---
title: "Fail Backchannel Authentication Request"
method: POST
path: "/api/{serviceId}/backchannel/authentication/fail"
tags: ["CIBA"]
---

# Fail Backchannel Authentication Request

`POST /api/{serviceId}/backchannel/authentication/fail`

The API prepares JSON that contains an error. The JSON should be used as the response body of the
response which is returned to the client from the [backchannel authentication endpoint](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#auth_backchannel_endpoint).

## Path parameters

- `serviceId` string, required

## Request body

- BackchannelAuthenticationFailRequest
  - `ticket` string, required — The ticket which should be deleted on a call of Authlete's `/backchannel/authentication/fail` API. This request parameter is not mandatory but optional. If this request parameter is given and the ticket belongs to the service, the specified ticket is deleted from the database. Giving this parameter is recommended to clean up the storage area for the service.
  - `reason` 'ACCESS_DENIED' | 'EXPIRED_LOGIN_HINT_TOKEN' | 'INVALID_BINDING_MESSAGE' | 'INVALID_TARGET' | 'INVALID_USER_CODE' | 'MISSING_USER_CODE' | 'SERVER_ERROR' | 'UNAUTHORIZED_CLIENT' | 'UNKNOWN_USER_ID', required — The reason of the failure of the backchannel authentication request. This request parameter is not mandatory but optional. However, giving this parameter is recommended. If omitted, `SERVER_ERROR` is used as a reason.
  - `errorDescription` string — The description of the error. This corresponds to the `error_description` property in the response to the client.
  - `errorUri` string — The URI of a document which describes the error in detail. If this optional request parameter is given, its value is used as the value of the `error_uri` property.

## Response `200`

- BackchannelAuthenticationFailResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `action` 'INTERNAL_SERVER_ERROR' | 'BAD_REQUEST' | 'FORBIDDEN' — The next action that the authorization server implementation should take.
  - `responseContent` string — The content that the authorization server implementation is to return to the client application. Its format varies depending on the value of `action` parameter.

## Other responses

- `400`
- `401`
- `403`
- `429` — The request exceeded the request rate permitted for the endpoint.
- `500`

---

[API](https://skmtc.net/authlete/apis/authlete-api.md) · [All operations](https://skmtc.net/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/authlete/authlete-api/versions/7ad74ab64749/schema)