CORS

CORS preflight for registered client origins. 2 operations

Expand an endpoint for authentication, parameters, request fields and responses.

OPTIONS/realms/{realm}/+

CORS preflight

Matches every path below this prefix (Go ServeMux subtree pattern). Only origins registered on active clients are reflected; credentials are allowed only for /auth/ paths. Always returns 204.

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-metadataPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

204 No Content

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Access-Control-Allow-Origin": {
    "schema": {
      "type": "string"
    }
  },
  "Access-Control-Allow-Methods": {
    "schema": {
      "type": "string"
    }
  },
  "Access-Control-Allow-Headers": {
    "schema": {
      "type": "string"
    }
  },
  "Access-Control-Max-Age": {
    "schema": {
      "type": "string"
    }
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation corsPreflightProtocol · Schema definitions · OpenAPI contract

OPTIONS/api/v1/realms/{realm}/+

CORS preflight

Matches every path below this prefix (Go ServeMux subtree pattern). Only origins registered on active clients are reflected; credentials are allowed only for /auth/ paths. Always returns 204.

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-metadataPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

204 No Content

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Access-Control-Allow-Origin": {
    "schema": {
      "type": "string"
    }
  },
  "Access-Control-Allow-Methods": {
    "schema": {
      "type": "string"
    }
  },
  "Access-Control-Allow-Headers": {
    "schema": {
      "type": "string"
    }
  },
  "Access-Control-Max-Age": {
    "schema": {
      "type": "string"
    }
  }
}

503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation corsPreflightApi · Schema definitions · OpenAPI contract