Authorization

Request

Start an authentication process. If the process is successful, an authorization code is returned to the redirect URI specified in the request. (See OIDC spec). For pushed authorization requests (PAR), provide request_uri returned by the PAR request endpoint instead of authorization parameters.

Query

client_idstringrequired

Client ID for which authentication is requested. For pushed authorization requests (PAR), the client ID should match the ID of the client that initiated the PAR flow.

redirect_uristring

Required for authorization code flow. URI to redirect to upon completion of the authentication flow. This is the server GET endpoint used to call the token endpoint, and should accept code as a query parameter. This URI must also be configured as an allowed redirect URI in the Mosaic Admin Portal

scopestring

Required for authorization code flow. Scope of the requested access. Used to request specific user details like email. Must include openid and can include additional values (space delimited). offline_access scope allows refreshing access tokens.

Enum:"openid""email""phone""offline_access"

loginTypestringdeprecated

For authorization code flow. Authentication method to be used for this process, where centralized is used to request authentication via the Authentication Hub.

Enum:"google-direct""apple-direct""facebook-direct""webauthn-direct""line-direct""centralized"

response_typestring

Required for authorization code flow. Response type requested for the authentication flow.

Default:"code"

Value:"code"

promptstring

For authorization code flow. Space-delimited, case-sensitive list of string values that specifies whether the Authorization Server prompts the end-user for reauthentication and consent.

Enum Value	Description
login	Prompts the user to authenticate.
consent	Prompts the user for consent if required. Must be passed to receive a refresh token and when trying to perform silent authentication to the app you haven't logged in before.
none	Checks for an existing session (and consent if required). Used for silent authentication to the same app as initially logged in to.

noncestring

For authorization code flow. A random value that is included in the authentication request from the client (e.g. browser) to mitigate replay attacks. It will be added to the id_token and the backend service should only accept id_tokens that include the same nonce value as the one included in the original request.

statestring

For authorization code flow. An opaque string that is used to maintain state between the request and the callback. It will be added to the redirect URI as a query parameter, which should be validated by your server to protect against cross-site request forgery (CSRF) attacks

code_challengestring

Required for authorization code flow with PKCE. A hashed value of the 'code_verifier' required for PKCE

code_challenge_methodstring

Required for authorization code flow with PKCE. The hashing mechanism used to transform a code_verifier into the code_challenge in PKCE flows, must be 'S256'

resourcestring

For authorization code flow. Resource URI the authentication request is attempting to access, which is reflected in the audience (aud claim) of the access token. This must be configured as resource for the application.

claimsstring

For authorization code flow. A stringified object used to request additional claims in the ID token, such as roles, permissions, and other user profile data. The structure is per the OIDC Standard. For supported claims and how to request custom claims, see the ID Token Reference. Note: You should stringify the value.

Example:claims={"id_token":{"roles":null}}

acr_valuesstring

For authorization code flow. Requested ACR values, specified as a space-separated string. The acr claim of the resulting ID token will indicate which requirements were satisfied.

Enum Value	Description
mfa	Requires multi-factor authentication. If it isn't satisfied, an error is returned indicating how to satisfy it via email/SMS authentication.
phone_number	Requires a verified phone number for a WebAuthn login. If it isn't yet verified, an SMS verification process will occur.
urn:transmit:google_direct	Requires Google authentication method to be used for this process.
urn:transmit:apple_direct	Requires Apple authentication method to be used for this process.
urn:transmit:facebook_direct	Requires Facebook authentication method to be used for this process.
urn:transmit:line_direct	Requires Line authentication method to be used for this process.
urn:transmit:centralized	Requires centralized authentication method to be used for this process, `centralized` is used to request authentication via the Authentication Hub.

createNewUserboolean

For authorization code flow. Indicates if a new user should be created if one doesn't already exist (or associated with the app if the user isn't already). Public sign up must be enabled for this application.

Default:false

login_hintstring

For authorization code flow. Hint for the user's login identifier for WebAuthn login.

Example:login_hint=user@acme.com

custom_messagestring

For authorization code flow. Custom message to present on the consent screens for WebAuthn login, which provides authentication context details.

Example:custom_message=Welcome to Acme

ui_localesstring

For authorization code flow. Preferred languages for the user interface for WebAuthn login, specified as a space-separated list of language tag values [RFC5646], ordered by preference.

org_idstring

For authorization code flow. Organization ID, used for member login in B2B scenarios

request_uristring

Required for PAR flow. The URI returned by the PAR request. The request_uri value is bound to the client that sent the PAR authorization request.

curl -i -X GET \
  'https://api.sbx.transmitsecurity.io/cis/oidc/auth?client_id=string&redirect_uri=string&scope=openid&loginType=google-direct&response_type=code&prompt=login&nonce=string&state=string&code_challenge=string&code_challenge_method=string&resource=string&claims=%7B%22id_token%22%3A%7B%22roles%22%3Anull%7D%7D&acr_values=mfa&createNewUser=false&login_hint=user%40acme.com&custom_message=Welcome%20to%20Acme&ui_locales=string&org_id=string&request_uri=string'

Responses

Redirects with authentication result.

Response

No content