DS Server

GET /oauth/authorize

Endpoint

GET https://example.com/oauth/authorize

Description

Requests an authorization code or an access token for a security profile and redirects the browser to the given redirect URI with the result. DS Server doesn't show a sign-in or consent page: when the client ID and the redirect URI are valid, it redirects at once.

With response_type=code, the redirect carries an authorization code that POST /oauth/token exchanges for an access token. With response_type=token, it carries the access token itself.

When DS Server can't authorize the request itself, for example because it doesn't know the client ID, it forwards the request to the registered authentication servers (see GET /authenticationserver/authorize).

Examples

The following sample requests an authorization code using the "code" flow. The authorization code is returned to the given redirect URI.

# Request:
curl --request GET 'https://trial.dsserver.io/oauth/authorize?redirect_uri=https://localhost:5001/callback&client_id=yourclientid&response_type=code&state=teststate'

# Response:
HTTP/1.1 302 Found
Location: https://localhost:5001/callback?code=g0ZGZmNjVmOWIjNTk2NTk4ZTYyZGI3&state=teststate

With response_type=token, the access token is returned to the redirect URI instead:

HTTP/1.1 302 Found
Location: https://localhost:5001/callback?access_token=nmZ80Zn2R0P2AbS149E31IUHd5aZgB9T&token_type=Bearer&expires_in=3600&state=teststate

Request Parameters

NameTypeValueOptional
client_idStringThe client ID of the security profile.no
response_typeStringThe type of the requested response. Supported values are "code" and "token".no
redirect_uriStringThe redirect URI must match one of the authorized redirect URIs of the security profile. Upper and lower case are ignored; the scheme, host, port, path and query string must be the same.no
stateStringDS Server echoes back the state value in the redirect.yes
scopeStringThe scope of the request.yes

Success Response

StatusDescription
302On success, the request is redirected to the given redirect URI with the query parameters code and state ("code") or access_token, token_type, expires_in and state ("token").

Error Response

StatusDescription
400A 400 (Bad Request) with the plain text (text/plain) "Missing, invalid or mismatching redirection URI." is returned, if the redirect URI is missing or is not one of the authorized redirect URIs of the security profile.
302Other errors are returned to the redirect URI in the query parameters error, error_description and state: unauthorized_client with an empty description for an unknown client ID or when the registered authentication servers reject the request, and unsupported_response_type "Unsupported response type." for a response type other than "code" or "token".
302Without a client ID or a response type, the Location header holds only the query string ?error=invalid_request&error_description=... with "Missing 'client_id' parameter." or "Missing 'response_type' parameter.", without the redirect URI and without state.