Resolve current identity-claim policy and consent state.

GET

/claim-state

const url = 'https://session-api.sudomimus.com/claim-state';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://session-api.sudomimus.com/claim-state \
  --header 'Authorization: Bearer <token>'

Accepts an ordinary application access token as a Bearer credential and returns the live policy requirement and standing consent state for each shareable UserInfo claim. This endpoint accepts only sessions whose issuance protocol is APPLICATION; OIDC clients use the custom claim_state_endpoint from OIDC discovery instead.

Authorizations

BearerAccessToken

Responses

200

Current application-visible claim state.

application/json

object

sub

required

Pairwise sector subject for this application.

string

>= 1 characters

claims

required

object

email

required

object

requirement

required

string

Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK

state

required

string

Allowed values: UNKNOWN GRANTED DENIED

given_name

required

object

requirement

required

string

Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK

state

required

string

Allowed values: UNKNOWN GRANTED DENIED

family_name

required

object

requirement

required

string

Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK

state

required

string

Allowed values: UNKNOWN GRANTED DENIED

picture

required

object

requirement

required

string

Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK

state

required

string

Allowed values: UNKNOWN GRANTED DENIED

picture_animated

required

object

requirement

required

string

Allowed values: SYNTHETIC_ONLY OFF OPTIONAL REQUIRED SYNTHETIC_FALLBACK

state

required

string

Allowed values: UNKNOWN GRANTED DENIED

Example

{
  "claims": {
    "email": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    },
    "given_name": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    },
    "family_name": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    },
    "picture": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    },
    "picture_animated": {
      "requirement": "SYNTHETIC_ONLY",
      "state": "UNKNOWN"
    }
  }
}

Headers

Cache-Control

string

Allowed values: no-store

Prevent storage of the credential-bearing response.

Pragma

string

Allowed values: no-cache

Legacy cache instruction retained for credential responses.

Vary

string

Allowed values: Authorization

Prevent shared-cache reuse across Bearer credentials.

401

Bearer token missing, malformed, expired, inactive, or owned by another issuance protocol.

application/json

object

error

required

string

Allowed values: invalid_token

Example

{
  "error": "invalid_token"
}

Headers

WWW-Authenticate

string

Bearer authentication challenge.