Sessions
Obtaining, inspecting and ending a credential.
| Operation | Auth | Purpose |
|---|---|---|
POST /api/v1/session | — | Log in with a user name and password (SRP), and receive a bearer credential. |
DELETE /api/v1/session | — | End a session. Idempotent. |
POST /api/v1/session/certificate/challenge | — | Certificate login, leg 1: present a certificate and receive the 89 bytes to sign. |
POST /api/v1/session/certificate | — | Certificate login, leg 2: answer with the signature and receive a bearer credential. |
POST /api/v1/session/delegated | Bearer + DPoP | Mint a session acting as an externally-authenticated principal. Guarded. |
POST /api/v1/session/scoped | Bearer + DPoP | Mint a short-lived, object-scoped, key-bound credential for a browser. Guarded. |
GET /api/v1/session/scoped | Bearer + DPoP | Report the object scope of the calling session, if it has one. |
POST /api/v1/session/scoped/revoke | Bearer + DPoP | Kill a scoped credential before it expires. |
POST /api/v1/auth/oidc/start | — | OpenID Connect sign-in, step 1: name the page key and a redemption challenge; receive a flow. |
GET /api/v1/auth/oidc/launch | — | OpenID Connect sign-in, step 2: the sign-in window; sets the login transaction cookie and redirects to the provider. |
GET /api/v1/auth/oidc/callback/{providerId} | — | OpenID Connect sign-in, step 3: the provider's redirect back; answers the completion page. |
POST /api/v1/auth/oidc/challenge | — | OpenID Connect sign-in, step 4: the redemption secret for one nonce. |
POST /api/v1/session/oidc | — | OpenID Connect sign-in, step 5: redeem the sign-in with a mint proof; receive a sender-constrained bearer session. |
PUT /api/v1/session/password | Bearer + DPoP | Change the calling principal's own password. |
GET /api/v1/session/principal | Bearer + DPoP | Whether the session's principal is still enabled. |