Sign in
authentication

Oidc Exchange

Changed on

Exchange a one-time ticket for authentication credentials.

The SPA calls this endpoint with the ticket received from the callback redirect. Tickets are single-use and expire after 60 seconds. A missing or malformed body is a 422 (FastAPI request validation); a well-formed but unknown or expired ticket is a 400. Legacy clients receive the refresh token in the response body; the PWA receives it only as an HttpOnly cookie.

post/api/v1/auth/oidc/exchange

Request

  • The document declares no server URL.
  • Auth: none declared

Headers

X-Journiv-Client'legacy' | 'pwa'

Request body

ticketstring required

Response

Successful Response

access_tokenstring required
refresh_tokenstring nullable
token_typestring
userobject required

Changes

  • e481ff759427Revision changes
    • breaking

      the response property became optional for the status

    • breaking

      response property refresh_token list-of-types was widened by adding types null to media type application/json of response 200

    • info

      added the new optional header request parameter X-Journiv-Client

  • 282e901e1663Revision changes
    • breaking

      added required request body

    • info

      added the non-success response with the status