Trigger guest login

POST 
/login-srv/login/guest/:requestId

Authenticates a guest user for the provided requestId.

• No bearer token required.
• No client secret required in request body.
• Returns 200 with an auto-submit HTML form containing generated guest credentials.
• requestId must be valid, active, and formatted as a UUID.
• Invalid or expired requestId returns 417 with LoginException (code: 10001).
• Malformed requestId returns 400 with LoginException (code: 24008).
• If Guest Login is disabled for the app, returns 400 with LoginException (code: LOGIN10075).
• If this endpoint is called with GET instead of POST, the server returns 404 Not Found.

Identity assurance note:

• Normal login: sub maps to a real user identity; assurance can be higher (for example with AMR/MFA).
• Guest login: sub maps to a guest identity; assurance is low and should be treated like anonymous access.

Quick test (minimum request):

curl -i -X POST "https://{your-domain}/login-srv/login/guest/{requestId}"

Expected success:

• 200 OK
• Content-Type: text/html
• Response contains an auto-submit form to /login-srv/login.

Request

Responses

200

Success. Returns auto-submit HTML form.

400

Malformed request ID or Guest Login disabled for the application.

404

Route or method not available (for example GET instead of POST).

417

Invalid, expired, or non-existent requestId.