Information
- OpenAPI version:
3.2.0
Overview
Browser and API authentication endpoints.
Authrim Authentication API 0.5.0
Section titled “Authrim Authentication API 0.5.0”Initial OpenAPI contract for endpoints owned by @authrim/ar-auth. This document intentionally contains route contracts only; do not add secrets, private test credentials, or vulnerability notes.
When coordinated SAML DR export is enabled, every operation can additionally return HTTP 503 while source updates are paused or update admission is unavailable. This availability response has Content-Type text/plain;charset=UTF-8, Cache-Control no-store, Retry-After 5, and the body “Service temporarily unavailable” (no response body for HEAD). Clients may retry after the indicated delay; a failed response does not establish whether an earlier write completed.
Browser CORS allows configured origins with credentials and the request headers Content-Type, Authorization, X-Session-Id, and X-Authrim-Interaction-Id. An unapproved origin receives no Access-Control-Allow-Origin header. The AWS SAML profile exposes only its supported passkey and Login Runtime routes; when login is disabled, those routes and their preflights return 404. External UI mode keeps the same client, active origin, PKCE, and WebAuthn verification requirements.
Authentication
Section titled “ Authentication ”sessionCookie
Section titled “sessionCookie ”Security scheme type: apiKey
Cookie parameter name: authrim_session
adminSessionCookie
Section titled “adminSessionCookie ”Security scheme type: apiKey
Cookie parameter name: authrim_admin_session