### UserInfo Request Example

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of a UserInfo Request using the HTTP GET method with the Access Token sent as a Bearer Token in the Authorization header.

```http
GET /userinfo HTTP/1.1
Host: server.example.com
Authorization: Bearer SlAV32hkKG
```

--------------------------------

### HTTP GET to fetch Request Object

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of the Authorization Server fetching the Request Object via HTTP GET to the request_uri. The server must send this request unless the object is already cached.

```http
  GET /request.jwt HTTP/1.1
  Host: client.example.org

```

--------------------------------

### Redirect URI Fragment Handling Example

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of a Redirect URI response that includes a JavaScript file hosted by the client. The script parses the fragment component and sends it by POST to a URI for validation.

```http
  GET /cb HTTP/1.1
  Host: client.example.org

  HTTP/1.1 200 OK
  Content-Type: text/html

  <script type="text/javascript">

  // First, parse the query string
  var params = {}, postBody = location.hash.substring(1),
      regex = /([^&=]+)=([^&]*)/g, m;
  while (m = regex.exec(postBody)) {
    params[decodeURIComponent(m[1])] = decodeURIComponent(m[2]);
  }

```

--------------------------------

### Query String Serialization Example

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of Query String Serialization for an authorization request, typically used in HTTP GET requests. Parameters are added to the query component of a URL using the application/x-www-form-urlencoded format. Line wraps within values are for display purposes only.

```http
  GET /authorize?
    response_type=code
    &scope=openid
    &client_id=s6BhdRkqt3
    &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb HTTP/1.1
  Host: server.example.com

```

--------------------------------

### Request URI value example

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of a Request URI value with line wraps for display purposes only. The URI includes a fragment with high-entropy value to prevent unauthorized access.

```text
  https://client.example.org/request.jwt#
    GkurKxf5T0Y-mnPFCHqWOMiZi4VS138cQO_V7PZHAdM

```

--------------------------------

### Implicit Flow Authentication Request (GET /authorize)

Source: https://openid.net/specs/openid-connect-core-1_0.html

Non-normative example of an Implicit Flow Authentication Request sent by the User Agent to the Authorization Server. The response_type is id_token token, and the request includes client_id, redirect_uri, scope, state, and nonce parameters. Line wraps within values are for display purposes only.

```http
GET /authorize?
    response_type=id_token%20token
    &client_id=s6BhdRkqt3
    &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
    &scope=openid%20profile
    &state=af0ifjsldkj
    &nonce=n-0S6_WzA2Mj HTTP/1.1
  Host: server.example.com
```

--------------------------------

### Successful UserInfo Response Example

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of a successful UserInfo Response. The response body is a JSON object containing the requested Claims, and the `sub` Claim must always be included. The content-type must be `application/json`.

```http
  HTTP/1.1 200 OK
  Content-Type: application/json

  {
   "sub": "248289761001",
   "name": "Jane Doe",
   "given_name": "Jane",
   "family_name": "Doe",
   "preferred_username": "j.doe",
   "email": "janedoe@example.com",
   "picture": "http://example.com/janedoe/me.jpg"
  }

```

--------------------------------

### OpenID Connect scope request example

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of an unencoded scope request for OpenID Connect. The scope value is a space-delimited list of ASCII scope values, requesting the openid, profile, email, and phone scopes.

```text
scope=openid profile email phone
```

--------------------------------

### UserInfo Error Response Example

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of a UserInfo Error Response. The response includes a `WWW-Authenticate` header with a Bearer error as defined in RFC 6750.

```http
  HTTP/1.1 401 Unauthorized
  WWW-Authenticate: Bearer error="invalid_token",
    error_description="The Access Token expired"

```

--------------------------------

### Authorization request and response for response_type=code token

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example A.5 showing an authorization request with response_type=code token and the corresponding redirect response containing an authorization code, access token, and state.

```http
  GET /authorize?
    response_type=code%20token
    &client_id=s6BhdRkqt3
    &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
    &scope=openid%20profile%20email
    &nonce=n-0S6_WzA2Mj
    &state=af0ifjsldkj HTTP/1.1
  Host: server.example.com

  HTTP/1.1 302 Found
  Location: https://client.example.org/cb#
    code=Qcb0Orv1zh30vL1MPRsbm-diHiMwcLyZvn1arpZv-Jxf_11jnpEX3Tgfvk
    &access_token=jHkWEdUXMU1BwAsC4vtUsZwnNvTIxEl0z9K3vx5KF0Y
    &token_type=Bearer
    &state=af0ifjsldkj
```

--------------------------------

### Distributed Claims Example with Claims Providers B and C

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of distributed claims in OpenID Connect. The first two JSON objects show claims held by Claims Providers B and C, respectively. The third object shows the OpenID Provider's response with normal claims and references to distributed claims via _claim_names and _claim_sources. Note that not all claims from a provider need be included, as phone_number is omitted.

```json
  {
   "iss": "https://bank.example.com",
   "shipping_address": {
     "street_address": "1234 Hollywood Blvd.",
     "locality": "Los Angeles",
     "region": "CA",
     "postal_code": "90210",
     "country": "United States of America"},
   "payment_info": "Some_Card 1234 5678 9012 3456",
   "phone_number": "+1 (310) 123-4567"
  }

```

```json
  {
   "iss": "https://creditagency.example.com",
   "credit_score": 650
  }

```

```json
  {
   "sub": "248289761001",
   "name": "Jane Doe",
   "given_name": "Jane",
   "family_name": "Doe",
   "email": "janedoe@example.com",
   "birthdate": "0000-03-22",
   "eye_color": "blue",
   "_claim_names": {
     "payment_info": "src1",
     "shipping_address": "src1",
     "credit_score": "src2"
    },
   "_claim_sources": {
     "src1": {"endpoint":
                "https://bank.example.com/claim_source"},
     "src2": {"endpoint":
                "https://creditagency.example.com/claims_here",
              "access_token": "ksj3n283dke"}
   }
  }

```

--------------------------------

### Form Serialization Example

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of Form Serialization for an authorization request, typically used in HTTP POST requests. Parameters are added to the entity body using the application/x-www-form-urlencoded format. Line wraps within values are for display purposes only.

```http
  POST /authorize HTTP/1.1
  Host: server.example.com
  Content-Type: application/x-www-form-urlencoded

  response_type=code
    &scope=openid
    &client_id=s6BhdRkqt3
    &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb

```

--------------------------------

### Authorization Request with request_uri parameter

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of an Authorization Request using the request_uri parameter, with line wraps for display purposes only. The request_uri is URL-encoded and includes the fragment.

```text
  https://server.example.com/authorize?
    response_type=code%20id_token
    &client_id=s6BhdRkqt3
    &request_uri=https%3A%2F%2Fclient.example.org%2Frequest.jwt
    %23GkurKxf5T0Y-mnPFCHqWOMiZi4VS138cQO_V7PZHAdM
    &state=af0ifjsldkj&nonce=n-0S6_WzA2Mj
    &scope=openid

```

--------------------------------

### GET /authorize (Hybrid Flow Authentication Request)

Source: https://openid.net/specs/openid-connect-core-1_0.html

Initiates the Hybrid Flow authentication request. The request includes required parameters such as response_type, client_id, redirect_uri, scope, and optionally nonce and state.

```APIDOC
## [GET] /authorize

### Description
Initiates the Hybrid Flow authentication request. The request includes required parameters such as response_type, client_id, redirect_uri, scope, and optionally nonce and state.

### Method
GET

### Endpoint
/authorize

### Parameters
#### Query Parameters
- **response_type** (string) - REQUIRED. OAuth 2.0 Response Type value that determines the authorization processing flow to be used. For Hybrid Flow, this value is `code id_token`, `code token`, or `code id_token token`.
- **client_id** (string) - REQUIRED. Client identifier.
- **redirect_uri** (string) - REQUIRED. Redirection URI to which the response will be sent.
- **scope** (string) - REQUIRED. Scope values, e.g., `openid profile email`.
- **nonce** (string) - REQUIRED if response_type is `code id_token` or `code id_token token`; OPTIONAL if response_type is `code token`. String value used to associate a Client session with an ID Token and mitigate replay attacks.
- **state** (string) - OPTIONAL. Opaque value used to maintain state between the request and the callback.

### Request Example
```
GET /authorize?
    response_type=code%20id_token
    &client_id=s6BhdRkqt3
    &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
    &scope=openid%20profile%20email
    &nonce=n-0S6_WzA2Mj
    &state=af0ifjsldkj HTTP/1.1
Host: server.example.com
```

### Response
#### Success Response (302 Found)
The Authorization Server redirects the User Agent to the redirect_uri with the authorization code and other tokens in the fragment component.

#### Response Example
```
HTTP/1.1 302 Found
Location: https://client.example.org/cb#
    code=SplxlOBeZQQYbYS6WxSbIA
    &id_token=eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso
    &state=af0ifjsldkj
```

### Error Response
When an error occurs, the Authorization Server returns the error in the fragment component of the Redirection URI, as defined in OAuth 2.0 and OAuth 2.0 Multiple Response Type Encoding Practices.
```

--------------------------------

### GET /userinfo

Source: https://openid.net/specs/openid-connect-core-1_0.html

The UserInfo Endpoint returns claims about the authenticated end-user. The client sends a request using HTTP GET or POST with an access token as a Bearer Token.

```APIDOC
## GET /userinfo

### Description
The UserInfo Endpoint is an OAuth 2.0 Protected Resource that returns Claims about the authenticated End-User. The Client makes a request using an Access Token obtained through OpenID Connect Authentication.

### Method
GET

### Endpoint
/userinfo

### Parameters
#### Header Parameters
- **Authorization** (string) - Required - Bearer Token obtained from an OpenID Connect Authentication Request.

### Request Example
```
GET /userinfo HTTP/1.1
Host: server.example.com
Authorization: Bearer SlAV32hkKG
```

### Response
#### Success Response (200)
Returns a JSON object containing the requested Claims about the End-User.

#### Response Example
```json
{
  "sub": "248289761001",
  "name": "Jane Doe",
  "given_name": "Jane",
  "family_name": "Doe",
  "preferred_username": "j.doe",
  "email": "janedoe@example.com",
  "picture": "http://example.com/janedoe/me.jpg"
}
```
```

--------------------------------

### Example of Aggregated Claims (JSON)

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of aggregated claims: first, claims from Claims Provider A (including issuer URL) are shown; then, the signed JWT (jwt_header.jwt_part2.jwt_part3) is combined with normal claims and returned with _claim_names and _claim_sources members.

```json
  {
   "iss": "https://a.example.com",
   "address": {
     "street_address": "1234 Hollywood Blvd.",
     "locality": "Los Angeles",
     "region": "CA",
     "postal_code": "90210",
     "country": "United States of America"},
   "phone_number": "+1 (310) 123-4567"
  }

```

```json
  {
   "sub": "248289761001",
   "name": "Jane Doe",
   "given_name": "Jane",
   "family_name": "Doe",
   "birthdate": "0000-03-22",
   "eye_color": "blue",
   "email": "janedoe@example.com",
   "_claim_names": {
     "address": "src1",
     "phone_number": "src1"
   },
   "_claim_sources": {
     "src1": {"JWT": "jwt_header.jwt_part2.jwt_part3"}
   }
  }

```

--------------------------------

### JSON Serialization Example

Source: https://openid.net/specs/openid-connect-core-1_0.html

Example of JSON Serialization for a token response. Parameters are serialized into a JSON object structure with each parameter at the highest level. Omitted parameters and parameters with no value SHOULD be omitted from the object and not represented by a JSON null value.

```json
  {
   "access_token": "SlAV32hkKG",
   "token_type": "Bearer",
   "expires_in": 3600,
   "refresh_token": "8xLOxBtZp8"
  }

```