CIBA Token Endpoint (v1)

CIBA Token Endpoint

Overview

Returns CIBA-compliant token or error responses as per OAuth 2.0 and CIBA specifications, without wrapping into Plumery-specific error structures.

Examples for App authentication error code, error_description:

  • access_denied, “not authorized”: Pending authentication was rejected by the user or the user didn’t approve the authentication request.’
  • authorization_pending, “The authorization request is still pending as the end-user hasn’t yet been authenticated.”: Pending authentication was not confirmed by the user yet.

POST (/internal/v1/auth/ciba/token)

Request Body

Responses

200 OK

Successful token response issued after a completed CIBA authentication request.

400 Bad Request

Error response for CIBA endpoints, following OAuth 2.0 and OpenID Connect error format.

401 Unauthorized

Error response for CIBA endpoints, following OAuth 2.0 and OpenID Connect error format.

500 Internal Server Error

Error response for CIBA endpoints, following OAuth 2.0 and OpenID Connect error format.

default

Error response for CIBA endpoints, following OAuth 2.0 and OpenID Connect error format.

Architecture

2 properties
grant_type string
required

OAuth 2.0 grant type. For CIBA this is typically `urn:openid:params:grant-type:ciba`.

auth_req_id string
required

Authentication request identifier returned by the backchannel-auth endpoint.

7 properties

Successful token response issued after a completed CIBA authentication request.

access_token string
required

Access token issued by the authorization server.

expires_in integer <int32>
required

Lifetime in seconds of the access token.

token_type string
required

Type of the token issued.

refresh_token string

Refresh token which can be used to obtain new access tokens.

id_token string

ID Token containing claims about the authenticated end-user.

scope string

Space-separated list of scopes associated with the issued tokens.

authentication_method string

Authentication method performed by the user.

Allowed values: smart-id mobile-id app-passcode app-biometrics
3 properties

Error response for CIBA endpoints, following OAuth 2.0 and OpenID Connect error format.

error string
required

Error code.

Allowed values: invalid_request invalid_client invalid_grant unauthorized_client access_denied invalid_scope authorization_pending slow_down expired_token server_error temporarily_unavailable
error_description string

Human-readable ASCII text providing additional information about the error.

error_uri string <uri>

URI identifying a human-readable web page with information about the error.

3 properties

Error response for CIBA endpoints, following OAuth 2.0 and OpenID Connect error format.

error string
required

Error code.

Allowed values: invalid_request invalid_client invalid_grant unauthorized_client access_denied invalid_scope authorization_pending slow_down expired_token server_error temporarily_unavailable
error_description string

Human-readable ASCII text providing additional information about the error.

error_uri string <uri>

URI identifying a human-readable web page with information about the error.

3 properties

Error response for CIBA endpoints, following OAuth 2.0 and OpenID Connect error format.

error string
required

Error code.

Allowed values: invalid_request invalid_client invalid_grant unauthorized_client access_denied invalid_scope authorization_pending slow_down expired_token server_error temporarily_unavailable
error_description string

Human-readable ASCII text providing additional information about the error.

error_uri string <uri>

URI identifying a human-readable web page with information about the error.

3 properties

Error response for CIBA endpoints, following OAuth 2.0 and OpenID Connect error format.

error string
required

Error code.

Allowed values: invalid_request invalid_client invalid_grant unauthorized_client access_denied invalid_scope authorization_pending slow_down expired_token server_error temporarily_unavailable
error_description string

Human-readable ASCII text providing additional information about the error.

error_uri string <uri>

URI identifying a human-readable web page with information about the error.