Check a remembered consent
Signed by this browser's device key: whether its card already approved the app for these scopes, so the page signs without a click.
/oidc/requests/{id}/grant- Access
- Signed request
- Client
- Local or server client
Parameters#
| Name | Location | Meaning |
|---|---|---|
idRequired | Path | The request id: 43 characters from the consent page's address (`?req=`) or its meta element. |
Send the common signed-request headers, including X-Nonce and X-Timestamp. A signed GET has no JSON body. Request signing
Request examples#
curl -fsS \
-H "X-Public-Key: $PUBLIC_KEY" -H "X-Signature: $REQUEST_SIGNATURE" -H "X-Nonce: $NONCE" -H "X-Timestamp: $TIMESTAMP" \
"https://veil.rip/oidc/requests/{id}/grant"Response#
{n, remembered, scopes, since}.
| Field | Type | Meaning |
|---|---|---|
n | integer | The card of the signing key. |
remembered | boolean | The consent covers every scope asked, and the app is not on the loopback interface (a native app is asked every time). |
scopes | array<string> | null | The scopes approved before. |
since | string | null | When. |
Response headers#
| Header | Value | Meaning |
|---|---|---|
Content-Type | application/json | JSON, also for errors. |
Cache-Control | no-store | Private: never cached. |
Errors#
API errors return an error object. Use error.code for program logic; error.message is English text for people and can change. Response and error guide
| HTTP | Code | Meaning and next step |
|---|---|---|
| 403 | key_mismatch | The signing key does not have authority over this card or operation. Use an active device key with the required owner or member role. |
| 404 | not_found | The requested card, key, alias, code or resource was not found. Check the identifier. Temporary codes and previews may already have expired or been used. |
| 410 | request_expired | The sign-in request was used or is older than 30 minutes. Go back to the app and start again. |
Shared request errors
| HTTP | Code | Meaning and next step |
|---|---|---|
| 400 | invalid_nonce | The signed-request nonce has an invalid format. Generate a fresh 16 to 128-character nonce using letters, digits, _ or -. |
| 400 | invalid_signature_alg |
Use a supported signing algorithm and matching key/signature encoding. |
| 400 | invalid_timestamp | The signed-request timestamp is not Unix milliseconds. Use an integer Unix timestamp in milliseconds and sign the corrected request. |
| 401 | invalid_signature | The HTTP request signature does not verify. Sign the exact method, path and body bytes, without changing them afterwards. |
| 401 | missing_signature | The request requires a device signature and its headers are missing or unreadable. Send |
| 401 | stale_timestamp | The signed timestamp is outside the accepted clock window. Compare the server Date header with your clock, then generate a fresh nonce, timestamp and signature. |
| 403 | key_banned | The device signing key is suspended by Veil staff. Use an authorised active key or ask staff to review the restriction. |
| 409 | replayed_nonce | The signing key already used this nonce. Check whether the previous request succeeded before making a fresh signed request. |
| 429 | rate_limited | An anonymous, signed-request or API-key allowance was exceeded. Wait at least |
| 500 | internal_error | An unexpected server error occurred. Internal details are not returned. Retry reads with bounded backoff. Check write results before sending a new signed operation. |
| 503 | busy | The application has reached a temporary concurrency or database limit. Wait |