---
title: "Issue Backchannel Authentication Response"
method: POST
path: "/api/{serviceId}/backchannel/authentication/issue"
tags: ["CIBA"]
---

# Issue Backchannel Authentication Response

`POST /api/{serviceId}/backchannel/authentication/issue`

This API prepares JSON that contains an `auth\_req\_id`. The JSON should be used as the response body
of the response which is returned to the client from the [backchannel authentication endpoint](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1\_0.html#auth\_backchannel\_endpoint)
### Description
This API is supposed to be called from within the implementation of the backchannel authentication
endpoint of the service in order to generate a successful response to the client application.
The description of the `/backchannel/authentication` API describes the timing when this API should
be called and the meaning of request parameters. See [AUTH\_REQ\_ID ISSUE] in `USER\_IDENTIFICATION`.
The response from `/backchannel/authentication/issue` API has some parameters. Among them, it is
`action` parameter that the authorization server implementation should check first because it denotes
the next `action` that the authorization server implementation should take. According to the value
of `action`, the authorization server implementation must take the steps described below.
```java
@POST
@Consumes(MediaType.APPLICATION\_FORM\_URLENCODED)
public Response post(String parameters)
{
// 'parameters' is the entity body of the backchannel authentication request.
......
}
```
The endpoint implementation does not have to parse the request parameters from the client application
because Authlete's `/backchannel/authentication` API does it.
The response from `/backchannel/authentication` API has various parameters. Among them, it is `action`
parameter that the authorization server implementation should check first because it denotes the
next action that the authorization server implementation should take. According to the value of
`action`, the service implementation must take the steps described below.
**INTERNAL\_SERVER\_ERROR**
When the value of `action` is `INTERNAL\_SERVER\_ERROR`, it means that the request from the authorization
server implementation was wrong or that an error occurred in Authlete.
In either case, from the viewpoint of the client application, it is an error on the server side.
Therefore, the service implementation should generate a response to the client application with
HTTP status of "500 Internal Server Error" and `application/json`.
The value of `responseContent` is a JSON string which describes the error, so it can be used as
the entity body of the response.
The following illustrates the response which the service implementation should generate and return
to the client application.
```
HTTP/1.1 500 Internal Server Error
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
{responseContent}
```
**INVALID\_TICKET**
When the value of `action` is `INVALID\_TICKET`, it means that the ticket included in the API call
was invalid. For example, it does not exist or has expired.
From a viewpoint of the client application, this is an error on the server side. Therefore, the
authorization server implementation should generate a response to the client application with
"500 Internal Server Error" and `application/json`.
You can build an error response in the same way as shown in the description for the case of `INTERNAL\_SERVER\_ERROR`.
**OK**
When the value of `action` is `OK`, it means that Authlete has succeeded in preparing JSON that
contains an `auth\_req\_id`. The JSON should be used as the response body of the response that is
returned to the client from the backchannel authentication endpoint. `responseContent` contains
the JSON.
The following illustrates the response which the authorization server implementation should generate
and return to the client application.
```
HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache
{responseContent}
```

## Path parameters

- `serviceId` string, required

## Request body

- BackchannelAuthenticationIssueRequest
  - `ticket` string, required — The ticket issued from Authlete's `/backchannel/authentication` API.

## Response `200`

Backchannel authentication issued successfully

- BackchannelAuthenticationIssueResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `action` 'INTERNAL_SERVER_ERROR' | 'INVALID_TICKET' | 'OK' — The next action that the authorization server implementation should take.
  - `responseContent` string — The content that the authorization server implementation is to return to the client application. Its format varies depending on the value of `action` parameter.
  - `authReqId` string — The newly issued authentication request ID.
  - `expiresIn` integer — The duration of the issued authentication request ID in seconds.
  - `interval` integer — The minimum amount of time in seconds that the client must wait for between polling requests to the token endpoint.

## Other responses

- `400`
- `401`
- `403`
- `500`

---

[API](https://skmtc.dev/authlete/apis/authlete-api.md) · [All operations](https://skmtc.dev/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authlete/authlete-api/revisions/8a534bc68775/schema)