0.com/docs/libraries/auth0js\n+\n+###How to get Auth0 access token\n+The Auth0 access token can be obtained in several ways.\n+Calls to Lock or library functions that invoke authentication will return the `access_token`.\n+\n+Calls to the Lock widget will return `access_token` as shown in code samples here:\n+https://auth0.com/docs/libraries/lock\n+\n+Examples using auth0.js\n+https://github.com/auth0/auth0.js\n+\n+https://auth0.com/docs/auth-api\n+The /authorize endpoint in the authentication API will return `access_token`\n+\n+Calls to libraries in other languages as shown in the tutorial for each language:\n+https://auth0.com/docs/tutorials\n+\n+###How to control contents of access token\n+It is not possible at this time to control the contents of the Auth0 access token.\n+\n+###Validity\n+The Auth0 access token remains valid for 24 hours. \n+\n+###Renewing the token\n+There is currently no way to renew the Auth0 access token without triggering authentication by the user.  To get a new access token, simply follow the process for getting an access token as described above in the How to Get an Access Token section.\n+\n+https://github.com/auth0/auth0.js\n+\n+###Termination of tokens\n+Once issued, Auth0 access tokens can not be revoked.  \n+\n+\n+###Uses\n+\n+The Auth0 access token is used to call the Auth0 Management APIv1.  This version of the Auth0 Management API has been deprecated and should no longer be used.\n+\n+It can also be used to call the /userinfo endpoint within the authentication API to get user profile information.\n+https://auth0.com/docs/auth-api#user-profile\n+\n+###Best practices\n+####Token Validation\n+The Auth0 access token is only used to call Auth0 Management APIv1 and as such Auth0 is the only entity that needs to validate this token.  Applications do not need to validate this token in any way.\n+\n+\n+## Identity Provider Access Tokens\n+Third Party Access Tokens are issued by third party social providers, such as Facebook or LinkedIn, when a user authenticates with the provider.  These third party access tokens can be used to call the API of the third party provider that issued the token.\n+ \n+https://auth0.com/docs/libraries/auth0js\n+\n+###How to get Identity Provider access tokens\n+\n+Identity Provider access tokens can be obtained in one of two ways.  First, if a user authenticates to a social Identity Provider, such as Facebook, an Identity Provider access token for that social Identity Provider will be returned in the first element of the `identities` array within the user profile object returned by Auth0.  \n+\n+For example, if authentication is invoked via a call to the Lock widget’s .show method, the following code would be used to put the Identity Provider access token into a variable called `identityProviderAccessToken`. .\n+\n+```\n+    lock.show({\n+       responseType: 'token'\n+      , authParams: {\n+        scope: 'openid name email'\n+      }\n+    }, function(err, profile, token) {\n+        identityProviderAccessToken = profile.identities[0].access_token;\n+    });\n+```\n+\n+Examples of the `identities` array and profiles as returned by various social providers are at:\n+https://auth0.com/docs/user-profile\n+\n+\n+###How to control contents of Identity Provider access tokens\n+The contents of third party access tokens will vary by the issuing Identity Provider.  \n+\n+###Validity\n+The validity period for third party access tokens will vary by the issuing Identity Provider.\n+\n+###Renewing the token\n+There is no standard way to renew Identity Provider access tokens through Auth0.  The mechanism, if available, for renewal of Identity Provider access tokens would vary by Identity Provider and be handled by each Identity Provider.\n+\n+\n+###Termination of tokens\n+The ability to terminate Identity Provider access tokens is up to each individual Identity Provider.\n+\n+###Uses\n+The Identity Provider access is used to call an API offered by the Identity Provider that issued the token.  For example, an access token issued after authentication to Facebook could be used to call the Facebook Graph API.\n+\n+Additional information is at:\n+https://auth0.com/docs/what-to-do-once-the-user-is-logged-in/calling-an-external-idp-api\n+https://auth0.com/docs/what-to-do-once-the-user-is-logged-in/adding-scopes-for-an-external-idp\n+\n+###Best practices\n+####Validation\n+In general, Identity Provider access tokens are passed to the issuing provider, and the issuing provider is responsible for validation of the token. \n+\n+## Refresh Token\n+The Auth0 refresh token is used to get a new `id_token` without requiring the user to re-authenticate.  This is primarily useful for mobile applications that are installed on a device.  \n+\n+More information on the refresh token is at:\n+https://auth0.com/docs/refresh-token\n+\n+###How to get the Auth0 refresh token\n+The Auth0 refresh token can be obtained via specifying the offline-access scope as a parameter to the /authorize endpoint.   This is documented at:\n+https://auth0.com/docs/auth-api#offline-access\n+\n+https://auth0.com/docs/libraries/lock/using-a-refresh-token\n+\n+https://github.com/auth0/auth0-angular/blob/master/docs/refresh-token.md\n+\n+https://github.com/auth0/auth0.js#login\n+\n+###How to control contents of Auth0 refresh token\n+The Auth0 refresh token can be issued and revoked for any combination of application, user and device.   The client application is specified in the call that invokes the Auth0 authentication sequence, and the user and device are the user that authenticates and the device used at the time of authentication.   There is no ability to further influence the contents of the Auth0 refresh token besides the application, user and device for which it is issued.\n+\n+###Validity\n+The refresh token is valid indefinitely, but it can be revoked.  See the Termination section below.\n+\n+###Renewing the Refresh token\n+There is no need to renew the refresh token as it is valid forever.  If the refresh token is revoked for any reason, a new one can be obtained as described in the “How to get the Auth0 refresh token” section above.\n+\n+###Termination of Refresh tokens\n+Refresh tokens can be revoked either through the Auth0 Dashboard or the Auth0 API.\n+\n+To revoke a refresh token in the Dashboard, navigate to “Users” -> {Name of user} -> “Devices” \n+\n+To use the APIv2, navigate to “Documentation” -> “APIv2” and use the Device Credentials calls.\n+ \n+Further information is at:\n+https://auth0.com/docs/refresh-token#2\n+\n+###Uses\n+The Refresh Token is used to obtain a new Auth0 `id_token`.  This can be done with the /delegation endpoint in the Auth0 Authentication API.  This endpoint is documented at:\n+https://auth0.com/docs/auth-api#delegated\n+\n+An example of this call is included at:\n+https://auth0.com/docs/refresh-token#3\n+\n+\n+To get a new `id_token` when the existing `id_token` has expired, use a refresh token to get a new id token, as explained at:\n+https://auth0.com/docs/refresh-token\n+\n+The auth0.js library can also be used to refresh an id token as shown at:\n+https://github.com/auth0/auth0.js#refresh-token\n+\n+###Best practices\n+####Validation\n+The refresh token is passed to Auth0 and Auth0 will perform any necessary validation.\n+\n+## Delegation Tokens\n+Delegation tokens are tokens used to call another API.  \n+The Auth0 `id_token` can be exchanged for another token, called a Delegation token, that can be used to call either other application APIs registered as clients in the same Auth0 tenant or APIs represented by some types of application Addons registered in the same Auth0 tenant.\n+\n+The type of the delegation token will vary depending on the target API with which it will be used.  For example, if it will be used for an application/API registered in Auth0, it will be a JWT token.  If the delegation token is for an application AddOn, it will vary by provider.  For exampke, if issued for Azure blob storage, it will be a SAS (Shared Access Signature).  If the delegation token is for the Firebase add on , it will be a JWT.\n+https://github.com/auth0/auth0.js#delegation-token-request\n+\n+###How to get a delegation token\n+The `id_token` for an authenticated user can be used with the /delegation endpoint to request a delegation token for a particular target.  The target can be either another application/API registered in Auth0 or an application Addon configured in Auth0.  The Addons for which this can be done are those that are not SAML or WS-Fed Addons and the Addon must be configured in Auth0 with secrets obtained from the Addon service, such as Firebase.  Instructions for setting up the secrets are available from the Addon configuration page for each Addon.  The secrets are used to sign the delegation token so that the Addon API can validate and trust the token.\n+\n+Information on the delegation endpoint is at:\n+https://auth0.com/docs/auth-api#delegated\n+\n+###How to control contents of a delegation token\n+The delegation endpoint allows the setting of several parameters which will govern the contents of the delegation token, including the target, the scope, the API to be called and an additional free-form area for additional parameters.\n+\n+See the delegation endpoint in the Authentication API for more information.\n+\n+###Validity\n+For customer application APIs registered in Auth0  - the validity of a delegation token issued for that target is governed by the setting for each application API in Apps/APIs -> Settings for “JWT expiration”.\n+\n+For APIs registered as Addons in Auth0, the validity period of the token will vary by individual Addon.  The documentation available from the provider of any Addon API should be consulted for further information on tokens and expirations.\n+\n+\n+###Renewal of a delegation token\n+When a delegation token expires, the delegation endpoint can be used to obtain a token.\n+\n+###Terminating a delegation token\n+The ability to revoke a delegation token will vary by individual Addon.  The documentation available from the provider of any Addon API should be consulted for further information on whether a token can be revoked and if so, how to do it.\n+\n+The delegation tokens for customer APIs registered in Auth0 cannot be revoked.  A best practice, therefore, is to set the JWT expiration duration to a relatively short value.\n+\n+###Uses\n+A delegation token should be obtained and used when a client program needs to call the API of either a) another application/API registered in Auth0 or b) the API for an Application Addon, such as Firebase or SAP, registered and configured in Auth0, in the same tenant as the calling program.\n+https://github.com/auth0/auth0.js#delegation-token-request\n+\n+https://auth0.com/docs/libraries/auth0js#12\n+\n+###Best Practices\n+For granularity of access control, good to set up different applications/APIs with different secrets, so that a delegation token can be issued uniquely for each application/API.\n+\n+Tokens should be issued with a short timeframe for expiration, where configurable.\n+\n+\n+## The Auth0 APIv2 access token","path":"articles/tokens.md","position":349,"original_position":349,"commit_id":"113bd476d20bb22e2591403631f13958552bf314","original_commit_id":"113bd476d20bb22e2591403631f13958552bf314","user":{"login":"yvonnewilson","id":9997803,"avatar_url":"https://avatars.githubusercontent.com/u/9997803?v=3","gravatar_id":"","url":"https://api.github.com/users/yvonnewilson","html_url":"https://github.com/yvonnewilson","followers_url":"https://api.github.com/users/yvonnewilson/followers","following_url":"https://api.github.com/users/yvonnewilson/following{/other_user}","gists_url":"https://api.github.com/users/yvonnewilson/gists{/gist_id}","starred_url":"https://api.github.com/users/yvonnewilson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yvonnewilson/subscriptions","organizations_url":"https://api.github.com/users/yvonnewilson/orgs","repos_url":"https://api.github.com/users/yvonnewilson/repos","events_url":"https://api.github.com/users/yvonnewilson/events{/privacy}","received_events_url":"https://api.github.com/users/yvonnewilson/received_events","type":"User","site_admin":false},"body":"@twistedstream Hi, I like the 'api' part of the name, but not sure we need the 'jwt' in it.  None of the other names allude to internal format details of the token.  I think it would be more helpful to clarify in the name which api it is for because there are several apis, each of which requires a different token.  It would eliminate a lot of confusion if\r\na) we use the same name (fully qualified) consistently throughout our docs for each type of token (e.g. don't just call it 'the token')\r\nb) each token is named to indicate what it is and/or what you use it for. - auth0 api token, IDP api token, 3rd party app API token, etc.  \r\nI'm not strongly against having jwt in the name, but I think the above 2 things are more important in helping people understand all these tokens and which ones they need.\r\n","created_at":"2015-08-07T14:50:04Z","updated_at":"2015-08-07T14:50:04Z","html_url":"https://github.com/auth0/docs/pull/213#discussion_r36526054","pull_request_url":"https://api.github.com/repos/auth0/docs/pulls/213","_links":{"self":{"href":"https://api.github.com/repos/auth0/docs/pulls/comments/36526054"},"html":{"href":"https://github.com/auth0/docs/pull/213#discussion_r36526054"},"pull_request":{"href":"https://api.github.com/repos/auth0/docs/pulls/213"}}},"pull_request":{"url":"https://api.github.com/repos/auth0/docs/pulls/213","id":41337738,"html_url":"https://github.com/auth0/docs/pull/213","diff_url":"https://github.com/auth0/docs/pull/213.diff","patch_url":"https://github.com/auth0/docs/pull/213.patch","issue_url":"https://api.github.com/repos/auth0/docs/issues/213","number":213,"state":"open","locked":false,"title":"Issue 212: Updates to User Profile","user":{"login":"twistedstream","id":3535918,"avatar_url":"https://avatars.githubusercontent.com/u/3535918?v=3","gravatar_id":"","url":"https://api.github.com/users/twistedstream","html_url":"https://github.com/twistedstream","followers_url":"https://api.github.com/users/twistedstream/followers","following_url":"https://api.github.com/users/twistedstream/following{/other_user}","gists_url":"https://api.github.com/users/twistedstream/gists{/gist_id}","starred_url":"https://api.github.com/users/twistedstream/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/twistedstream/subscriptions","organizations_url":"https://api.github.com/users/twistedstream/orgs","repos_url":"https://api.github.com/users/twistedstream/repos","events_url":"https://api.github.com/users/twistedstream/events{/privacy}","received_events_url":"https://api.github.com/users/twistedstream/received_events","type":"User","site_admin":false},"body":"Starting a PR to collaborate on the updates to User Profile described in #212, with a special heads-up to @yvonnewilson and @eugeniop.\r\n\r\n**PLEASE DO NOT MERGE THIS PR (yet)**\r\n\r\nCloses #212 ","created_at":"2015-07-31T13:11:39Z","updated_at":"2015-08-07T14:50:04Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9e03176b890a01a2f26c10cd5a1768198f5f28f3","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/auth0/docs/pulls/213/commits","review_comments_url":"https://api.github.com/repos/auth0/docs/pulls/213/comments","review_comment_url":"https://api.github.com/repos/auth0/docs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/auth0/docs/issues/213/comments","statuses_url":"https://api.github.com/repos/auth0/docs/statuses/113bd476d20bb22e2591403631f13958552bf314","head":{"label":"auth0:issue-212_updates-to-user-profile","ref":"issue-212_updates-to-user-profile","sha":"113bd476d20bb22e2591403631f13958552bf314","user":{"login":"auth0","id":2824157,"avatar_url":"https://avatars.githubusercontent.com/u/2824157?v=3","gravatar_id":"","url":"https://api.github.com/users/auth0","html_url":"https://github.com/auth0","followers_url":"https://api.github.com/users/auth0/followers","following_url":"https://api.github.com/users/auth0/following{/other_user}","gists_url":"https://api.github.com/users/auth0/gists{/gist_id}","starred_url":"https://api.github.com/users/auth0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/auth0/subscriptions","organizations_url":"https://api.github.com/users/auth0/orgs","repos_url":"https://api.github.com/users/auth0/repos","events_url":"https://api.github.com/users/auth0/events{/privacy}","received_events_url":"https://api.github.com/users/auth0/received_events","type":"Organization","site_admin":false},"repo":{"id":33872272,"name":"docs","full_name":"auth0/docs","owner":{"login":"auth0","id":2824157,"avatar_url":"https://avatars.githubusercontent.com/u/2824157?v=3","gravatar_id":"","url":"https://api.github.com/users/auth0","html_url":"https://github.com/auth0","followers_url":"https://api.github.com/users/auth0/followers","following_url":"https://api.github.com/users/auth0/following{/other_user}","gists_url":"https://api.github.com/users/auth0/gists{/gist_id}","starred_url":"https://api.github.com/users/auth0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/auth0/subscriptions","organizations_url":"https://api.github.com/users/auth0/orgs","repos_url":"https://api.github.com/users/auth0/repos","events_url":"https://api.github.com/users/auth0/events{/privacy}","received_events_url":"https://api.github.com/users/auth0/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/auth0/docs","description":"Auth0 documentation","fork":false,"url":"https://api.github.com/repos/auth0/docs","forks_url":"https://api.github.com/repos/auth0/docs/forks","keys_url":"https://api.github.com/repos/auth0/docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/auth0/docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/auth0/docs/teams","hooks_url":"https://api.github.com/repos/auth0/docs/hooks","issue_events_url":"https://api.github.com/repos/auth0/docs/issues/events{/number}","events_url":"https://api.github.com/repos/auth0/docs/events","assignees_url":"https://api.github.com/repos/auth0/docs/assignees{/user}","branches_url":"https://api.github.com/repos/auth0/docs/branches{/branch}","tags_url":"https://api.github.com/repos/auth0/docs/tags","blobs_url":"https://api.github.com/repos/auth0/docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/auth0/docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/auth0/docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/auth0/docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/auth0/docs/statuses/{sha}","languages_url":"https://api.github.com/repos/auth0/docs/languages","stargazers_url":"https://api.github.com/repos/auth0/docs/stargazers","contributors_url":"https://api.github.com/repos/auth0/docs/contributors","subscribers_url":"https://api.github.com/repos/auth0/docs/subscribers","subscription_url":"https://api.github.com/repos/auth0/docs/subscription","commits_url":"https://api.github.com/repos/auth0/docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/auth0/docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/auth0/docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/auth0/docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/auth0/docs/contents/{+path}","compare_url":"https://api.github.com/repos/auth0/docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/auth0/docs/merges","archive_url":"https://api.github.com/repos/auth0/docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/auth0/docs/downloads","issues_url":"https://api.github.com/repos/auth0/docs/issues{/number}","pulls_url":"https://api.github.com/repos/auth0/docs/pulls{/number}","milestones_url":"https://api.github.com/repos/auth0/docs/milestones{/number}","notifications_url":"https://api.github.com/repos/auth0/docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/auth0/docs/labels{/name}","releases_url":"https://api.github.com/repos/auth0/docs/releases{/id}","created_at":"2015-04-13T14:09:26Z","updated_at":"2015-08-06T15:57:01Z","pushed_at":"2015-08-06T23:53:48Z","git_url":"git://github.com/auth0/docs.git","ssh_url":"git@github.com:auth0/docs.git","clone_url":"https://github.com/auth0/docs.git","svn_url":"https://github.com/auth0/docs","homepage":null,"size":118163,"stargazers_count":6,"watchers_count":6,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":33,"mirror_url":null,"open_issues_count":70,"forks":33,"open_issues":70,"watchers":6,"default_branch":"master"}},"base":{"label":"auth0:master","ref":"master","sha":"f7e12b4237b3578503478776b83ecd33ea080f80","user":{"login":"auth0","id":2824157,"avatar_url":"https://avatars.githubusercontent.com/u/2824157?v=3","gravatar_id":"","url":"https://api.github.com/users/auth0","html_url":"https://github.com/auth0","followers_url":"https://api.github.com/users/auth0/followers","following_url":"https://api.github.com/users/auth0/following{/other_user}","gists_url":"https://api.github.com/users/auth0/gists{/gist_id}","starred_url":"https://api.github.com/users/auth0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/auth0/subscriptions","organizations_url":"https://api.github.com/users/auth0/orgs","repos_url":"https://api.github.com/users/auth0/repos","events_url":"https://api.github.com/users/auth0/events{/privacy}","received_events_url":"https://api.github.com/users/auth0/received_events","type":"Organization","site_admin":false},"repo":{"id":33872272,"name":"docs","full_name":"auth0/docs","owner":{"login":"auth0","id":2824157,"avatar_url":"https://avatars.githubusercontent.com/u/2824157?v=3","gravatar_id":"","url":"https://api.github.com/users/auth0","html_url":"https://github.com/auth0","followers_url":"https://api.github.com/users/auth0/followers","following_url":"https://api.github.com/users/auth0/following{/other_user}","gists_url":"https://api.github.com/users/auth0/gists{/gist_id}","starred_url":"https://api.github.com/users/auth0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/auth0/subscriptions","organizations_url":"https://api.github.com/users/auth0/orgs","repos_url":"https://api.github.com/users/auth0/repos","events_url":"https://api.github.com/users/auth0/events{/privacy}","received_events_url":"https://api.github.com/users/auth0/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/auth0/docs","description":"Auth0 documentation","fork":false,"url":"https://api.github.com/repos/auth0/docs","forks_url":"https://api.github.com/repos/auth0/docs/forks","keys_url":"https://api.github.com/repos/auth0/docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/auth0/docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/auth0/docs/teams","hooks_url":"https://api.github.com/repos/auth0/docs/hooks","issue_events_url":"https://api.github.com/repos/auth0/docs/issues/events{/number}","events_url":"https://api.github.com/repos/auth0/docs/events","assignees_url":"https://api.github.com/repos/auth0/docs/assignees{/user}","branches_url":"https://api.github.com/repos/auth0/docs/branches{/branch}","tags_url":"https://api.github.com/repos/auth0/docs/tags","blobs_url":"https://api.github.com/repos/auth0/docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/auth0/docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/auth0/docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/auth0/docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/auth0/docs/statuses/{sha}","languages_url":"https://api.github.com/repos/auth0/docs/languages","stargazers_url":"https://api.github.com/repos/auth0/docs/stargazers","contributors_url":"https://api.github.com/repos/auth0/docs/contributors","subscribers_url":"https://api.github.com/repos/auth0/docs/subscribers","subscription_url":"https://api.github.com/repos/auth0/docs/subscription","commits_url":"https://api.github.com/repos/auth0/docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/auth0/docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/auth0/docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/auth0/docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/auth0/docs/contents/{+path}","compare_url":"https://api.github.com/repos/auth0/docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/auth0/docs/merges","archive_url":"https://api.github.com/repos/auth0/docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/auth0/docs/downloads","issues_url":"https://api.github.com/repos/auth0/docs/issues{/number}","pulls_url":"https://api.github.com/repos/auth0/docs/pulls{/number}","milestones_url":"https://api.github.com/repos/auth0/docs/milestones{/number}","notifications_url":"https://api.github.com/repos/auth0/docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/auth0/docs/labels{/name}","releases_url":"https://api.github.com/repos/auth0/docs/releases{/id}","created_at":"2015-04-13T14:09:26Z","updated_at":"2015-08-06T15:57:01Z","pushed_at":"2015-08-06T23:53:48Z","git_url":"git://github.com/auth0/docs.git","ssh_url":"git@github.com:auth0/docs.git","clone_url":"https://github.com/auth0/docs.git","svn_url":"https://github.com/auth0/docs","homepage":null,"size":118163,"stargazers_count":6,"watchers_count":6,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":33,"mirror_url":null,"open_issues_count":70,"forks":33,"open_issues":70,"watchers":6,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/auth0/docs/pulls/213"},"html":{"href":"https://github.com/auth0/docs/pull/213"},"issue":{"href":"https://api.github.com/repos/auth0/docs/issues/213"},"comments":{"href":"https://api.github.com/repos/auth0/docs/issues/213/comments"},"review_comments":{"href":"https://api.github.com/repos/auth0/docs/pulls/213/comments"},"review_comment":{"href":"https://api.github.com/repos/auth0/docs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/auth0/docs/pulls/213/commits"},"statuses":{"href":"https://api.github.com/repos/auth0/docs/statuses/113bd476d20bb22e2591403631f13958552bf314"}}}}