Authorization endpoint (auth-code + PKCE S256)
GET /authorize
GET
/authorize
Redirect-based. Accepts the request parameters directly, or client_id + a request_uri obtained from /par. Brokers to an enterprise IdP when the org has an active SSO connection, else redirects to the consent screen.
Parameters
Section titled “ Parameters ”Query Parameters
Section titled “Query Parameters ” response_type
required
string
Must be code.
client_id
required
string
redirect_uri
string
scope
string
Space-delimited; e.g. openid profile offline_access.
state
string
nonce
string
code_challenge
string
PKCE S256 challenge.
code_challenge_method
string
Only S256.
request_uri
string
A PAR request URI (RFC 9126).
organization
string
Org id to broker inbound SSO.
resource
string
RFC 8707 resource indicator; bound here and reflected into the access-token aud.
Responses
Section titled “ Responses ”Redirect to consent, IdP, or redirect_uri