---
title: "Process Pushed Authorization Request"
method: POST
path: "/api/{serviceId}/pushed_auth_req"
tags: ["Pushed Authorization Endpoint"]
---

# Process Pushed Authorization Request

`POST /api/{serviceId}/pushed_auth_req`

This API creates a pushed request authorization. It authenticates the client and creates a authorization_uri to be returned by the authorization server.

## Path parameters

- `serviceId` string, required

## Request body

- PushedAuthorizationRequest
  - `parameters` string, required — The pushed authorization request body received from the client application. The value of parameters is the entire entity body (which is formatted in `application/x-www-form-urlencoded`) of the request from the client application.
  - `clientId` string — The client ID extracted from `Authorization` header of the pushed request from the client application.
  - `clientSecret` string — The client secret extracted from `Authorization` header of the pushed authorization request from the client application.
  - `clientCertificate` string — The client certificate from the MTLS connection to pushed authorization endpoint from the client application.
  - `clientCertificatePath` string[] — The certificate path presented by the client during client authentication. These certificates are strings in PEM format.
  - `dpop` string — DPoP Header
  - `htm` string — HTTP Method (for DPoP validation).
  - `htu` string — HTTP URL base (for DPoP validation).
  - `oauthClientAttestation` string — The value of the `OAuth-Client-Attestation` HTTP header, which is defined in the specification of [OAuth 2.0 Attestation-Based Client Authentication](https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/).
  - `oauthClientAttestationPop` string — The value of the `OAuth-Client-Attestation-PoP` HTTP header, which is defined in the specification of [OAuth 2.0 Attestation-Based Client Authentication](https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/).
  - `dpopNonceRequired` boolean — The flag indicating whether to require the DPoP proof JWT to include the `nonce` claim. Even if the service's `dpopNonceRequired` property is `false`, calling the `/pushed_auth_req` API with this `dpopNonceRequired` parameter `true` will force the Authlete API to check whether the DPoP proof JWT includes the expected `nonce` value.

## Response `200`

- PushedAuthorizationResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `action` 'CREATED' | 'BAD_REQUEST' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'PAYLOAD_TOO_LARGE' | 'INTERNAL_SERVER_ERROR' — The next action that the authorization server implementation should take. Any other value other than "CREATED" should be handled as unsuccessful result.
  - `requestUri` string — The request_uri created to the client to be used as request_uri on the authorize call.
  - `responseContent` string — The content that the authorization server implementation is to return to the client application.
  - `clientAuthMethod` 'NONE' | 'CLIENT_SECRET_BASIC' | 'CLIENT_SECRET_POST' | 'CLIENT_SECRET_JWT' | 'PRIVATE_KEY_JWT' | 'TLS_CLIENT_AUTH' | 'SELF_SIGNED_TLS_CLIENT_AUTH' | 'ATTEST_JWT_CLIENT_AUTH' | 'SPIFFE_JWT' — The client authentication method that the client application declares that it uses at the token endpoint. This property corresponds to `token_endpoint_auth_method` in [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata).
  - `dpopNonce` string — Get the expected nonce value for DPoP proof JWT, which should be used as the value of the `DPoP-Nonce` HTTP header.

## Other responses

- `400`
- `401`
- `403`
- `429` — The request exceeded the request rate permitted for the endpoint.
- `500`

## Changes

- **2026-08-03** `7ad74ab64749` — 1 warning, 1 info
  - added the new `SPIFFE_JWT` enum value to the `clientAuthMethod` response property for the response status `200`
  - added the non-success response with the status `429`
- **2026-01-15** `8a534bc68775` — 1 warning
  - added the new `ATTEST_JWT_CLIENT_AUTH` enum value to the `clientAuthMethod` response property for the response status `200`

[Change history](https://skmtc.dev/authlete/apis/authlete-api/changes/api/:serviceId/pushed_auth_req/post.md)

---

[API](https://skmtc.dev/authlete/apis/authlete-api.md) · [All operations](https://skmtc.dev/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authlete/authlete-api/revisions/7ad74ab64749/schema)