Skip to main content
OpenID Provider (Sandbox organisation)

Authorisation endpoint

GET/v4/service/platform/extension/oidc/{organisationId}/{sandboxOrgId}/auth

The endpoint of the OpenID Provider of a sandbox organisation. It works like the endpoint of the main organisation; the path holds the ID of the sandbox organisation after the ID of the organisation.

Starts a login with the EUDI Wallet (OpenID Connect authorisation code flow). Send the browser of the person here; your identity and access management system does this when it uses the discovery URL.

The answer is a web page with a QR code and a link that opens the EUDI Wallet. The wallet answers the presentation definition of the client. A QR code is valid for 5 minutes; the page refreshes it up to two times. After the presentation, the page sends the browser to redirect_uri with code, state and iss. When the person does not answer within 15 minutes, it sends error=interaction_required instead.

When client_id is unknown, or redirect_uri is not a redirect URI of the client, the page shows the error and does not redirect. The endpoint takes GET and POST.

Authorizations

Public. The operation takes no credentials.

Path parameters

  • organisationIdstringrequired

    The ID of the organisation

  • sandboxOrgIdstringrequired

    Unique identifier of the sandbox organisation.

Query parameters

  • scopestringrequired

    Must contain openid.

    Default:openid

  • response_typeenum<string>required

    The authorisation code flow. Only code.

    Available options:code

    Default:code

  • client_idstringrequired

    The client ID of the OIDC client.

  • redirect_uristringrequired

    Where the provider sends the browser back. It must match a redirect URI of the client exactly.

  • statestringrequired

    An opaque value that the provider returns with the code. Check it to stop cross-site request forgery.

  • noncestring

    A value that the provider puts in the ID token and the access token. Check it to stop replay.

  • code_challengestring

    The PKCE code challenge (RFC 7636). Send code_verifier in the token request when you use it.

  • code_challenge_methodenum<string>

    The PKCE method. Only S256.

    Available options:S256

Response

text/html

The login page with the QR code, or a page that shows an error of the client or the redirect URI.

Headers

  • X-Frame-Optionsstring

    The page cannot be shown in a frame.

    Example:"DENY"

  • bodystring

    The HTML page.