{ "openapi": "3.1.0", "info": { "title": "QAuth Interaction API", "version": "v1-rc.0", "description": "The Interaction API is how a sign-in page reaches the QAuth engine (ADR-019 Decision 6). The reference ceremony app, and any UI that replaces it, reads the current step of an interaction, answers it and follows the result, until the interaction ends in a redirect. It shares its step grammar with the FiPA authorization challenge endpoint, the transport for first-party native apps (ADR-017 Decision 3): a step is the same object on both, and only the envelope differs.\n\nStatus: this document is the contract, published before the implementation. The auth server serves it today; the operations it describes arrive with the Interaction API implementation.\n\n## Rules\n\n- Browser-facing and same-origin. A page calls the API on the realm origin it was served from. A flow cookie (`__Host-qauth_flow`) and a CSRF value protect it, and the server sends no CORS headers.\n- Typed data from the auth server’s own records, never HTML. Every string a response carries is an enum, a constant or a bounded value with a pattern. A display value has no markup bracket, no control, format, private-use or unassigned character, no line separator, and no space at either end.\n- No URL carries `return_to`, a redirect or a client parameter. A page reads one opaque interaction id from its own URL, and the client, the redirect target and everything else it shows come from the API.\n- The interaction id alone reads the current step, with no personal data. Personal data, such as the account chooser’s list, needs the flow cookie and a same-origin request. Answering a step or cancelling the interaction needs the flow cookie, the step’s CSRF value and a same-origin request.\n- Every operation answers with `Cache-Control: no-store`.\n\n## Versioning\n\n- The path carries the major version. Until QAuth 1.0.0 it is a release candidate, `/interaction/v1-rc.` (today `/interaction/v1-rc.0`), and nothing about it is promised: a breaking change raises ``. The release that ships 1.0.0 serves `/interaction/v1`.\n- Within a major version, changes are additive only: new operations, new steps, new optional request members, new response members, and new values of an extensible set (step names, problem codes, fonts).\n- A client ignores response members it does not know, and a page shows its error page for a step it does not know. A request with a member the operation does not declare is refused.\n- The published schemas close response objects (`additionalProperties: false`) to describe this version exactly. A later version may add members, so a client must not validate responses strictly against an older schema, and ignores the members it does not know.\n- Removing or renaming a member, changing a type, tightening validation, changing a status code, removing an operation or a step, and adding to a closed set, such as a step’s errors, need a new major version.\n- A successor major version is served beside the previous one for at least 12 months, and the previous one stays until the next major release of QAuth.\n- A step is named `urn:qauth:ia::v1-rc.` until 1.0.0 and `urn:qauth:ia::v1` from then on, with the same release candidate as the path. QAuth never renames a step; if a registry of standard step names appears, its names are added beside QAuth’s.\n\n## Paths\n\n- The prefix `/interaction/v1-rc.0/wallet/` is reserved for the wallet return leg (ADR-013). No operation of this document is served under it.\n- The auth server serves this document at `/interaction/v1-rc.0/openapi.json`.", "license": { "name": "Apache-2.0", "identifier": "Apache-2.0" } }, "servers": [ { "url": "/", "description": "The realm origin. The API is same-origin: a page calls it on the host it was served from." } ], "tags": [ { "name": "Interaction", "description": "The current step of an interaction: read it, answer it, or cancel." } ], "x-qauth-reserved-prefixes": [ "/interaction/v1-rc.0/wallet/" ], "paths": { "/interaction/v1-rc.0/{interactionId}": { "get": { "operationId": "interactions.get", "summary": "Read the current step", "description": "The current step of the interaction, the steps offered beside it, a CSRF value for one answer, the client’s display data and the realm’s brand. The interaction id alone is enough, so the ceremony app’s server can read it while the proxy strips QAuth’s cookies; for the same reason the read returns no personal data. Reading does not change the interaction.", "tags": [ "Interaction" ], "x-qauth-stability": "stable", "security": [], "x-qauth-flow-cookie": "none", "x-qauth-csrf": "none", "parameters": [ { "name": "interactionId", "in": "path", "required": true, "description": "The interaction id the page read from its own URL.", "schema": { "$ref": "#/components/schemas/InteractionId" } } ], "responses": { "200": { "description": "The current step.", "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Interaction" }, "examples": { "identifier": { "summary": "urn:qauth:ia:identifier:v1-rc.0", "value": { "step": "urn:qauth:ia:identifier:v1-rc.0", "alternatives": [ "urn:qauth:ia:webauthn_get:v1-rc.0" ], "params": { "urn:qauth:ia:identifier:v1-rc.0": {}, "urn:qauth:ia:webauthn_get:v1-rc.0": { "challenge": "Qm9vbGVhbi1ub3QtYS1yZWFsLWNoYWxsZW5nZS0zMmI", "rpId": "auth.example.com", "timeout": 300000, "userVerification": "required" } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "password": { "summary": "urn:qauth:ia:password:v1-rc.0", "value": { "step": "urn:qauth:ia:password:v1-rc.0", "error": "invalid_credentials", "alternatives": [ "urn:qauth:ia:identifier:v1-rc.0", "urn:qauth:ia:webauthn_get:v1-rc.0", "urn:qauth:ia:password_reset:v1-rc.0", "urn:qauth:ia:recovery_code:v1-rc.0" ], "params": { "urn:qauth:ia:password:v1-rc.0": {}, "urn:qauth:ia:identifier:v1-rc.0": {}, "urn:qauth:ia:webauthn_get:v1-rc.0": { "challenge": "Qm9vbGVhbi1ub3QtYS1yZWFsLWNoYWxsZW5nZS0zMmI", "rpId": "auth.example.com", "timeout": 300000, "userVerification": "required" }, "urn:qauth:ia:password_reset:v1-rc.0": {}, "urn:qauth:ia:recovery_code:v1-rc.0": {} }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "email_code": { "summary": "urn:qauth:ia:email_code:v1-rc.0", "value": { "step": "urn:qauth:ia:email_code:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:email_code:v1-rc.0": { "purpose": "verify_account", "length": 6, "expires_in": 600, "resend_after": 60 } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "new_password": { "summary": "urn:qauth:ia:new_password:v1-rc.0", "value": { "step": "urn:qauth:ia:new_password:v1-rc.0", "error": "password_rejected", "alternatives": [], "params": { "urn:qauth:ia:new_password:v1-rc.0": { "purpose": "reset", "min_length": 15, "max_length": 256, "reasons": [ "too_short" ] } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "password_reset": { "summary": "urn:qauth:ia:password_reset:v1-rc.0", "value": { "step": "urn:qauth:ia:password_reset:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:password_reset:v1-rc.0": {} }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "captcha": { "summary": "urn:qauth:ia:captcha:v1-rc.0", "value": { "step": "urn:qauth:ia:captcha:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:captcha:v1-rc.0": { "provider": "pow", "challenge": "Qm9vbGVhbi1ub3QtYS1yZWFsLWNoYWxsZW5nZS0zMmI", "difficulty": 18 } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "webauthn_get": { "summary": "urn:qauth:ia:webauthn_get:v1-rc.0", "value": { "step": "urn:qauth:ia:webauthn_get:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:webauthn_get:v1-rc.0": { "challenge": "Qm9vbGVhbi1ub3QtYS1yZWFsLWNoYWxsZW5nZS0zMmI", "rpId": "auth.example.com", "timeout": 300000, "userVerification": "required" } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "webauthn_create": { "summary": "urn:qauth:ia:webauthn_create:v1-rc.0", "value": { "step": "urn:qauth:ia:webauthn_create:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:webauthn_create:v1-rc.0": { "optional": true, "options": { "challenge": "Qm9vbGVhbi1ub3QtYS1yZWFsLWNoYWxsZW5nZS0zMmI", "rp": { "id": "auth.example.com", "name": "Example" }, "pubKeyCredParams": [ { "type": "public-key", "alg": -8 }, { "type": "public-key", "alg": -7 }, { "type": "public-key", "alg": -257 } ], "timeout": 300000, "authenticatorSelection": { "residentKey": "required", "userVerification": "required" }, "attestation": "none" } } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "totp": { "summary": "urn:qauth:ia:totp:v1-rc.0", "value": { "step": "urn:qauth:ia:totp:v1-rc.0", "alternatives": [ "urn:qauth:ia:recovery_code:v1-rc.0" ], "params": { "urn:qauth:ia:totp:v1-rc.0": { "digits": 6 }, "urn:qauth:ia:recovery_code:v1-rc.0": {} }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "recovery_code": { "summary": "urn:qauth:ia:recovery_code:v1-rc.0", "value": { "step": "urn:qauth:ia:recovery_code:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:recovery_code:v1-rc.0": {} }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "recovery_codes": { "summary": "urn:qauth:ia:recovery_codes:v1-rc.0", "value": { "step": "urn:qauth:ia:recovery_codes:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:recovery_codes:v1-rc.0": { "count": 10 } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "totp_setup": { "summary": "urn:qauth:ia:totp_setup:v1-rc.0", "value": { "step": "urn:qauth:ia:totp_setup:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:totp_setup:v1-rc.0": { "algorithm": "SHA1", "digits": 6, "period": 30 } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "consent": { "summary": "urn:qauth:ia:consent:v1-rc.0", "value": { "step": "urn:qauth:ia:consent:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:consent:v1-rc.0": { "scopes": [ { "scope": "openid", "sensitive": false, "dangerous": false }, { "scope": "notes:read", "text": "Read your notes", "sensitive": false, "dangerous": false }, { "scope": "write:notes", "text": "Change and delete your notes", "sensitive": true, "dangerous": true } ], "resources": [ "https://notes.example.com/" ], "remember_default": true } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "unverified", "redirect": { "target": "this_device" }, "declaredName": "Notes Helper", "newClient": true }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "select_account": { "summary": "urn:qauth:ia:select_account:v1-rc.0", "value": { "step": "urn:qauth:ia:select_account:v1-rc.0", "alternatives": [ "urn:qauth:ia:identifier:v1-rc.0" ], "params": { "urn:qauth:ia:select_account:v1-rc.0": {}, "urn:qauth:ia:identifier:v1-rc.0": {} }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "device_code": { "summary": "urn:qauth:ia:device_code:v1-rc.0", "value": { "step": "urn:qauth:ia:device_code:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:device_code:v1-rc.0": { "length": 8 } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "device_confirm": { "summary": "urn:qauth:ia:device_confirm:v1-rc.0", "value": { "step": "urn:qauth:ia:device_confirm:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:device_confirm:v1-rc.0": { "user_code": "WDJB-MJHT", "requested_at": "2026-10-26T09:29:12Z" } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } }, "logout_confirm": { "summary": "urn:qauth:ia:logout_confirm:v1-rc.0", "value": { "step": "urn:qauth:ia:logout_confirm:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:logout_confirm:v1-rc.0": {} }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } } } } } }, "410": { "description": "Gone: `interaction_expired`.", "x-qauth-problem-codes": [ "interaction_expired" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#interaction-expired", "title": "Interaction expired", "status": 410, "code": "interaction_expired", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "421": { "description": "Misdirected Request: `misdirected_request`.", "x-qauth-problem-codes": [ "misdirected_request" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#misdirected-request", "title": "Misdirected request", "status": 421, "code": "misdirected_request", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "429": { "description": "Too Many Requests: `too_many_requests`.", "x-qauth-problem-codes": [ "too_many_requests" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" }, "Retry-After": { "$ref": "#/components/headers/RetryAfter" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#too-many-requests", "title": "Too many requests", "status": 429, "code": "too_many_requests", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "500": { "description": "Internal Server Error: `internal_error`.", "x-qauth-problem-codes": [ "internal_error" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#internal-error", "title": "Internal error", "status": 500, "code": "internal_error", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "503": { "description": "Service Unavailable: `service_unavailable`.", "x-qauth-problem-codes": [ "service_unavailable" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#service-unavailable", "title": "Service unavailable", "status": 503, "code": "service_unavailable", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } } } } }, "/interaction/v1-rc.0/{interactionId}/personal": { "get": { "operationId": "interactions.personal.get", "summary": "Read the personal data of the current step", "description": "The personal data the current step’s screen shows: the account chooser’s list, the identifier being signed in, a secret shown once. Only the browser that started the interaction can read it: the request needs the flow cookie, so the page calls it from the browser. The read refuses a request from another origin with 403 `forbidden`: one whose `Sec-Fetch-Site` is present and not `same-origin`, or whose `Origin` is present and not the realm origin (`null` included). A request with neither header is allowed, such as from a browser that sends neither (Safari before 16.4): the server sends no CORS headers, so a page on another origin cannot read the answer anyway, and the check is defence in depth. The server checks the origin, then the flow cookie. A step with no personal data answers an empty `data`.", "tags": [ "Interaction" ], "x-qauth-stability": "stable", "security": [ { "flowCookie": [] } ], "x-qauth-flow-cookie": "required", "x-qauth-csrf": "none", "parameters": [ { "name": "interactionId", "in": "path", "required": true, "description": "The interaction id the page read from its own URL.", "schema": { "$ref": "#/components/schemas/InteractionId" } } ], "responses": { "200": { "description": "The current step’s personal data.", "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PersonalData" }, "examples": { "identifier": { "summary": "urn:qauth:ia:identifier:v1-rc.0", "value": { "step": "urn:qauth:ia:identifier:v1-rc.0", "data": {} } }, "password": { "summary": "urn:qauth:ia:password:v1-rc.0", "value": { "step": "urn:qauth:ia:password:v1-rc.0", "data": { "urn:qauth:ia:password:v1-rc.0": { "identifier": "alice@example.com" } } } }, "email_code": { "summary": "urn:qauth:ia:email_code:v1-rc.0", "value": { "step": "urn:qauth:ia:email_code:v1-rc.0", "data": { "urn:qauth:ia:email_code:v1-rc.0": { "identifier": "alice@example.com" } } } }, "new_password": { "summary": "urn:qauth:ia:new_password:v1-rc.0", "value": { "step": "urn:qauth:ia:new_password:v1-rc.0", "data": { "urn:qauth:ia:new_password:v1-rc.0": { "identifier": "alice@example.com" } } } }, "password_reset": { "summary": "urn:qauth:ia:password_reset:v1-rc.0", "value": { "step": "urn:qauth:ia:password_reset:v1-rc.0", "data": {} } }, "captcha": { "summary": "urn:qauth:ia:captcha:v1-rc.0", "value": { "step": "urn:qauth:ia:captcha:v1-rc.0", "data": {} } }, "webauthn_get": { "summary": "urn:qauth:ia:webauthn_get:v1-rc.0", "value": { "step": "urn:qauth:ia:webauthn_get:v1-rc.0", "data": { "urn:qauth:ia:webauthn_get:v1-rc.0": { "identifier": "alice@example.com" } } } }, "webauthn_create": { "summary": "urn:qauth:ia:webauthn_create:v1-rc.0", "value": { "step": "urn:qauth:ia:webauthn_create:v1-rc.0", "data": { "urn:qauth:ia:webauthn_create:v1-rc.0": { "identifier": "alice@example.com", "user": { "id": "b2Zmc2V0LXVzZXItaGFuZGxl", "name": "alice@example.com", "displayName": "alice@example.com" }, "excludeCredentials": [] } } } }, "totp": { "summary": "urn:qauth:ia:totp:v1-rc.0", "value": { "step": "urn:qauth:ia:totp:v1-rc.0", "data": { "urn:qauth:ia:totp:v1-rc.0": { "identifier": "alice@example.com" } } } }, "recovery_code": { "summary": "urn:qauth:ia:recovery_code:v1-rc.0", "value": { "step": "urn:qauth:ia:recovery_code:v1-rc.0", "data": { "urn:qauth:ia:recovery_code:v1-rc.0": { "identifier": "alice@example.com" } } } }, "recovery_codes": { "summary": "urn:qauth:ia:recovery_codes:v1-rc.0", "value": { "step": "urn:qauth:ia:recovery_codes:v1-rc.0", "data": { "urn:qauth:ia:recovery_codes:v1-rc.0": { "codes": [ "k7qd-2mvw-x4ra-p6tn", "b3hs-q6ze-u2yc-m5lf", "w4na-j7rk-e3gx-t6pd", "c5ub-y2mh-r7kw-a4qs", "z6fe-n3td-g5vp-l2jx", "h2ry-s4ka-v6cm-d7wb", "q3lg-f5xn-k2ze-p4ut", "m7ws-b6dj-x3hr-e5ca", "t4pk-a2qf-n6ly-g3vz", "r5ex-w7cu-j4mb-s2hd" ] } } } }, "totp_setup": { "summary": "urn:qauth:ia:totp_setup:v1-rc.0", "value": { "step": "urn:qauth:ia:totp_setup:v1-rc.0", "data": { "urn:qauth:ia:totp_setup:v1-rc.0": { "identifier": "alice@example.com", "secret": "JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP", "otpauth_uri": "otpauth://totp/Example:alice%40example.com?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=Example&algorithm=SHA1&digits=6&period=30" } } } }, "consent": { "summary": "urn:qauth:ia:consent:v1-rc.0", "value": { "step": "urn:qauth:ia:consent:v1-rc.0", "data": { "urn:qauth:ia:consent:v1-rc.0": { "identifier": "alice@example.com" } } } }, "select_account": { "summary": "urn:qauth:ia:select_account:v1-rc.0", "value": { "step": "urn:qauth:ia:select_account:v1-rc.0", "data": { "urn:qauth:ia:select_account:v1-rc.0": { "accounts": [ { "account": "c2Vzc2lvbi1yZWYtMDAwMDAx", "identifier": "alice@example.com", "current": true }, { "account": "c2Vzc2lvbi1yZWYtMDAwMDAy", "identifier": "alice@work.example", "current": false } ] } } } }, "device_code": { "summary": "urn:qauth:ia:device_code:v1-rc.0", "value": { "step": "urn:qauth:ia:device_code:v1-rc.0", "data": {} } }, "device_confirm": { "summary": "urn:qauth:ia:device_confirm:v1-rc.0", "value": { "step": "urn:qauth:ia:device_confirm:v1-rc.0", "data": { "urn:qauth:ia:device_confirm:v1-rc.0": { "location": { "country": "DE", "region": "Bavaria" }, "network": { "asn": 64500, "name": "Example Broadband" }, "user_agent": "ExampleTV/4.2 (Linux; Android 14)" } } } }, "logout_confirm": { "summary": "urn:qauth:ia:logout_confirm:v1-rc.0", "value": { "step": "urn:qauth:ia:logout_confirm:v1-rc.0", "data": { "urn:qauth:ia:logout_confirm:v1-rc.0": { "accounts": [ { "identifier": "alice@example.com", "current": true }, { "identifier": "alice@work.example", "current": false } ] } } } } } } } }, "403": { "description": "Forbidden: `forbidden`.", "x-qauth-problem-codes": [ "forbidden" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#forbidden", "title": "Forbidden", "status": 403, "code": "forbidden", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "410": { "description": "Gone: `interaction_expired`.", "x-qauth-problem-codes": [ "interaction_expired" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#interaction-expired", "title": "Interaction expired", "status": 410, "code": "interaction_expired", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "421": { "description": "Misdirected Request: `misdirected_request`.", "x-qauth-problem-codes": [ "misdirected_request" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#misdirected-request", "title": "Misdirected request", "status": 421, "code": "misdirected_request", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "429": { "description": "Too Many Requests: `too_many_requests`.", "x-qauth-problem-codes": [ "too_many_requests" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" }, "Retry-After": { "$ref": "#/components/headers/RetryAfter" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#too-many-requests", "title": "Too many requests", "status": 429, "code": "too_many_requests", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "500": { "description": "Internal Server Error: `internal_error`.", "x-qauth-problem-codes": [ "internal_error" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#internal-error", "title": "Internal error", "status": 500, "code": "internal_error", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "503": { "description": "Service Unavailable: `service_unavailable`.", "x-qauth-problem-codes": [ "service_unavailable" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#service-unavailable", "title": "Service unavailable", "status": 503, "code": "service_unavailable", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } } } } }, "/interaction/v1-rc.0/{interactionId}/answer": { "post": { "operationId": "interactions.answer", "summary": "Answer the current step", "description": "Answer the current step, or one of the alternatives it offers, with the CSRF value of the step read. As JSON or as a plain HTML form post (`application/x-www-form-urlencoded`, UTF-8) with the same members, so a page works without JavaScript. In a form post every value is a string: a boolean is `true` or `false` (an unchecked checkbox sends nothing, which means `false`), and no member may be repeated. The request must come from the realm origin: `Sec-Fetch-Site` must be `same-origin`; when the browser sent no `Sec-Fetch-Site`, `Origin` must equal the realm origin, and an `Origin` of `null` or of any other origin is refused. A request that fails gets 403 `forbidden`. The server checks the origin, then the flow cookie, then the CSRF value, and runs no engine work before all three pass. A body is at most 16 KiB, or 64 KiB for an answer to `webauthn_create` (ADR-017 Decision 7); a larger one gets 413. A refused answer, such as a wrong password, is not an error: the same step comes back with `error` set and a new CSRF value.", "tags": [ "Interaction" ], "x-qauth-stability": "stable", "security": [ { "flowCookie": [] } ], "x-qauth-flow-cookie": "required", "x-qauth-csrf": "required", "parameters": [ { "name": "interactionId", "in": "path", "required": true, "description": "The interaction id the page read from its own URL.", "schema": { "$ref": "#/components/schemas/InteractionId" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnswerRequest" }, "examples": { "identifier": { "summary": "urn:qauth:ia:identifier:v1-rc.0", "value": { "type": "urn:qauth:ia:identifier:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "login_hint": "alice@example.com" } }, "password": { "summary": "urn:qauth:ia:password:v1-rc.0", "value": { "type": "urn:qauth:ia:password:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "password": "correct horse battery staple x" } }, "email_code": { "summary": "urn:qauth:ia:email_code:v1-rc.0", "value": { "type": "urn:qauth:ia:email_code:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "otp": "482913" } }, "new_password": { "summary": "urn:qauth:ia:new_password:v1-rc.0", "value": { "type": "urn:qauth:ia:new_password:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "new_password": "a much longer passphrase than before" } }, "password_reset": { "summary": "urn:qauth:ia:password_reset:v1-rc.0", "value": { "type": "urn:qauth:ia:password_reset:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE" } }, "captcha": { "summary": "urn:qauth:ia:captcha:v1-rc.0", "value": { "type": "urn:qauth:ia:captcha:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "captcha_token": "AAAAAAAABl9x" } }, "webauthn_get": { "summary": "urn:qauth:ia:webauthn_get:v1-rc.0", "value": { "type": "urn:qauth:ia:webauthn_get:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "webauthn_response": "{\"id\":\"mC1lKXgSi0S3vW2mU1Nwhg\",\"rawId\":\"mC1lKXgSi0S3vW2mU1Nwhg\",\"type\":\"public-key\",\"response\":{\"clientDataJSON\":\"eyJ0eXBlIjoid2ViYXV0aG4uZ2V0In0\",\"authenticatorData\":\"SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MFAAAAAQ\",\"signature\":\"MEUCIQDzVOkaFj9Kf2m9VE3e3Jx1yX2w\",\"userHandle\":\"b2Zmc2V0LXVzZXItaGFuZGxl\"},\"authenticatorAttachment\":\"platform\",\"clientExtensionResults\":{}}" } }, "webauthn_create": { "summary": "urn:qauth:ia:webauthn_create:v1-rc.0", "value": { "type": "urn:qauth:ia:webauthn_create:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "webauthn_response": "{\"id\":\"mC1lKXgSi0S3vW2mU1Nwhg\",\"rawId\":\"mC1lKXgSi0S3vW2mU1Nwhg\",\"type\":\"public-key\",\"response\":{\"clientDataJSON\":\"eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0\",\"attestationObject\":\"o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE\",\"transports\":[\"internal\",\"hybrid\"]},\"authenticatorAttachment\":\"platform\",\"clientExtensionResults\":{}}" } }, "totp": { "summary": "urn:qauth:ia:totp:v1-rc.0", "value": { "type": "urn:qauth:ia:totp:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "otp": "482913" } }, "recovery_code": { "summary": "urn:qauth:ia:recovery_code:v1-rc.0", "value": { "type": "urn:qauth:ia:recovery_code:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "recovery_code": "k7qd-2mvw-x4ra-p6tn" } }, "recovery_codes": { "summary": "urn:qauth:ia:recovery_codes:v1-rc.0", "value": { "type": "urn:qauth:ia:recovery_codes:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "acknowledged": true } }, "totp_setup": { "summary": "urn:qauth:ia:totp_setup:v1-rc.0", "value": { "type": "urn:qauth:ia:totp_setup:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "otp": "482913" } }, "consent": { "summary": "urn:qauth:ia:consent:v1-rc.0", "value": { "type": "urn:qauth:ia:consent:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "decision": "allow", "remember": true } }, "select_account": { "summary": "urn:qauth:ia:select_account:v1-rc.0", "value": { "type": "urn:qauth:ia:select_account:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "account": "c2Vzc2lvbi1yZWYtMDAwMDAx" } }, "device_code": { "summary": "urn:qauth:ia:device_code:v1-rc.0", "value": { "type": "urn:qauth:ia:device_code:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "user_code": "wdjb-mjht" } }, "device_confirm": { "summary": "urn:qauth:ia:device_confirm:v1-rc.0", "value": { "type": "urn:qauth:ia:device_confirm:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "decision": "confirm" } }, "logout_confirm": { "summary": "urn:qauth:ia:logout_confirm:v1-rc.0", "value": { "type": "urn:qauth:ia:logout_confirm:v1-rc.0", "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "decision": "logout" } } } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnswerRequest" } } } }, "responses": { "200": { "description": "For a JSON answer: the next step, or the final redirect.", "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnswerResult" }, "examples": { "identifier": { "summary": "urn:qauth:ia:identifier:v1-rc.0", "value": { "result": "step", "interaction": { "step": "urn:qauth:ia:password:v1-rc.0", "alternatives": [ "urn:qauth:ia:identifier:v1-rc.0", "urn:qauth:ia:webauthn_get:v1-rc.0", "urn:qauth:ia:password_reset:v1-rc.0", "urn:qauth:ia:recovery_code:v1-rc.0" ], "params": { "urn:qauth:ia:password:v1-rc.0": {}, "urn:qauth:ia:identifier:v1-rc.0": {}, "urn:qauth:ia:webauthn_get:v1-rc.0": { "challenge": "Qm9vbGVhbi1ub3QtYS1yZWFsLWNoYWxsZW5nZS0zMmI", "rpId": "auth.example.com", "timeout": 300000, "userVerification": "required" }, "urn:qauth:ia:password_reset:v1-rc.0": {}, "urn:qauth:ia:recovery_code:v1-rc.0": {} }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } } }, "password": { "summary": "urn:qauth:ia:password:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/callback?code=uY29tL2F1dGhlbnRpY2F0aW9u&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } }, "email_code": { "summary": "urn:qauth:ia:email_code:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/callback?code=uY29tL2F1dGhlbnRpY2F0aW9u&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } }, "new_password": { "summary": "urn:qauth:ia:new_password:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/callback?code=uY29tL2F1dGhlbnRpY2F0aW9u&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } }, "password_reset": { "summary": "urn:qauth:ia:password_reset:v1-rc.0", "value": { "result": "step", "interaction": { "step": "urn:qauth:ia:email_code:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:email_code:v1-rc.0": { "purpose": "verify_account", "length": 6, "expires_in": 600, "resend_after": 60 } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } } }, "captcha": { "summary": "urn:qauth:ia:captcha:v1-rc.0", "value": { "result": "step", "interaction": { "step": "urn:qauth:ia:password:v1-rc.0", "alternatives": [ "urn:qauth:ia:identifier:v1-rc.0", "urn:qauth:ia:webauthn_get:v1-rc.0", "urn:qauth:ia:password_reset:v1-rc.0", "urn:qauth:ia:recovery_code:v1-rc.0" ], "params": { "urn:qauth:ia:password:v1-rc.0": {}, "urn:qauth:ia:identifier:v1-rc.0": {}, "urn:qauth:ia:webauthn_get:v1-rc.0": { "challenge": "Qm9vbGVhbi1ub3QtYS1yZWFsLWNoYWxsZW5nZS0zMmI", "rpId": "auth.example.com", "timeout": 300000, "userVerification": "required" }, "urn:qauth:ia:password_reset:v1-rc.0": {}, "urn:qauth:ia:recovery_code:v1-rc.0": {} }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } } }, "webauthn_get": { "summary": "urn:qauth:ia:webauthn_get:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/callback?code=uY29tL2F1dGhlbnRpY2F0aW9u&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } }, "webauthn_create": { "summary": "urn:qauth:ia:webauthn_create:v1-rc.0", "value": { "result": "step", "interaction": { "step": "urn:qauth:ia:recovery_codes:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:recovery_codes:v1-rc.0": { "count": 10 } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } } }, "totp": { "summary": "urn:qauth:ia:totp:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/callback?code=uY29tL2F1dGhlbnRpY2F0aW9u&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } }, "recovery_code": { "summary": "urn:qauth:ia:recovery_code:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/callback?code=uY29tL2F1dGhlbnRpY2F0aW9u&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } }, "recovery_codes": { "summary": "urn:qauth:ia:recovery_codes:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/callback?code=uY29tL2F1dGhlbnRpY2F0aW9u&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } }, "totp_setup": { "summary": "urn:qauth:ia:totp_setup:v1-rc.0", "value": { "result": "step", "interaction": { "step": "urn:qauth:ia:recovery_codes:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:recovery_codes:v1-rc.0": { "count": 10 } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } } }, "consent": { "summary": "urn:qauth:ia:consent:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/callback?code=uY29tL2F1dGhlbnRpY2F0aW9u&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } }, "select_account": { "summary": "urn:qauth:ia:select_account:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/callback?code=uY29tL2F1dGhlbnRpY2F0aW9u&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } }, "device_code": { "summary": "urn:qauth:ia:device_code:v1-rc.0", "value": { "result": "step", "interaction": { "step": "urn:qauth:ia:device_confirm:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:device_confirm:v1-rc.0": { "user_code": "WDJB-MJHT", "requested_at": "2026-10-26T09:29:12Z" } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "cimd", "verifiedDomain": { "host": "app.example.com", "registrableDomain": "example.com", "sharedHosting": false }, "redirect": { "target": "host", "host": "app.example.com" }, "declaredName": "Example Notes", "newClient": false }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } } }, "device_confirm": { "summary": "urn:qauth:ia:device_confirm:v1-rc.0", "value": { "result": "step", "interaction": { "step": "urn:qauth:ia:consent:v1-rc.0", "alternatives": [], "params": { "urn:qauth:ia:consent:v1-rc.0": { "scopes": [ { "scope": "openid", "sensitive": false, "dangerous": false }, { "scope": "notes:read", "text": "Read your notes", "sensitive": false, "dangerous": false }, { "scope": "write:notes", "text": "Change and delete your notes", "sensitive": true, "dangerous": true } ], "resources": [ "https://notes.example.com/" ], "remember_default": true } }, "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE", "client": { "kind": "unverified", "redirect": { "target": "this_device" }, "declaredName": "Notes Helper", "newClient": true }, "brand": { "logo": { "light": { "url": "/ui/assets/logo-3f9a1c2e.svg", "width": 160, "height": 40 } }, "colors": { "light": { "primary": "#1f5fbf" }, "dark": { "primary": "#7aa7ef", "background": "#10141a" } }, "font": "inter", "links": { "privacy": "https://example.com/privacy", "help": "https://example.com/help" }, "strings": { "en": { "name": "Example", "title": "Sign in to Example" } }, "darkMode": "enabled" }, "uiLocales": [ "en" ], "expiresAt": "2026-10-26T10:00:00Z" } } }, "logout_confirm": { "summary": "urn:qauth:ia:logout_confirm:v1-rc.0", "value": { "result": "redirect", "location": "https://app.example.com/signed-out?state=b8f2c1" } } } } } }, "303": { "description": "For a form post: the next page. `Location` is the ceremony app’s page for the next step, or the final redirect. A form post never gets the JSON result.", "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" }, "Location": { "$ref": "#/components/headers/Location" } } }, "400": { "description": "Bad Request: `bad_request` or `invalid_answer`.", "x-qauth-problem-codes": [ "bad_request", "invalid_answer" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#bad-request", "title": "Bad request", "status": 400, "code": "bad_request", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "403": { "description": "Forbidden: `forbidden`.", "x-qauth-problem-codes": [ "forbidden" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#forbidden", "title": "Forbidden", "status": 403, "code": "forbidden", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "410": { "description": "Gone: `interaction_expired`.", "x-qauth-problem-codes": [ "interaction_expired" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#interaction-expired", "title": "Interaction expired", "status": 410, "code": "interaction_expired", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "413": { "description": "Payload Too Large: `content_too_large`.", "x-qauth-problem-codes": [ "content_too_large" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#content-too-large", "title": "Content too large", "status": 413, "code": "content_too_large", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "415": { "description": "Unsupported Media Type: `unsupported_media_type`.", "x-qauth-problem-codes": [ "unsupported_media_type" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#unsupported-media-type", "title": "Unsupported media type", "status": 415, "code": "unsupported_media_type", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "421": { "description": "Misdirected Request: `misdirected_request`.", "x-qauth-problem-codes": [ "misdirected_request" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#misdirected-request", "title": "Misdirected request", "status": 421, "code": "misdirected_request", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "429": { "description": "Too Many Requests: `too_many_requests`.", "x-qauth-problem-codes": [ "too_many_requests" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" }, "Retry-After": { "$ref": "#/components/headers/RetryAfter" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#too-many-requests", "title": "Too many requests", "status": 429, "code": "too_many_requests", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "500": { "description": "Internal Server Error: `internal_error`.", "x-qauth-problem-codes": [ "internal_error" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#internal-error", "title": "Internal error", "status": 500, "code": "internal_error", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "503": { "description": "Service Unavailable: `service_unavailable`.", "x-qauth-problem-codes": [ "service_unavailable" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#service-unavailable", "title": "Service unavailable", "status": 503, "code": "service_unavailable", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } } } } }, "/interaction/v1-rc.0/{interactionId}/cancel": { "post": { "operationId": "interactions.cancel", "summary": "Cancel the interaction", "description": "End the interaction without completing it: the client gets `access_denied`, and a logout ends with the person still signed in. As JSON or as a plain HTML form post (`application/x-www-form-urlencoded`, UTF-8) with the same members, so a page works without JavaScript. In a form post every value is a string: a boolean is `true` or `false` (an unchecked checkbox sends nothing, which means `false`), and no member may be repeated. The request must come from the realm origin: `Sec-Fetch-Site` must be `same-origin`; when the browser sent no `Sec-Fetch-Site`, `Origin` must equal the realm origin, and an `Origin` of `null` or of any other origin is refused. A request that fails gets 403 `forbidden`. The server checks the origin, then the flow cookie, then the CSRF value, and runs no engine work before all three pass. A body is at most 16 KiB, or 64 KiB for an answer to `webauthn_create` (ADR-017 Decision 7); a larger one gets 413.", "tags": [ "Interaction" ], "x-qauth-stability": "stable", "security": [ { "flowCookie": [] } ], "x-qauth-flow-cookie": "required", "x-qauth-csrf": "required", "parameters": [ { "name": "interactionId", "in": "path", "required": true, "description": "The interaction id the page read from its own URL.", "schema": { "$ref": "#/components/schemas/InteractionId" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CancelRequest" }, "example": { "csrf": "cGVyLXN0ZXAtY3NyZi12YWx1ZS1vZi0zMi1ieXRlcyE" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/CancelRequest" } } } }, "responses": { "200": { "description": "For a JSON request: the final redirect.", "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RedirectResult" }, "example": { "result": "redirect", "location": "https://app.example.com/callback?error=access_denied&state=af0ifjsldkj&iss=https%3A%2F%2Fauth.example.com" } } } }, "303": { "description": "For a form post: the next page. `Location` is the ceremony app’s page for the next step, or the final redirect. A form post never gets the JSON result.", "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" }, "Location": { "$ref": "#/components/headers/Location" } } }, "400": { "description": "Bad Request: `bad_request` or `invalid_answer`.", "x-qauth-problem-codes": [ "bad_request", "invalid_answer" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#bad-request", "title": "Bad request", "status": 400, "code": "bad_request", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "403": { "description": "Forbidden: `forbidden`.", "x-qauth-problem-codes": [ "forbidden" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#forbidden", "title": "Forbidden", "status": 403, "code": "forbidden", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "410": { "description": "Gone: `interaction_expired`.", "x-qauth-problem-codes": [ "interaction_expired" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#interaction-expired", "title": "Interaction expired", "status": 410, "code": "interaction_expired", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "413": { "description": "Payload Too Large: `content_too_large`.", "x-qauth-problem-codes": [ "content_too_large" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#content-too-large", "title": "Content too large", "status": 413, "code": "content_too_large", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "415": { "description": "Unsupported Media Type: `unsupported_media_type`.", "x-qauth-problem-codes": [ "unsupported_media_type" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#unsupported-media-type", "title": "Unsupported media type", "status": 415, "code": "unsupported_media_type", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "421": { "description": "Misdirected Request: `misdirected_request`.", "x-qauth-problem-codes": [ "misdirected_request" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#misdirected-request", "title": "Misdirected request", "status": 421, "code": "misdirected_request", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "429": { "description": "Too Many Requests: `too_many_requests`.", "x-qauth-problem-codes": [ "too_many_requests" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" }, "Retry-After": { "$ref": "#/components/headers/RetryAfter" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#too-many-requests", "title": "Too many requests", "status": 429, "code": "too_many_requests", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "500": { "description": "Internal Server Error: `internal_error`.", "x-qauth-problem-codes": [ "internal_error" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#internal-error", "title": "Internal error", "status": 500, "code": "internal_error", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } }, "503": { "description": "Service Unavailable: `service_unavailable`.", "x-qauth-problem-codes": [ "service_unavailable" ], "headers": { "Cache-Control": { "$ref": "#/components/headers/CacheControl" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://docs.qauth.dev/reference/problem-types/#service-unavailable", "title": "Service unavailable", "status": 503, "code": "service_unavailable", "trace_id": "7f3a9c1e-2b4d-4e6f-8a0b-1c2d3e4f5a6b" } } } } } } } }, "components": { "securitySchemes": { "flowCookie": { "type": "apiKey", "in": "cookie", "name": "__Host-qauth_flow", "description": "The flow cookie the authorization endpoint set when it created the interaction: `HttpOnly`, `Secure`, `SameSite=Lax`, `Path=/`, no `Domain`. It binds the interaction to the browser that started it; a wrong or missing cookie gets the same `interaction_expired` as an unknown id." } }, "headers": { "CacheControl": { "description": "Every answer is `no-store` (ADR-019 Decision 5).", "schema": { "type": "string", "const": "no-store" } }, "RetryAfter": { "description": "How many seconds to wait before trying again.", "schema": { "type": "integer", "minimum": 0 } }, "Location": { "description": "Where the browser goes next.", "schema": { "type": "string", "format": "uri-reference", "maxLength": 8192 } } }, "schemas": { "InteractionId": { "type": "string", "minLength": 43, "maxLength": 43, "pattern": "^[A-Za-z0-9_-]{43}$", "description": "The opaque interaction id: 32 random bytes the authorization endpoint created (#592). The server stores only its hash. Any other value gets the same `interaction_expired` as an unknown id." }, "Csrf": { "type": "string", "minLength": 43, "maxLength": 43, "pattern": "^[A-Za-z0-9_-]{43}$", "description": "The CSRF value of the step read it came with: valid for one answer to that step view, bound to the interaction, and never put in a URL. The ceremony app embeds it; it cannot mint one." }, "Interaction": { "type": "object", "description": "An interaction as its current step shows it: the step, the alternatives and their params, a CSRF value for one answer, who the client is and the realm’s brand. No personal data. The step grammar’s part has the shape of the FiPA endpoint’s answer (ADR-017 Decision 3): `step` is its `interaction_type_required`, `step` and `alternatives` its `qauth_interaction_types_offered`, `params` its `qauth_interaction_params` and `error` its `qauth_interaction_error`.", "properties": { "step": { "$ref": "#/components/schemas/StepName", "description": "The current step: the one the engine asks for." }, "error": { "$ref": "#/components/schemas/StepError", "description": "Why the last answer to the current step was refused, from that step’s closed error set. Absent otherwise." }, "alternatives": { "type": "array", "description": "The other steps the engine accepts as the next answer, preferred first: \"try another way\", the paths a page links to (a reset, a resend), and the account switch. Never the current step. Before a first factor succeeds, the list holds only what the same request would offer every account, so it reveals no account’s methods; after it, that account’s remaining methods (ADR-017 Decision 4). The list is part of the read with the interaction id alone, so after a first factor that read shows which methods the account has. The contract accepts this: the read shows which methods remain, never who the account is or any of its data.", "minItems": 0, "maxItems": 15, "uniqueItems": true, "items": { "$ref": "#/components/schemas/StepName" } }, "params": { "$ref": "#/components/schemas/StepParams" }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "client": { "$ref": "#/components/schemas/ClientDisplay" }, "brand": { "$ref": "#/components/schemas/Brand" }, "uiLocales": { "type": "array", "description": "The `ui_locales` of the authorization request, validated, in order.", "minItems": 0, "maxItems": 8, "items": { "type": "string", "minLength": 2, "maxLength": 35, "pattern": "^[a-z]{2,3}(?:-[A-Za-z0-9]{1,8})*$", "description": "A BCP 47 language tag." } }, "expiresAt": { "type": "string", "format": "date-time", "maxLength": 30, "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{1,9})?Z$", "description": "When the interaction expires." } }, "required": [ "step", "alternatives", "params", "csrf", "brand", "expiresAt" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "step": { "const": "urn:qauth:ia:identifier:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:identifier:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:password:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:password:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:email_code:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:email_code:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:new_password:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:new_password:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:password_reset:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:password_reset:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:captcha:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:captcha:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:webauthn_get:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:webauthn_get:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:webauthn_create:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:webauthn_create:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:totp:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:totp:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:recovery_code:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:recovery_code:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:recovery_codes:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:recovery_codes:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:totp_setup:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:totp_setup:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:consent:v1-rc.0" } }, "required": [ "step" ] }, "then": { "required": [ "client" ], "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:consent:v1-rc.0" ] }, "client": { "type": "object", "if": { "properties": { "kind": { "const": "unverified" } }, "required": [ "kind" ] }, "then": { "required": [ "redirect" ] } } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:select_account:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:select_account:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:device_code:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:device_code:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:device_confirm:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:device_confirm:v1-rc.0" ] } } } }, { "if": { "properties": { "step": { "const": "urn:qauth:ia:logout_confirm:v1-rc.0" } }, "required": [ "step" ] }, "then": { "properties": { "params": { "type": "object", "required": [ "urn:qauth:ia:logout_confirm:v1-rc.0" ] } } } } ] }, "StepName": { "type": "string", "maxLength": 96, "pattern": "^urn:qauth:ia:[a-z][a-z0-9_]{0,62}:v1-rc\\.0$", "x-extensible-enum": [ "urn:qauth:ia:identifier:v1-rc.0", "urn:qauth:ia:password:v1-rc.0", "urn:qauth:ia:email_code:v1-rc.0", "urn:qauth:ia:new_password:v1-rc.0", "urn:qauth:ia:password_reset:v1-rc.0", "urn:qauth:ia:captcha:v1-rc.0", "urn:qauth:ia:webauthn_get:v1-rc.0", "urn:qauth:ia:webauthn_create:v1-rc.0", "urn:qauth:ia:totp:v1-rc.0", "urn:qauth:ia:recovery_code:v1-rc.0", "urn:qauth:ia:recovery_codes:v1-rc.0", "urn:qauth:ia:totp_setup:v1-rc.0", "urn:qauth:ia:consent:v1-rc.0", "urn:qauth:ia:select_account:v1-rc.0", "urn:qauth:ia:device_code:v1-rc.0", "urn:qauth:ia:device_confirm:v1-rc.0", "urn:qauth:ia:logout_confirm:v1-rc.0" ], "description": "A step name, `urn:qauth:ia::v1-rc.0`. A page shows its error page for a step it does not know." }, "StepError": { "type": "string", "maxLength": 64, "pattern": "^[a-z][a-z0-9_]{0,63}$", "x-extensible-enum": [ "invalid_credentials", "code_expired", "password_rejected", "captcha_failed", "account_unavailable", "invalid_user_code" ], "description": "Why an answer was refused. Each step names its own closed set (`x-qauth-step` beside its params, and its schema file)." }, "StepParams": { "type": "object", "description": "The params of the offered steps, keyed by step name: the current step’s and each alternative’s. What any reader of the interaction id may see.", "properties": { "urn:qauth:ia:identifier:v1-rc.0": { "$ref": "#/components/schemas/IdentifierParams" }, "urn:qauth:ia:password:v1-rc.0": { "$ref": "#/components/schemas/PasswordParams" }, "urn:qauth:ia:email_code:v1-rc.0": { "$ref": "#/components/schemas/EmailCodeParams" }, "urn:qauth:ia:new_password:v1-rc.0": { "$ref": "#/components/schemas/NewPasswordParams" }, "urn:qauth:ia:password_reset:v1-rc.0": { "$ref": "#/components/schemas/PasswordResetParams" }, "urn:qauth:ia:captcha:v1-rc.0": { "$ref": "#/components/schemas/CaptchaParams" }, "urn:qauth:ia:webauthn_get:v1-rc.0": { "$ref": "#/components/schemas/WebauthnGetParams" }, "urn:qauth:ia:webauthn_create:v1-rc.0": { "$ref": "#/components/schemas/WebauthnCreateParams" }, "urn:qauth:ia:totp:v1-rc.0": { "$ref": "#/components/schemas/TotpParams" }, "urn:qauth:ia:recovery_code:v1-rc.0": { "$ref": "#/components/schemas/RecoveryCodeParams" }, "urn:qauth:ia:recovery_codes:v1-rc.0": { "$ref": "#/components/schemas/RecoveryCodesParams" }, "urn:qauth:ia:totp_setup:v1-rc.0": { "$ref": "#/components/schemas/TotpSetupParams" }, "urn:qauth:ia:consent:v1-rc.0": { "$ref": "#/components/schemas/ConsentParams" }, "urn:qauth:ia:select_account:v1-rc.0": { "$ref": "#/components/schemas/SelectAccountParams" }, "urn:qauth:ia:device_code:v1-rc.0": { "$ref": "#/components/schemas/DeviceCodeParams" }, "urn:qauth:ia:device_confirm:v1-rc.0": { "$ref": "#/components/schemas/DeviceConfirmParams" }, "urn:qauth:ia:logout_confirm:v1-rc.0": { "$ref": "#/components/schemas/LogoutConfirmParams" } } }, "AnswerRequest": { "description": "An answer to one step, by its name: the envelope’s `type` and `csrf`, and the step’s answer fields. A new step adds a variant, which widens what the server accepts.", "oneOf": [ { "$ref": "#/components/schemas/IdentifierAnswer" }, { "$ref": "#/components/schemas/PasswordAnswer" }, { "$ref": "#/components/schemas/EmailCodeAnswer" }, { "$ref": "#/components/schemas/NewPasswordAnswer" }, { "$ref": "#/components/schemas/PasswordResetAnswer" }, { "$ref": "#/components/schemas/CaptchaAnswer" }, { "$ref": "#/components/schemas/WebauthnGetAnswer" }, { "$ref": "#/components/schemas/WebauthnCreateAnswer" }, { "$ref": "#/components/schemas/TotpAnswer" }, { "$ref": "#/components/schemas/RecoveryCodeAnswer" }, { "$ref": "#/components/schemas/RecoveryCodesAnswer" }, { "$ref": "#/components/schemas/TotpSetupAnswer" }, { "$ref": "#/components/schemas/ConsentAnswer" }, { "$ref": "#/components/schemas/SelectAccountAnswer" }, { "$ref": "#/components/schemas/DeviceCodeAnswer" }, { "$ref": "#/components/schemas/DeviceConfirmAnswer" }, { "$ref": "#/components/schemas/LogoutConfirmAnswer" } ], "discriminator": { "propertyName": "type", "mapping": { "urn:qauth:ia:identifier:v1-rc.0": "#/components/schemas/IdentifierAnswer", "urn:qauth:ia:password:v1-rc.0": "#/components/schemas/PasswordAnswer", "urn:qauth:ia:email_code:v1-rc.0": "#/components/schemas/EmailCodeAnswer", "urn:qauth:ia:new_password:v1-rc.0": "#/components/schemas/NewPasswordAnswer", "urn:qauth:ia:password_reset:v1-rc.0": "#/components/schemas/PasswordResetAnswer", "urn:qauth:ia:captcha:v1-rc.0": "#/components/schemas/CaptchaAnswer", "urn:qauth:ia:webauthn_get:v1-rc.0": "#/components/schemas/WebauthnGetAnswer", "urn:qauth:ia:webauthn_create:v1-rc.0": "#/components/schemas/WebauthnCreateAnswer", "urn:qauth:ia:totp:v1-rc.0": "#/components/schemas/TotpAnswer", "urn:qauth:ia:recovery_code:v1-rc.0": "#/components/schemas/RecoveryCodeAnswer", "urn:qauth:ia:recovery_codes:v1-rc.0": "#/components/schemas/RecoveryCodesAnswer", "urn:qauth:ia:totp_setup:v1-rc.0": "#/components/schemas/TotpSetupAnswer", "urn:qauth:ia:consent:v1-rc.0": "#/components/schemas/ConsentAnswer", "urn:qauth:ia:select_account:v1-rc.0": "#/components/schemas/SelectAccountAnswer", "urn:qauth:ia:device_code:v1-rc.0": "#/components/schemas/DeviceCodeAnswer", "urn:qauth:ia:device_confirm:v1-rc.0": "#/components/schemas/DeviceConfirmAnswer", "urn:qauth:ia:logout_confirm:v1-rc.0": "#/components/schemas/LogoutConfirmAnswer" } } }, "AnswerResult": { "description": "What a JSON answer leads to. A form post gets the same as a `303 See Other` instead (#616).", "oneOf": [ { "$ref": "#/components/schemas/NextStepResult" }, { "$ref": "#/components/schemas/RedirectResult" } ], "discriminator": { "propertyName": "result", "mapping": { "step": "#/components/schemas/NextStepResult", "redirect": "#/components/schemas/RedirectResult" } } }, "NextStepResult": { "type": "object", "description": "The next step: the same as a step read now returns. A refused answer gets the same step back, with its `error` set and a new CSRF value.", "properties": { "result": { "const": "step", "description": "Another step comes next, or the same one again." }, "interaction": { "$ref": "#/components/schemas/Interaction" } }, "required": [ "result", "interaction" ], "additionalProperties": false }, "RedirectResult": { "type": "object", "description": "The final redirect. The page navigates to `location`.", "properties": { "result": { "const": "redirect", "description": "The interaction is finished." }, "location": { "type": "string", "format": "uri", "maxLength": 8192, "pattern": "^[a-z][a-z0-9+.-]*:[!#-;=?-\\[\\]-~]+$", "not": { "type": "string", "pattern": "^(?:javascript|data|vbscript|file|blob):" }, "description": "Where the browser goes now: the authorization response to the client, the post-logout redirect, the ceremony app’s page of a new interaction (after an account switch), or a page of the ceremony app when no client waits, as at the end of a device authorization. Taken from the interaction record and the realm, never from the request." } }, "required": [ "result", "location" ], "additionalProperties": false }, "CancelRequest": { "type": "object", "description": "Cancel the interaction. The client gets `access_denied` with its `state` and `iss`; a logout ends with the person still signed in.", "properties": { "csrf": { "$ref": "#/components/schemas/Csrf" } }, "required": [ "csrf" ], "additionalProperties": false }, "PersonalData": { "type": "object", "description": "The personal data of the current step: only the browser that holds the flow cookie reads it.", "properties": { "step": { "$ref": "#/components/schemas/StepName", "description": "The current step, whose personal data this is." }, "data": { "$ref": "#/components/schemas/StepPersonalData" } }, "required": [ "step", "data" ], "additionalProperties": false }, "StepPersonalData": { "type": "object", "description": "The current step’s personal data, under its step name. Empty for a step that has none.", "properties": { "urn:qauth:ia:identifier:v1-rc.0": { "$ref": "#/components/schemas/IdentifierPersonalData" }, "urn:qauth:ia:password:v1-rc.0": { "$ref": "#/components/schemas/PasswordPersonalData" }, "urn:qauth:ia:email_code:v1-rc.0": { "$ref": "#/components/schemas/EmailCodePersonalData" }, "urn:qauth:ia:new_password:v1-rc.0": { "$ref": "#/components/schemas/NewPasswordPersonalData" }, "urn:qauth:ia:password_reset:v1-rc.0": { "$ref": "#/components/schemas/PasswordResetPersonalData" }, "urn:qauth:ia:captcha:v1-rc.0": { "$ref": "#/components/schemas/CaptchaPersonalData" }, "urn:qauth:ia:webauthn_get:v1-rc.0": { "$ref": "#/components/schemas/WebauthnGetPersonalData" }, "urn:qauth:ia:webauthn_create:v1-rc.0": { "$ref": "#/components/schemas/WebauthnCreatePersonalData" }, "urn:qauth:ia:totp:v1-rc.0": { "$ref": "#/components/schemas/TotpPersonalData" }, "urn:qauth:ia:recovery_code:v1-rc.0": { "$ref": "#/components/schemas/RecoveryCodePersonalData" }, "urn:qauth:ia:recovery_codes:v1-rc.0": { "$ref": "#/components/schemas/RecoveryCodesPersonalData" }, "urn:qauth:ia:totp_setup:v1-rc.0": { "$ref": "#/components/schemas/TotpSetupPersonalData" }, "urn:qauth:ia:consent:v1-rc.0": { "$ref": "#/components/schemas/ConsentPersonalData" }, "urn:qauth:ia:select_account:v1-rc.0": { "$ref": "#/components/schemas/SelectAccountPersonalData" }, "urn:qauth:ia:device_code:v1-rc.0": { "$ref": "#/components/schemas/DeviceCodePersonalData" }, "urn:qauth:ia:device_confirm:v1-rc.0": { "$ref": "#/components/schemas/DeviceConfirmPersonalData" }, "urn:qauth:ia:logout_confirm:v1-rc.0": { "$ref": "#/components/schemas/LogoutConfirmPersonalData" } } }, "ClientDisplay": { "type": "object", "description": "Who the client is, as the auth server’s own records say (#593). Client-supplied text is untrusted: no logo comes from a client-supplied URL, and an unverified client shows none.", "properties": { "kind": { "type": "string", "enum": [ "cimd", "admin_registered", "federation", "unverified" ], "description": "How the client is known, which decides what is verified (ADR-019 Decision 6): a Client ID Metadata Document client (the host of its client id URL), a client an admin registered (the domain the admin set), a federation client (its entity id and trust marks), or a dynamically registered or developer-portal client (nothing: the screen says the app is unverified)." }, "verifiedDomain": { "type": "object", "description": "For `cimd` and `admin_registered`: the verified domain, which the screen shows first.", "properties": { "host": { "type": "string", "minLength": 1, "maxLength": 253, "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$", "description": "The verified host, in ASCII (punycode) form." }, "registrableDomain": { "type": "string", "minLength": 1, "maxLength": 253, "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$", "description": "The part of `host` the screen highlights: its registrable domain." }, "sharedHosting": { "type": "boolean", "description": "Whether `host` sits under a shared-hosting suffix, from the private section of the Public Suffix List: the screen flags it." } }, "required": [ "host", "registrableDomain", "sharedHosting" ], "additionalProperties": false }, "federation": { "type": "object", "description": "For `federation`: the entity id and its validated trust marks.", "properties": { "entityId": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^https://[!#-;=?-\\[\\]-~]+$", "description": "The federation entity id." }, "trustMarks": { "type": "array", "description": "The trust marks the server validated.", "items": { "type": "object", "properties": { "id": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^[a-z][a-z0-9+.-]*:[!#-;=?-\\[\\]-~]+$", "not": { "type": "string", "pattern": "^(?:javascript|data|vbscript|file|blob):" }, "description": "The trust mark type." }, "issuer": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^https://[!#-;=?-\\[\\]-~]+$", "description": "The trust mark issuer’s entity id." } }, "required": [ "id", "issuer" ], "additionalProperties": false }, "minItems": 0, "maxItems": 16 } }, "required": [ "entityId", "trustMarks" ], "additionalProperties": false }, "redirect": { "type": "object", "description": "Where the code goes, from the redirect URI the request was bound to. Absent when no code goes anywhere, as on a logout. Always present on the `consent` step of an `unverified` client, whose screen shows where the code goes as the only fact it can check (ADR-019 Decision 6).", "properties": { "target": { "type": "string", "enum": [ "host", "this_device", "app" ], "description": "Where the authorization code goes: a web host, a loopback address (shown as \"this device\", with a warning), or a native app’s own URI scheme." }, "host": { "type": "string", "minLength": 1, "maxLength": 253, "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$", "description": "For `host`: the host that receives the code." }, "scheme": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[a-z][a-z0-9+.-]*$", "description": "For `app`: the URI scheme of the app." } }, "required": [ "target" ], "allOf": [ { "if": { "properties": { "target": { "const": "host" } }, "required": [ "target" ] }, "then": { "required": [ "host" ] } }, { "if": { "properties": { "target": { "const": "app" } }, "required": [ "target" ] }, "then": { "required": [ "scheme" ] } } ], "additionalProperties": false }, "declaredName": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "declared", "description": "The name the client declared about itself: length-capped and stripped. The screen marks it as declared and never shows it above or instead of the verified data." }, "logo": { "$ref": "#/components/schemas/Asset" }, "newClient": { "type": "boolean", "description": "Whether the client registered itself recently: the screen shows a badge." } }, "required": [ "kind", "newClient" ], "allOf": [ { "if": { "properties": { "kind": { "enum": [ "cimd", "admin_registered" ] } }, "required": [ "kind" ] }, "then": { "required": [ "verifiedDomain" ], "properties": { "federation": { "not": {} } } } }, { "if": { "properties": { "kind": { "const": "federation" } }, "required": [ "kind" ] }, "then": { "required": [ "federation" ], "properties": { "verifiedDomain": { "not": {} } } } }, { "if": { "properties": { "kind": { "const": "unverified" } }, "required": [ "kind" ] }, "then": { "properties": { "verifiedDomain": { "not": {} }, "federation": { "not": {} }, "logo": { "not": {} } } } } ], "additionalProperties": false }, "Brand": { "type": "object", "description": "The realm’s brand settings, the theme tier of ADR-019 Decision 5: a logo, colours, a font from a safe list, links, per-locale strings and dark mode. No uploaded templates, CSS or script. Admins set them in the admin console; a realm that set nothing gets the defaults, and every member left out keeps the ceremony app’s own.", "properties": { "logo": { "type": "object", "description": "The realm’s logo, for light and, optionally, dark mode. Absent when no admin uploaded one: the page shows the service’s name.", "properties": { "light": { "$ref": "#/components/schemas/Asset" }, "dark": { "$ref": "#/components/schemas/Asset" } }, "required": [ "light" ], "additionalProperties": false }, "colors": { "type": "object", "description": "The brand colours. The ceremony app derives text colours from them and keeps WCAG 2.2 AA contrast.", "properties": { "light": { "type": "object", "description": "Colours for one colour scheme. A colour left out keeps the ceremony app’s default.", "properties": { "primary": { "type": "string", "minLength": 7, "maxLength": 7, "pattern": "^#[0-9a-f]{6}$", "description": "The brand colour of buttons and links." }, "background": { "type": "string", "minLength": 7, "maxLength": 7, "pattern": "^#[0-9a-f]{6}$", "description": "The page background." } }, "additionalProperties": false }, "dark": { "type": "object", "description": "Colours for one colour scheme. A colour left out keeps the ceremony app’s default.", "properties": { "primary": { "type": "string", "minLength": 7, "maxLength": 7, "pattern": "^#[0-9a-f]{6}$", "description": "The brand colour of buttons and links." }, "background": { "type": "string", "minLength": 7, "maxLength": 7, "pattern": "^#[0-9a-f]{6}$", "description": "The page background." } }, "additionalProperties": false } }, "additionalProperties": false }, "font": { "type": "string", "maxLength": 32, "pattern": "^[a-z][a-z0-9_]{0,31}$", "x-extensible-enum": [ "system", "inter", "noto_sans", "atkinson_hyperlegible", "ibm_plex_sans", "source_sans_3" ], "description": "A font from the safe list the ceremony app serves from the realm origin. `system` loads none and uses the platform’s interface font. A page that does not know a value uses `system`.", "default": "system" }, "links": { "type": "object", "description": "Links the pages show in their footer, when set.", "properties": { "terms": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^https://[!#-;=?-\\[\\]-~]+$", "description": "The terms of service." }, "privacy": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^https://[!#-;=?-\\[\\]-~]+$", "description": "The privacy notice." }, "help": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^https://[!#-;=?-\\[\\]-~]+$", "description": "Where to get help." } }, "additionalProperties": false }, "strings": { "type": "object", "description": "The realm’s strings, by locale. The page picks the first of the interaction’s `uiLocales` it has strings for, then its own default.", "maxProperties": 32, "propertyNames": { "type": "string", "minLength": 2, "maxLength": 35, "pattern": "^[a-z]{2,3}(?:-[A-Za-z0-9]{1,8})*$", "description": "A BCP 47 language tag." }, "additionalProperties": { "$ref": "#/components/schemas/BrandStrings" } }, "darkMode": { "type": "string", "enum": [ "enabled", "disabled" ], "description": "`enabled`: the pages follow the system setting and offer a switch. `disabled`: the realm turned dark mode off on its sign-in pages (ADR-020 §5).", "default": "enabled" } }, "required": [ "font", "darkMode" ], "additionalProperties": false }, "BrandStrings": { "type": "object", "description": "The realm’s own strings for one locale. A string left out keeps the ceremony app’s text.", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "realm", "description": "The service’s display name, in headings and as the logo’s text alternative." }, "title": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "realm", "description": "The sign-in page heading." }, "footer": { "type": "string", "minLength": 1, "maxLength": 280, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "realm", "description": "A short notice at the foot of every page." } }, "additionalProperties": false }, "Asset": { "type": "object", "description": "An image an admin uploaded, re-encoded by the server and served from the realm origin. Never a URL a client supplied (ADR-019 Decision 6).", "properties": { "url": { "type": "string", "minLength": 2, "maxLength": 255, "pattern": "^(?:/[A-Za-z0-9_~-][A-Za-z0-9._~-]*)+$", "description": "Where the realm origin serves the image." }, "width": { "type": "integer", "minimum": 1, "maximum": 2048, "description": "Its width in pixels." }, "height": { "type": "integer", "minimum": 1, "maximum": 2048, "description": "Its height in pixels." } }, "required": [ "url", "width", "height" ], "additionalProperties": false }, "Problem": { "type": "object", "description": "An RFC 9457 problem details document with a stable `code` and a `trace_id`, and no prose: no `detail`, no `instance`, no `errors`.", "properties": { "type": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^[a-z][a-z0-9+.-]*:[!#-;=?-\\[\\]-~]+$", "not": { "type": "string", "pattern": "^(?:javascript|data|vbscript|file|blob):" }, "description": "RFC 9457 §3.1.1: `https://docs.qauth.dev/reference/problem-types/#` followed by the type’s slug, a page a person can open. A page never dereferences it, and branches on `code`, never on `type`." }, "title": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[A-Za-z][A-Za-z -]*$", "description": "The problem type’s title (RFC 9457 §3.1.3), the same in every document with this code. Not for branching, and not for a screen." }, "status": { "type": "integer", "minimum": 400, "maximum": 599, "description": "The HTTP status, repeated." }, "code": { "type": "string", "maxLength": 64, "pattern": "^[a-z][a-z0-9_]{0,63}$", "x-extensible-enum": [ "bad_request", "invalid_answer", "forbidden", "interaction_expired", "content_too_large", "unsupported_media_type", "misdirected_request", "too_many_requests", "internal_error", "service_unavailable" ], "description": "The error, from the published list. A page shows its own text for it, and treats a code it does not know by its HTTP status." }, "trace_id": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[!#-;=?-~]+$", "description": "The id the server logged the request under. A page shows it, so an operator can find the failure (ADR-020 §3)." }, "detail": { "not": {}, "description": "Never sent: no prose." }, "instance": { "not": {}, "description": "Never sent." }, "errors": { "not": {}, "description": "Never sent: a refused answer comes back as its step’s `error`." } }, "required": [ "type", "title", "status", "code", "trace_id" ] }, "IdentifierParams": { "type": "object", "properties": {}, "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:identifier:v1-rc.0", "transports": [ "interaction", "fipa" ], "errors": [], "amr": [] } }, "IdentifierAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:identifier:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:identifier:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "login_hint": { "type": "string", "minLength": 3, "maxLength": 254, "pattern": "^[^@\\s]+@[^@\\s]+$", "description": "The identifier: today an email address of at most 254 bytes in UTF-8 (ADR-017 Decision 3). The schema counts characters; the server counts bytes, checks the full email syntax and normalises the address before use." } }, "required": [ "type", "csrf", "login_hint" ], "additionalProperties": false }, "IdentifierPersonalData": { "type": "object", "properties": {}, "additionalProperties": false }, "PasswordParams": { "type": "object", "properties": {}, "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:password:v1-rc.0", "transports": [ "interaction", "fipa" ], "errors": [ "invalid_credentials" ], "amr": [ "pwd" ] } }, "PasswordAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:password:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:password:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "password": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The password. The server refuses one longer than 256 UTF-16 code units before anything else (ADR-017 Decision 8)." }, "login_hint": { "type": "string", "minLength": 3, "maxLength": 254, "pattern": "^[^@\\s]+@[^@\\s]+$", "description": "The identifier: today an email address of at most 254 bytes in UTF-8 (ADR-017 Decision 3). The schema counts characters; the server counts bytes, checks the full email syntax and normalises the address before use. Sent only when the transaction holds no identifier yet: a page that asks for both at once." } }, "required": [ "type", "csrf", "password" ], "additionalProperties": false }, "PasswordPersonalData": { "type": "object", "description": "Who the transaction is for, so the screen can show it with a way to switch accounts. Absent until the transaction has an identifier.", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." } }, "additionalProperties": false }, "EmailCodeParams": { "type": "object", "properties": { "purpose": { "type": "string", "enum": [ "verify_account", "recovery", "confirm_sign_in" ], "description": "Why the code was sent, so one screen can say so: to verify the account, to recover the account, or (FiPA endpoint only; the Interaction API never offers it) to confirm a sign-in after the password." }, "length": { "type": "integer", "enum": [ 6, 8 ], "description": "How many digits the code has: six after a password, eight for recovery and registration." }, "expires_in": { "type": "integer", "minimum": 1, "maximum": 86400, "description": "How many seconds the code stays valid." }, "resend_after": { "type": "integer", "minimum": 0, "maximum": 3600, "description": "How many seconds until another code may be asked for." } }, "required": [ "purpose", "length", "expires_in", "resend_after" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:email_code:v1-rc.0", "transports": [ "interaction", "fipa" ], "errors": [ "invalid_credentials", "code_expired" ], "amr": [] } }, "EmailCodeAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:email_code:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:email_code:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "otp": { "type": "string", "pattern": "^(?:[0-9]{6}|[0-9]{8})$", "description": "The code. Leave it out to ask for a new one." } }, "required": [ "type", "csrf" ], "additionalProperties": false }, "EmailCodePersonalData": { "type": "object", "description": "The address the code went to, when the transaction holds one.", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." } }, "additionalProperties": false }, "NewPasswordParams": { "type": "object", "properties": { "purpose": { "type": "string", "enum": [ "register", "reset", "update_required" ], "description": "Why a new password is asked for, so one screen can say so: a new account, a reset, or a required update." }, "min_length": { "type": "integer", "minimum": 8, "maximum": 256, "description": "The shortest password the policy accepts, in code points." }, "max_length": { "type": "integer", "minimum": 8, "maximum": 256, "description": "The longest password the policy accepts." }, "reasons": { "type": "array", "description": "After a refused answer: why the policy refused it.", "minItems": 1, "maxItems": 4, "uniqueItems": true, "items": { "type": "string", "enum": [ "too_short", "too_long", "blocklisted", "too_weak" ], "description": "One reason." } } }, "required": [ "purpose", "min_length", "max_length" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:new_password:v1-rc.0", "transports": [ "interaction", "fipa" ], "errors": [ "password_rejected" ], "amr": [] } }, "NewPasswordAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:new_password:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:new_password:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "new_password": { "type": "string", "minLength": 1, "maxLength": 256, "description": "The new password." } }, "required": [ "type", "csrf", "new_password" ], "additionalProperties": false }, "NewPasswordPersonalData": { "type": "object", "description": "Who the transaction is for, so the screen can show it with a way to switch accounts. Absent until the transaction has an identifier.", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." } }, "additionalProperties": false }, "PasswordResetParams": { "type": "object", "properties": {}, "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:password_reset:v1-rc.0", "transports": [ "interaction", "fipa" ], "errors": [], "amr": [] } }, "PasswordResetAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:password_reset:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:password_reset:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "login_hint": { "type": "string", "minLength": 3, "maxLength": 254, "pattern": "^[^@\\s]+@[^@\\s]+$", "description": "The identifier: today an email address of at most 254 bytes in UTF-8 (ADR-017 Decision 3). The schema counts characters; the server counts bytes, checks the full email syntax and normalises the address before use. Sent only when the transaction holds no identifier yet." } }, "required": [ "type", "csrf" ], "additionalProperties": false }, "PasswordResetPersonalData": { "type": "object", "properties": {}, "additionalProperties": false }, "CaptchaParams": { "description": "The challenge to solve: the built-in proof of work, or a hosted provider.", "oneOf": [ { "type": "object", "properties": { "provider": { "const": "pow", "description": "The built-in proof of work." }, "challenge": { "type": "string", "minLength": 22, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]{22,128}$", "description": "The puzzle the engine issued." }, "difficulty": { "type": "integer", "minimum": 1, "maximum": 32, "description": "How many leading zero bits the answer must produce." } }, "required": [ "provider", "challenge", "difficulty" ], "additionalProperties": false }, { "type": "object", "properties": { "provider": { "const": "hosted", "description": "A hosted provider the operator named." }, "name": { "type": "string", "minLength": 1, "maxLength": 32, "pattern": "^[a-z][a-z0-9_-]{0,31}$", "description": "The name the operator gave the hosted provider." }, "site_key": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[A-Za-z0-9._-]+$", "description": "The provider’s public site key." } }, "required": [ "provider", "name", "site_key" ], "additionalProperties": false } ], "x-qauth-step": { "name": "urn:qauth:ia:captcha:v1-rc.0", "transports": [ "interaction", "fipa" ], "errors": [ "captcha_failed" ], "amr": [] } }, "CaptchaAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:captcha:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:captcha:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "captcha_token": { "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^[!-~]+$", "description": "The solution, or the provider’s token: printable ASCII, so 4096 characters are 4096 bytes." } }, "required": [ "type", "csrf", "captcha_token" ], "additionalProperties": false }, "CaptchaPersonalData": { "type": "object", "properties": {}, "additionalProperties": false }, "WebauthnGetParams": { "type": "object", "properties": { "challenge": { "type": "string", "minLength": 43, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]{43,128}$", "description": "The challenge, at least 32 random bytes." }, "rpId": { "type": "string", "minLength": 1, "maxLength": 253, "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$", "description": "The relying party ID: the realm’s host." }, "timeout": { "type": "integer", "minimum": 1000, "maximum": 600000, "description": "How long the ceremony may take, in milliseconds." }, "userVerification": { "const": "required", "description": "The server refuses an assertion without user verification." } }, "required": [ "challenge", "rpId", "userVerification" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:webauthn_get:v1-rc.0", "transports": [ "interaction", "fipa" ], "errors": [ "invalid_credentials" ], "amr": [ "pop", "mfa" ] } }, "WebauthnGetAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:webauthn_get:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:webauthn_get:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "webauthn_response": { "type": "string", "minLength": 2, "maxLength": 8192, "contentMediaType": "application/json", "contentSchema": { "type": "object", "properties": { "id": { "type": "string" }, "rawId": { "type": "string" }, "type": { "const": "public-key" }, "response": { "type": "object", "properties": { "clientDataJSON": { "type": "string" }, "authenticatorData": { "type": "string" }, "signature": { "type": "string" }, "userHandle": { "type": "string" } }, "required": [ "clientDataJSON", "authenticatorData", "signature" ] }, "authenticatorAttachment": { "type": "string" }, "clientExtensionResults": { "type": "object" } }, "required": [ "id", "rawId", "type", "response", "clientExtensionResults" ] }, "description": "The authentication response, `PublicKeyCredential.toJSON()` (WebAuthn Level 3), as a JSON string. It is a string on both transports, so a form post carries it in one field (ADR-017 Decision 3)." } }, "required": [ "type", "csrf", "webauthn_response" ], "additionalProperties": false }, "WebauthnGetPersonalData": { "type": "object", "description": "Who the transaction is for, so the screen can show it with a way to switch accounts. Absent until the transaction has an identifier.", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." } }, "additionalProperties": false }, "WebauthnCreateParams": { "type": "object", "properties": { "optional": { "type": "boolean", "description": "Whether this is an offer the person may decline: an answer with no `webauthn_response` declines it." }, "options": { "type": "object", "properties": { "challenge": { "type": "string", "minLength": 43, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]{43,128}$", "description": "The challenge, at least 32 random bytes." }, "rp": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 253, "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$", "description": "The relying party ID: the realm’s host." }, "name": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "realm", "description": "The realm’s display name." } }, "required": [ "id", "name" ], "additionalProperties": false }, "pubKeyCredParams": { "type": "array", "minItems": 1, "maxItems": 8, "description": "The COSE algorithms the server accepts, preferred first.", "items": { "type": "object", "properties": { "type": { "const": "public-key" }, "alg": { "type": "integer", "enum": [ -8, -7, -257 ], "description": "EdDSA, ES256 or RS256." } }, "required": [ "type", "alg" ], "additionalProperties": false } }, "timeout": { "type": "integer", "minimum": 1000, "maximum": 600000, "description": "How long the ceremony may take, in milliseconds." }, "authenticatorSelection": { "type": "object", "properties": { "residentKey": { "const": "required", "description": "A passkey is discoverable." }, "userVerification": { "const": "required" } }, "required": [ "residentKey", "userVerification" ], "additionalProperties": false }, "attestation": { "const": "none", "description": "QAuth asks for no attestation and claims nothing about the key store." } }, "required": [ "challenge", "rp", "pubKeyCredParams", "authenticatorSelection", "attestation" ], "additionalProperties": false } }, "required": [ "optional", "options" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:webauthn_create:v1-rc.0", "transports": [ "interaction", "fipa" ], "errors": [ "invalid_credentials" ], "amr": [] } }, "WebauthnCreateAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:webauthn_create:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:webauthn_create:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "webauthn_response": { "type": "string", "minLength": 2, "maxLength": 16384, "contentMediaType": "application/json", "contentSchema": { "type": "object", "properties": { "id": { "type": "string" }, "rawId": { "type": "string" }, "type": { "const": "public-key" }, "response": { "type": "object", "properties": { "clientDataJSON": { "type": "string" }, "attestationObject": { "type": "string" }, "transports": { "type": "array", "items": { "type": "string" } } }, "required": [ "clientDataJSON", "attestationObject" ] }, "authenticatorAttachment": { "type": "string" }, "clientExtensionResults": { "type": "object" } }, "required": [ "id", "rawId", "type", "response", "clientExtensionResults" ] }, "description": "The registration response, `PublicKeyCredential.toJSON()` (WebAuthn Level 3), as a JSON string. It is a string on both transports, so a form post carries it in one field (ADR-017 Decision 3)." } }, "required": [ "type", "csrf" ], "additionalProperties": false }, "WebauthnCreatePersonalData": { "type": "object", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." }, "user": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 86, "pattern": "^[A-Za-z0-9_-]{1,86}$", "description": "The user handle: an opaque id, at most 64 bytes." }, "name": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The account name the authenticator shows." }, "displayName": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The display name the authenticator shows." } }, "required": [ "id", "name", "displayName" ], "additionalProperties": false }, "excludeCredentials": { "type": "array", "description": "The account’s passkeys, so the authenticator does not make a second one.", "minItems": 0, "maxItems": 32, "items": { "type": "object", "properties": { "type": { "const": "public-key" }, "id": { "type": "string", "minLength": 1, "maxLength": 1366, "pattern": "^[A-Za-z0-9_-]{1,1366}$", "description": "The credential id." }, "transports": { "type": "array", "maxItems": 6, "items": { "type": "string", "enum": [ "ble", "hybrid", "internal", "nfc", "smart-card", "usb" ], "description": "How the authenticator is reached." } } }, "required": [ "type", "id" ], "additionalProperties": false } } }, "required": [ "user", "excludeCredentials" ], "additionalProperties": false }, "TotpParams": { "type": "object", "properties": { "digits": { "type": "integer", "enum": [ 6 ], "description": "How many digits the code has." } }, "required": [ "digits" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:totp:v1-rc.0", "transports": [ "interaction", "fipa" ], "errors": [ "invalid_credentials" ], "amr": [ "otp" ] } }, "TotpAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:totp:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:totp:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "otp": { "type": "string", "pattern": "^[0-9]{6}$", "description": "The six digits the authenticator app shows." } }, "required": [ "type", "csrf", "otp" ], "additionalProperties": false }, "TotpPersonalData": { "type": "object", "description": "Who the transaction is for, so the screen can show it with a way to switch accounts. Absent until the transaction has an identifier.", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." } }, "additionalProperties": false }, "RecoveryCodeParams": { "type": "object", "properties": {}, "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:recovery_code:v1-rc.0", "transports": [ "interaction" ], "errors": [ "invalid_credentials" ], "amr": [] } }, "RecoveryCodeAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:recovery_code:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:recovery_code:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "recovery_code": { "type": "string", "minLength": 16, "maxLength": 39, "pattern": "^[A-Za-z0-9 -]+$", "description": "The code as the person typed it. The server ignores case, spaces and dashes before comparing." } }, "required": [ "type", "csrf", "recovery_code" ], "additionalProperties": false }, "RecoveryCodePersonalData": { "type": "object", "description": "Who the transaction is for, so the screen can show it with a way to switch accounts. Absent until the transaction has an identifier.", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." } }, "additionalProperties": false }, "RecoveryCodesParams": { "type": "object", "properties": { "count": { "type": "integer", "enum": [ 10 ], "description": "How many codes the set holds." } }, "required": [ "count" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:recovery_codes:v1-rc.0", "transports": [ "interaction" ], "errors": [], "amr": [] } }, "RecoveryCodesAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:recovery_codes:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:recovery_codes:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "acknowledged": { "const": true, "description": "The person confirms they saved the codes. In a form post: `true`." } }, "required": [ "type", "csrf", "acknowledged" ], "additionalProperties": false }, "RecoveryCodesPersonalData": { "type": "object", "properties": { "codes": { "type": "array", "description": "The codes, each usable once.", "minItems": 10, "maxItems": 10, "uniqueItems": true, "items": { "type": "string", "minLength": 19, "maxLength": 19, "pattern": "^[a-z2-7]{4}-[a-z2-7]{4}-[a-z2-7]{4}-[a-z2-7]{4}$", "description": "One code." } } }, "required": [ "codes" ], "additionalProperties": false }, "TotpSetupParams": { "type": "object", "properties": { "algorithm": { "type": "string", "enum": [ "SHA1" ], "description": "The HMAC algorithm." }, "digits": { "type": "integer", "enum": [ 6 ], "description": "How many digits a code has." }, "period": { "type": "integer", "enum": [ 30 ], "description": "How many seconds a code lasts." } }, "required": [ "algorithm", "digits", "period" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:totp_setup:v1-rc.0", "transports": [ "interaction" ], "errors": [ "invalid_credentials" ], "amr": [] } }, "TotpSetupAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:totp_setup:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:totp_setup:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "otp": { "type": "string", "pattern": "^[0-9]{6}$", "description": "The six digits the authenticator app shows." } }, "required": [ "type", "csrf", "otp" ], "additionalProperties": false }, "TotpSetupPersonalData": { "type": "object", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." }, "secret": { "type": "string", "minLength": 32, "maxLength": 32, "pattern": "^[A-Z2-7]{32}$", "description": "The shared secret, 160 bits in base32 (RFC 4648 §6), unpadded." }, "otpauth_uri": { "type": "string", "format": "uri", "maxLength": 1024, "pattern": "^otpauth://totp/[!#-;=?-\\[\\]-~]+$", "description": "The same secret as an `otpauth://` URI, for the QR code." } }, "required": [ "secret", "otpauth_uri" ], "additionalProperties": false }, "ConsentParams": { "type": "object", "properties": { "scopes": { "type": "array", "description": "The scopes asked for, in the order the screen lists them.", "minItems": 1, "maxItems": 64, "items": { "type": "object", "properties": { "scope": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[!#-;=?-\\[\\]-~]+$", "description": "The scope value (RFC 6749 §3.3), from its alphabet without `<` and `>`. A requested scope outside it never reaches this step: the request is refused first." }, "text": { "type": "string", "minLength": 1, "maxLength": 280, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "realm", "description": "The consent text the realm’s scope catalog holds for this scope, in the interaction’s locale. Absent when the catalog has none: the screen shows the scope value." }, "sensitive": { "type": "boolean", "description": "Whether the realm flagged the scope as sensitive." }, "dangerous": { "type": "boolean", "description": "Whether the scope is dangerous (`write:*`, `agent:admin`, `agent:exec`): it always needs consent and a fresh sign-in." } }, "required": [ "scope", "sensitive", "dangerous" ], "additionalProperties": false } }, "resources": { "type": "array", "description": "Where the tokens may be used: the resource indicators (RFC 8707) of the request.", "minItems": 0, "maxItems": 16, "items": { "type": "string", "format": "uri", "maxLength": 2048, "pattern": "^[a-z][a-z0-9+.-]*:[!#-;=?-\\[\\]-~]+$", "not": { "type": "string", "pattern": "^(?:javascript|data|vbscript|file|blob):" }, "description": "One resource indicator, as the request named it. The request chose it, so the screen marks it as asked for by the app.", "x-qauth-declared": true } }, "remember_default": { "type": "boolean", "description": "Whether \"remember this decision\" starts checked." } }, "required": [ "scopes", "resources", "remember_default" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:consent:v1-rc.0", "transports": [ "interaction" ], "errors": [], "amr": [] } }, "ConsentAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:consent:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:consent:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "decision": { "type": "string", "enum": [ "allow", "deny" ], "description": "The decision." }, "remember": { "type": "boolean", "default": false, "description": "Whether to remember an `allow` for later requests that fit it. In a form post the checkbox sends `true`, and its absence means `false`." } }, "required": [ "type", "csrf", "decision" ], "additionalProperties": false }, "ConsentPersonalData": { "type": "object", "description": "Who the transaction is for, so the screen can show it with a way to switch accounts. Absent until the transaction has an identifier.", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." } }, "additionalProperties": false }, "SelectAccountParams": { "type": "object", "properties": {}, "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:select_account:v1-rc.0", "transports": [ "interaction" ], "errors": [ "account_unavailable" ], "amr": [] } }, "SelectAccountAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:select_account:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:select_account:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "account": { "type": "string", "minLength": 22, "maxLength": 64, "pattern": "^[A-Za-z0-9_-]{22,64}$", "description": "The `account` reference of the chosen entry." } }, "required": [ "type", "csrf", "account" ], "additionalProperties": false }, "SelectAccountPersonalData": { "type": "object", "properties": { "accounts": { "type": "array", "description": "The accounts the browser holds a session for, the current one first.", "minItems": 1, "maxItems": 16, "items": { "type": "object", "properties": { "account": { "type": "string", "minLength": 22, "maxLength": 64, "pattern": "^[A-Za-z0-9_-]{22,64}$", "description": "An opaque reference to the account’s session, valid for this interaction only." }, "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." }, "current": { "type": "boolean", "description": "Whether this is the account the browser last used." } }, "required": [ "account", "identifier", "current" ], "additionalProperties": false } } }, "required": [ "accounts" ], "additionalProperties": false }, "DeviceCodeParams": { "type": "object", "properties": { "length": { "type": "integer", "enum": [ 8 ], "description": "How many characters the code has, without the dash." } }, "required": [ "length" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:device_code:v1-rc.0", "transports": [ "interaction" ], "errors": [ "invalid_user_code" ], "amr": [] } }, "DeviceCodeAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:device_code:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:device_code:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "user_code": { "type": "string", "minLength": 1, "maxLength": 32, "pattern": "^[A-Za-z -]+$", "description": "The code as typed. The server ignores case, spaces and dashes (RFC 8628 §6.1)." } }, "required": [ "type", "csrf", "user_code" ], "additionalProperties": false }, "DeviceCodePersonalData": { "type": "object", "properties": {}, "additionalProperties": false }, "DeviceConfirmParams": { "type": "object", "properties": { "user_code": { "type": "string", "minLength": 9, "maxLength": 9, "pattern": "^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$", "description": "The code being confirmed, so the person can compare it with the device." }, "requested_at": { "type": "string", "format": "date-time", "maxLength": 30, "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{1,9})?Z$", "description": "When the device started the request." } }, "required": [ "user_code", "requested_at" ], "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:device_confirm:v1-rc.0", "transports": [ "interaction" ], "errors": [], "amr": [] } }, "DeviceConfirmAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:device_confirm:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:device_confirm:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "decision": { "type": "string", "enum": [ "confirm", "deny" ], "description": "The decision." } }, "required": [ "type", "csrf", "decision" ], "additionalProperties": false }, "DeviceConfirmPersonalData": { "type": "object", "properties": { "location": { "type": "object", "description": "Where the requesting address is, approximately. Absent when the lookup knows nothing.", "properties": { "country": { "type": "string", "minLength": 2, "maxLength": 2, "pattern": "^[A-Z]{2}$", "description": "The ISO 3166-1 alpha-2 country of the requesting address." }, "region": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "server", "description": "The region of the requesting address." } }, "additionalProperties": false }, "network": { "type": "object", "description": "The network the request came from.", "properties": { "asn": { "type": "integer", "minimum": 1, "maximum": 4294967295, "description": "The autonomous system number of the requesting address." }, "name": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "declared", "description": "The name of that network, as its registrant declared it in the address registry. The registrant chose it, so the screen marks it as declared." } }, "additionalProperties": false }, "user_agent": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "declared", "description": "The user agent the device declared, cut and stripped. The device chose it, so the screen marks it as declared." } }, "additionalProperties": false }, "LogoutConfirmParams": { "type": "object", "properties": {}, "additionalProperties": false, "x-qauth-step": { "name": "urn:qauth:ia:logout_confirm:v1-rc.0", "transports": [ "interaction" ], "errors": [], "amr": [] } }, "LogoutConfirmAnswer": { "type": "object", "description": "An answer to `urn:qauth:ia:logout_confirm:v1-rc.0`.", "properties": { "type": { "const": "urn:qauth:ia:logout_confirm:v1-rc.0", "description": "The step this request answers." }, "csrf": { "$ref": "#/components/schemas/Csrf" }, "decision": { "type": "string", "enum": [ "logout", "logout_all", "stay" ], "description": "Sign out of this account, of every account on the browser, or stay signed in." } }, "required": [ "type", "csrf", "decision" ], "additionalProperties": false }, "LogoutConfirmPersonalData": { "type": "object", "properties": { "accounts": { "type": "array", "description": "The accounts signed in on this browser, the one being signed out first.", "minItems": 1, "maxItems": 16, "items": { "type": "object", "properties": { "identifier": { "type": "string", "minLength": 1, "maxLength": 254, "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$", "x-qauth-display": "account", "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it." }, "current": { "type": "boolean", "description": "Whether this is the account the logout request is for." } }, "required": [ "identifier", "current" ], "additionalProperties": false } } }, "required": [ "accounts" ], "additionalProperties": false } } } }