OAuth 2.0 Pushed Authorization Request (PAR)
POST/api/oauth/:OAuthAppName/par
Accepts an OAuth 2.0 authorization request and stores it server-side per RFC 9126 (OAuth 2.0 Pushed Authorization Requests). Returns a short-lived request_uri that the client passes as the sole parameter to the authorization endpoint, keeping all sensitive request parameters out of the browser URL. This feature must be explicitly enabled on the OAuth application configuration.
Request
Responses
- 201
- 400
- 403
Created: PAR accepted. Use the returned request_uri as the sole parameter to the authorization endpoint within expires_in seconds.
Status Bad Request: One or more request parameters are missing or invalid.
Status Forbidden: The application or client is not permitted to use this endpoint.