Discovery endpoints

The following resources are publicly accessible without authentication. OIDC libraries and OpenAPI tooling should be pointed at these URLs rather than hardcoded endpoint values.

OIDC discovery document

GET https://auth.merion.com.au/.well-known/openid-configuration

Served by auth.merion.com.au and exposed through the API hub. Conforms to OpenID Connect Discovery 1.0. Contains:

issuer: The canonical issuer URI — must be validated on every JWT you receive.
authorization_endpoint: The authorisation endpoint for the authorisation code + PKCE flow.
token_endpoint: The token endpoint for code exchange and refresh.
jwks_uri: The JSON Web Key Set endpoint — fetch to obtain ES256 public keys for JWT signature verification.
code_challenge_methods_supported: Contains "S256". The plain method is not supported.
response_types_supported: Contains "code".

curl -s https://auth.merion.com.au/.well-known/openid-configuration | python3 -m json.tool

OpenAPI specification

GET https://api.merion.com.au/openapi.yaml

OpenAPI 3.x specification in YAML. The authoritative source for all routes, request schemas, response shapes, and authentication requirements. See OpenAPI Specification for import and client-generation instructions.

Interactive documentation

GET https://api.merion.com.au/docs

Human-readable documentation page rendered from the OpenAPI spec. Open in a browser for the full experience.

HTTP Link headers

The API root (GET https://api.merion.com.au/) returns Link headers pointing to the machine-readable resources, following the spirit of RFC 8631 (Link relation types for Web services). Tooling that auto-discovers API descriptions can use these headers:

curl -sI https://api.merion.com.au/ | grep -i link

You will see Link headers similar to:

Link: </openapi.yaml>; rel="service-desc"
Link: <https://api.merion.com.au/docs>; rel="service-doc"

rel="service-desc": Points to the OpenAPI YAML specification.
rel="service-doc": Points to the human-readable documentation page.

llms.txt — for agents and LLMs

developers.merion.com.au/llms.txt is a plain-text summary of the Merion API surface in the llms.txt convention, designed for consumption by LLM-powered tools and AI agents that need a compact description of what the API does and how to call it.

GET https://developers.merion.com.au/llms.txt

The file covers:

The API base URL and authentication model (OIDC, ES256, PKCE S256).
All public endpoints with their signatures and response shapes.
All five Forms API keys with required and optional fields.
Error envelope shape.
Links to each documentation section.
Company contact information.

If you are building an agent or LLM integration that needs to discover and call the Merion API, fetching llms.txt first gives you a compact, accurate summary without parsing HTML documentation.

curl -s https://developers.merion.com.au/llms.txt

robots.txt

GET https://developers.merion.com.au/robots.txt

The robots.txt file controls crawler access to this developer documentation site. The API hub itself (api.merion.com.au) does not serve a robots.txt — it is an API endpoint, not a crawlable website.

Building a discovery-aware client

A well-behaved API client should auto-configure from discovery rather than hardcoding endpoint URLs. Recommended startup sequence:

Fetch the OIDC discovery document from https://auth.merion.com.au/.well-known/openid-configuration.
Extract and cache authorization_endpoint, token_endpoint, jwks_uri, and issuer.
Fetch the JWKS from jwks_uri and cache the public keys (re-fetch on unknown kid).
Optionally fetch the OpenAPI spec from /openapi.yaml to validate your request shapes during development.

// Minimal discovery bootstrap (Node.js / browser)
async function discoverMerionApi() {
  const discoveryUrl =
    "https://auth.merion.com.au/.well-known/openid-configuration";

  const res = await fetch(discoveryUrl);
  if (!res.ok) throw new Error("OIDC discovery failed");

  const config = await res.json();
  return {
    issuer:              config.issuer,
    authorizationUrl:    config.authorization_endpoint,
    tokenUrl:            config.token_endpoint,
    jwksUri:             config.jwks_uri,
    codeChallengeMethod: "S256", // always required
  };
}

See Authentication for the full OIDC/PKCE walkthrough, and OpenAPI Specification for client-generation instructions.

Discovery & Well-Known