PAR

Request

Pushed authorization request (PAR) is a secure way to initiate the authorization flow. All parameters are sent in the body of the request (see OAuth 2.0 Pushed Authorization Requests RFC).

Bodyapplication/x-www-form-urlencodedrequired

client_idstringrequired

Client ID for which authentication is requested.

client_secretstringrequired

Client secret.

redirect_uristringrequired

URI to redirect to upon completion of the authentication flow. This is the server GET endpoint used to call the token endpoint, and should accept code as a query parameter. This URI must also be configured as an allowed redirect URI in the Admin Portal

response_typestringrequired

Response type requested for the authentication flow.

Value:"code"

scopestring

Scope of the requested access. Used to request specific user details like email. Must include openid and can include additional values (space delimited). offline_access scope allows refreshing access tokens.

Enum:"openid""email""phone""offline_access"

promptstring

Space-delimited, case-sensitive list of string values that specifies whether the Authorization Server prompts the end-user for reauthentication and consent.

Enum:"none""login""consent"

noncestring

A random value that is included in the authentication request from the client (e.g. browser) to mitigate replay attacks. It will be added to the id_token and the backend service should only accept id_tokens that include the same nonce value as the one included in the original request.

statestring

An opaque string that is used to maintain state between the request and the callback. It will be added to the redirect URI as a query parameter, which should be validated by your server to protect against cross-site request forgery (CSRF) attacks

resourcestring

Resource URI the authentication request is attempting to access, which is reflected in the audience (aud claim) of the access token. This must be configured as resource for the application.

claimsstring

A stringified object used to request additional claims in the ID token, such as roles, permissions, and other user profile data. The structure is per the OIDC Standard. For supported claims and how to request custom claims, see the ID Token Reference. Note: You should stringify the value.

acr_valuesstring

Requested ACR values, specified as a space-separated string. The acr claim of the resulting ID token will indicate which requirements were satisfied.

Enum:"mfa""phone_number""urn:transmit:google_direct""urn:transmit:apple_direct""urn:transmit:facebook_direct""urn:transmit:line_direct""urn:transmit:centralized"

createNewUserboolean

Indicates if a new user should be created if one doesn't already exist (or associated with the app if the user isn't already). Public sign up must be enabled for this application.

Default:false

login_hintstring

Hint for the user's login identifier for WebAuthn login.

custom_messagestring

Custom message to present on the consent screens for WebAuthn login, which provides authentication context details.

Example:"Welcome to Acme"

ui_localesstring

Preferred languages for the user interface for WebAuthn login, specified as a space-separated list of language tag values [RFC5646], ordered by preference.

org_idstring

Organization ID, used for member login in B2B scenarios

code_challengestring

A hashed value of the 'code_verifier' required for PKCE

code_challenge_methodstring

The hashing mechanism used to transform a code_verifier into the code_challenge in PKCE flows, must be 'S256'

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/oidc/request \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d client_id=string \
  -d client_secret=string \
  -d redirect_uri=string \
  -d response_type=code \
  -d scope=openid \
  -d prompt=none \
  -d nonce=string \
  -d state=string \
  -d resource=string \
  -d claims=string \
  -d acr_values=mfa \
  -d createNewUser=false \
  -d login_hint=string \
  -d 'custom_message=Welcome to Acme' \
  -d ui_locales=string \
  -d org_id=string \
  -d code_challenge=string \
  -d code_challenge_method=string

Responses

The request has been accepted

Bodyapplication/json

request_uristringrequired

A single-use reference to the respective request data in the subsequent authorization request.

expires_inintegerrequired

A positive integer value indicating the expiration time of the request_uri in seconds since the request was received

Default:60

Response

{
  "request_uri": "string",
  "expires_in": 60
}