Xeonr Developer Docs
API SpecificationPRIVATEOAuth Provider

Complete OAuth Flow

POST
/xeonr.auth.private.v1.OAuthService/CompleteOAuthFlow

Completes the OAuth authorisation flow after user consent, generating an authorisation code and returning the redirect URL.

Required scopes: auth:oauth

Authorization

BearerAuth
AuthorizationBearer <token>

JWT access token for internal API access. Requires 'private' scope for most endpoints, 'admin' scope for administrative operations.

In: header

Header Parameters

Connect-Protocol-Version*number

Define the version of the Connect protocol

Value in1
Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

acceptType?string

Indicates if the user accepts the OAuth flow

Value in"ACCEPT_TYPE_DENY" | "ACCEPT_TYPE_ALLOW" | "ACCEPT_TYPE_ALLOW_WITH_EXISTING_GRANT"
responseType?string

Type of response expected from the OAuth flow

codeChallenge?string|null

Code challenge for PKCE

codeChallengeMethod?CodeChallengeMethod|null
state?string

State parameter to maintain state between request and callback

redirectUri?string

URI to redirect to after completing the OAuth flow

Formaturi
Length1 <= length <= 1024
scope?scope

Scopes requested during the OAuth flow

Items1 <= items
forever?boolean

Indicates if the authorization should be long-lived

clientId?string
Formatuuid
withoutApproval?boolean

If set, the request will only succeed if we can skip the OAuth flow.

nonce?string|null
Length1 <= length <= 1024
resource?string|null

RFC 8707: Resource indicator to restrict token audience

Formaturi
maxAge?integer|null

OIDC: Maximum authentication age in seconds. Forces re-auth if auth_time is older.

Formatint32
acrValues?string|null

OIDC: Requested Authentication Context Class Reference values (space-separated)

requestUri?string|null

PAR request URI containing authorization_details and other params

prompt?string|null

OIDC: space-delimited prompt values (none, login, consent, select_account). none = fail if any interaction (login or consent) would be required; login = force re-authentication; consent = force the consent screen.

loginHint?string|null

OIDC: login_hint — a hint (e.g. email or username) about the identity the client expects to authenticate, used to pre-fill/select the account.

[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://auth.xeonr.io/xeonr.auth.private.v1.OAuthService/CompleteOAuthFlow" \  -H "Connect-Protocol-Version: 1" \  -H "Content-Type: application/json" \  -d '{}'
{
  "url": "https://myapp.example.com/oauth/callback?code=abc123&state=xyz123state"
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Complete OAuth Code POST

Completes the device code flow by approving or denying the authorisation request. **Required scopes:** `auth:oauth`

Get Public Client POST

Retrieves public details of an OAuth client for displaying on the consent screen, including requested scopes and user permissions. **Required scopes:** `auth:oauth`