/api/oauth2
GET /oauth2/auth — Begin an authorization request (interactive login).
GET /oauth2/auth — Begin an authorization request (interactive login).The OAuth2 client identifier.
The OAuth2/OIDC response type. Combined types such as
code id_token are also supported.
Where to redirect with the result. Must match the client registration.
Space-separated scopes, within the client's allowed set (a
client that configures none may use all of read, write,
openid, offline). Their effect in fylr:
openid— also issue an OpenID Connectid_token(an RS256 JWT) alongside the access token. (The/api/oauth2/userinfoendpoint itself accepts any valid access token and is not gated on this scope.)offline— request a refresh token. A refresh token is issued (for the authorization-code and password grants) only when this scope is granted, and granting it also applies the configured refresh-token expiration override. fylr accepts bothofflineand the OIDC-standardoffline_accessfor this.read,write— capability labels only; they are not consulted to authorize API calls. Actual API authorization uses fylr's per-user/per-pool ACL rights, which are independent of these OAuth2 scopes despite the matching names.
Opaque value echoed back to the client.
PKCE code challenge.
fylr login method (default easydb). The endpoint accepts a
comma-separated list and tries the methods in order; the
web-app sends a single value. Each method authenticates a
specific user type:
easydb—login+passwordagainst the fylr user database (user typeseasydb,system,easydb_self_register). Also the fallback whenauth_methodis set to an unrecognised value. (An emptyauth_methodparses toauto, noteasydb.)ldap—login+passwordbound against a configured LDAP directory; provisions/updates anldapuser. Only available when an LDAP connection is configured and the license permits external auth.email— passwordless login for invitedemailusers:loginplus the account UUID (sent in thepasswordfield) — the UUID is the secret.collection—login+passwordforcollectionuser accounts.saml— SAML 2.0 SSO; no credentials in the form. The first call redirects to the IdP, then the returned assertion provisions/updates anssouser. Only available when SAML is configured and the license permits external auth.action_code— a one-timesecret+action_codepair used by internal redirect flows (forced password change, system messages); logs in whichever user the code was issued for. Single-use.anonymous— guest login, no credentials; binds to a per-browser anonymous user. Only when guest login is enabled (base configguest).auto— server-side selector (the web-app default): resolves toanonymouswhen guests are allowed and nologinis supplied, otherwise to password login (easydb, thenldapwhen configured).
easydbPossible values: User login (for password methods).
User password (for password methods).
The HTML login form, rendered when credentials are absent or
invalid (with a generic server.oauth2.LoginFailed message).
Redirect to the client redirect_uri carrying the
authorization code, token or id_token (per
response_type). May instead redirect (303) to
/api/page/setPassword (forced password change) or
/api/page/showMessage (pending tasks).
POST /oauth2/auth — Submit the login form / authorization request.
POST /oauth2/auth — Submit the login form / authorization request.Same as GET, but the parameters are sent as an
application/x-www-form-urlencoded body — used when the login
form is submitted.
Action-code secret (for auth_method=action_code).
HTML login form (on missing/invalid credentials).
Redirect to redirect_uri with the authorization result.
POST /oauth2/token — Issue an access token.
POST /oauth2/token — Issue an access token.application/x-www-form-urlencoded request. Confidential clients
authenticate with client_id/client_secret (form fields or HTTP
Basic); public clients send only client_id. For the resource-owner
password grant fylr validates username/password against the
easydb, collection, email, then LDAP login methods in turn.
Authorization code (grant_type=authorization_code).
Refresh token (grant_type=refresh_token).
Resource-owner login (grant_type=password).
Resource-owner password (grant_type=password).
Space-separated scopes.
PKCE code verifier.
The issued token.
RFC 6749 error response (invalid_request, invalid_grant,
unsupported_grant_type, invalid_client, ...). fylr's
internal error is appended to error_description.
POST /oauth2/revoke — Revoke a token (logout).
POST /oauth2/revoke — Revoke a token (logout).The access or refresh token to revoke.
The token was revoked (also returned for an unknown token).
The token was revoked (also returned for an unknown token).
No content
POST /oauth2/introspect — Introspect a token.
POST /oauth2/introspect — Introspect a token.Introspection result. active is false for an unknown,
expired or revoked token; the other fields are present only
when the token is active.
Introspection result. active is false for an unknown,
expired or revoked token; the other fields are present only
when the token is active.
GET /oauth2/userinfo — Get claims for the access-token user.
GET /oauth2/userinfo — Get claims for the access-token user.Access token in the Authorization header:
Authorization: Bearer <token>.
The user's OpenID claims.
No valid user could be resolved from the token. Code
InvalidToken (realm: api).
POST /oauth2/userinfo — Get claims for the access-token user (form POST).
POST /oauth2/userinfo — Get claims for the access-token user (form POST).Last updated