# unsupported_response_type

The authorization request asked for a response type this server does not serve (RFC 6749 §4.1.2.1).

## Meaning

This server serves the authorization code flow, and the OpenID Connect implicit flow
(`id_token` and `id_token token`) only where `issuer.implicit_flow` is on and the
organization is not in FAPI mode. A `response_type` outside those three in the query
fails schema validation and gets a problem document instead; this error is sent when the
request has no `response_type` at all, when it asks for an implicit type the
organization does not serve, or when the value that counts is inside a signed request
object or a pushed request and is not served. At `/authorize` it is redirected to the
client's validated redirect URI; at `/par` it is the response body.

## Impact

The flow never starts. It is a client bug, a library configured for the hybrid flow, or
an implicit client against an organization that does not serve the implicit flow; the
user is returned to the application with the error before any sign-in.

## Diagnosis

1. Check the `response_type` the client sends, including inside its request object.
2. Read `response_types_supported` in the organization's discovery document: the
   implicit types appear only where the organization serves them.
3. The audit record under `oauth.authorization.requested` has reason
   `unsupported_response_type` and cause `response_type_unsupported`. Find it by
   `X-Request-ID`, or filter the Audit log by client and reason.

## Mitigation

- As a client developer: send `response_type=code` with PKCE. Disable implicit and
  hybrid options in your OpenID Connect library.
- As an operator: if a relying party cannot move off the implicit flow, set
  `issuer.implicit_flow: true`. An organization in FAPI mode never serves it.
- As a user: tell the application's owner.

## Escalation

If `response_type=code`, or an implicit type the discovery document lists, is refused,
open an issue with the request id and the server version. Never attach the request
object.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.