Skip to main content
Version: 4.0.2

Authorization Request

GET 
/authz-srv/authz

Authorization Request

This API initiates the OAuth 2.0 / OpenID Connect authorization process. It can be used to perform the following flows:

The flow type is determined by the response_type parameter. All parameters are passed as query parameters in the URL, except when using PAR where request_uri is used instead.

response_type validation

The new behavior works as follows:

  • The response_type is split into individual values. Only known values (code, token, id_token, device_code) are kept — anything else is ignored. If no valid value remains, the request is rejected with AUTH10013.
  • If the app has no response_type configured, all syntactically valid values are accepted.
  • If the app does have response_type configured, only the allowed values are kept. Disallowed values are silently removed. If nothing allowed remains after filtering, AUTH10013 is returned.
  • Grant type checks are then applied to the filtered result: if the response_type contains token or id_token without code, the app must have the implicit grant enabled (otherwise AUTH10014). If it contains code, authorization_code must be enabled (otherwise AUTH10015). Hybrid flows like code token do not require implicit.

One thing worth keeping in mind: when values are removed by filtering, this is logged on our side but no error is returned to the client. So if you send response_type=code id_token but only code is allowed on the app, you'll effectively get a plain Authorization Code Flow — no ID Token from the authorization endpoint, and no error. If you're not expecting that, it can be easy to miss during testing.

The same response_type rules apply when response_type is sent via POST /authz-srv/par (Pushed Authorization Request).

Request​

Responses​

Redirect to redirect_uri with the authorization result (code, token, and/or id_token depending on the filtered response_type) as query parameters or URL fragment, plus state when provided.

Response Headers
    Location

    Redirect URL with authorization result.

    Example: https://example.com/callback?code=SplxlOBeZQQYbYS6WxSbIA&state=QBTVJ59VHOTKRKUCQ18V