Handling Responses from Authlete API

Most of Authlete APIs make a response that includes “action” parameter. On implementing an authorization server with Authlete, there is a principle of processing; making a request to one of Authlete’s APIs, parsing a response from the API, checking a value of “action” in the response and processing in accordance with the value.

You NEVER use a value of resultCode as condition of processing.

For example, an response from /auth/authorization API includes either the following values in “action” field:

BAD_REQUEST
FORM
INTERACTION
INTERNAL_SERVER_ERROR
LOCATION
NO_INTERACTION

action=INTERACTION indicates that an authorization request is valid. Your authorization server is expected to generate a webpage (HTML) to authenticate a user and ask his/her consent, send the webpage to the user’s Web browser, and do some interaction with him/her. Once the auth process is done successfully, your authorization server will make a request to /auth/authorization/issue API. if unsuccessful (e.g. the user cancelled the process), the server will do a request to /auth/authorization/fail API instead. (cf. Ticket Parameter in Authorization Endpoint ） action=BAD_REQUEST indicates that an authorization request is invalid and your authorization server should make a “400 Bad Request” response to Web browser. The response will be like this:

HTTP/1.1 400 Bad Request
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache

(Add responseContent value here)

action=LOCATION indicates that your authorization server is expected to make a “302 Found” response to Web browser. The response will be like this:

HTTP/1.1 302 Found
Location: (Add responseContent value here)
Cache-Control: no-store
Pragma: no-cache

Endpoints

Tokens and Claims

Key Management

Metadata

Error Handling & Debugging

Security

Client Management

Service Settings