Xeonr Developer Docs
API SpecificationPRIVATEOAuth Provider

Complete OAuth Flow

POST
/xeonr.auth.private.v1.OAuthService/CompleteOAuthFlow

Completes the OAuth authorisation flow after user consent, generating an authorisation code and returning the redirect URL.

Required scopes: private

Authorization

BearerAuth
AuthorizationBearer <token>

JWT access token for internal API access. Requires 'private' scope for most endpoints, 'admin' scope for administrative operations.

In: header

Header Parameters

Connect-Protocol-Version*number

Define the version of the Connect protocol

Value in1
Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

acceptType?string

Indicates if the user accepts the OAuth flow

Value in"ACCEPT_TYPE_DENY" | "ACCEPT_TYPE_ALLOW" | "ACCEPT_TYPE_ALLOW_WITH_EXISTING_GRANT"
responseType?string

Type of response expected from the OAuth flow

codeChallenge?string|null

Code challenge for PKCE

codeChallengeMethod?string
Value in"CODE_CHALLENGE_METHOD_UNSPECIFIED" | "CODE_CHALLENGE_METHOD_PLAIN" | "CODE_CHALLENGE_METHOD_S256"
state?string

State parameter to maintain state between request and callback

redirectUri?string

URI to redirect to after completing the OAuth flow

Formaturi
Length1 <= length <= 1024
scope?scope

Scopes requested during the OAuth flow

Items1 <= items
forever?boolean

Indicates if the authorization should be long-lived

clientId?string
Formatuuid
withoutApproval?boolean

If set, the request will only succeed if we can skip the OAuth flow.

nonce?string|null
Length1 <= length <= 1024
resource?string|null

RFC 8707: Resource indicator to restrict token audience

Formaturi
maxAge?integer|null

OIDC: Maximum authentication age in seconds. Forces re-auth if auth_time is older.

Formatint32
acrValues?string|null

OIDC: Requested Authentication Context Class Reference values (space-separated)

[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://auth.xeonr.io/xeonr.auth.private.v1.OAuthService/CompleteOAuthFlow" \  -H "Connect-Protocol-Version: 1" \  -H "Content-Type: application/json" \  -d '{}'
{
  "url": "https://myapp.example.com/oauth/callback?code=abc123&state=xyz123state"
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Complete OAuth Code POST

Completes the device code flow by approving or denying the authorisation request. **Required scopes:** `private`

Get Public Client POST

Retrieves public details of an OAuth client for displaying on the consent screen, including requested scopes and user permissions. **Required scopes:** `private`