GET/api/oidc/authorizePublic

Authorization endpoint

The OAuth 2.0 / OpenID Connect authorization endpoint (RFC 6749 §3.1, OIDC Core §3.1.2). Validates the request and redirects the user-agent to the auth server's login / consent UI, which later redirects back to redirect_uri with code, state and iss (RFC 9207). PKCE S256 is mandatory. Errors in client_id or redirect_uri are answered with a direct 400 (never a redirect); every later failure (unsupported_response_type, invalid_scope, invalid_request, login_required, request_not_supported, ...) redirects back to the validated redirect_uri with error, error_description, state and iss query parameters. Responses carry Cache-Control: no-store.

operationId get_api_oidc_authorizeOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials: None required
Notes: No credentials: the resource owner authenticates on the login page this endpoint redirects to. The client is identified by client_id and its registered redirect_uri.

Query parameters

Name	Type	Description
client_id	string	REQUIRED. The client application id.
redirect_uri	string	REQUIRED. Must exactly match a callback URL registered for the client app (http loopback URLs are port-agnostic per RFC 8252 §7.3).
response_type	string	REQUIRED. Only `code` is supported.
scope	string	OPTIONAL. Space-delimited scopes. With `openid` this is an OpenID Connect authentication request (an id_token is minted); without it a plain OAuth 2.1 authorization grant (access + refresh tokens only). Supported: `openid`, `email`, `profile`; unknown scopes are ignored.
state	string	RECOMMENDED. Opaque value echoed back on the redirect (also on error redirects).
nonce	string	OPTIONAL. Bound to the id_token's `nonce` claim (OIDC Core §3.1.2.1).
code_challenge	string	REQUIRED. PKCE code challenge (RFC 7636); every client is treated as public.
code_challenge_method	string	REQUIRED. Only `S256` is supported.
prompt	string	OPTIONAL. `none` is refused with `login_required` (silent authentication is not supported); other values are ignored.
request	string	Not supported: refused with `request_not_supported` (no JAR / RFC 9101).
request_uri	string	Not supported: refused with `request_uri_not_supported`.
resource	string	Ignored at this endpoint. Send the RFC 8707 `resource` parameter to the token endpoint instead to mint the access token for a registered API server.

Responses

Example request

bashcurl

curl -X GET 'https://auth.schemavaults.com/api/oidc/authorize'

Authentication & permissionsPublic

Query parameters

Responses

400client_id is missing, malformed, unknown or not registered for web redirect flows (invalid_request / unauthorized_client), redirect_uri is missing, invalid or unregistered, state is malformed, or the client app could not be loaded (server_error).

Example request