v17

latestOpenAPI 3.0.3Apache 2.0raw.githubusercontent.com2026-08-0491166902.9 KB

Grant Management Endpoint

Process Grant Management Request

The API is for the implementation of the grant management endpoint which is defined in "Grant Management for OAuth 2.0".

post/api/{serviceId}/gm

Path parameters

serviceIdstring required

A service ID.

Request body

accessTokenstring

An access token to introspect.

clientCertificatestring

Client certificate in PEM format, used to validate binding against access tokens using the TLS client certificate confirmation method.

dpopstring

DPoP header presented by the client during the request to the resource server.

The header contains a signed JWT which includes the public key that is paired with the private key used to sign the JWT. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.

htmstring

HTTP method of the request from the client to the protected resource endpoint. This field is used to validate the DPoP header.

See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.

htustring

URL of the protected resource endpoint. This field is used to validate the DPoP header.

See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.

gmAction'CREATE' | 'QUERY' | 'REPLACE' | 'REVOKE' | 'MERGE'

The grant management action of the device authorization request.

The grant_management_action request parameter is defined in Grant Management for OAuth 2.0.

grantIdstring

The value of the grant_id request parameter of the device authorization request.

The grant_id request parameter is defined in Grant Management for OAuth 2.0 , which is supported by Authlete 2.3 and newer versions.

dpopNonceRequiredboolean

The flag indicating whether to require the DPoP proof JWT to include the nonce claim. Even if the service's dpopNonceRequired property is false, calling the /auth/gm API with this dpopNonceRequired parameter true will force the Authlete API to check whether the DPoP proof JWT includes the expected nonce value.

Response

Grant management completed successfully

resultCodestring

The code which represents the result of the API call.

resultMessagestring

A short message which explains the result of the API call.

The next action that the authorization server implementation should take.

responseContentstring

The content that the authorization server implementation is to return to the client application. Its format varies depending on the value of action parameter.

dpopNoncestring

Get the expected nonce value for DPoP proof JWT, which should be used as the value of the DPoP-Nonce HTTP header.