API ReferenceApplications
POST
oauth2/v1/authorizeRequest Body
application/json
response_type?string
response_type, scope and state are required for OIDC but marked optional so a PAR client may omit them from the outer authorize request and carry them via request_uri (RFC 9126 §4). The resolved values are enforced in OIDCService.OIDCAuthZEndpointStart (after applyPARToOIDCAuthZRequest): response_type and state must be present, scope must contain "openid". The PAR push (handleOIDCPAR) requires the same fields up front for fail-fast.
scope?string
Length
length <= 10000client_id?string
Length
length <= 200state?string
Length
length <= 100000redirect_uri?string
code_challenge_method?string
PKCE
code_challenge?string
Length
length <= 5000dynamic_val?string
Length
length <= 5000nonce?string
Length
length <= 5000ssoAppId?string
Length
length <= 100loginHint?string
Length
length <= 1000prompt?string
Length
length <= 254flow?string
Length
length <= 254flow_token?string
Length
length <= 254tenant?string
Length
length <= 100style?string
Length
length <= 254dpop_jkt?string
Length
length <= 100request_uri?string
Length
length <= 200project_id?string
bg?string
Length
length <= 2048theme?string
Length
length <= 254OIDC POST authorization endpoint start
curl -X POST "https://api.descope.com/oauth2/v1/authorize" \ -H "Content-Type: application/json" \ -d '{}'{}export interface Response {} Was this helpful?