APG PayAPG Paydocs

Identity

OIDC sso launch

POST/oidc/.extension/sso/launch
Request
POSThttps://api.tst.au.apgpay.dev/oidc/.extension/sso/launch
curl -X POST https://api.tst.au.apgpay.dev/oidc/.extension/sso/launch \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"bearerToken":"string","target":"string"}'

Just-in-time SSO launch. Submit as a top-level form POST; the answer sets a first-party session cookie and redirects the browser to target. Form-encoded and cookie-setting because it is a browser navigation, not a fetch.

Request body

bearerTokenstringrequired

The bearer proving who the user already is. In the body, never the URL, a top-level navigation cannot carry a header.

targetstringrequired

Which downstream application to land in. Validated against a registered allow-list.

Example request
{
  "bearerToken": "string",
  "target": "string"
}

Responses

No response body.

Error responses