GET /oauth/authorize for Authorization Codes

GET https://example.com/oauth/authorize

Description

Requests an authorization code or an access token for a security profile and redirects the browser to the given redirect URI with the result. DS Server doesn't show a sign-in or consent page: when the client ID and the redirect URI are valid, it redirects at once.

With response_type=code, the redirect carries an authorization code that POST /oauth/token exchanges for an access token. With response_type=token, it carries the access token itself.

When DS Server can't authorize the request itself, for example because it doesn't know the client ID, it forwards the request to the registered authentication servers (see GET /authenticationserver/authorize).

Examples

The following sample requests an authorization code using the "code" flow. The authorization code is returned to the given redirect URI.

# Request:
curl --request GET 'https://trial.dsserver.io/oauth/authorize?redirect_uri=https://localhost:5001/callback&client_id=yourclientid&response_type=code&state=teststate'

# Response:
HTTP/1.1 302 Found
Location: https://localhost:5001/callback?code=g0ZGZmNjVmOWIjNTk2NTk4ZTYyZGI3&state=teststate

With response_type=token, the access token is returned to the redirect URI instead:

HTTP/1.1 302 Found
Location: https://localhost:5001/callback?access_token=nmZ80Zn2R0P2AbS149E31IUHd5aZgB9T&token_type=Bearer&expires_in=3600&state=teststate

Request Parameters

Name	Type	Value	Optional
client_id	String	The client ID of the security profile.	no
response_type	String	The type of the requested response. Supported values are "code" and "token".	no
redirect_uri	String	The redirect URI must match one of the authorized redirect URIs of the security profile. Upper and lower case are ignored; the scheme, host, port, path and query string must be the same.	no
state	String	DS Server echoes back the state value in the redirect.	yes
scope	String	The scope of the request.	yes

Success Response

Status	Description
302	On success, the request is redirected to the given redirect URI with the query parameters `code` and `state` ("code") or `access_token`, `token_type`, `expires_in` and `state` ("token").

Error Response

Status	Description
400	A 400 (Bad Request) with the plain text (`text/plain`) "Missing, invalid or mismatching redirection URI." is returned, if the redirect URI is missing or is not one of the authorized redirect URIs of the security profile.
302	Other errors are returned to the redirect URI in the query parameters `error`, `error_description` and `state`: `unauthorized_client` with an empty description for an unknown client ID or when the registered authentication servers reject the request, and `unsupported_response_type` "Unsupported response type." for a response type other than "code" or "token".
302	Without a client ID or a response type, the `Location` header holds only the query string `?error=invalid_request&error_description=...` with "Missing 'client_id' parameter." or "Missing 'response_type' parameter.", without the redirect URI and without `state`.