GET/api/oidc/authorizePublic

Authorization endpoint

The OAuth 2.0 / OpenID Connect authorization endpoint (RFC 6749 §3.1, OIDC Core §3.1.2). Validates the request and redirects the user-agent to the auth server's login / consent UI, which later redirects back to redirect_uri with code, state and iss (RFC 9207). PKCE S256 is mandatory. Errors in client_id or redirect_uri are answered with a direct 400 (never a redirect); every later failure (unsupported_response_type, invalid_scope, invalid_request, login_required, consent_required, interaction_required, request_not_supported, ...) redirects back to the validated redirect_uri with error, error_description, state and iss query parameters. Responses carry Cache-Control: no-store.

operationId get_api_oidc_authorizeOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials: None required
Notes: No credentials: the resource owner authenticates on the login page this endpoint redirects to. The client is identified by client_id and its registered redirect_uri.

Query parameters

Name	Type	Description
client_id	string	REQUIRED. The client application id.
redirect_uri	string	REQUIRED. Must exactly match a callback URL registered for the client app (http loopback URLs are port-agnostic per RFC 8252 §7.3).
response_type	string	REQUIRED. Only `code` is supported.
scope	string	OPTIONAL. Space-delimited scopes. With `openid` this is an OpenID Connect authentication request (an id_token is minted); without it a plain OAuth 2.1 authorization grant (access + refresh tokens only). Supported: `openid`, `email`, `profile`, plus the API scopes defined by the API server named in `resource`; unknown scopes are ignored.
state	string	RECOMMENDED. Opaque value echoed back on the redirect (also on error redirects).
nonce	string	OPTIONAL. Bound to the id_token's `nonce` claim (OIDC Core §3.1.2.1).
code_challenge	string	REQUIRED. PKCE code challenge (RFC 7636); every client is treated as public.
code_challenge_method	string	REQUIRED. Only `S256` is supported.
prompt	string	OPTIONAL. Space-delimited. `none` (alone): no UI — when the user agent has a signed-in session, the account may be handed to the app and the user already consented to everything requested, the endpoint redirects back with a code; otherwise with `login_required`, `interaction_required` (e-mail verification pending) or `consent_required`. `consent`: the consent screen is shown even if nothing new is requested. Other values are ignored.
request	string	Not supported: refused with `request_not_supported` (no JAR / RFC 9101).
request_uri	string	Not supported: refused with `request_uri_not_supported`.
resource	string	OPTIONAL. RFC 8707 resource indicator: an API server id, or the https URL of one of its registered domains, that this client may get tokens for. The requested `scope` values that API server defines (its API scopes, e.g. `notes:read`) are granted: the access tokens minted for that API server (send the same `resource` to the token endpoint) carry them, and the refresh token keeps them. A value that names no such API server, or several `resource` values, is ignored (only OIDC scopes are granted); the token endpoint refuses an unusable `resource` with `invalid_target`.

Responses

Example request

bashcurl

curl -X GET 'https://auth.schemavaults.com/api/oidc/authorize'

Authentication & permissionsPublic

Query parameters

Responses

400client_id is missing, malformed, unknown or not registered for web redirect flows (invalid_request / unauthorized_client), redirect_uri is missing, invalid or unregistered, state is malformed, or the client app could not be loaded (server_error).

Example request