Pushed Authorization Request (RFC 9126)
/parAccepts the authorization-request parameters directly from a
client-authenticated back channel and returns a single-use request_uri
the client then passes to /authorize. Hardens the flow against
request tampering and oversized front-channel requests. request_uri
MUST NOT be present in the PAR body.
- Authorizationstring
The access token, as
Bearer <token>(RFC 6750 §2.1) or, for a sender-constrained token,DPoP <token>(RFC 9449 §7.1). A token minted with acnf.jktconfirmation is only accepted together with aDPoPproof signed by that key, whichever of the two schemes carries it. - DPoPstring
DPoP proof JWT (RFC 9449 §4). REQUIRED on a request presenting a DPoP-bound access token, and it must be signed by the key named in the token's
cnf.jktand cover this request's method and URI. The proof is read from the request itself rather than from this decoded parameter, so every protected operation is covered whether or not it declares it.
Request body
Authorization-request parameters pushed to the PAR endpoint (RFC 9126). Mirrors the /authorize query parameters plus client authentication.
- request_uristring
MUST NOT be sent; present only so the server can reject it.
at most 512 characters
- response_typeenumPossible values
"code" - max_ageinteger · int64
at least 0
- client_idstringExample
"nauthera_2Rk9"1–256 characters · pattern
^[!-~]+$ - redirect_uristring · uriExample
"https://app.example.com/callback"at most 2048 characters
- scopestringExample
"openid profile email"at most 2048 characters · pattern
^\S+( \S+)*$ - statestring
at most 1024 characters
- noncestring
at most 1024 characters
- response_modeenumPossible values
"query""fragment""form_post" - promptstring
at most 64 characters · pattern
^(none|login|consent|select_account)( (none|login|consent|select_account))*$ - login_hintstring
at most 512 characters
- ui_localesstring
at most 256 characters · pattern
^\S+( \S+)*$ - acr_valuesstring
at most 512 characters · pattern
^\S+( \S+)*$ - claimsstring
at most 8192 characters
- code_challengestring
43–128 characters · pattern
^[A-Za-z0-9_-]+$ - Possible values
"S256" - requeststring
at most 16384 characters
- resourcestring · uri
at most 2048 characters
- dpop_jktstring
exactly 43 characters · pattern
^[A-Za-z0-9_-]+$ - client_secretstring
at most 512 characters
- client_assertion_typestringExample
"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"at most 128 characters
- client_assertionstring
at most 16384 characters
201 Createdapplication/jsonThe pushed request was accepted.
The pushed request was accepted.
Headers
Cache-Controlno-store
Body
A pushed authorization request reference (RFC 9126 §2.2).
Single-use reference passed to /authorize.
Example"urn:ietf:params:oauth:request_uri:6esc_11ACC5bwc014ltc14eY22c"Lifetime of the request_uri in seconds.
Example90
429 Too Many Requestsapplication/problem+jsonToo many requests.
Too many requests.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json).
codeis a stable machine-readable slug for the problem kind (it mirrors the suffix oftype), so consumers can branch on it without parsing prose.errorsis present on validation failures and lists every offending field.- Example
"Request validation failed" - Example
400 - typestring · uriExample
"urn:problem-type:validation_error" - detailstringExample
"One or more fields did not satisfy the API schema." - codeenum
The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing
titleordetail, which are English prose for logs. A problem whose status says everything the server knows carries nocode.Show moreShow less
validation_erroris the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are theerrorslist — one entry per offending field — which a form renders on those fields.requiredandmalformedare spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.Compatibility: this is a CLOSED enum, with the same cost as
AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error" - instancestringExample
"/introspect" - request_idstringExample
"8d94ed49-1caf-4ab3-9594-557142f2d023" - trace_idstring
Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
Example"4bf92f3577b34da6a3ce929d0e0e4736" - errorsarray of objects
Field-level violations (present for validation errors).
Each item:A single field-level validation violation.
Show item attributesHide item attributes
Offending field, dotted for nested bodies (e.g. child.id).
Example"token_type_hint"Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
Example"not_allowed"- Example
"field token_type_hint must be one of [access_token, refresh_token]"
Errorapplication/jsonOAuth2 error response (RFC 6749 §5.2).
OAuth2 error response (RFC 6749 §5.2).
Headers
Cache-Controlno-storeWWW-AuthenticatestringDPoP-Noncestring
Body
An OAuth2 error response (RFC 6749 §5.2).
iss(RFC 9207) is present on authorization-endpoint error responses so clients can detect mix-up.A single ASCII error code.
Example"invalid_request"- error_descriptionstringExample
"client_id, redirect_uri and response_type are required" - error_uristring · uri
- statestring
Echoed authorization-request state (RFC 6749 §4.1.2.1).
- issstring · uri
Issuer identifier on authorization error responses (RFC 9207).