Retrieve the Authentication Result and Access Token

You can retrieve the authentication result from the token endpoint.

Copy

Sample request with a CIBA grant using the authentication request ID

POST https://[base-server-url]/{tenant}/authn/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Authorization: Bearer RTp7HwAAAXk3vsD/zWlMvdnsYBjme0uXks0qQlT0
 
grant_type=urn%3Aopenid%3Aparams%3Agrant-type%3Aciba&auth_req_id=a95c61e0-f604-4905-98b1-26b7b87fe073

Copy

Sample response with the id_token

HTTP/1.1 200 OK
Cache-Control: no-store
Pragma: no-cache
Content-Type: application/json;charset=UTF-8
Content-Length: 84
 
{
   "access_token": "rYt9pwAAAXk3wN50Qm06NLzAbv0I/XKR/zknMhIY",
   "auth_req_id": "a95c61e0-f604-4905-98b1-26b7b87fe073",
   "id_token": "eyJraWQiOiIxNjQ2OTMxNzgwNjYzIiwidHlwIjoiSldUIiwiYW..aX7OPI2IWbsC3NsniVH18rWBr2bGKlVB53gAypM2-IAoQWksnlcM9wvHp_eQefZnbqung",
   "token_type": "Bearer",
   "expires_in": 86400
}

Copy

Where the decoded id_token is:

{
    "at_hash": "A1ifydl-B1V7MqvVZUp56Q",
    "sub": "spl-cust02",
    "reason": "Reason not defined",
    "JWS": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSU....xxblIja9ZHWxaX7nMZU1h9iGEtZRtO1dhrZKq4OMNnIpRLoVzHVp1Zx2kzxdCbdjAoGHdn3OAS3wNppL5Y5nlZbZQ1inEacVjeyGZo9xYdJYwVEW3F4cIVQNRwFu0QPaBi0MPgZ7f_SPYN2IyglU9yy8MC7WylQ==",
    "PUK": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4WjK..4PQE6/w/QNUwZ21Xw9OAYWbn1pb1BopV8zhmjDQmBRpSyFIKs7iq9HOs7irQ/33KtWa3zpVHywrlELD2Lr/zIrwRFzQGWOZs6w0dAZ+OIR7igJdZQ/JhvztBL/K0pKRHlPrlQIDAQAB",
    "iss": "https://[base-server-url]/{tenant}/authn/token",
    "deviceid": 11727,
    "result": 1,
    "acr": "2",
    "urn:openid:params:jwt:claim:auth_req_id": "32709383-3542-4024-9659-43f72b803bb9",
    "auth_time": 1649789512,
    "tds_context" : "TXkgdHJhbnNhY3Rpb24gc2FtcGxlIGNvbnRleHQ=" 
    "mobile_tds_context": "TXkgbW9iaWxlIGRldmljZSB0cmFuc2FjdGlvbiBzYW1wbGUgY29udGV4dA==",
    "clientapprovalstatus": "accept",
    "exp": 1649793112,
    "iat": 1649789512
}

Copy

Sample request for RADIUS send after for push authentication

POST https://[base-server-url]/{tenant}/authn/token HTTP/1.1
Connection: close
Content-Type: application/x-www-form-urlencoded
Authorization: Bearer Uyet6AAAAYAfHAZK+t/2Qm92EL5OWcqY/PVeuaPI
 
grant_type=urn%3Aopenid%3Aparams%3Agrant-type%3Aciba&auth_req_id=32709383-3542-4024-9659-43f72b803bb9

Copy

Sample response for RADIUS send after for push authentication

HTTP/1.1 200 OK
Cache-Control: no-store
Pragma: no-cache
Content-Type: application/json;charset=UTF-8
Content-Length: 84
 
{
    "access_token": "hamx1AAAAYAfHixmK/chSkfR+sXemoONj63mPuTm",
    "auth_req_id": "32709383-3542-4024-9659-43f72b803bb9",
    "id_token": "eyJraWQiOiIxNjQ2OTMxNzgwNjYzIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdF9oYXNoIjoiQTFpZnlkbC1CMVY3TXF2VlpVcDU2USIsInN1YiI6InNwbC1jdXN0MDIiLCJyZWFzb24iOiJSZWFzb24gbm90IGRlZmluZWQiLCJKV1MiOiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpTVXpVeE1pSjkuZXlKamJHbGxiblJoY0hCeWIzWmhiSE4wWVhSMWN5STZJbUZqWTJWd2RDSXNJblJrY3lJNkluUmxjM1FnY21Ga2FYVnpJaXdpZEhoamIzVnVkR1Z5SWpvaU9TSjkuU3FkdWwweGluWUZzenJCblNxWVR4ZUlxSE5zWjJFM3dsdHZELVFrbTRyMWZPMElPUGU5ZGZpdnNzamloSVFnSlVyU25qMGczYW1YSFJjYXVSckxpamhxeE5qREltSk9JZjNmbFNhaFh6NkVsbFN2WHZxYXJQdW9YRWtlMWVMTW93cnpHcTJEWVFxUE5KOVlXa25OWXNKekxkdmYxM1Q5RmFTRG04bm5DRkRqZ3pfMnRIczJLclYzeHhibElqYTlaSFd4YVg3bk1aVTFoOWlHRXRaUnRPMWRoclpLcTRPTU5uSXBSTG9WekhWcDFaeDJrenhkQ2JkakFvR0hkbjNPQVMzd05wcEw1WTVubFpiWlExaW5FYWNWamV5R1pvOXhZZEpZd1ZFVzNGNGNJVlFOUndGdTBRUGFCaTBNUGdaN2ZfU1BZTjJJeWdsVTl5eThNQzdXeWxRPT0iLCJQVUsiOiJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQTRXaktyOEdWWVYrcU9YcjNUbE9VckRWVzZPXC9VMnI3VHhqXC9wSDV6OU4wNjBkWmFwczROUnVEaENuT3FrU3owM0h1aXpPMXVcL2dDc3lXRDRrektkVHlwU2s0ZEpIeXZuMmRqcjlNZ2ozMFF2S1V3Y1NFNUdhencwNDBrOXN3OVJGanl1ZUQ5YTh0YWxhNUNuT1FmT3NoWjg2VitITk8yUFhQdmRxSExBaDZkajFGdXErdzhzU3N3RjJUVExZbnNOVnJselVIbFZFbmhpUjRVQkdENFBRRTZcL3dcL1FOVXdaMjFYdzlPQVlXYm4xcGIxQm9wVjh6aG1qRFFtQlJwU3lGSUtzN2lxOUhPczdpclFcLzMzS3RXYTN6cFZIeXdybEVMRDJMclwveklyd1JGelFHV09aczZ3MGRBWitPSVI3aWdKZFpRXC9KaHZ6dEJMXC9LMHBLUkhsUHJsUUlEQVFBQiIsImlzcyI6Imh0dHBzOlwvXC9oamk5Mi5hZC5nbG9iYWxcL2lkcFwvT05MSU5FQkFOS1wvYXV0aG4iLCJkZXZpY2VpZCI6MTE3MjcsInJlc3VsdCI6MSwiYXVkIjoic3BsLWlkcC1wdXNoLXNlbmRhZnRlciIsImFjciI6IjIiLCJ1cm46b3BlbmlkOnBhcmFtczpqd3Q6Y2xhaW06YXV0aF9yZXFfaWQiOiIzMjcwOTM4My0zNTQyLTQwMjQtOTY1OS00M2Y3MmI4MDNiYjkiLCJhdXRoX3RpbWUiOjE2NDk3ODk1MTIsImNvbnRleHQiOnsiRnJhbWVkLUlQLUFkZHJlc3MiOiIxLjEuMS4xIiwiVXNlci1OYW1lIjoic3BsIn0sImNsaWVudGFwcHJvdmFsc3RhdHVzIjoiYWNjZXB0IiwiZXhwIjoxNjQ5NzkzMTEyLCJpYXQiOjE2NDk3ODk1MTJ9.Q75NlJvT8BX3xHzcth9c9bXXUWDMjXOMd5iB1UA3q92zz1Cfg93lqZHvW3JRWydvsadEtuzBwa2P10PanMp2rDkvh-jrobPALXOOxni3VCtGkMfaSh9eELdv6HMllNB8x_uJQHoRinvXsHtdP3F4RsQ-ilD3VJByNce_M9f7dHywAxbuqQfQNBD-kV56ITckoTnCih93vpJnBwGQqPb_6eSjqKUAQyTu8puwwl9Soo6jtlDeHtarD3QhAjPxTzRfh7hYJ94OssWXwA1U3aX7OPI2IWbsC3NsniVH18rWBr2bGKlVB53gAypM2-IAoQWksnlcM9wvHp_eQefZnbqung",
    "token_type": "Bearer",
    "expires_in": 3600
}

Copy

Where the decoded id_token is:

{
    "at_hash": "A1ifydl-B1V7MqvVZUp56Q",
    "sub": "spl-cust02",
    "reason": "Reason not defined",
    "JWS": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJjbGllbnRhcHByb3ZhbHN0YXR1cyI6ImFjY2VwdCIsInRkcyI6InRlc3QgcmFkaXVzIiwidHhjb3VudGVyIjoiOSJ9.Sqdul0xinYFszrBnSqYTxeIqHNsZ2E3wltvD-Qkm4r1fO0IOPe9dfivssjihIQgJUrSnj0g3amXHRcauRrLijhqxNjDImJOIf3flSahXz6EllSvXvqarPuoXEke1eLMowrzGq2DYQqPNJ9YWknNYsJzLdvf13T9FaSDm8nnCFDjgz_2tHs2KrV3xxblIja9ZHWxaX7nMZU1h9iGEtZRtO1dhrZKq4OMNnIpRLoVzHVp1Zx2kzxdCbdjAoGHdn3OAS3wNppL5Y5nlZbZQ1inEacVjeyGZo9xYdJYwVEW3F4cIVQNRwFu0QPaBi0MPgZ7f_SPYN2IyglU9yy8MC7WylQ==",
    "PUK": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4WjKr8GVYV+qOXr3TlOUrDVW6O/U2r7Txj/pH5z9N060dZaps4NRuDhCnOqkSz03HuizO1u/gCsyWD4kzKdTypSk4dJHyvn2djr9Mgj30QvKUwcSE5Gazw040k9sw9RFjyueD9a8tala5CnOQfOshZ86V+HNO2PXPvdqHLAh6dj1Fuq+w8sSswF2TTLYnsNVrlzUHlVEnhiR4UBGD4PQE6/w/QNUwZ21Xw9OAYWbn1pb1BopV8zhmjDQmBRpSyFIKs7iq9HOs7irQ/33KtWa3zpVHywrlELD2Lr/zIrwRFzQGWOZs6w0dAZ+OIR7igJdZQ/JhvztBL/K0pKRHlPrlQIDAQAB",
    "iss": "https://[base-server-url]/{tenant}/authn/token",
    "deviceid": 11727,
    "result": 1,
    "aud": "spl-idp-push-sendafter",
    "acr": "2",
    "urn:openid:params:jwt:claim:auth_req_id": "32709383-3542-4024-9659-43f72b803bb9",
    "auth_time": 1649789512,
    "context": {
        "Framed-IP-Address": "1.1.1.1",
        "User-Name": "spl"
    },
    "clientapprovalstatus": "accept",
    "exp": 1649793112,
    "iat": 1649789512
}