Begin an OIDC login: the IdP authorization URL the browser should be sent to. The CSRF `state`, `nonce` and PKCE verifier are stashed server-side for the flight. Unauthenticated (pre-session).

GET

/api/v1/auth/oidc/authorize

curl --request GET \
  --url https://example.com/api/v1/auth/oidc/authorize

Authorizations

• None

Responses

200

The IdP authorization URL the browser should be sent to

Media typeapplication/json

Where to send the browser to start the SSO handshake.

object

authorize_url

required

string

Example^generated

{
  "authorize_url": "example"
}

502

Provider discovery or configuration failed

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

No OIDC provider store, or no provider enabled

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}