ProudAuthDocs
Documentation/API reference

OIDC

OpenID Connect UserInfo and RP-initiated logout. 7 operations

Expand an endpoint for authentication, parameters, request fields and responses.

GET/realms/{realm}/oidc/userinfo+

UserInfo (GET)

Returns claims permitted by the access token. Missing or invalid tokens return 401 with an empty body and a WWW-Authenticate Bearer challenge.

AuthenticationuserAccessTokenTrust classpublic-protocol-initiationPermissionsSee operation description

Parameters

NameLocationRequiredDetails
realmpathYesRealm name (path-based issuer). Unknown realms return 404.
{"type":"string"}
X-Request-Idheader—Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.
{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}

Responses

200 OK

application/json

FieldTypeRequiredDescription
substringYes

application/jwt

{
  "type": "string"
}

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
400 The client registered response encryption but has no registered public key that can receive it (error invalid_request).
401 Missing or invalid access token (empty body).

Response headers

{
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}
404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation userinfoGet · Schema definitions · OpenAPI contract

POST/realms/{realm}/oidc/userinfo+

UserInfo (POST)

Returns claims permitted by the access token. Missing or invalid tokens return 401 with an empty body and a WWW-Authenticate Bearer challenge.

AuthenticationuserAccessTokenTrust classpublic-protocol-initiationPermissionsSee operation description

Parameters

NameLocationRequiredDetails
realmpathYesRealm name (path-based issuer). Unknown realms return 404.
{"type":"string"}
X-Request-Idheader—Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.
{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}

Responses

200 OK

application/json

FieldTypeRequiredDescription
substringYes

application/jwt

{
  "type": "string"
}

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
400 The client registered response encryption but has no registered public key that can receive it (error invalid_request).
401 Missing or invalid access token (empty body).

Response headers

{
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}
404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation userinfoPost · Schema definitions · OpenAPI contract

GET/realms/{realm}/oidc/check-session+

OpenID Connect Session Management check_session_iframe

OIDC-014, only when the realm policy sets sessions.check_session_iframe (404 otherwise). An HTML page for relying parties to embed: it answers postMessage("client_id session_state") with changed, unchanged or error, only to an origin registered for the client, recomputing session_state from the pa_opbs browser-state cookie and the message origin. Browsers that block or partition third-party cookies make every check report changed; server-side session ends (administrator revocation, timeouts) appear only after the browser next reaches the provider, so relying parties should also use back-channel logout or token introspection.

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-metadataPermissionsSee operation description

Parameters

NameLocationRequiredDetails
realmpathYesRealm name (path-based issuer). Unknown realms return 404.
{"type":"string"}
X-Request-Idheader—Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.
{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}

Responses

200 OK

text/html

{
  "type": "string"
}

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation checkSessionIframe · Schema definitions · OpenAPI contract

GET/realms/{realm}/oidc/check-session/origin+

Check-session iframe origin check

OIDC-014, used by the check_session_iframe page: whether origin is one of the client's allowed origins or the origin of one of its redirect URIs. 404 when session management is off.

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-metadataPermissionsSee operation description

Parameters

NameLocationRequiredDetails
realmpathYesRealm name (path-based issuer). Unknown realms return 404.
{"type":"string"}
X-Request-Idheader—Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.
{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}
client_idqueryYesclient_id
{"type":"string"}
originqueryYesThe origin of the message the iframe received.
{"type":"string"}

Responses

200 OK

application/json

FieldTypeRequiredDescription
allowedbooleanYes

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation checkSessionOrigin · Schema definitions · OpenAPI contract

GET/realms/{realm}/oidc/logout+

RP-initiated logout (GET)

A GET without id_token_hint never ends the browser session silently (the client must POST). Redirects (302) to a registered post_logout_redirect_uri when valid.

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-protocol-initiationPermissionsSee operation description

Parameters

NameLocationRequiredDetails
realmpathYesRealm name (path-based issuer). Unknown realms return 404.
{"type":"string"}
X-Request-Idheader—Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.
{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}
id_token_hintquery—id_token_hint
{"type":"string","x-secret":true}
client_idquery—client_id
{"type":"string"}
post_logout_redirect_uriquery—post_logout_redirect_uri
{"type":"string","format":"uri"}
statequery—state
{"type":"string"}
upstream_logoutquery—Extension (FED-013): also send the browser to the federated provider's logout endpoint when the ended session came from one.
{"type":"string","enum":["true","false"]}

Responses

200 OK

application/json

FieldTypeRequiredDescription
session_endedbooleanYes
frontchannel_logout_urisarray—Front-channel logout (SES-018), only to callers sending Accept: application/json: the front-channel logout URIs of the clients that took part in the ended session, for the caller to load in iframes before continuing to redirect_to. Delivery is not confirmed.
redirect_tostring—With frontchannel_logout_uris, the post-logout destination the caller continues to afterwards.
upstream_logoutobject—What happened to a federated provider's session (FED-013): not_federated, not_requested (only the local session ended; the provider's session may remain active), unsupported (the provider has no logout endpoint) or unavailable. A redirect to the provider is a 302 instead. With post_logout_redirect_uri and upstream_logout=true, the status is also appended to the redirect as upstream_logout.

text/html

{
  "type": "string"
}

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
302 Redirect to the registered post-logout URI, or with upstream_logout=true to the federated provider's logout endpoint, which returns to /oidc/logout/upstream-return.

Response headers

{
  "Location": {
    "$ref": "#/components/headers/Location"
  },
  "Set-Cookie": {
    "$ref": "#/components/headers/Set-Cookie"
  }
}
404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation logoutGet · Schema definitions · OpenAPI contract

POST/realms/{realm}/oidc/logout+

RP-initiated logout (POST)

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-protocol-initiationPermissionsSee operation description

Parameters

NameLocationRequiredDetails
realmpathYesRealm name (path-based issuer). Unknown realms return 404.
{"type":"string"}
X-Request-Idheader—Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.
{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}

Request body

application/x-www-form-urlencoded

FieldTypeRequiredDescription
id_token_hintone-time secretstring—
upstream_logoutstring—Extension (FED-013): also send the browser to the federated provider's logout endpoint.
true | false
client_idstring—
post_logout_redirect_uristring—
statestring—
Complete request schema
{
  "type": "object",
  "properties": {
    "id_token_hint": {
      "type": "string",
      "x-secret": true
    },
    "upstream_logout": {
      "type": "string",
      "enum": [
        "true",
        "false"
      ],
      "description": "Extension (FED-013): also send the browser to the federated provider's logout endpoint."
    },
    "client_id": {
      "type": "string"
    },
    "post_logout_redirect_uri": {
      "type": "string",
      "format": "uri"
    },
    "state": {
      "type": "string"
    }
  }
}

Responses

200 OK

application/json

FieldTypeRequiredDescription
session_endedbooleanYes
frontchannel_logout_urisarray—Front-channel logout (SES-018), only to callers sending Accept: application/json: the front-channel logout URIs of the clients that took part in the ended session, for the caller to load in iframes before continuing to redirect_to. Delivery is not confirmed.
redirect_tostring—With frontchannel_logout_uris, the post-logout destination the caller continues to afterwards.
upstream_logoutobject—What happened to a federated provider's session (FED-013): not_federated, not_requested (only the local session ended; the provider's session may remain active), unsupported (the provider has no logout endpoint) or unavailable. A redirect to the provider is a 302 instead. With post_logout_redirect_uri and upstream_logout=true, the status is also appended to the redirect as upstream_logout.

text/html

{
  "type": "string"
}

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
302 Redirect to the registered post-logout URI, or with upstream_logout=true to the federated provider's logout endpoint, which returns to /oidc/logout/upstream-return.

Response headers

{
  "Location": {
    "$ref": "#/components/headers/Location"
  },
  "Set-Cookie": {
    "$ref": "#/components/headers/Set-Cookie"
  }
}
400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
415 Wrong Content-Type (code unsupported_media_type).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
503 Load shedding, realm unavailable or dependency failure (code unavailable, upstream_unavailable). May include Retry-After.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "Retry-After": {
    "$ref": "#/components/headers/Retry-After"
  }
}

Operation logoutPost · Schema definitions · OpenAPI contract

GET/realms/{realm}/oidc/logout/upstream-return+

Return from a federated provider's logout

Where a federated provider sends the browser after its own logout (FED-013); register this URI as a post-logout redirect at the provider. The sealed state (valid 15 minutes) names the client's post-logout destination, reached with upstream_logout=returned appended: the provider's return does not prove its session ended. Without a destination the response is JSON. The state is single-use: a state that is malformed, expired or already used is refused with 400 ("invalid state", "expired state", "state already used").

AuthenticationPublic / endpoint-specific credentialsTrust classpublic-protocol-initiationPermissionsSee operation description

Parameters

NameLocationRequiredDetails
realmpathYesRealm name (path-based issuer). Unknown realms return 404.
{"type":"string"}
X-Request-Idheader—Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id.
{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}
statequeryYesSealed state issued with the upstream logout redirect.
{"type":"string"}

Responses

200 OK

application/json

FieldTypeRequiredDescription
session_endedboolean—
upstream_logoutobject—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
302 Redirect to the client's registered post-logout URI.

Response headers

{
  "Location": {
    "$ref": "#/components/headers/Location"
  }
}
400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}
500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

FieldTypeRequiredDescription
typestringYeshttps://auth.proudbase.com/problems/{code}
titlestringYes
statusintegerYes
codestringYesStable machine-readable error code.
invalid_request | validation_failed | unauthenticated | forbidden | not_found | conflict | precondition_failed | precondition_required | rate_limited | unavailable | internal_error | payload_too_large | unsupported_media_type | step_up_required | recent_authentication_required | mfa_required | recovery_restricted | transaction_invalid | transaction_expired | invalid_credentials | invalid_proof | unexpected_step | password_policy | last_owner | grant_ceiling_exceeded | impersonation_denied | impersonation_restricted | feature_disabled | invitation_invalid | last_sign_in_method | idempotency_key_reused | account_unavailable | sso_required | upstream_unavailable
detailstring—Client-safe detail; never contains secrets.
errorsobject—Field name -> validation message.
request_idstring—Correlation identifier, equal to the X-Request-Id response header.
obligationsarray—Present on step-up / recent-authentication / MFA problems.
original_statusinteger—Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation logoutUpstreamReturn · Schema definitions · OpenAPI contract

ProudAuth · Self-hosted identityBuilt 2026-10-13 · d9cc813ae809 · content snapshot
⌕

Search all guides and the API contract.

↑ ↓ to navigate Enter to open · Esc to close