Begin an OIDC identity-linking ceremony

POST 
/api/v1/auth/identities/oidc/:provider_id/start

Requires a normal authenticated session and same-origin request. The verified callback can only add a credential to that exact recently authenticated local account; it cannot admit a new account or issue a replacement session.

Request

Responses

200

Browser authorization URL and correlation cookie

401

The opaque credential is absent, ambiguous, malformed, expired, revoked, or invalid

403

The browser mutation did not originate from this application, or the authenticated member lacks the required permission

404

OIDC is disabled

429

OIDC start capacity is busy; retry with backoff

503

A required core dependency is unavailable; retry with bounded backoff