Skip to content
Sudomimus

Redeem a realized inquiry for an application token pair.

POST
/redeem
curl --request POST \
  --url https://connect-api.sudomimus.com/redeem \
  --header 'Content-Type: application/json' \
  --data '{ "exposureKey": "example", "hiddenKey": "example", "confirmationKey": "example" }'

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
exposureKey
required
string
hiddenKey
required
string
confirmationKey
required
string
Examplegenerated
{
  "exposureKey": "example",
  "hiddenKey": "example",
  "confirmationKey": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Tokens issued.

Media typeapplication/json
object
claims
required

Per-claim view across the five shareable claims — why a claim is or is not present in the minted token (policy OFF, never asked, declined, or granted).

object
email
required

One shareable claim: what the application requests (requirement) joined with the user’s standing decision (state). UNKNOWN means the user was never asked; DENIED means the user explicitly declined.

object
requirement
required

The developer’s policy for the claim. SYNTHETIC_ONLY always emits the generated placeholder and never asks for real data. SYNTHETIC_FALLBACK guarantees the claim is present but uses a generated placeholder (a stand-in name, a proxy email, or a generated avatar) when the user has not shared real data. Unlike REQUIRED, neither synthetic mode blocks issuance or raises an errand.

string
Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK
state
required
string
Allowed values: UNKNOWN GRANTED DENIED
firstName
required

One shareable claim: what the application requests (requirement) joined with the user’s standing decision (state). UNKNOWN means the user was never asked; DENIED means the user explicitly declined.

object
requirement
required

The developer’s policy for the claim. SYNTHETIC_ONLY always emits the generated placeholder and never asks for real data. SYNTHETIC_FALLBACK guarantees the claim is present but uses a generated placeholder (a stand-in name, a proxy email, or a generated avatar) when the user has not shared real data. Unlike REQUIRED, neither synthetic mode blocks issuance or raises an errand.

string
Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK
state
required
string
Allowed values: UNKNOWN GRANTED DENIED
lastName
required

One shareable claim: what the application requests (requirement) joined with the user’s standing decision (state). UNKNOWN means the user was never asked; DENIED means the user explicitly declined.

object
requirement
required

The developer’s policy for the claim. SYNTHETIC_ONLY always emits the generated placeholder and never asks for real data. SYNTHETIC_FALLBACK guarantees the claim is present but uses a generated placeholder (a stand-in name, a proxy email, or a generated avatar) when the user has not shared real data. Unlike REQUIRED, neither synthetic mode blocks issuance or raises an errand.

string
Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK
state
required
string
Allowed values: UNKNOWN GRANTED DENIED
staticAvatar
required

One shareable claim: what the application requests (requirement) joined with the user’s standing decision (state). UNKNOWN means the user was never asked; DENIED means the user explicitly declined.

object
requirement
required

The developer’s policy for the claim. SYNTHETIC_ONLY always emits the generated placeholder and never asks for real data. SYNTHETIC_FALLBACK guarantees the claim is present but uses a generated placeholder (a stand-in name, a proxy email, or a generated avatar) when the user has not shared real data. Unlike REQUIRED, neither synthetic mode blocks issuance or raises an errand.

string
Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK
state
required
string
Allowed values: UNKNOWN GRANTED DENIED
animatedAvatar
required

One shareable claim: what the application requests (requirement) joined with the user’s standing decision (state). UNKNOWN means the user was never asked; DENIED means the user explicitly declined.

object
requirement
required

The developer’s policy for the claim. SYNTHETIC_ONLY always emits the generated placeholder and never asks for real data. SYNTHETIC_FALLBACK guarantees the claim is present but uses a generated placeholder (a stand-in name, a proxy email, or a generated avatar) when the user has not shared real data. Unlike REQUIRED, neither synthetic mode blocks issuance or raises an errand.

string
Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK
state
required
string
Allowed values: UNKNOWN GRANTED DENIED
applicationAnchor
required
string
refreshToken
required

Long-lived refresh token (JWT). Decode its protected header as RefreshTokenHeader and its body as RefreshTokenBody. The payload binds the logical session as sid, names the rotating bearer instance as jti, and carries a positive rotationVersion. It carries no user identifier or profile data.

string
accessToken
required

Short-lived access token (JWT). Decode its protected header as AccessTokenHeader and its body as AccessTokenBody. The payload carries the application-visible user key as sub, the logical session as sid, and this access-token instance as jti. Fetch current shared profile data from Session API /userinfo.

string
Example
{
  "claims": {
    "email": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    },
    "firstName": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    },
    "lastName": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    },
    "staticAvatar": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    },
    "animatedAvatar": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    }
  }
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed values: no-store

Prevent storage of the credential-bearing response.

Pragma
string
Allowed values: no-cache

Legacy cache instruction retained for credential responses.

400

Section titled “400”

The inquiry could not be redeemed. The reason distinguishes:

  • InquiryNotFound — the supplied key triple is not valid.
  • InquiryExpired — the inquiry has expired.
  • InquiryNotRealized — authentication is not complete.
  • InquiryAlreadyRedeemed — the single-use inquiry was consumed.
  • ApplicationNotFound, AuthenticationNotFound, or AccountNotFound — required issuance authority is unavailable.
Media typeapplication/json

Error response body. Known failures may include a stable reason. Some failures are status-only and have an empty body. A missing, malformed, or structurally invalid JSON body returns InvalidBody.

object
reason

Stable machine-readable reason code.

string
Examplegenerated
{
  "reason": "example"
}

403

Section titled “403”

The attempt was refused. The reason distinguishes:

  • ApplicationNotActive — the application is unavailable.
  • AccountDisabled — the realizing account is disabled.
  • AccountDeleted — the realizing account has been erased.
  • ClaimConsentRequired — interactive login is required to establish the current claim grant.
  • RequiredClaimDataMissing — a REQUIRED claim cannot currently be disclosed. An approved account without a surname is not missing data and discloses an empty surname.
  • EmailDomainBlocked, EmailDomainRequiresSso, or SsoAuthorityConflict — current email-domain policy prevents issuance.
Media typeapplication/json

Error response body. Known failures may include a stable reason. Some failures are status-only and have an empty body. A missing, malformed, or structurally invalid JSON body returns InvalidBody.

object
reason

Stable machine-readable reason code.

string
Examplegenerated
{
  "reason": "example"
}

409

Section titled “409”

Reason AuthorizationArtifactStale: identity authority changed after authentication. Start a new inquiry before retrying.

Media typeapplication/json

Error response body. Known failures may include a stable reason. Some failures are status-only and have an empty body. A missing, malformed, or structurally invalid JSON body returns InvalidBody.

object
reason

Stable machine-readable reason code.

string
Examplegenerated
{
  "reason": "example"
}

default

Section titled “default”

Error response.

Media typeapplication/json

Error response body. Known failures may include a stable reason. Some failures are status-only and have an empty body. A missing, malformed, or structurally invalid JSON body returns InvalidBody.

object
reason

Stable machine-readable reason code.

string
Examplegenerated
{
  "reason": "example"
}