OAuth endpoints
Client lookup, authorize, token, revoke, userinfo and connected apps.
All paths are under the API base, for example http://localhost:5008/api/v1. Successful answers are { "SUCCESS": true, "message": "...", "data": ... } except the token endpoint, which returns the token fields at the top level. Errors are { "message": "...", "code": "..." }; see errors.
GET /oauth/clients/:clientId
Public. Returns what the hosted pages show about your app.
| Query | Effect |
|---|---|
redirect_uri | Fails with invalid_redirect_uri unless it is registered |
post_logout_redirect_uri | Same check against the post logout list |
return_to | Fails unless its origin is one of the client's allowed origins |
{ "data": { "clientId": "corpland-content", "name": "Corpland Content", "logo": null, "homepage": "http://localhost:3320", "firstParty": true } }POST /oauth/authorize
Needs a Corpland ID session (Authorization: Bearer <ID access token>). The hosted pages call this for you; apps normally never do.
{
"client_id": "corpland-content",
"redirect_uri": "http://localhost:3320/auth/callback",
"state": "st_123",
"code_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
"code_challenge_method": "S256",
"venture_id": "6aca9bfeb50f1fec97df56d6"
}Answers { "data": { "redirect_to": "<redirect_uri>?code=...&state=...", "client": {...} } }. venture_id is optional and must be a venture the person is an active member of, or the call fails with venture_forbidden.
POST /oauth/token
Public, rate limited. Answers carry Cache-Control: no-store.
grant_type | Body |
|---|---|
authorization_code | code, client_id, redirect_uri, code_verifier |
refresh_token | refresh_token, client_id |
Both return access_token, token_type, expires_in, refresh_token, refresh_expires_at, venture_id and user. A refresh keeps the venture only while the person is still a member.
POST /oauth/revoke
Public. { "token": "<refresh token>", "client_id": "..." } ends that token's whole session family. Always answers success, so it is safe to call twice.
GET /oauth/userinfo
Bearer access token. Returns _id, sub, name, email, image and venture_id from the token's vid.
GET /oauth/grants and DELETE /oauth/grants/:clientId
Bearer ID session. The apps a person has signed in to, with device counts and last use, and removing one ends all of its sessions. These power Connected apps in the portal.