Approve a CIBA request.

POST

/api/ciba/approve

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/ciba/approve \
  --header 'Content-Type: application/json' \
  --cookie authrim_session=<authrim_session> \
  --data '{ "auth_req_id": "auth_req_123", "user_id": "user_123" }'

A request made before the user last withdrew the client’s consent cannot be approved: 400 consent_withdrawn, and the client has to start again. Consent state that cannot be read returns 503 temporarily_unavailable and leaves the request pending. 404 only when the request does not exist (or expired and was removed). 503 temporarily_unavailable also when the request store cannot answer or does not confirm the approval; the approval may or may not have been saved, so check the request (GET /api/ciba/requests/{auth_req_id}) before retrying. A request already decided is 400. For a ping-mode request the client’s notification endpoint is called before this response is sent, and waits at most ciba.ping_notification_timeout_ms (a failed notification is not retried and does not fail the approval).

Authorizations

• sessionCookie
• sessionHeader

Request Body ^required

Media type application/json

object

auth_req_id

required

string

user_id

string

sub

string

nonce

string

reason

string

Example

{
  "auth_req_id": "auth_req_123",
  "user_id": "user_123"
}

Responses

200

Successful JSON response.

Media type application/json

object

success

required

boolean

message

string

error

string

error_description

string

retry_after

integer

Example

{
  "success": true,
  "message": "Authentication request approved"
}

400

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

401

An authenticated end-user session is required.

Media type application/json

object

error

required

string

error_description

required

string

key

additional properties

Example

{
  "error": "login_required",
  "error_description": "Authentication is required"
}

403

The authenticated user does not own the CIBA request.

Media type application/json

object

error

required

string

error_description

required

string

key

additional properties

Example

{
  "error": "access_denied",
  "error_description": "Insufficient permissions"
}

404

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

503

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}