Sign in
auth

Complete an SP-initiated SAML transaction over HTTP-POST.

Changed on

The only accepted response binding. The per-provider path, exact Destination, both Issuer legs, RelayState, InResponseTo and initiator binding must all resolve to the same live transaction before an ordinary session can be minted, linked or reauthenticated. Successful browser requests accepting HTML continue with a 303 to /auth/saml/done?state=<validated RelayState> and the ordinary session and CSRF cookie pair. Requests with no HTML Accept range, including application/json callers, retain the JSON response. Errors never redirect or mint browser cookies.

post/api/v1/auth/saml/{provider}/acs

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/auth/saml/{provider}/acs
  • Auth: none required

Response

The minted or rotated ordinary Hikyo session.

session_tokenstring

The bearer value, returned exactly once. A replayable credential: cookie attributes constrain browsers, not an attacker holding the value, which is why lifetimes are short and revocation is a delete. OMITTED for a browser-artifact session: that token is delivered ONLY on the __Host-hikyo HttpOnly cookie so injected same-origin script cannot read it. A CLI-artifact session, which has no cookie channel, still carries it here.

Changes

  • f24ca8785e72Revision changes
    • info

      added the non-success response with the status

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status