Begin an OIDC authorization-code + PKCE browser flow
POST/api/v1/auth/oidc/:provider_id/start
Requires same-origin JSON. The result is an authorization URL and a short-lived host-only HttpOnly SameSite=Lax correlation cookie; no provider tokens are returned to browser JavaScript.
Request
Responses
- 200
- 400
- 403
- 404
- 421
- 429
- 503
Browser authorization URL and correlation cookie
Response Headers
Always no-store
One or more host-only HttpOnly OIDC correlation-cookie headers
Opaque request correlation identifier. ProblemDetails.requestId carries the same value on JSON failures.
The request syntax, headers, body, or validated input is malformed or invalid
Response Headers
Opaque request correlation identifier. ProblemDetails.requestId carries the same value on JSON failures.
The browser mutation did not originate from this application, or the authenticated member lacks the required permission
Response Headers
Opaque request correlation identifier. ProblemDetails.requestId carries the same value on JSON failures.
OIDC is disabled
Response Headers
Opaque request correlation identifier. ProblemDetails.requestId carries the same value on JSON failures.
The request authority or direct peer is outside the configured Jiandu ingress boundary
Response Headers
Opaque request correlation identifier. ProblemDetails.requestId carries the same value on JSON failures.
The trusted connection peer or global OIDC start capacity is busy; retry with backoff
Response Headers
Opaque request correlation identifier. ProblemDetails.requestId carries the same value on JSON failures.
A required core dependency is unavailable; retry with bounded backoff
Response Headers
Opaque request correlation identifier. ProblemDetails.requestId carries the same value on JSON failures.