--- title: Service endpoints description: Reference guide to PingAM service endpoints including JSP files, REST APIs, and well-known URIs accessible by default component: pingam version: 8 page_id: pingam:am-reference:endpoints-reference canonical_url: https://docs.pingidentity.com/pingam/8.1/am-reference/endpoints-reference.html llms_txt: https://docs.pingidentity.com/pingam/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-06-01T14:34:20Z keywords: ["Endpoints", "JSP"] page_aliases: ["reference:endpoints-reference.adoc"] superseded_by: https://docs.pingidentity.com/pingam/8.1/am-reference/endpoints-reference.html section_ids: jsp-endpoints: JSP files web-inf-endpoints: WEB-INF URL patterns json-rest-endpoints: REST API endpoints well-known-endpoints: Well-known endpoints --- # Service endpoints A service endpoint is an entry point to a web service. This page lists AM service endpoints that are accessible by default. If you're certain a particular AM service endpoint isn't used in your deployment, you can block access to the endpoint. Learn more in [Secure network communication](../security/securing-communications.html). ## JSP files Some AM JSP pages are directly accessible as service endpoints. The following sections describe the files for those JSP pages. Directory paths in this section are relative to AM's deployment path, for example, `/path/to/tomcat/webapps/am/`. > **Collapse: Top-level JSP files** > > You will find these files in the top-level directory of AM's deployment path. > > * `Logback.jsp` > > Provides a page to configure debug logging. > > See [Debug logging](../maintenance/debug-logging.html) for details. > > * `encode.jsp` > > Provides a page to encode a cleartext password for use in SAML entity configurations. > > * `getServerInfo.jsp` > > Supports requests for server information. This page is used internally by AM. > > * `isAlive.jsp` > > Displays a "Server is ALIVE" message when AM is ready to serve requests. > > * `proxyidpfinder.jsp` > > Supports access to a remote identity provider through the federation broker. > > * `services.jsp` > > Lists service configuration information. Use this page when translating configuration changes made in the console into corresponding `ssoadm` commands. > > * `showServerConfig.jsp` > > Displays system configuration information, including the deployment URL, OS, Java VM, configuration directory, and more. > **Collapse: User interface JSP files** > > The JSP files in the `com_sun_web_ui/jsp/` directory were used only for the JATO-based UI pages. They weren't intended to be used directly as external endpoints. > **Collapse: Authentication JSP files** > > The JSP files in the `config/auth/default*/` directories were used only for authentication modules and JATO-based UI pages. > **Collapse: OAuth 2.0 JSP files** > > The JSP file, `oauth2/registerClient.jsp`, provides a template page to register an OAuth 2.0 client application without using the main console. > > The JSP files in the `oauth2c/` directory were used only for authentication modules. They weren't intended to be used directly as external endpoints. > **Collapse: SAML 2.0 JSP files** > > The JSP files in the `saml2/jsp/` directory provide endpoints used in SAML 2.0 deployments. > > Find descriptions for externally useful endpoints in [Federate identities](../am-saml2/saml2-linking-accounts.html). > **Collapse: WS Federation JSP files** > > The JSP files in the `wsfederation/jsp/` directory provide endpoints used in WS-Federation deployments. ## WEB-INF URL patterns The AM `.war` file includes a deployment descriptor file, `WEB-INF/web.xml`. The deployment descriptor lists services implemented as servlets, and `` elements that map services to AM endpoints. When protecting an AM server, consider blocking external access to unused services based on their URL patterns. The `web.xml` file changes from release to release. If you remove endpoints from this file to disable access to parts of the AM configuration, make sure you review `web.xml` when you upgrade to a new release of AM. Remove the restricted endpoints and decide whether to disable the new endpoints. You can find more information about securing your deployment by restricting access to endpoints in [Protecting PingAM with PingGateway](https://docs.pingidentity.com/pinggateway/2025.3/gateway-guide/protect-am.html), [How do I remove admin UI access in PingAM](https://support.pingidentity.com/s/article/How-do-I-remove-admin-UI-access-in-PingAM) and [Best practice for blocking the top level realm in a proxy for PingAM](https://support.pingidentity.com/s/article/Best-practice-for-blocking-the-top-level-realm-in-a-proxy-for-PingAM). ## REST API endpoints REST API endpoints are discussed in detail as follows: * [Authenticate over REST](../am-authentication/authn-rest.html) How to use the AM REST APIs to authenticate to AM. * [Policies over REST](../am-authorization/rest-api-authz-policies.html), [Policy sets over REST](../am-authorization/rest-api-authz-applications.html), [Resource types over REST](../am-authorization/rest-api-authz-resource-types.html), and [Policy set application types over REST](../am-authorization/rest-api-authz-application-types.html) How to use the AM REST APIs for policy management. * [Request policy decisions over REST](../am-authorization/rest-api-authz-policy-decisions.html) How to use the AM REST APIs for requesting authorization decisions from AM. * [Reset registered devices over REST](../am-authentication/authn-mfa-reset-devices.html) How to use the AM REST APIs to reset, or remove a user's 2FA devices. * [OAuth 2.0 endpoints](../am-oauth2/oauth2-client-endpoints.html) How to use OAuth 2.0-specific endpoints to request access and refresh tokens, as well as introspecting and revoking them. * [OAuth 2.0 administration REST endpoints](../am-oauth2/oauth2-admin-endpoints.html) How to use AM REST APIs to perform OAuth 2.0 administrative tasks such as registering, reading, and deleting clients. * [OpenID Connect 1.0 endpoints](../am-oidc1/oidc-client-endpoints.html) How to use OpenID Connect-specific endpoints to retrieve information about an authenticated user, as well as validate ID tokens and check sessions. * [Retrieve forgotten usernames](../user-self-service/uss-forgotten-username.html), [Reset forgotten passwords](../user-self-service/uss-forgotten-password.html), and [Register a user](../user-self-service/uss-registering-users.html) How to use the AM REST APIs for user self-registration and forgotten password reset. * [Configure realms over REST](../setup/am-realms.html#sec-rest-realm-rest) How to use the AM REST APIs for managing AM identities and realms. * [Manage scripts (REST)](../am-scripting/manage-scripts-rest.html) How to use the AM REST APIs to manage AM scripts. * [Capture troubleshooting information](../maintenance/record-troubleshooting.html) How to use the AM REST APIs to record information that can help you troubleshoot AM. * [Manage sessions using REST](../am-sessions/managing-sessions-REST.html) How to use the AM REST APIs to manage AM sessions. * [Consume STS instances](../sts/sts-consume-rest.html) and [Query, validate, and cancel tokens](../sts/sts-query-validate-cancel.html) How to use the AM REST APIs to manage AM's Security Token Service, which lets you bridge identities across web and enterprise identity access management (IAM) systems through its token transformation process. ## Well-known endpoints The endpoints described in this section are [Well-known URIs](https://www.rfc-editor.org/info/rfc5785) supported by AM: * `/.well-known/openid-configuration` Exposes OpenID Provider configuration by HTTP GET as specified by OpenID Connect Discovery 1.0. No query string parameters are required. * `/uma/.well-known/uma2-configuration` Exposes User-Managed Access (UMA) configuration by HTTP GET as specified by UMA Profile of OAuth 2.0. No query string parameters are required. Find an example in [/uma/.well-known/uma2-configuration](../uma/endpoint-configuration.html). * `/.well-known/webfinger` Lets a client retrieve the provider URL for an end user by HTTP GET as specified by OpenID Connect Discovery 1.0. Find an example in [OpenID Connect Discovery](../am-oidc1/oidc-am-provider.html#configure-openid-connect-discovery).