The structure of the response from the OIDC userinfo endpoint depends on the scopes and claims included in the access token used to call the endpoint. The response will include user attributes specified by the scopes in the access token. It's important to note that the

openid

scope must be one of the access token claims [source](https://www.ory.sh/docs/oauth2-oidc/userinfo-oidc). The response you're getting seems to be a standard OIDC response, which includes claims like

sub

(subject),

aud

(audience),

auth_time

(authentication time), etc. These are standard claims and their presence in the response is expected. The mismatch between the response structure and the Ory documentation could be due to several reasons: 1. Scopes and Claims: The scopes and claims included in the access token might not match the ones described in the Ory documentation. Ensure that the access token includes the necessary scopes and claims. 2. Custom Claims: If you have added any custom claims to the userinfo response, they will also be included in the response. Check if any custom claims have been added [source](https://www.ory.sh/docs/oauth2-oidc/userinfo-oidc#adding-custom-claims-to-the-userinfo-response). 3. Ory Hydra Configuration: The configuration of your Ory Hydra instance might be affecting the response structure. Check your Ory Hydra configuration to ensure it matches the requirements described in the Ory documentation. 4. Version Differences: There might be differences between the version of Ory Hydra you're using and the version described in the documentation. Check the version of Ory Hydra you're using and compare it with the version described in the documentation. Remember, the contents of the userinfo endpoint are publicly available, and should not include any sensitive information without the user's consent [source](https://www.ory.sh/docs/oauth2-oidc/userinfo-oidc#returning-a-signed-jwt-from-the-userinfo-endpoint).