captured core.authorization

Authorize a client for the signed-in user

The authorization endpoint of OAuth 2.1, GET or POST (OpenID Connect Core §3.1.2.1). It checks the client, its redirect URI against the registration and the environment, its grant and response type and the dpop_jkt it names, before anything about the user. Then it reads the browser session. Without one, or for a request whose sign-in is too old for what it asks (prompt=login, max_age, a dangerous scope, a native_backend client), the person signs in; under prompt=none the client gets login_required instead. With a session it refuses an agent scope above the client's cap and a QAuth API audience the client does not list, and asks for consent when no stored or administrative consent covers the request (consent_required under prompt=none). Otherwise it mints the code, under the consent and the session, both read again in its transaction, and sends it back with iss. With INTERACTION_UI_ENABLED on, the sign-in and the consent are interactions: the endpoint redirects to the ceremony page with the interaction id and nothing else, and when the interaction finishes the request is decided again for the session it holds, and the code minted, or the next interaction started.

What this view shows

GET and POST /oauth/authorize from the request to the response, in both modes, and the answer of the Interaction API that finishes or cancels one of its interactions.

Open world: what is not drawn here is not ruled out. Only the guarantees below are binding.

Left out of this view:

the steps of a sign-in before its last answer: core.sign-in (the engine) and the Interaction API (#616), whose answers lead to another step until the one that finishes the interaction
the server-rendered pages: /ui/login and /ui/resume (core.sign-in-page) and /ui/consent (core.consent-page)
the consent step past its start (core.consent, #629): its reads, its answer, the request checked again, and the code for exactly the scope set the step showed, or the error the client gets. core.consent also draws two refusals of the start this graph does not: a redirect URI the client display cannot describe (400, never redirected) and a client audience the step cannot carry (invalid_target)
the expiry of an interaction nobody finished, which the sweep reports (interaction.expired), and a cancel or a read for an interaction that has expired, which answer 410
an answer that another answer to the same step beat (the turn was taken), which gets the step as it now is and finishes nothing
a store failure before anything is written (the lookup of the host, the rate-limit counter, the session, the client, the consent) answers 500; a failure to record the event of a refusal turns that refusal into a 500
the causes of a 421 (a malformed or unknown host, a disabled realm, a realm with no issuer, an endpoint host) give one answer and are drawn as one exit
with RATE_LIMIT_ENABLED=false the authorize limit is not applied
when the pending-authorization store is down, the login redirect carries the authorize URL itself in return_to instead of a handle
the scope allowlist: the scopes decided on are the requested ones the client's allowlist holds, and a client with no allowlist is granted none (filterRequestedScopes); an empty set is a request like any other
staging reads as production in every check drawn here; the environment is the stricter of the client's and its realm's ceiling, and a development client is spared only the dangerous-scope rule of the step-up gate
a code the mint transaction stored whose event store write then failed: the transaction rolls back, and no code is left

The main story

When: INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries no session cookie, or one that names a cookie key this process has not read yet and may not read again yet (#493), which is left for the next request, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again.

Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form
Find the realm of the host: the request has its realm
Count the request against the authorize limit: the address is under its limit
Check the parameters against the authorize schema: the parameters match the schema
Find the client: the client is found
Check the redirect URI against the client's registration: redirect_uri is registered
Check the redirect URI against the environment policy: the environment permits the redirect URI
Check that the client may use the endpoint: the client may use the endpoint
Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed
Check a request for a registration: the request carries no prompt=create
Find the browser session: no usable session: the person signs in first, and the request is decided again with that session
Send the person to sign in: INTERACTION_UI_ENABLED is on
Start a sign-in interaction: the interaction is stored
The person signs in at the ceremony page: the person's last answer, such as the right password, finishes the interaction
End the interaction before anything is issued: the interaction is over
Check the request again, as the endpoint checks it: the request still passes
Find the session the interaction holds: the session is live: the request is decided again for it
Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds
Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists
Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request
Mint the authorization code under the consent and the session: the code is stored, for the request whose interaction finished

Result: Send the authorization code to the client once the interaction finished.

The flow

Show failure paths and “the user closes the page”

blue line: the main storyred dashed line: a failure path (shown with “Show failure paths”)dotted line: decided by a rule, nobody actsdashed grey box: the server decides, nothing is showngreen exit: successred exit: no redirect

What each step answers

Step	The outside world sees
The person registers at the ceremony page atRegistrationCeremony	302 from /oauth/authorize; 303 or 200 from the Interaction API when an interaction finished · headers: {"Location":"/ui/interaction/<the interaction id, 43 base64url characters>, from /oauth/authorize; the same path on the realm's issuer, when an interaction finished","Set-Cookie":"__Host-qauth_flow=<the browser's interaction secrets, this one's added>; Path=/; HttpOnly; SameSite=Lax, and the session cookie cleared when the request carried an unusable one"} · body: none from /oauth/authorize; from the Interaction API, a form post gets the redirect and a JSON answer { result: redirect, location }
The person signs in at the ceremony page atSignInCeremony	302 from /oauth/authorize; 303 or 200 from the Interaction API when an interaction finished · headers: {"Location":"/ui/interaction/<the interaction id, 43 base64url characters>, from /oauth/authorize; the same path on the realm's issuer, when an interaction finished","Set-Cookie":"__Host-qauth_flow=<the browser's interaction secrets, this one's added>; Path=/; HttpOnly; SameSite=Lax, and the session cookie cleared when the request carried an unusable one"} · body: none from /oauth/authorize; from the Interaction API, a form post gets the redirect and a JSON answer { result: redirect, location }
The person is asked for consent at the ceremony page atConsentCeremony	as atSignInCeremony · headers: {"Location":"as atSignInCeremony","Set-Cookie":"__Host-qauth_flow=<the browser's interaction secrets, this one's added>; Path=/; HttpOnly; SameSite=Lax"} · body: as atSignInCeremony
Send the authorization code to the client code_issued	302 · headers: {"Location":"redirect_uri with code (43 base64url characters), state when the request had one, and iss"}
Send the authorization code to the client once the interaction finished code_issued.after_sign_in	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, redirect_uri with code (43 base64url characters), state when the request had one, and iss","Set-Cookie":"the new session cookie, and __Host-qauth_flow without the finished interaction's secret","Cache-Control":"no-store"} · body: for a JSON answer, { result: redirect, location: the same URL }
Send a browser with no session to sign in sign_in_required.no_session	302 · headers: {"Location":"/ui/login?return_to=<percent-encoded /ui/resume/<handle>>"}
Send a browser whose session cookie is of no use to sign in sign_in_required.unusable_session	302 · headers: {"Location":"/ui/login?return_to=<percent-encoded /ui/resume/<handle>>","Set-Cookie":"__Host-qauth_session cleared (Max-Age=0)"}
Send a browser whose sign-in is too old for the request to sign in again sign_in_required.fresh_login	302 · headers: {"Location":"/ui/login?return_to=<percent-encoded /ui/resume/<handle>>"}
Send a browser whose session ended under the request to sign in again sign_in_required.session_ended	302 · headers: {"Location":"/ui/login?return_to=<percent-encoded /ui/resume/<handle>>"}
Send the signed-in user to the consent page consent_screen.page	302 · headers: {"Location":"/ui/consent?<the authorize parameters, as the request carried them>"}
Send the user whose consent was revoked under the request to the consent page consent_screen.consent_withdrawn	302 · headers: {"Location":"/ui/consent?<the authorize parameters, as the request carried them>"}
Tell the client the person cancelled access_denied.cancelled	303 for a form post; 200 for a JSON cancel · headers: {"Location":"for a form post, redirect_uri with error=access_denied, state when the request had one, and iss","Set-Cookie":"__Host-qauth_flow without the cancelled interaction's secret"} · body: for a JSON cancel, { result: redirect, location: the same URL }
Refuse a request for an interaction that already finished interaction_expired.finished	410 · headers: {"Content-Type":"application/problem+json","Cache-Control":"no-store"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#interaction-expired","status":410,"code":"interaction_expired","trace_id":"the request id"}
Refuse a finish the expiry sweep beat interaction_expired.finished_late	410 · headers: {"Content-Type":"application/problem+json","Cache-Control":"no-store"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#interaction-expired","status":410,"code":"interaction_expired","trace_id":"the request id"}
Refuse a finish whose session ended since interaction_expired.session_ended	410 · headers: {"Content-Type":"application/problem+json","Cache-Control":"no-store"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#interaction-expired","status":410,"code":"interaction_expired","trace_id":"the request id"}
Refuse a finish or a cancel whose client or redirect URI no longer passes invalid_request.client_changed	400 · headers: {"Content-Type":"application/problem+json","Cache-Control":"no-store"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-request","status":400,"code":"invalid_request","trace_id":"the request id"}
Refuse a finish or a cancel whose client may no longer use the endpoint unauthorized_client.client_changed	400 · headers: {"Content-Type":"application/problem+json","Cache-Control":"no-store"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#unauthorized-client","status":400,"code":"unauthorized_client","trace_id":"the request id"}
Refuse a next interaction too large to hold invalid_request.authorization_too_large_after_sign_in	400 · headers: {"Content-Type":"application/problem+json","Cache-Control":"no-store"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-request","status":400,"code":"invalid_request","trace_id":"the request id"}
Fail the answer when the interaction store fails server_error.interaction_store_after_sign_in	500 · headers: {"Content-Type":"application/problem+json"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","status":500,"code":"internal_error","trace_id":"the request id"}
Fail the answer when the database fails at the mint server_error.store_after_sign_in	500 · headers: {"Content-Type":"application/problem+json"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","status":500,"code":"internal_error","trace_id":"the request id"}
Tell the client an agent scope is above its cap, once the person signed in invalid_scope.agent_scope_mode_exceeded_after_sign_in	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, redirect_uri with error=invalid_scope, error_description=requested scope exceeds the agent scope mode for this client, state when the request had one, and iss"} · body: for a JSON answer, { result: redirect, location: the same URL }
Tell the client it named an audience it does not list, once the person signed in invalid_target.unlisted_reserved_audience_after_sign_in	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, redirect_uri with error=invalid_target, error_description=a QAuth API audience is issued only to a client that lists it, state when the request had one, and iss"} · body: for a JSON answer, { result: redirect, location: the same URL }
Tell the client the consent step cannot show its scopes, once the person signed in invalid_scope.consent_not_shown_after_sign_in	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, redirect_uri with error=invalid_scope, error_description=the requested scopes cannot be shown for consent, state when the request had one, and iss"} · body: for a JSON answer, { result: redirect, location: the same URL }
Tell the client the consent step cannot show its resources, once the person signed in invalid_target.consent_not_shown_after_sign_in	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, redirect_uri with error=invalid_target, error_description=the requested resources cannot be shown for consent, state when the request had one, and iss"} · body: for a JSON answer, { result: redirect, location: the same URL }
Tell the client its dpop_jkt is malformed invalid_request.malformed_dpop_jkt	302 · headers: {"Location":"redirect_uri with error=invalid_request, error_description=dpop_jkt must be the base64url SHA-256 JWK thumbprint of a DPoP key, state when the request had one, and iss"}
Show, rather than redirect, the dpop_jkt error of a client no operator provisioned invalid_request.malformed_dpop_jkt_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client prompt=create needs the openid scope invalid_request.create_without_openid	302 · headers: {"Location":"redirect_uri with error=invalid_request, error_description=prompt=create requires the openid scope, state when the request had one, and iss"}
Show, rather than redirect, the openid error of a client no operator provisioned invalid_request.create_without_openid_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client the realm offers no sign-up invalid_request.registration_not_offered	302 · headers: {"Location":"redirect_uri with error=invalid_request, error_description=prompt=create is not supported, state when the request had one, and iss"}
Show, rather than redirect, the sign-up refusal of a client no operator provisioned invalid_request.registration_not_offered_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client it may not register accounts unauthorized_client.registration_not_allowed	302 · headers: {"Location":"redirect_uri with error=unauthorized_client, error_description=the client may not register accounts, state when the request had one, and iss"}
Show, rather than redirect, the registration refusal of a client no operator provisioned unauthorized_client.registration_not_allowed_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client prompt=create takes no max_age invalid_request.create_with_max_age	302 · headers: {"Location":"redirect_uri with error=invalid_request, error_description=prompt=create cannot be combined with max_age, state when the request had one, and iss"}
Show, rather than redirect, the max_age error of a client no operator provisioned invalid_request.create_with_max_age_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client prompt=none found no session login_required.no_session	302 · headers: {"Location":"redirect_uri with error=login_required, error_description=authentication is required but prompt=none was requested, state when the request had one, and iss","Set-Cookie":"__Host-qauth_session cleared (Max-Age=0), when the request carried a cookie of no usable session"}
Show, rather than redirect, the login_required of a client no operator provisioned login_required.no_session_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client an agent scope is above its cap invalid_scope.agent_scope_mode_exceeded	302 · headers: {"Location":"redirect_uri with error=invalid_scope, error_description=requested scope exceeds the agent scope mode for this client, state when the request had one, and iss"}
Show, rather than redirect, the agent-cap error of a client no operator provisioned invalid_scope.agent_scope_mode_exceeded_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client it named a QAuth API audience it does not list invalid_target.unlisted_reserved_audience	302 · headers: {"Location":"redirect_uri with error=invalid_target, error_description=a QAuth API audience is issued only to a client that lists it, state when the request had one, and iss"}
Show, rather than redirect, the audience error of a client no operator provisioned invalid_target.unlisted_reserved_audience_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client prompt=none cannot give the fresh sign-in the request needs login_required.fresh_login	302 · headers: {"Location":"redirect_uri with error=login_required, error_description=user interaction is required but prompt=none was requested, state when the request had one, and iss"}
Show, rather than redirect, that error for a client no operator provisioned login_required.fresh_login_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client prompt=none cannot ask for the consent the request needs consent_required.prompt_none	302 · headers: {"Location":"redirect_uri with error=consent_required, error_description=user interaction is required but prompt=none was requested, state when the request had one, and iss"}
Show, rather than redirect, that error for a client no operator provisioned consent_required.prompt_none_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client under prompt=none that the session ended under the request login_required.session_ended	302 · headers: {"Location":"redirect_uri with error=login_required, error_description=authentication is required but prompt=none was requested, state when the request had one, and iss"}
Show, rather than redirect, that error for a client no operator provisioned login_required.session_ended_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client under prompt=none that the consent was revoked under the request consent_required.consent_withdrawn	302 · headers: {"Location":"redirect_uri with error=consent_required, error_description=user interaction is required but prompt=none was requested, state when the request had one, and iss"}
Show, rather than redirect, that error for a client no operator provisioned consent_required.consent_withdrawn_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client the consent step cannot show its scopes invalid_scope.consent_not_shown	302 · headers: {"Location":"redirect_uri with error=invalid_scope, error_description=the requested scopes cannot be shown for consent, state when the request had one, and iss"}
Show, rather than redirect, that error for a client no operator provisioned invalid_scope.consent_not_shown_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Tell the client the consent step cannot show its resources invalid_target.consent_not_shown	302 · headers: {"Location":"redirect_uri with error=invalid_target, error_description=the requested resources cannot be shown for consent, state when the request had one, and iss"}
Show, rather than redirect, that error for a client no operator provisioned invalid_target.consent_not_shown_shown	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: a page titled "Sign-in not completed" that names the error with its description and the host of redirect_uri, and, for an http(s) redirect URI, a link "Continue to <host>" carrying the whole error response
Refuse parameters the schema does not accept invalid_request.schema	400 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"invalid_request","error_description":"the fields the schema refused, each with its message"}
Refuse a client_id that names no client invalid_request.unknown_client	400 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"invalid_request","error_description":"client_id does not name a client of this realm"}
Refuse a redirect URI the client did not register invalid_request.redirect_uri_not_registered	400 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"invalid_request","error_description":"redirect_uri not registered"}
Refuse a redirect URI no environment permits invalid_request.redirect_uri_not_permitted	400 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"invalid_request","error_description":"redirect_uri not permitted for this environment"}
Refuse a disabled or suspended client unauthorized_client.disabled	400 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"unauthorized_client","error_description":"client is disabled"}
Refuse a client not registered for the authorization_code grant unauthorized_client.grant_type	400 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"unauthorized_client","error_description":"client is not registered for the authorization_code grant"}
Refuse a client not registered for the code response type unauthorized_client.response_type	400 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"unauthorized_client","error_description":"client is not registered for the code response type"}
Refuse a request too large to hold through the sign-in or the consent invalid_request.authorization_too_large	400 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"invalid_request","error_description":"authorization request is too large"}
Refuse a host this server does not answer for here misdirected_request.host	421 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"invalid_request","error_description":"This server does not answer for the requested host"}
Refuse an address over the authorize limit too_many_requests.authorize_limit	429 · headers: {"Content-Type":"application/json; charset=utf-8","Retry-After":"the seconds until the window ends"} · body: {"error":"temporarily_unavailable","error_description":"the rate limiter's message, which says when to retry"}
Fail a request whose session cookie cannot be decoded server_error.malformed_cookie	500 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"server_error"}
Fail the request when the database fails at the mint server_error.store	500 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"server_error"}
Fail the request when the interaction store fails server_error.interaction_store	500 · headers: {"Content-Type":"application/json; charset=utf-8"} · body: {"error":"server_error"}

How it decides what happens next

Find the realm of the host

#	If	Then
1	the host names no enabled realm with an issuer, or is one of its endpoint hosts	Refuse a host this server does not answer for here
2	the request has its realm	Count the request against the authorize limit

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`hostUnknown`	`misdirected_request.host`	23040 of 253440
2	otherwise	`rateLimiting`	230400 of 253440

hostUnknown: gate == 'unknownHost'

Count the request against the authorize limit

#	If	Then
1	the address has used up its requests	Refuse an address over the authorize limit
2	the address is under its limit	Check the parameters against the authorize schema

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`rateLimited`	`too_many_requests.authorize_limit`	23040 of 230400
2	otherwise	`validatingParameters`	207360 of 230400

rateLimited: gate == 'rateLimited'

Check the parameters against the authorize schema

#	If	Then
1	the parameters do not match the schema	Refuse parameters the schema does not accept
2	the parameters match the schema	Find the client

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`inputInvalid`	`invalid_request.schema`	23040 of 207360
2	otherwise	`resolvingClient`	184320 of 207360

inputInvalid: gate == 'invalidInput'

Find the client

#	If	Then
1	the client_id names no client of the realm	Refuse a client_id that names no client
2	the client is found	Check the redirect URI against the client's registration

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`clientUnknown`	`invalid_request.unknown_client`	23040 of 184320
2	otherwise	`checkingRedirectUri`	161280 of 184320

clientUnknown: gate == 'unknownClient'

Check the redirect URI against the client's registration

#	If	Then
1	redirect_uri is not registered for the client	Refuse a redirect URI the client did not register
2	redirect_uri is registered	Check the redirect URI against the environment policy

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`redirectUnregistered`	`invalid_request.redirect_uri_not_registered`	23040 of 161280
2	otherwise	`checkingEnvironment`	138240 of 161280

redirectUnregistered: gate == 'unregisteredRedirect'

Check the redirect URI against the environment policy

#	If	Then
1	no environment permits that redirect_uri	Refuse a redirect URI no environment permits
2	the environment permits the redirect URI	Check that the client may use the endpoint

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`redirectNotPermitted`	`invalid_request.redirect_uri_not_permitted`	23040 of 138240
2	otherwise	`checkingClientGrant`	115200 of 138240

redirectNotPermitted: gate == 'unpermittedRedirect'

Check that the client may use the endpoint

#	If	Then
1	the client is disabled or suspended	Refuse a disabled or suspended client
2	the client is not registered for the authorization_code grant	Refuse a client not registered for the authorization_code grant
3	the client is not registered for the code response type	Refuse a client not registered for the code response type
4	the client may use the endpoint	Read the DPoP key the code is to be bound to

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`clientDisabled`	`unauthorized_client.disabled`	23040 of 115200
2	`noCodeGrant`	`unauthorized_client.grant_type`	23040 of 115200
3	`noCodeResponse`	`unauthorized_client.response_type`	23040 of 115200
4	otherwise	`readingDpopKey`	46080 of 115200

clientDisabled: gate == 'disabledClient'
noCodeGrant: gate == 'noCodeGrant'
noCodeResponse: gate == 'noCodeResponse'

Read the DPoP key the code is to be bound to

#	If	Then
1	dpop_jkt is not one thumbprint, for a client an operator provisioned	Tell the client its dpop_jkt is malformed
2	dpop_jkt is not one thumbprint, for a client no operator provisioned	Show, rather than redirect, the dpop_jkt error of a client no operator provisioned
3	dpop_jkt is absent, unread or well formed	Check a request for a registration

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`dpopJktMalformed and operatorClient`	`invalid_request.malformed_dpop_jkt`	11520 of 46080
2	`dpopJktMalformed`	`invalid_request.malformed_dpop_jkt_shown`	11520 of 46080
3	otherwise	`checkingCreatePrompt`	23040 of 46080

dpopJktMalformed: gate == 'malformedDpopJkt'
operatorClient: provisioning == 'operator'

Check a request for a registration

#	If	Then
1	the request carries no prompt=create	Find the browser session
2	prompt=create without openid, for a client an operator provisioned	Tell the client prompt=create needs the openid scope
3	prompt=create without openid, for a client no operator provisioned	Show, rather than redirect, the openid error of a client no operator provisioned
4	the realm offers no sign-up, for a client an operator provisioned	Tell the client the realm offers no sign-up
5	the realm offers no sign-up, for a client no operator provisioned	Show, rather than redirect, the sign-up refusal of a client no operator provisioned
6	the client may not register accounts, for a client an operator provisioned	Tell the client it may not register accounts
7	the client may not register accounts, for a client no operator provisioned	Show, rather than redirect, the registration refusal of a client no operator provisioned
8	prompt=create with max_age, for a client an operator provisioned	Tell the client prompt=create takes no max_age
9	prompt=create with max_age, for a client no operator provisioned	Show, rather than redirect, the max_age error of a client no operator provisioned
10	the session cookie cannot be decoded	Fail a request whose session cookie cannot be decoded
11	the registration is allowed	Start a registration interaction

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`create == 'absent' or silent`	`findingSession`	13440 of 23040
2	`create == 'withoutOpenid' and operatorClient`	`invalid_request.create_without_openid`	960 of 23040
3	`create == 'withoutOpenid'`	`invalid_request.create_without_openid_shown`	960 of 23040
4	`(create == 'notOffered' or pages) and operatorClient`	`invalid_request.registration_not_offered`	2400 of 23040
5	`create == 'notOffered' or pages`	`invalid_request.registration_not_offered_shown`	2400 of 23040
6	`create == 'clientNotAllowed' and operatorClient`	`unauthorized_client.registration_not_allowed`	480 of 23040
7	`create == 'clientNotAllowed'`	`unauthorized_client.registration_not_allowed_shown`	480 of 23040
8	`create == 'withMaxAge' and operatorClient`	`invalid_request.create_with_max_age`	480 of 23040
9	`create == 'withMaxAge'`	`invalid_request.create_with_max_age_shown`	480 of 23040
10	`cookieMalformed`	`server_error.malformed_cookie`	240 of 23040
11	otherwise	`startingRegistration`	720 of 23040

operatorClient: provisioning == 'operator'
cookieMalformed: session == 'malformedCookie'
silent: promptNone
pages: mode == 'pages'

Find the browser session

#	If	Then
1	the session cookie cannot be decoded	Fail a request whose session cookie cannot be decoded
2	no usable session under prompt=none, for a client an operator provisioned; step_up.required is recorded	Tell the client prompt=none found no session
3	no usable session under prompt=none, for a client no operator provisioned	Show, rather than redirect, the login_required of a client no operator provisioned
4	no usable session: the person signs in first, and the request is decided again with that session	Send the person to sign in
5	the session is live	Refuse an agent scope above the client's cap

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`cookieMalformed`	`server_error.malformed_cookie`	3360 of 13440
2	`(noSession or unusableSession) and silent and operatorClient`	`login_required.no_session`	2880 of 13440
3	`(noSession or unusableSession) and silent`	`login_required.no_session_shown`	2880 of 13440
4	`noSession or unusableSession`	`signInNeeded`	960 of 13440
5	otherwise	`checkingAgentCap`	3360 of 13440

operatorClient: provisioning == 'operator'
cookieMalformed: session == 'malformedCookie'
noSession: session == 'none'
unusableSession: session == 'unusable'
silent: promptNone

Refuse an agent scope above the client's cap

#	If	Then
1	an agent scope is above the cap, decided when the interaction finished	Tell the client an agent scope is above its cap, once the person signed in
2	an agent scope is above the cap, for a client an operator provisioned	Tell the client an agent scope is above its cap
3	an agent scope is above the cap, for a client no operator provisioned	Show, rather than redirect, the agent-cap error of a client no operator provisioned
4	no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds	Refuse a QAuth API audience the client does not list

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`overAgentCap and finishing`	`invalid_scope.agent_scope_mode_exceeded_after_sign_in`	32 of 3604
2	`overAgentCap and operatorClient`	`invalid_scope.agent_scope_mode_exceeded`	336 of 3604
3	`overAgentCap`	`invalid_scope.agent_scope_mode_exceeded_shown`	336 of 3604
4	otherwise	`checkingAudience`	2900 of 3604

operatorClient: provisioning == 'operator'
overAgentCap: refusal == 'overAgentCap'
finishing: phase == 'finish'

Refuse a QAuth API audience the client does not list

#	If	Then
1	a resource names a QAuth API audience the client does not list, decided when the interaction finished	Tell the client it named an audience it does not list, once the person signed in
2	a resource names a QAuth API audience the client does not list, for a client an operator provisioned	Tell the client it named a QAuth API audience it does not list
3	a resource names a QAuth API audience the client does not list, for a client no operator provisioned	Show, rather than redirect, the audience error of a client no operator provisioned
4	every QAuth API audience among the resources is one the client lists	Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`audienceUnlisted and finishing`	`invalid_target.unlisted_reserved_audience_after_sign_in`	32 of 2900
2	`audienceUnlisted and operatorClient`	`invalid_target.unlisted_reserved_audience`	336 of 2900
3	`audienceUnlisted`	`invalid_target.unlisted_reserved_audience_shown`	336 of 2900
4	otherwise	`decidingStepUp`	2196 of 2900

operatorClient: provisioning == 'operator'
audienceUnlisted: refusal == 'unlistedAudience'
finishing: phase == 'finish'

Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request

#	If	Then
1	prompt=none, and the sign-in is too old for what is asked, for a client an operator provisioned	Tell the client prompt=none cannot give the fresh sign-in the request needs
2	prompt=none, and the sign-in is too old for what is asked, for a client no operator provisioned	Show, rather than redirect, that error for a client no operator provisioned
3	prompt=none, and no consent covers the request, for a client an operator provisioned	Tell the client prompt=none cannot ask for the consent the request needs
4	prompt=none, and no consent covers the request, for a client no operator provisioned	Show, rather than redirect, that error for a client no operator provisioned
5	the sign-in is too old for what is asked: the person signs in again	Send the person to sign in
6	no consent covers the request: the person is asked	Send the person to consent
7	the sign-in is fresh enough and a consent covers the request	Mint the authorization code under the consent and the session

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`silent and needsFreshLogin and operatorClient`	`login_required.fresh_login`	432 of 2196
2	`silent and needsFreshLogin`	`login_required.fresh_login_shown`	432 of 2196
3	`silent and consentMissing and operatorClient`	`consent_required.prompt_none`	216 of 2196
4	`silent and consentMissing`	`consent_required.prompt_none_shown`	216 of 2196
5	`needsFreshLogin`	`signInNeeded`	180 of 2196
6	`consentMissing`	`consentNeeded`	126 of 2196
7	otherwise	`mintingCode`	594 of 2196

operatorClient: provisioning == 'operator'
silent: promptNone
needsFreshLogin: stepUp == 'freshLogin'
consentMissing: consent == 'missing'

Send the person to sign in

#	If	Then
1	the request is decided at the finish of an interaction: the next interaction continues it	Continue the request in a new sign-in interaction
2	INTERACTION_UI_ENABLED is off	Park the authorization request for the sign-in
3	INTERACTION_UI_ENABLED is on	Start a sign-in interaction

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`finishing`	`continuingToSignIn`	244 of 1420
2	`pages`	`parkingRequest`	588 of 1420
3	otherwise	`startingSignIn`	588 of 1420

pages: mode == 'pages'
finishing: phase == 'finish'

Send the person to consent

#	If	Then
1	INTERACTION_UI_ENABLED is off, and the consent was revoked under the request	Send the user whose consent was revoked under the request to the consent page
2	INTERACTION_UI_ENABLED is off	Send the signed-in user to the consent page
3	the consent step cannot show the scopes, decided when the interaction finished	Tell the client the consent step cannot show its scopes, once the person signed in
4	the consent step cannot show the resources, decided when the interaction finished	Tell the client the consent step cannot show its resources, once the person signed in
5	the consent step cannot show the scopes, for a client an operator provisioned	Tell the client the consent step cannot show its scopes
6	the consent step cannot show the scopes, for a client no operator provisioned	Show, rather than redirect, that error for a client no operator provisioned
7	the consent step cannot show the resources, for a client an operator provisioned	Tell the client the consent step cannot show its resources
8	the consent step cannot show the resources, for a client no operator provisioned	Show, rather than redirect, that error for a client no operator provisioned
9	the consent step can show the request, which an interaction just finished: the next one continues it	Continue the request in a consent interaction
10	the consent step can show the request	Start a consent interaction

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`pages and consentCause == 'withdrawn'`	`consent_screen.consent_withdrawn`	36 of 288
2	`pages`	`consent_screen.page`	36 of 288
3	`scopesUnshowable and finishing`	`invalid_scope.consent_not_shown_after_sign_in`	48 of 288
4	`resourcesUnshowable and finishing`	`invalid_target.consent_not_shown_after_sign_in`	48 of 288
5	`scopesUnshowable and operatorClient`	`invalid_scope.consent_not_shown`	12 of 288
6	`scopesUnshowable`	`invalid_scope.consent_not_shown_shown`	12 of 288
7	`resourcesUnshowable and operatorClient`	`invalid_target.consent_not_shown`	12 of 288
8	`resourcesUnshowable`	`invalid_target.consent_not_shown_shown`	12 of 288
9	`finishing`	`continuingToConsent`	48 of 288
10	otherwise	`startingConsent`	24 of 288

operatorClient: provisioning == 'operator'
scopesUnshowable: refusal == 'unshowableScopes'
resourcesUnshowable: refusal == 'unshowableResources'
pages: mode == 'pages'
finishing: phase == 'finish'

Check the request again before the cancel goes to the client

#	If	Then
1	the client, or its redirect URI, no longer passes	Refuse a finish or a cancel whose client or redirect URI no longer passes
2	the client may no longer use the endpoint	Refuse a finish or a cancel whose client may no longer use the endpoint
3	the request still passes	Tell the client the person cancelled

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`since == 'clientGone'`	`invalid_request.client_changed`	444 of 1624
2	`since == 'clientUnusable'`	`unauthorized_client.client_changed`	444 of 1624
3	otherwise	`access_denied.cancelled`	736 of 1624

Check the request again, as the endpoint checks it

#	If	Then
1	the client, or its redirect URI, no longer passes	Refuse a finish or a cancel whose client or redirect URI no longer passes
2	the client may no longer use the endpoint	Refuse a finish or a cancel whose client may no longer use the endpoint
3	the request still passes	Find the session the interaction holds

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`since == 'clientGone'`	`invalid_request.client_changed`	356 of 1240
2	`since == 'clientUnusable'`	`unauthorized_client.client_changed`	356 of 1240
3	otherwise	`findingTransactionSession`	528 of 1240

Find the session the interaction holds

#	If	Then
1	the session is no longer usable: the request needs a sign-in again	Send the person to sign in
2	the session is live: the request is decided again for it	Refuse an agent scope above the client's cap

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`finishSession == 'unusable'`	`signInNeeded`	284 of 528
2	otherwise	`checkingAgentCap`	244 of 528

Every way it can end

It ends with	When	What happens
Send the authorization code to the client redirect with code + state + iss	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: the code is stored
Send the authorization code to the client once the interaction finished redirect with code + state + iss	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: the interaction is over Check the request again, as the endpoint checks it: the request still passes Find the session the interaction holds: the session is live: the request is decided again for it Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: the code is stored, for the request whose interaction finished
Send a browser with no session to sign in no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries no session cookie, or one that names a cookie key this process has not read yet and may not read again yet (#493), which is left for the next request, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: no usable session: the person signs in first, and the request is decided again with that session Send the person to sign in: INTERACTION_UI_ENABLED is off Park the authorization request for the sign-in: the request is parked, for a request with no session
Send a browser whose session cookie is of no use to sign in no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the cookie does not verify with the realm's cookie keys, or its session has ended or expired, or its user has been deleted or disabled, or was disabled after the session began; the cookie is cleared, and a disabled user's session is ended, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: no usable session: the person signs in first, and the request is decided again with that session Send the person to sign in: INTERACTION_UI_ENABLED is off Park the authorization request for the sign-in: the request is parked, for a cookie of no usable session
Send a browser whose sign-in is too old for the request to sign in again no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, prompt=login, a dangerous scope (write:*, agent:admin, agent:exec) outside development, or a native_backend client asks for a sign-in within the last two minutes and it is older; or max_age asks for one within that many whole seconds and it is older, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is too old for what is asked: the person signs in again Send the person to sign in: INTERACTION_UI_ENABLED is off Park the authorization request for the sign-in: the request is parked, for a step-up
Send a browser whose session ended under the request to sign in again no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: it fails, because the session ended under the request: the person signs in again Send the person to sign in: INTERACTION_UI_ENABLED is off Park the authorization request for the sign-in: the request is parked, for a session that ended under it
Send the signed-in user to the consent page no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: no consent covers the request: the person is asked Send the person to consent: INTERACTION_UI_ENABLED is off
Send the user whose consent was revoked under the request to the consent page no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: it fails, because the consent was revoked under the request: the person is asked again Send the person to consent: INTERACTION_UI_ENABLED is off, and the consent was revoked under the request
Tell the client the person cancelled redirect, error=access_denied	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the person cancels, with the CSRF value of the step they see; the interaction ends Check the request again before the cancel goes to the client: the request still passes
Leave the answer to the consent step's graph ends here	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: no consent covers the request: the person is asked Send the person to consent: the consent step can show the request Start a consent interaction: the interaction is stored The person is asked for consent at the ceremony page: the person answers the consent step
Refuse a request for an interaction that already finished no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: an answer, a cancel or a read names an interaction of this request that already finished, such as a replayed or a second form post
Refuse a finish the expiry sweep beat no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: it fails, because the expiry sweep claimed the interaction first
Refuse a finish whose session ended since no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: it fails, because the session the sign-in started has ended since, such as by a sign-out in another tab
Refuse a finish or a cancel whose client or redirect URI no longer passes no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, by the finish or the cancel, client_id names no client any more, or its redirect URI was removed or is no longer permitted, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the person cancels, with the CSRF value of the step they see; the interaction ends Check the request again before the cancel goes to the client: the client, or its redirect URI, no longer passes
Refuse a finish or a cancel whose client may no longer use the endpoint no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, by the finish or the cancel, the client was disabled or suspended, or lost the authorization_code grant or the code response type, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the person cancels, with the CSRF value of the step they see; the interaction ends Check the request again before the cancel goes to the client: the client may no longer use the endpoint
Refuse a next interaction too large to hold no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, it ended, or its account was disabled, between the interaction's finish and the decision: the request needs a sign-in again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: the interaction is over Check the request again, as the endpoint checks it: the request still passes Find the session the interaction holds: the session is no longer usable: the request needs a sign-in again Send the person to sign in: the request is decided at the finish of an interaction: the next interaction continues it Continue the request in a new sign-in interaction: it fails, because the record of the next interaction is over 32 KiB
Fail the answer when the interaction store fails no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: it fails, because the interaction store fails; the turn is given back
Fail the answer when the database fails at the mint no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: the interaction is over Check the request again, as the endpoint checks it: the request still passes Find the session the interaction holds: the session is live: the request is decided again for it Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: it fails, because the database fails, when the interaction finished
Tell the client an agent scope is above its cap, once the person signed in redirect, error=invalid_scope	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, the scope parameter names an agent:* scope above the client's agent mode cap (any agent:* scope for a client that is no agent or has no cap), it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: the interaction is over Check the request again, as the endpoint checks it: the request still passes Find the session the interaction holds: the session is live: the request is decided again for it Refuse an agent scope above the client's cap: an agent scope is above the cap, decided when the interaction finished
Tell the client it named an audience it does not list, once the person signed in redirect, error=invalid_target	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, a resource indicator names a QAuth API audience (urn:qauth:aud:) the client does not list, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: the interaction is over Check the request again, as the endpoint checks it: the request still passes Find the session the interaction holds: the session is live: the request is decided again for it Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: a resource names a QAuth API audience the client does not list, decided when the interaction finished
Tell the client the consent step cannot show its scopes, once the person signed in redirect, error=invalid_scope	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, the consent step cannot show the scopes: more than 64, or one outside its alphabet (RFC 6749 §3.3 without < and >) or over 128 characters; read only when an interaction asks for consent, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: the interaction is over Check the request again, as the endpoint checks it: the request still passes Find the session the interaction holds: the session is live: the request is decided again for it Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: no consent covers the request: the person is asked Send the person to consent: the consent step cannot show the scopes, decided when the interaction finished
Tell the client the consent step cannot show its resources, once the person signed in redirect, error=invalid_target	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, the consent step cannot show the resources: more than 16, or one over 2048 characters; read only when an interaction asks for consent, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: the interaction is stored The person registers at the ceremony page: the new password creates the account, which finishes the interaction End the interaction before anything is issued: the interaction is over Check the request again, as the endpoint checks it: the request still passes Find the session the interaction holds: the session is live: the request is decided again for it Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: no consent covers the request: the person is asked Send the person to consent: the consent step cannot show the resources, decided when the interaction finished
Tell the client its dpop_jkt is malformed redirect, error=invalid_request	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, DPoP is on and dpop_jkt is not one base64url SHA-256 thumbprint, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is not one thumbprint, for a client an operator provisioned
Show, rather than redirect, the dpop_jkt error of a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, DPoP is on and dpop_jkt is not one base64url SHA-256 thumbprint, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is not one thumbprint, for a client no operator provisioned
Tell the client prompt=create needs the openid scope redirect, error=invalid_request	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create without the openid scope, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: prompt=create without openid, for a client an operator provisioned
Show, rather than redirect, the openid error of a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create without the openid scope, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: prompt=create without openid, for a client no operator provisioned
Tell the client the realm offers no sign-up redirect, error=invalid_request	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid, and the realm's accounts.allowSignUp is off, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the realm offers no sign-up, for a client an operator provisioned
Show, rather than redirect, the sign-up refusal of a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid, and the realm's accounts.allowSignUp is off, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the realm offers no sign-up, for a client no operator provisioned
Tell the client it may not register accounts redirect, error=unauthorized_client	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid, the realm allows sign-up, and the client's operator-set hosted_flows do not name register, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the client may not register accounts, for a client an operator provisioned
Show, rather than redirect, the registration refusal of a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid, the realm allows sign-up, and the client's operator-set hosted_flows do not name register, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the client may not register accounts, for a client no operator provisioned
Tell the client prompt=create takes no max_age redirect, error=invalid_request	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: prompt=create with max_age, for a client an operator provisioned
Show, rather than redirect, the max_age error of a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: prompt=create with max_age, for a client no operator provisioned
Tell the client prompt=none found no session redirect, error=login_required	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries no session cookie, or one that names a cookie key this process has not read yet and may not read again yet (#493), which is left for the next request, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: no usable session under prompt=none, for a client an operator provisioned; step_up.required is recorded
Show, rather than redirect, the login_required of a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries no session cookie, or one that names a cookie key this process has not read yet and may not read again yet (#493), which is left for the next request, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: no usable session under prompt=none, for a client no operator provisioned
Tell the client an agent scope is above its cap redirect, error=invalid_scope	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, the scope parameter names an agent:* scope above the client's agent mode cap (any agent:* scope for a client that is no agent or has no cap), it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: an agent scope is above the cap, for a client an operator provisioned
Show, rather than redirect, the agent-cap error of a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, the scope parameter names an agent:* scope above the client's agent mode cap (any agent:* scope for a client that is no agent or has no cap), it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: an agent scope is above the cap, for a client no operator provisioned
Tell the client it named a QAuth API audience it does not list redirect, error=invalid_target	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, a resource indicator names a QAuth API audience (urn:qauth:aud:) the client does not list, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: a resource names a QAuth API audience the client does not list, for a client an operator provisioned
Show, rather than redirect, the audience error of a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, a resource indicator names a QAuth API audience (urn:qauth:aud:) the client does not list, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: a resource names a QAuth API audience the client does not list, for a client no operator provisioned
Tell the client prompt=none cannot give the fresh sign-in the request needs redirect, error=login_required	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, prompt=login, a dangerous scope (write:*, agent:admin, agent:exec) outside development, or a native_backend client asks for a sign-in within the last two minutes and it is older; or max_age asks for one within that many whole seconds and it is older, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: prompt=none, and the sign-in is too old for what is asked, for a client an operator provisioned
Show, rather than redirect, that error for a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, prompt=login, a dangerous scope (write:*, agent:admin, agent:exec) outside development, or a native_backend client asks for a sign-in within the last two minutes and it is older; or max_age asks for one within that many whole seconds and it is older, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: prompt=none, and the sign-in is too old for what is asked, for a client no operator provisioned
Tell the client prompt=none cannot ask for the consent the request needs redirect, error=consent_required	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: prompt=none, and no consent covers the request, for a client an operator provisioned
Show, rather than redirect, that error for a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: prompt=none, and no consent covers the request, for a client no operator provisioned
Tell the client under prompt=none that the session ended under the request redirect, error=login_required	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: it fails, because the session ended under the request, under prompt=none, for a client an operator provisioned
Show, rather than redirect, that error for a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: it fails, because the session ended under the request, under prompt=none, for a client no operator provisioned
Tell the client under prompt=none that the consent was revoked under the request redirect, error=consent_required	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: it fails, because the consent was revoked under the request, under prompt=none, for a client an operator provisioned
Show, rather than redirect, that error for a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, the request carries prompt=none: no page may be shown, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: it fails, because the consent was revoked under the request, under prompt=none, for a client no operator provisioned
Tell the client the consent step cannot show its scopes redirect, error=invalid_scope	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, the consent step cannot show the scopes: more than 64, or one outside its alphabet (RFC 6749 §3.3 without < and >) or over 128 characters; read only when an interaction asks for consent, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: no consent covers the request: the person is asked Send the person to consent: the consent step cannot show the scopes, for a client an operator provisioned
Show, rather than redirect, that error for a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, the consent step cannot show the scopes: more than 64, or one outside its alphabet (RFC 6749 §3.3 without < and >) or over 128 characters; read only when an interaction asks for consent, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: no consent covers the request: the person is asked Send the person to consent: the consent step cannot show the scopes, for a client no operator provisioned
Tell the client the consent step cannot show its resources redirect, error=invalid_target	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, the consent step cannot show the resources: more than 16, or one over 2048 characters; read only when an interaction asks for consent, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: no consent covers the request: the person is asked Send the person to consent: the consent step cannot show the resources, for a client an operator provisioned
Show, rather than redirect, that error for a client no operator provisioned no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, the client registered itself: open registration, CIMD or a developer account, the request carries the cookie of a live browser session of an enabled user, the consent step cannot show the resources: more than 16, or one over 2048 characters; read only when an interaction asks for consent, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, no stored consent covers the request, prompt=consent asks for the screen, the request widens a prior grant, or the client is an AI agent, which never skips the screen (ADR-015 Decision 11), the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: no consent covers the request: the person is asked Send the person to consent: the consent step cannot show the resources, for a client no operator provisioned
Refuse parameters the schema does not accept no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the query (GET) or the form (POST) does not pass authorizeQuerySchema: a missing or malformed code_challenge, a code_challenge_method other than S256, a response_type other than code, a state or nonce over 2048 characters, a login_hint over 254 bytes, a resource that is not an absolute URI, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters do not match the schema
Refuse a client_id that names no client no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, client_id names no client of the realm, or a CIMD document that does not resolve, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client_id names no client of the realm
Refuse a redirect URI the client did not register no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, redirect_uri is none of the client's (a loopback URI may differ only in its port), an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is not registered for the client
Refuse a redirect URI no environment permits no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, redirect_uri is the client's, but no environment permits it: a scheme outside the allowed ones, plain http to a host that is not loopback, or http to localhost outside development, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: no environment permits that redirect_uri
Refuse a disabled or suspended client no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the client is disabled or suspended, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client is disabled or suspended
Refuse a client not registered for the authorization_code grant no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the client is not registered for the authorization_code grant, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client is not registered for the authorization_code grant
Refuse a client not registered for the code response type no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the client is not registered for the code response type, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client is not registered for the code response type
Refuse a request too large to hold through the sign-in or the consent no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: it fails, because the request is over 16 KiB, or the record over 32 KiB
Refuse a host this server does not answer for here no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host names no realm, a disabled realm or a realm with no issuer, or it is one of the realm's endpoint hosts, which serve no browser route, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the host names no enabled realm with an issuer, or is one of its endpoint hosts
Refuse an address over the authorize limit no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the address has used up its AUTHORIZE_RATE_LIMIT requests for the window, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address has used up its requests
Fail a request whose session cookie cannot be decoded no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the session cookie's value is not valid percent-encoding, such as %zz, which the cookie reader decodes without a catch, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the session cookie cannot be decoded
Fail the request when the database fails at the mint no redirect, page shown	INTERACTION_UI_ENABLED is off, the default: the sign-in and the consent are the server-rendered pages, the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, the request carries no prompt=create, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the request carries no prompt=create Find the browser session: the session is live Refuse an agent scope above the client's cap: no agent scope is above the cap; the scopes are the requested ones the client's allowlist holds Refuse a QAuth API audience the client does not list: every QAuth API audience among the resources is one the client lists Read the consent, and decide whether the sign-in is fresh enough and the consent covers the request: the sign-in is fresh enough and a consent covers the request Mint the authorization code under the consent and the session: it fails, because the database fails
Fail the request when the interaction store fails no redirect, page shown	INTERACTION_UI_ENABLED is on: the sign-in and the consent are interactions (#628), the host is the primary host of an enabled realm, the address is under its limit, the parameters pass the route schema, and the client, its redirect URI, its grant and response type and dpop_jkt all pass, an operator provisioned the client (provisioned_by_operator): the system client or the seed manifest, the request carries the cookie of a live browser session of an enabled user, nothing in the request is refused after the session, it carries no prompt, or prompt=login, prompt=consent or prompt=create, prompt=create with openid and no max_age, the realm and the client allowing sign-up, nothing asks for a fresh sign-in, or the sign-in is fresh enough for what asks, a stored consent covers every requested scope at each requested resource, or the client's administrative consent does (ADR-017 Decision 9), and nothing asks for the screen, the client and its redirect URI still pass when the interaction finishes or is cancelled, the session the interaction holds is live and its account may use it, when the request is decided again	Wait for an authorization request: GET /oauth/authorize arrives with its parameters in the query, or POST with them in a form Find the realm of the host: the request has its realm Count the request against the authorize limit: the address is under its limit Check the parameters against the authorize schema: the parameters match the schema Find the client: the client is found Check the redirect URI against the client's registration: redirect_uri is registered Check the redirect URI against the environment policy: the environment permits the redirect URI Check that the client may use the endpoint: the client may use the endpoint Read the DPoP key the code is to be bound to: dpop_jkt is absent, unread or well formed Check a request for a registration: the registration is allowed Start a registration interaction: it fails, because the interaction store fails

Each row is also a generated test: set the starting situation, send the events, expect the ending.

What is guaranteed

These hold in all 2162908 situations the model can reach, from 253440 different starting situations.

An interaction is created only for a request whose client, redirect URI, PKCE parameters and dpop_jkt passed every check: a request that fails them never reaches the interaction store
With INTERACTION_UI_ENABLED off, no interaction is created: the request takes the pages it takes today
With INTERACTION_UI_ENABLED on, no URL carries the authorization request: nothing is parked behind /ui/login, and no redirect to /ui/consent carries the parameters
A request with prompt=none starts no interaction and is sent to no page, in either mode
A code is minted only once the interaction has ended: never while it can still be answered, so a finish that the expiry sweep beat, or a replayed answer, issues none
A code is minted only under a stored or administrative consent that covers the request
No code is minted on a sign-in older than what the request or its scopes ask for
No code is minted above the agent cap, for an audience the client does not list, or for a client that no longer passes the checks when its interaction finishes
Before the person has seen any QAuth page, an error goes by redirect only to a client an operator provisioned (RFC 9700 §4.11.2)
The request is decided at a finish only for an interaction this request started
A registration starts only for prompt=create with openid and no max_age, while the realm and the client both allow sign-up

Exact rules

Id	Never
`interaction-only-for-a-checked-request`	`interactionStarted and gate != 'open'`
`pages-start-no-interaction`	`interactionStarted and pages`
`interactions-park-nothing`	`state in ['parkingRequest', 'consent_screen.page', 'consent_screen.consent_withdrawn'] and not pages`
`prompt-none-shows-nothing`	`silent and (interactionStarted or state in ['parkingRequest', 'consent_screen.page', 'consent_screen.consent_withdrawn', 'atSignInCeremony', 'atConsentCeremony'])`
`no-code-while-an-interaction-is-open`	`codeMinted and interactionOpen`
`no-code-without-consent`	`codeMinted and consentMissing`
`no-code-on-a-stale-sign-in`	`codeMinted and needsFreshLogin`
`no-code-for-a-refused-request`	`codeMinted and (overAgentCap or audienceUnlisted or (finishing and since != 'unchanged'))`
`shown-not-redirected-before-any-page`	provisioning == 'selfService' and state in ['invalid_request.malformed_dpop_jkt', 'login_required.no_session', 'invalid_request.create_without_openid', 'invalid_request.registration_not_offered', 'unauthorized_client.registration_not_allowed', 'invalid_request.create_with_max_age', 'invalid_scope.agent_scope_mode_exceeded', 'invalid_target.unlisted_reserved_audience', 'login_required.fresh_login', 'consent_required.prompt_none', 'login_required.session_ended', 'consent_required.consent_withdrawn', 'invalid_scope.consent_not_shown', 'invalid_target.consent_not_shown']
`a-finish-only-from-an-interaction`	`phase == 'finish' and not interactionStarted`
`registration-only-when-allowed`	`state in ['startingRegistration', 'atRegistrationCeremony'] and create != 'allowed'`

Reference

All transitions (113)

From	Event	Guard	To	Effects	Taken
`idle`	`AUTHORIZE`		`resolvingRealm`		yes
`idle`	`REPLAY`		`interaction_expired.finished`		yes
`resolvingRealm`	`rule 1`	`hostUnknown`	`misdirected_request.host`		yes
`resolvingRealm`	`rule 2`		`rateLimiting`		yes
`rateLimiting`	`rule 1`	`rateLimited`	`too_many_requests.authorize_limit`		yes
`rateLimiting`	`rule 2`		`validatingParameters`		yes
`validatingParameters`	`rule 1`	`inputInvalid`	`invalid_request.schema`		yes
`validatingParameters`	`rule 2`		`resolvingClient`		yes
`resolvingClient`	`rule 1`	`clientUnknown`	`invalid_request.unknown_client`		yes
`resolvingClient`	`rule 2`		`checkingRedirectUri`		yes
`checkingRedirectUri`	`rule 1`	`redirectUnregistered`	`invalid_request.redirect_uri_not_registered`		yes
`checkingRedirectUri`	`rule 2`		`checkingEnvironment`		yes
`checkingEnvironment`	`rule 1`	`redirectNotPermitted`	`invalid_request.redirect_uri_not_permitted`		yes
`checkingEnvironment`	`rule 2`		`checkingClientGrant`		yes
`checkingClientGrant`	`rule 1`	`clientDisabled`	`unauthorized_client.disabled`		yes
`checkingClientGrant`	`rule 2`	`noCodeGrant`	`unauthorized_client.grant_type`		yes
`checkingClientGrant`	`rule 3`	`noCodeResponse`	`unauthorized_client.response_type`		yes
`checkingClientGrant`	`rule 4`		`readingDpopKey`		yes
`readingDpopKey`	`rule 1`	`dpopJktMalformed and operatorClient`	`invalid_request.malformed_dpop_jkt`		yes
`readingDpopKey`	`rule 2`	`dpopJktMalformed`	`invalid_request.malformed_dpop_jkt_shown`		yes
`readingDpopKey`	`rule 3`		`checkingCreatePrompt`		yes
`checkingCreatePrompt`	`rule 1`	`create == 'absent' or silent`	`findingSession`		yes
`checkingCreatePrompt`	`rule 2`	`create == 'withoutOpenid' and operatorClient`	`invalid_request.create_without_openid`		yes
`checkingCreatePrompt`	`rule 3`	`create == 'withoutOpenid'`	`invalid_request.create_without_openid_shown`		yes
`checkingCreatePrompt`	`rule 4`	`(create == 'notOffered' or pages) and operatorClient`	`invalid_request.registration_not_offered`		yes
`checkingCreatePrompt`	`rule 5`	`create == 'notOffered' or pages`	`invalid_request.registration_not_offered_shown`		yes
`checkingCreatePrompt`	`rule 6`	`create == 'clientNotAllowed' and operatorClient`	`unauthorized_client.registration_not_allowed`		yes
`checkingCreatePrompt`	`rule 7`	`create == 'clientNotAllowed'`	`unauthorized_client.registration_not_allowed_shown`		yes
`checkingCreatePrompt`	`rule 8`	`create == 'withMaxAge' and operatorClient`	`invalid_request.create_with_max_age`		yes
`checkingCreatePrompt`	`rule 9`	`create == 'withMaxAge'`	`invalid_request.create_with_max_age_shown`		yes
`checkingCreatePrompt`	`rule 10`	`cookieMalformed`	`server_error.malformed_cookie`		yes
`checkingCreatePrompt`	`rule 11`		`startingRegistration`		yes
`startingRegistration`	`DONE`		`atRegistrationCeremony`	`openInteraction`	yes
`startingRegistration`	`FAIL.tooLarge`		`invalid_request.authorization_too_large`		yes
`startingRegistration`	`FAIL.server`		`server_error.interaction_store`		yes
`atRegistrationCeremony`	`FINISH`		`takingFinish`	`finishRegistration`	yes
`atRegistrationCeremony`	`CANCEL`		`recheckingCancel`		yes
`findingSession`	`rule 1`	`cookieMalformed`	`server_error.malformed_cookie`		yes
`findingSession`	`rule 2`	`(noSession or unusableSession) and silent and operatorClient`	`login_required.no_session`		yes
`findingSession`	`rule 3`	`(noSession or unusableSession) and silent`	`login_required.no_session_shown`		yes
`findingSession`	`rule 4`	`noSession or unusableSession`	`signInNeeded`		yes
`findingSession`	`rule 5`		`checkingAgentCap`		yes
`checkingAgentCap`	`rule 1`	`overAgentCap and finishing`	`invalid_scope.agent_scope_mode_exceeded_after_sign_in`		yes
`checkingAgentCap`	`rule 2`	`overAgentCap and operatorClient`	`invalid_scope.agent_scope_mode_exceeded`		yes
`checkingAgentCap`	`rule 3`	`overAgentCap`	`invalid_scope.agent_scope_mode_exceeded_shown`		yes
`checkingAgentCap`	`rule 4`		`checkingAudience`		yes
`checkingAudience`	`rule 1`	`audienceUnlisted and finishing`	`invalid_target.unlisted_reserved_audience_after_sign_in`		yes
`checkingAudience`	`rule 2`	`audienceUnlisted and operatorClient`	`invalid_target.unlisted_reserved_audience`		yes
`checkingAudience`	`rule 3`	`audienceUnlisted`	`invalid_target.unlisted_reserved_audience_shown`		yes
`checkingAudience`	`rule 4`		`decidingStepUp`		yes
`decidingStepUp`	`rule 1`	`silent and needsFreshLogin and operatorClient`	`login_required.fresh_login`		yes
`decidingStepUp`	`rule 2`	`silent and needsFreshLogin`	`login_required.fresh_login_shown`		yes
`decidingStepUp`	`rule 3`	`silent and consentMissing and operatorClient`	`consent_required.prompt_none`		yes
`decidingStepUp`	`rule 4`	`silent and consentMissing`	`consent_required.prompt_none_shown`		yes
`decidingStepUp`	`rule 5`	`needsFreshLogin`	`signInNeeded`	`forFreshLogin`	yes
`decidingStepUp`	`rule 6`	`consentMissing`	`consentNeeded`		yes
`decidingStepUp`	`rule 7`		`mintingCode`		yes
`mintingCode`	`DONE`	`finishing`	`code_issued.after_sign_in`	`mintCode`	yes
`mintingCode`	`DONE`		`code_issued`	`mintCode`	yes
`mintingCode`	`FAIL.sessionEnded`	`silent and operatorClient`	`login_required.session_ended`		yes
`mintingCode`	`FAIL.sessionEnded`	`silent`	`login_required.session_ended_shown`		yes
`mintingCode`	`FAIL.sessionEnded`		`signInNeeded`	`forEndedSession`	yes
`mintingCode`	`FAIL.consentWithdrawn`	`silent and operatorClient`	`consent_required.consent_withdrawn`		yes
`mintingCode`	`FAIL.consentWithdrawn`	`silent`	`consent_required.consent_withdrawn_shown`		yes
`mintingCode`	`FAIL.consentWithdrawn`		`consentNeeded`	`forWithdrawnConsent`	yes
`mintingCode`	`FAIL.server`	`finishing`	`server_error.store_after_sign_in`		yes
`mintingCode`	`FAIL.server`		`server_error.store`		yes
`signInNeeded`	`rule 1`	`finishing`	`continuingToSignIn`		yes
`signInNeeded`	`rule 2`	`pages`	`parkingRequest`		yes
`signInNeeded`	`rule 3`		`startingSignIn`		yes
`consentNeeded`	`rule 1`	`pages and consentCause == 'withdrawn'`	`consent_screen.consent_withdrawn`		yes
`consentNeeded`	`rule 2`	`pages`	`consent_screen.page`		yes
`consentNeeded`	`rule 3`	`scopesUnshowable and finishing`	`invalid_scope.consent_not_shown_after_sign_in`		yes
`consentNeeded`	`rule 4`	`resourcesUnshowable and finishing`	`invalid_target.consent_not_shown_after_sign_in`		yes
`consentNeeded`	`rule 5`	`scopesUnshowable and operatorClient`	`invalid_scope.consent_not_shown`		yes
`consentNeeded`	`rule 6`	`scopesUnshowable`	`invalid_scope.consent_not_shown_shown`		yes
`consentNeeded`	`rule 7`	`resourcesUnshowable and operatorClient`	`invalid_target.consent_not_shown`		yes
`consentNeeded`	`rule 8`	`resourcesUnshowable`	`invalid_target.consent_not_shown_shown`		yes
`consentNeeded`	`rule 9`	`finishing`	`continuingToConsent`		yes
`consentNeeded`	`rule 10`		`startingConsent`		yes
`parkingRequest`	`DONE`	`noSession`	`sign_in_required.no_session`		yes
`parkingRequest`	`DONE`	`unusableSession`	`sign_in_required.unusable_session`		yes
`parkingRequest`	`DONE`	`signInCause == 'sessionEnded'`	`sign_in_required.session_ended`		yes
`parkingRequest`	`DONE`		`sign_in_required.fresh_login`		yes
`parkingRequest`	`FAIL.tooLarge`		`invalid_request.authorization_too_large`		yes
`startingSignIn`	`DONE`		`atSignInCeremony`	`openInteraction`	yes
`startingSignIn`	`FAIL.tooLarge`		`invalid_request.authorization_too_large`		yes
`startingSignIn`	`FAIL.server`		`server_error.interaction_store`		yes
`startingConsent`	`DONE`		`atConsentCeremony`	`openInteraction`	yes
`startingConsent`	`FAIL.tooLarge`		`invalid_request.authorization_too_large`		yes
`startingConsent`	`FAIL.server`		`server_error.interaction_store`		yes
`atSignInCeremony`	`FINISH`		`takingFinish`	`finishInteraction`	yes
`atSignInCeremony`	`CANCEL`		`recheckingCancel`		yes
`atConsentCeremony`	`ANSWER`		`consent_step.answered`		yes
`atConsentCeremony`	`CANCEL`		`recheckingCancel`		yes
`recheckingCancel`	`rule 1`	`since == 'clientGone'`	`invalid_request.client_changed`		yes
`recheckingCancel`	`rule 2`	`since == 'clientUnusable'`	`unauthorized_client.client_changed`		yes
`recheckingCancel`	`rule 3`		`access_denied.cancelled`		yes
`takingFinish`	`DONE`		`recheckingRequest`		yes
`takingFinish`	`FAIL.expired`		`interaction_expired.finished_late`		yes
`takingFinish`	`FAIL.sessionEnded`		`interaction_expired.session_ended`		yes
`takingFinish`	`FAIL.server`		`server_error.interaction_store_after_sign_in`		yes
`recheckingRequest`	`rule 1`	`since == 'clientGone'`	`invalid_request.client_changed`		yes
`recheckingRequest`	`rule 2`	`since == 'clientUnusable'`	`unauthorized_client.client_changed`		yes
`recheckingRequest`	`rule 3`		`findingTransactionSession`		yes
`findingTransactionSession`	`rule 1`	`finishSession == 'unusable'`	`signInNeeded`	`forEndedSession`	yes
`findingTransactionSession`	`rule 2`		`checkingAgentCap`		yes
`continuingToSignIn`	`DONE`		`atSignInCeremony`	`openInteraction`	yes
`continuingToSignIn`	`FAIL.tooLarge`		`invalid_request.authorization_too_large_after_sign_in`		yes
`continuingToSignIn`	`FAIL.server`		`server_error.interaction_store_after_sign_in`		yes
`continuingToConsent`	`DONE`		`atConsentCeremony`	`openInteraction`	yes
`continuingToConsent`	`FAIL.tooLarge`		`invalid_request.authorization_too_large_after_sign_in`		yes
`continuingToConsent`	`FAIL.server`		`server_error.interaction_store_after_sign_in`		yes