Complete an OIDC login: exchange the code, validate the ID token, map IdP groups to a role, JIT-provision the account, and issue a Yagra session.

POST

/api/v1/auth/oidc/callback

curl --request POST \
  --url https://example.com/api/v1/auth/oidc/callback \
  --header 'Content-Type: application/json' \
  --data '{ "code": "example", "state": "example" }'

Authorizations

• None

Request Body^required

Media typeapplication/json

OIDC callback body: the code + state the WebUI forwards from the IdP redirect.

object

code

required

string

state

required

string

Example^generated

{
  "code": "example",
  "state": "example"
}

Responses

200

A Yagra session for the SSO account

Media typeapplication/json

A session minted by a completed SSO login — the same shape local login returns, deliberately, so the WebUI stores a token the same way whichever path produced it.

object

role

required

Predefined roles, ordered least → most privileged.

string

Allowed values: viewer operator admin

token

required

string

Example

{
  "role": "viewer"
}

401

The login could not be completed; which step failed stays server-side

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

No OIDC provider store, no provider enabled, or skeleton mode

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}