| Enable and disable an AuthMethod plugin in a realm | captured
records what QAuth does today; not approved | graphs/flows/admin/plugin-enable |
| Verify an account's address after its correct password | proposed
a design under review; not approved | graphs/flows/core/account-verification |
| Authorize a client for the signed-in user | captured
records what QAuth does today; not approved | graphs/flows/core/authorization |
| Tell each app a browser session signed in to that the session ended | proposed
a design under review; not approved | graphs/flows/core/backchannel-logout |
| Ask the signed-in person to allow a client's access, as a step of the Interaction API | proposed
a design under review; not approved | graphs/flows/core/consent |
| Ask the user to approve a client's access | captured
records what QAuth does today; not approved | graphs/flows/core/consent-page |
| Sign the browser out at an app's request, and send it back to the app | proposed
a design under review; not approved | graphs/flows/core/logout |
| Sign out with an access token | captured
records what QAuth does today; not approved | graphs/flows/core/logout-token |
| Sign in with a passkey, prove it on a passkey-bound account, and bind one after a sign-in | proposed
a design under review; not approved | graphs/flows/core/passkey |
| Reset a password, the mailbox first, never past another authenticator | proposed
a design under review; not approved | graphs/flows/core/password-reset |
| Redeem a recovery code in place of a lost factor, and show a new set once | proposed
a design under review; not approved | graphs/flows/core/recovery-code |
| Decide a sign-in, one round at a time | proposed
a design under review; not approved | graphs/flows/core/sign-in |
| Sign in with a password in the browser | captured
records what QAuth does today; not approved | graphs/flows/core/sign-in-page |
| Sign in with a password for tokens | captured
records what QAuth does today; not approved | graphs/flows/core/sign-in-token |
| Register a password account, the mailbox first | proposed
a design under review; not approved | graphs/flows/core/sign-up |
| Sign in, or sign up, through one of the realm's upstream identity providers | proposed
a design under review; not approved | graphs/flows/federation/upstream-sign-in |
| Sign in at an upstream provider through an AuthMethod | proposed
a design under review; not approved | graphs/flows/federation/upstream-step |