Error Responses

• 401 - Unauthorized

  • For example, if passing in an unknown client_id, the endpoint returns a response like:

        {
        "type": "https://tools.ietf.org/html/rfc9110#section-15.5.2",
        "title": "Unauthorized",
        "status": 401,
        "traceId": "00-676e4f60e893d3cf6bb37b9262dda023-7d0ef785dd85a317-00"
        }

  • With Parameters:

    1. type: string url - Link to the RFC

    2. title: string - Human-readable name of the error

    3. status: int - The Error Code

    4. traceId: string - The id of the trace with which to use to check the stack trace later on.

• Note: It’s recommended to also include a "state" parameter (in our case: code) in the authorization URL (not shown above) to maintain state between the request and callback (protecting against CSRF attacks). The AIRisk authorization server will return this state value unmodified in the redirect. This is part of OAuth2 best practices, though for brevity the examples here focus on the core parameters.