AUauthlete
Pushed Authorization Endpoint

Process Pushed Authorization Request

Changed on

This API creates a pushed request authorization. It authenticates the client and creates a authorization_uri to be returned by the authorization server.

post/api/{serviceId}/pushed_auth_req

Request

  • Base URL
    https://us.authlete.com
  • URL
    https://us.authlete.com/api/{serviceId}/pushed_auth_req
  • Auth
    HTTP bearer

Path parameters

serviceIdstring required

A service ID.

Request body

parametersstring required

The pushed authorization request body received from the client application.

The value of parameters is the entire entity body (which is formatted in application/x-www-form-urlencoded) of the request from the client application.

clientIdstring

The client ID extracted from Authorization header of the pushed request from the client application.

clientSecretstring

The client secret extracted from Authorization header of the pushed authorization request from the client application.

clientCertificatestring

The client certificate from the MTLS connection to pushed authorization endpoint from the client application.

clientCertificatePathstring[]

The certificate path presented by the client during client authentication. These certificates are strings in PEM format.

dpopstring

DPoP Header

htmstring

HTTP Method (for DPoP validation).

htustring

HTTP URL base (for DPoP validation).

oauthClientAttestationstring

The value of the OAuth-Client-Attestation HTTP header, which is defined in the specification of OAuth 2.0 Attestation-Based Client Authentication.

oauthClientAttestationPopstring

The value of the OAuth-Client-Attestation-PoP HTTP header, which is defined in the specification of OAuth 2.0 Attestation-Based Client Authentication.

dpopNonceRequiredboolean

The flag indicating whether to require the DPoP proof JWT to include the nonce claim. Even if the service's dpopNonceRequired property is false, calling the /pushed_auth_req API with this dpopNonceRequired parameter true will force the Authlete API to check whether the DPoP proof JWT includes the expected nonce value.

Response

resultCodestring

The code which represents the result of the API call.

resultMessagestring

A short message which explains the result of the API call.

action'CREATED' | 'BAD_REQUEST' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'PAYLOAD_TOO_LARGE' | 'INTERNAL_SERVER_ERROR'

The next action that the authorization server implementation should take. Any other value other than "CREATED" should be handled as unsuccessful result.

requestUristring

The request_uri created to the client to be used as request_uri on the authorize call.

responseContentstring

The content that the authorization server implementation is to return to the client application.

clientAuthMethod'NONE' | 'CLIENT_SECRET_BASIC' | 'CLIENT_SECRET_POST' | 'CLIENT_SECRET_JWT' | 'PRIVATE_KEY_JWT' | 'TLS_CLIENT_AUTH' | 'SELF_SIGNED_TLS_CLIENT_AUTH' | 'ATTEST_JWT_CLIENT_AUTH' | 'SPIFFE_JWT'

The client authentication method that the client application declares that it uses at the token endpoint. This property corresponds to token_endpoint_auth_method in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

dpopNoncestring

Get the expected nonce value for DPoP proof JWT, which should be used as the value of the DPoP-Nonce HTTP header.

Changes

  • 7ad74ab64749Revision changes
    • warning

      added the new SPIFFE_JWT enum value to the response property for the response status

    • info

      added the non-success response with the status

  • 8a534bc68775Revision changes
    • warning

      added the new ATTEST_JWT_CLIENT_AUTH enum value to the response property for the response status