Process OIDC Callback

Handles the callback from an OIDC-based Identity Provider after user authentication.

This endpoint is called by the IDP (not by the client directly). After the user authenticates at the IDP, the IDP redirects the user's browser to this endpoint with an authorization code.

Flow:

User authenticates at the OIDC Identity Provider
IDP redirects to GET /api2/oidc/callback with code and state in the request body
GIS exchanges the authorization code with the IDP for user identity claims
GIS resolves or creates the guest identity
GIS redirects to the original redirect_uri with a one-time code parameter

This is a server-to-server exchange; the client does not call this endpoint directly.

Headers

X-Correlation-Id
Type: string

Optional caller-provided correlation ID; echoed in responses when present.

Body·

required

application/json

Request body containing the authorization code and state from the OIDC Identity Provider.

code
Type: string
required

Authorization code received from the OIDC Identity Provider.
state
Type: string
required

State parameter for CSRF protection, originally generated during the login initiation.

Responses

application/json
application/json
application/json
application/json

get/api2/oidc/callback

curl https://SERVER_NAME_GOES_HERE/api2/oidc/callback \
  --header 'Content-Type: application/json' \
  --data '{
  "code": "",
  "state": ""
}'

No Body

Redirect to the client's redirect_uri with a one-time code.