Read a sign-in request
The consent page's data: the app, whether a card vouches for it, the scopes, and the fields the consent text signs.
/oidc/requests/{id}- Access
- Private code required
- Client
- Local or server client
Parameters#
| Name | Location | Meaning |
|---|---|---|
idRequired | Path | The request id: 43 characters from the consent page's address (`?req=`) or its meta element. |
Request examples#
curl -fsS 'https://veil.rip/oidc/requests/{id}'Response#
The request as the server checked it.
| Field | Type | Meaning |
|---|---|---|
id | string | The request id. |
issuer | string | https://veil.rip. |
client | object | {id, name, site, logo, verified, owner, dynamic, type}. |
redirectUri | string | Where the code goes. |
redirectHost | string | null | Its host, for the page. |
scopes | array<string> | In the order the consent signs them. |
prompt | string | null | The app's prompt. |
uiLocales | string | null | The app's ui_locales. |
askEveryTime | boolean | The redirect URI is on the loopback interface (a native app): the page asks for the click every time, even for an app the card approved. |
consent | object | {prefix, iss, client, redirect, scopes, nonce, state (SHA-256 hex or null), challenge, request}: the signed fields. |
createdAt | string | ISO 8601 UTC. |
expiresAt | string | 30 minutes after. |
Response headers#
| Header | Value | Meaning |
|---|---|---|
Content-Type | application/json | JSON, also for errors. |
Cache-Control | no-store | Private: never cached. |
Usage notes#
- Anyone with the id can read it, as anyone with the URL can open the page. No CORS.
Errors#
API errors return an error object. Use error.code for program logic; error.message is English text for people and can change. Response and error guide
| HTTP | Code | Meaning and next step |
|---|---|---|
| 404 | not_found | The requested card, key, alias, code or resource was not found. Check the identifier. Temporary codes and previews may already have expired or been used. |
| 410 | request_expired | The sign-in request was used or is older than 30 minutes. Go back to the app and start again. |
Shared request errors
| HTTP | Code | Meaning and next step |
|---|---|---|
| 429 | rate_limited | An anonymous, signed-request or API-key allowance was exceeded. Wait at least |
| 500 | internal_error | An unexpected server error occurred. Internal details are not returned. Retry reads with bounded backoff. Check write results before sending a new signed operation. |
| 503 | busy | The application has reached a temporary concurrency or database limit. Wait |