List pending CIBA requests for the current user/session.

GET

/api/ciba/pending

Code sample: Shell / cURL

curl --request GET \
  --url https://auth.example.com/api/ciba/pending \
  --cookie authrim_session=<authrim_session>

The pending, unexpired requests addressed to the signed-in user, across clients: by the subject resolved from a signed hint or, failing that, by its login_hint. At most 50 are returned, oldest first among those found; a user with more sees the rest as earlier ones are decided or expire. The user is taken from the session, never from parameters; a login_hint or user_id naming someone else is refused with 403. When the store cannot produce a complete list right now (its address index is being brought up to date), the response is 503 temporarily_unavailable rather than a partial list: retry. created_at and expires_at are epoch milliseconds.

Authorizations

• sessionCookie
• sessionHeader

Responses

200

Successful JSON response.

Media type application/json

object

requests

required

Array<object>

object

auth_req_id

string

client_id

string

client_name

string

client_logo_uri

string | null

scope

string

binding_message

string | null

user_code

string | null

created_at

Epoch milliseconds.

integer

expires_at

Epoch milliseconds.

integer

status

string

Example

{
  "requests": [
    {
      "auth_req_id": "auth_req_123",
      "client_id": "client_123",
      "client_name": "Example App",
      "client_logo_uri": "https://example.com/logo.png",
      "scope": "openid profile email",
      "binding_message": "Approve sign-in",
      "user_code": "123456",
      "created_at": 1770000000000,
      "expires_at": 1770000300000,
      "status": "pending"
    }
  ]
}

401

An authenticated end-user session is required.

Media type application/json

object

error

required

string

error_description

required

string

key

additional properties

Example

{
  "error": "login_required",
  "error_description": "Authentication is required"
}

403

The authenticated user does not own the CIBA request.

Media type application/json

object

error

required

string

error_description

required

string

key

additional properties

Example

{
  "error": "access_denied",
  "error_description": "Insufficient permissions"
}

503

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}