Initiate OIDC Login

Initialize the OIDC login process by returning the identity provider authorization URL to redirect the user to.

This is SSO where your identity provider also manages users, available on request: DFNS enables it for your organization or tenant. Users are created on their first sign-in, and their roles and group memberships follow your identity provider’s role claims at each login. For standard SSO configured in the dashboard, use Initiate SSO Login. Pass exactly one of orgId or tenantId.

POST /auth/login/oidc/init

Initiate OIDC Login

cURL

curl --request POST \
  --url https://api.dfns.io/auth/login/oidc/init \
  --header 'Content-Type: application/json' \
  --data '
{
  "redirectUri": "<string>",
  "orgId": "or-30tnh-itmjs-s235s5ontr3r23h2",
  "tenantId": "acct-24hka-dhili-9hgvdlvr1ohpibp4",
  "nonce": "<string>"
}
'

200

{
  "redirectUrl": "<string>"
}

​

Authentication

No authentication required.

​

Required Permissions

No authentication required.

Body

application/json

redirectUri · string<uri> · required

Redirect URI used for the authentication flow

orgId · string

Organization id.

Required string length: 1 - 64

Pattern: ^or-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"or-30tnh-itmjs-s235s5ontr3r23h2"

tenantId · string

Tenant id.

Required string length: 1 - 64

Pattern: ^acct-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"acct-24hka-dhili-9hgvdlvr1ohpibp4"

nonce · string

Session-key mode only: client-generated nonce (the credential id of the session key the client will register) that binds the OIDC id_token to that credential. Required when auth.oidc.sessionKeys.enabled is on; rejected otherwise.

Minimum string length: 1

Response

200 - application/json

Success

redirectUrl · string<uri> · required

The URL to redirect the user to authenticate with the IdP