Signaturgruppen Broker

https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation
Admin
Signaturgruppen Broker is an OpenID Connect-based authentication and digital signing solution that...
Tokens:62,964
Snippets:663
Trust Score:8.3
Update:2 months ago
Show doc for...
Tokens:
Raw
### Workflow Status Response Example

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/workflow-signing-example.html

Example JSON response showing the status of a workflow and its associated signatures.

```json
{
    "id": "36....01",
    "created": "2025-12-03T08:19:05.4942269+00:00",
    "title": "[Title]",
    "organizationTin": "DK...",
    "expiresAt": "2025-12-04T09:18:00+00:00",
    "signatures": [
        {
            "id": "d24....b9",
            "created": "2025-12-03T08:19:22.4973269+00:00",
            "serviceProvidedSignerName": null,
            "signatureTransactionId": "5e7...40",
            "userClaims": {
                "mitid.identity_name": "Anker Andersen",
                "loa": "https://data.gov.dk/concept/core/nsis/Substantial",
                "ial": "https://data.gov.dk/concept/core/nsis/Substantial",
                "idp_identity_id": "e799.......52",
                "idp": "mitid",
                "auth_time": "1764749954"
            },
            "ipAddressOfUser": "...9"
        }
    ]
}
```

--------------------------------

### Execute UI Mode Simulation Request

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/simulation.html

Example URL for initiating a simulation in UI mode.

```text
https://pp.netseidbroker.dk/op/connect/authorize?client_id=CLIENT_ID&response_type=...&simulation=ui uuid:GUID
```

--------------------------------

### Initialization response with QR code

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/ageverification/av_eu_ciba.html

Example of an initialization response when the qr_code_response parameter is set to png.

```json
{
  "auth_req_id": "9384B..-1",
  "expires_in": 300,
  "interval": 3,
  "authentication_uri": "https://pp.idbroker.eu/op/connect/authorize?client_id=b.7&request_uri=urn:ietf:params:oauth:request_uri:4BEE..2",
  "qr_b64": "iVBORw0KGg...",
}
```

--------------------------------

### Authorization Code Request Example

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/ageverification/age_verification.html

Example URL for initiating an age verification request using the Authorization Code flow.

```http
https://pp.netseidbroker.dk/op/connect/authorize?client_id=0b5ac04e-5dbb-4bb8-a697-93152896a2f6&redirect_uri=https://oidcdebugger.com/debug&response_type=code&scope=openid%20age_verify:16&prompt=login
```

--------------------------------

### Identity Provider Parameters Configuration

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/eboks.html

JSON and URL-encoded examples for configuring identity provider parameters.

```json
{
  "eboks": {
    "reference_text": "Approve handout of data"
  }
}
```

```text
idp_params=%7B%20%22eboks%22%3A%7B%22Approve%20handout%20of%20data%22%3A%22%22%7D%7D
```

--------------------------------

### Transaction token example

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/workflow-signing-example.html

Example of the transaction token received after completing the OIDC flow.

```json
{
  "mitid.transaction_id": "e4c6e9cd-8e69-47b2-8c7d-7b95f873d755",
  "mitid.uuid": "e...8",
  "mitid.age": "89",
  "mitid.date_of_birth": "1936-04-08",
  "mitid.has_cpr": "true",
  "mitid.identity_name": "Ileya Jensen",
  "amr": "code_app",
  "loa": "https://data.gov.dk/concept/core/nsis/Substantial",
  "ial": "https://data.gov.dk/concept/core/nsis/Substantial",
  "aal": "https://data.gov.dk/concept/core/nsis/Substantial",
  "identity_type": "private",
  "idp_identity_id": "e..8",
  "idp": "mitid",
  "acr": "https://data.gov.dk/concept/core/nsis/Substantial",
  "auth_time": "1764593359",
  "sub": "9..5",
  "transaction_id": "98150b00-1729-4f40-9c14-6940cead4bc9",
  "redirect_uri": "https://brokerdemo-pp.signaturgruppen.dk/signin-oidc",
  "transaction_actions": [
    "mitid.login",
    "workflow_finalized"
  ],
  "workflow_signature_transaction_id": "f73064fe-2d6e-4635-adca-e9623734c5ed",
  "workflow_id": "workflowid1234",
  "workflow_pdf_title_and_sha256": "{\"Agreement for Digital Signing\":\"f2888bc8aae9cbc0f691a6847ea9f0401785959b17b1a9f9a84d11e54d3614c8\",\"Demo Data \\u0026 Permissions Overview\":\"3ccc0e3a4d7dacc3dfbc6150158c2000c690964c2754d4f3f9ce5365dfd5c8fb\"}",
  "transaction_client_ip": "1..9",
  "nbf": 1764593469,
  "exp": 1953895869,
  "iat": 1764593469,
  "iss": "https://pp.netseidbroker.dk/op",
  "aud": "14148e23-1d32-4d5b-a7ef-8935fdf65836"
}
```

--------------------------------

### Production configuration for HTML+JS integration

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/ageverification/age_verification.html

Example configuration file for setting up the production environment in the HTML+JS integration.

```javascript
var sg_broker_origin = 'https://netseidbroker.dk';
var sg_broker_redirect_uri = `${sg_broker_origin}/op/WebMessagingCallback/ImplicitCallback`;
var sg_broker_authorize_endpoint = `${sg_broker_origin}/op/connect/authorize`;
var sg_broker_clientId = "<Your production client ID>";
var sg_broker_demo_age_to_verify = 16;
```

--------------------------------

### Execute No UI Mode Simulation Request

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/simulation.html

Example URL for initiating a simulation in no-UI mode with multiple parameters.

```text
https://pp.netseidbroker.dk/op/connect/authorize?client_id=CLIENT_ID&response_type=...&simulation=no-ui uuid:GUID mitid_erhverv_uuid:GUID
```

--------------------------------

### ID Token Structure Example

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/ageverification/age_verification.html

Example of a JWT ID token structure received from the broker, including the age verification claim.

```json
{
   "iss": "https://pp.netseidbroker.dk/op",
   "nbf": 1725009225,
   "iat": 1725009225,
   "exp": 1725009525,
   "aud": "9d3c7d79-96c4-43bc-8562-f0bf88ef69b8",
   "nonce": "new-nonce",
   "sid": "2d08c82b-dd1f-441f-ae7d-5b690c4d23fa",
   "sub": "624256d3-4cac-44d1-8a97-0e967c015b6c",
   "auth_time": 1725009225,
   "idp": "idbrokerdk",
   "neb_sid": "2d08c82b-dd1f-441f-ae7d-5b690c4d23fa",
   "transaction_id": "90aceda9-da54-40aa-97ac-cd99eca38332",
   "idtoken_type": "idbroker.dk",
   "idbrokerdk_age_verified": "16:false"
}
```

--------------------------------

### Initialization response for iframe flow

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/ageverification/av_eu_ciba.html

Example of an initialization response when the flow_type parameter is set to iframe.

```json
{
  "auth_req_id": "9384B..-1",
  "expires_in": 300,
  "interval": 3,
  "iframe_src":  "https://pp.idbroker.eu/op/iframe/av/?client_id=b.7&request_uri=urn:ietf:params:oauth:request_uri:4BEE..2",
}
```

--------------------------------

### Implicit Flow Configuration

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/ageverification/age_verification.html

Example configuration and URL for performing an age verification using the Implicit flow.

```text
client_id: 9d3c7d79-96c4-43bc-8562-f0bf88ef69b8
Example URL: https://pp.netseidbroker.dk/op/connect/authorize?client_id=9d3c7d79-96c4-43bc-8562-f0bf88ef69b8&redirect_uri=https://oidcdebugger.com/debug&response_type=id_token&scope=openid%20age_verify:16&prompt=login&nonce=new-nonce
```

--------------------------------

### Example UserInfo Response

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/apis.html

A sample JSON response from the UserInfo endpoint following a successful MitID authentication flow.

```json
{
  "sub" : "bab646bb-8608-4ac7-ac42-cee4ad490600",
  "mitid_uuid" : "af0196a3-6c61-464d-ab04-6394191a753d",
  "mitid.age" : "35",
  "mitid.date_of_birth"	: "1985-03-29",
  "mitid.has_cpr" : "true”,
  "da.cpr" : "290385-xxxx",
  "mitid.identity_name" : "Hans Hansen",
  "session_status" : "active",
  "session_identifier" : "19712D37-0C76-4AAA-B049-BACD585F484F"
}
```

--------------------------------

### Example Error Response

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/oidc-integration.html

The format of the redirect URI when an authentication request results in an error.

```text
[client_redirect_uri]?error= access_denied&error_description=mitid_user_aborted&state=xyz
```

--------------------------------

### JWT Header Example

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/transactionsigning/transaction-signing.html

The header contains the algorithm and key identifier used for signing the token.

```json
{
  "alg": "RS256",
  "kid": "20595A4BE9F566771792BC3DBC7DF78FF9C36575",
  "typ": "JWT"
}
```

--------------------------------

### Define Request Object Parameters

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/flex-app-ciba.html

Dictionary setup for the claims required in the signed request object.

```csharp
            var parameters = new Dictionary<string, object>
            {
                { "client_id", clientId },
                { "login_hint_token", loginHint },
                { "scope", "openid mitid" },
                { "jti", Guid.NewGuid() }
            };
```

--------------------------------

### Handle NemLog-in3 signing events

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/nemlogin/nemlogin-qualifiedsigning.html

Example of an event listener to handle messages returned from the NemLog-in3 signing iframe.

```javascript
async function nemloginHandler(event) {
    console.log("nemloginHandler received event: " + event.data.command + ", from origin: " + event.origin);
    if (event.data.command === "complete") {
        // Success
    }
    if (event.data.command === "error") {
        // Error. Note that error message is technical and is not meant for end user
        systemLog(event.data.message);
    }
    if (event.data.command === "cancelSign") {
        // Cancelled
    }

    window.removeEventListener("message", nemloginHandler);
}

window.addEventListener("message", nemloginHandler);
```

--------------------------------

### Configure MitID Erhverv Identity Provider Parameters

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mitid-erhverv.html

Examples of the JSON configuration for identity provider parameters and its URL-encoded equivalent.

```json
{
  "mitid_erhverv": {
    "allow_private": true
  }
}
```

```text
idp_params=%7B%E2%80%9Cmitid_erhverv%E2%80%9D%3A%7B%E2%80%9Callow_private%E2%80%9D%3Atrue%7D%7D
```

--------------------------------

### AASA File Structure Example

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/native_app_integration.html

A JSON structure defining the app ID and path components for Universal Link routing.

```json
{
  "applinks": {
    "details": [
      {
        "appIDs": [
          "TEAMID.com.example.mobile"
        ],
        "components": [
          {
            "/": "/mobile/oauth/callback*"
          },
          {
            "/": "/mobile/open-app*"
          }
        ]
      }
    ]
  }
}
```

--------------------------------

### MitID Identity Provider Parameters

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mitid.html

Configuration examples for MitID identity provider parameters provided as a JSON object or a URL-encoded string.

```json
{
  "mitid": {
    "loa_value": "substantial",
    "reference_text": "VGVzdCByZWZlcmVuY2UgdGV4dA=="
  }
}
```

```text
idp_params=%7B%20%22mitid%22%3A%7B%22loa_value%22%3A%22substantial%22%2C%22reference_text%22%3A%22VGVzdCByZWZlcmVuY2UgdGV4dA%3D%3D%22%7D%7D
```

--------------------------------

### One-Time Handle URL

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/native_app_integration.html

Example of a secure, short-lived opaque handle used to resume the authentication flow.

```text
https://auth.example.com/mobile/open-app?t=ONE_TIME_HANDLE
```

--------------------------------

### GET /op/connect/authorize

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mitid-age-verification.html

Initiates the MitID age verification flow by providing specific OIDC scopes.

```APIDOC
## GET /op/connect/authorize

### Description
Initiates an OIDC authorization request to perform age verification. By using the 'minimal' and 'age_verify:[age]' scopes, the broker triggers specific default IdP parameters optimized for age confirmation.

### Method
GET

### Endpoint
/op/connect/authorize

### Parameters
#### Query Parameters
- **client_id** (string) - Required - Your client identifier.
- **scope** (string) - Required - Must include 'openid', 'minimal', and either 'age_verify:[age]' or 'age'.
- **response_type** (string) - Required - The OIDC response type (e.g., 'code').
- **redirect_uri** (string) - Required - The URI to redirect to after authentication.
- **nonce** (string) - Required - A random string to prevent replay attacks.
- **idp_values** (string) - Optional - Set to 'mitid' if it is the only active IdP.
- **idp_params** (string) - Optional - Overrides default IdP settings including reference text and AAL level.

### Response
#### Success Response (200)
- **idbrokerdk_age_verified** (string) - Returned in ID token when using 'age_verify:[age]'.
- **idbrokerdk_age** (string) - Returned in ID token when using 'age' scope.
- **idbrokerdk_age_verify_[age]** (string) - Returned via Userinfo endpoint.
```

--------------------------------

### GET /op/connect/authorize

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/transactionsigning/transaction-signing.html

Initiates the OpenID Connect authentication flow with the Signaturgruppen Broker, including the transaction signing reference.

```APIDOC
## GET /op/connect/authorize

### Description
Starts the signing process with the user by including the signtext_id parameter in the OIDC authorization request.

### Method
GET

### Endpoint
https://pp.netseidbroker.dk/op/connect/authorize

### Query Parameters
- **client_id** (string) - Required - The client identifier.
- **redirect_uri** (string) - Required - The URI to redirect to after authorization.
- **scope** (string) - Required - The requested scopes (e.g., "openid mitid transaction_token").
- **response_type** (string) - Required - The response type (e.g., "code").
- **signtext_id** (string) - Required - The signtext ID obtained from the Signtext API.
- **prompt** (string) - Optional - Set to "login" to force user interaction.
- **idp_params** (string) - Optional - JSON-encoded parameters for the identity provider (e.g., {"mitid":{"action_text":"SIGN"}}).
```

--------------------------------

### Authorization Code Flow Configuration

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/ageverification/age_verification.html

Example configuration and URL for performing an age verification using the Authorization Code flow.

```text
client_id: 0b5ac04e-5dbb-4bb8-a697-93152896a2f6
client_secret: lk9JFkNkvodVPNA7E4Aui7oMal2HraIXwCqvOjEo1ymToAmsEdmLSPX8fevqvAaKSxmi1HHYufKnBOY9KCsLNQ==
Example URL: https://pp.netseidbroker.dk/op/connect/authorize?client_id=0b5ac04e-5dbb-4bb8-a697-93152896a2f6&redirect_uri=https://oidcdebugger.com/debug&response_type=code&scope=openid%20age_verify:16&prompt=login
```

--------------------------------

### Example Transaction Token

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mobilepay.html

Optional transaction token demonstrating expected claims including user information and transaction metadata.

```json
{
  "birthdate": "19..3",
  "address": "{\"street_address\":\"Weldon Trafficway 48w\\ne\",\"formatted\":\"Weldon Trafficway 48w\\ne\\n4267\\nSouth Jazminchester\\nDK\",\"region\":\"South Jazminchester\",\"postal_code\":\"4267\",\"country\":\"DK\",\"address_type\":\"home\"}",
  "gender": "male",
  "given_name": "Lacey",
  "name": "Lacey Walter",
  "phone_number": "45..19",
  "family_name": "Walter",
  "email": "b...m",
  "mobilepay_msn": "20..1",
  "mobilepay_client_id": "a..d471"
  "idp": "mobilepay",
  "idp_identity_id": "c2fa...ed",
  "auth_time": "1777626074",
  "sub": "c2fa...ed",
  "transaction_id": "eeab..a",
  "redirect_uri": "https://brokerdemo-pp.signaturgruppen.dk/signin-oidc",
  "transaction_actions": "mobilepay_authenticated",
  "transaction_client_ip": "1....9",
  "reference_id": "demo_normal_flow_requestid",
  "nbf": 1777626075,
  "exp": 1967014875,
  "iat": 1777626075,
  "nin": 2......4
  "iss": "https://idbroker.eu/op",
  "aud": "14...36",

}
```

--------------------------------

### OIDC idp_params configuration

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/app-mitid-integration.html

Example of a URL-encoded JSON object passed as the idp_params parameter to override default app switch settings.

```text
idp_params=%7B%22mitid%22%3A%7B%22enable_app_switch%22%3A%20true%2C%20%22app_switch_os%22%3A%22ios%22%2C%20%22app_switch_url%22%3A%22https%3A%2F%2Fyour.appswitch.url%2F%22%7D%7D
```

--------------------------------

### Token Endpoint POST Request with Client Assertion

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/openid-intro.html

Example cURL command for authenticating at the token endpoint using a client assertion.

```bash
curl --location --request POST '' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'client_id=asd...ca21382877' \
--data-urlencode 'redirect_uri=<redirectUri>' \
--data-urlencode 'code=35CA4BC2A0F5DB9A....1BEF00150EEA44' \
--data-urlencode 'client_assertion=...XahMP78S7DdgwZEvVa4vA3usNsJg' \
--data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
```

--------------------------------

### Setup a loopback listener in C#

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/ageverification/windows-native.html

Initializes an HttpListener to capture incoming requests on a local loopback address. Requires appropriate permissions to bind to the specified URL prefix.

```csharp
using System;
using System.Net;
using System.Text;
using System.Threading.Tasks;

namespace LoopbackListenerExample
{
    class Program
    {
        static async Task Main(string[] args)
        {
            // Define the loopback URL and port
            string url = "http://127.0.0.1:5000/";
            
            // Initialize HttpListener and add the URL prefix
            using (HttpListener listener = new HttpListener())
            {
                listener.Prefixes.Add(url);
                
                try
                {
                    // Start listening for incoming HTTP requests
                    listener.Start();
                    Console.WriteLine($"Listening for requests on {url}");
                    
                    // Wait for an incoming request (this can be run in a loop or handled per request)
                    HttpListenerContext context = await listener.GetContextAsync();
                    
                    // Log the incoming request details
                    Console.WriteLine("Received request: " + context.Request.RawUrl);
                    
                    // You can extract query parameters here, e.g., the authorization code from OpenID Connect
                    // string authCode = context.Request.QueryString["code"];
                    
                    // Respond to the browser (for example, a simple HTML page)
                    string responseHtml = "<html><body><h1>You may now close this window.</h1></body></html>";
                    byte[] buffer = Encoding.UTF8.GetBytes(responseHtml);
                    
                    context.Response.ContentLength64 = buffer.Length;
                    context.Response.ContentType = "text/html";
                    await context.Response.OutputStream.WriteAsync(buffer, 0, buffer.Length);
                    context.Response.OutputStream.Close();
                    
                    // Optionally, break out of the loop after a successful request or continue listening
                }
                catch (HttpListenerException hlex)
                {
                    Console.WriteLine("HttpListener Exception: " + hlex.Message);
                }
                catch (Exception ex)
                {
                    Console.WriteLine("Exception: " + ex.Message);
                }
                finally
                {
                    listener.Close();
                }
            }
            
            Console.WriteLine("Listener stopped. Press any key to exit.");
            Console.ReadKey();
        }
    }
}
```

--------------------------------

### Launch Auth Tab Intent

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/native_app_integration.html

Initiate the authentication flow by providing the authorization URI and the expected callback host and path.

```kotlin
val authTabIntent = AuthTabIntent.Builder().build()

authTabIntent.launch(
    authTabLauncher,
    authorizationUri,
    "auth.example.com",
    "/mobile/oauth/callback"
)
```

--------------------------------

### Get workflow status

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/workflow-signing-example.html

Retrieves the current status of a workflow.

```http
GET /api/workflows/{cvr}/{workflowId}
```

--------------------------------

### GET /api/workflows/{cvr}

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/workflow-signing.html

Retrieves all workflows for a specific CVR.

```APIDOC
## GET /api/workflows/{cvr}

### Description
Get all workflows.

### Method
GET

### Endpoint
/api/workflows/{cvr}

### Parameters
#### Path Parameters
- **cvr** (string) - Required - The CVR identifier.
```

--------------------------------

### POST /op/api/v1/iframe/initialize

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mitid-iframe.html

Initializes a MitID authentication session and returns an iframe URL.

```APIDOC
## POST /op/api/v1/iframe/initialize

### Description
Initializes the MitID authentication process and returns the necessary iframe URL to embed in the client application.

### Method
POST

### Endpoint
https://pp.netseidbroker.dk/op/api/v1/iframe/initialize

### Request Body
- **client_secret** (string) - Required - The client secret for authentication.
- **client_id** (string) - Required - The client ID.
- **response_type** (string) - Required - The response type (e.g., code).
- **scope** (string) - Required - The requested scopes (e.g., openid mitid).
- **idp_values** (string) - Required - The identity provider (e.g., mitid).
- **redirect_uri** (string) - Required - The URI to redirect to after authentication.
- **idp_params** (string) - Required - JSON string containing MitID specific parameters like cpr_hint, iframe_mode, and authenticators.

### Request Example
curl --location 'https://pp.netseidbroker.dk/op/api/v1/iframe/initialize' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_secret=...' \
--data-urlencode 'client_id=...' \
--data-urlencode 'response_type=code' \
--data-urlencode 'scope=openid mitid' \
--data-urlencode 'idp_values=mitid' \
--data-urlencode 'redirect_uri=https://oidcdebugger.com/debug' \
--data-urlencode 'idp_params={"mitid": {"cpr_hint": "[CPR]", "iframe_mode": "minimized", "authenticators": "app code_token"}}'

### Response
#### Success Response (200)
- **auth_token** (string) - The authentication token.
- **auth_token_expiration** (integer) - The expiration timestamp of the token.
- **iframe_url** (string) - The URL to be loaded in the iframe.

#### Response Example
{
    "auth_token": "a1d...a0",
    "auth_token_expiration": 1726564561,
    "iframe_url": "https://netseidbroker.pp.mitid.dk/iframe"
}
```

--------------------------------

### GET /api/workflows/{cvr}/{workflowId}

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/workflow-signing.html

Retrieves a single workflow by ID.

```APIDOC
## GET /api/workflows/{cvr}/{workflowId}

### Description
Get single workflow.

### Method
GET

### Endpoint
/api/workflows/{cvr}/{workflowId}

### Parameters
#### Path Parameters
- **cvr** (string) - Required - The CVR identifier.
- **workflowId** (string) - Required - The workflow ID.
```

--------------------------------

### Initialize Session with Custom Callback Scheme

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/native_app_integration.html

Use this initialization method for deployments requiring an older callback API with a custom URL scheme.

```swift
let session = ASWebAuthenticationSession(
    url: authorizationURL,
    callbackURLScheme: "com.example.mobile"
) { callbackURL, error in
    // Process result.
}
```

--------------------------------

### GET /api/workflows/{cvr}/{workflowId}/workflowtoken

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/workflow-signing.html

Retrieves a Workflow token for a workflow.

```APIDOC
## GET /api/workflows/{cvr}/{workflowId}/workflowtoken

### Description
Builds a Workflow token that seals the workflow and signers.

### Method
GET

### Endpoint
/api/workflows/{cvr}/{workflowId}/workflowtoken

### Parameters
#### Path Parameters
- **cvr** (string) - Required - The CVR identifier.
- **workflowId** (string) - Required - The workflow ID.
```

--------------------------------

### Demo Service Provider Credentials

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/flex-app-ciba.html

Use these preconfigured credentials for testing the CIBA flow in the PP environment.

```text
service provider name: "Signaturgruppen flex app demo"
client_id: "62b8cc03-aa73-4d6a-922c-7c8fb0a4a1d9"
client_secret: "mIpxk84FI1wpc7cP7nodFLfgQQ1ScZHYO44FZ9wPOqrB0ha9S5RUNYPXMkrCWwRjGqEH0hflnIJea8IKmW19aQ=="
```

--------------------------------

### Example ID Token

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mobilepay.html

Representation of an ID token issued by the broker for a MobilePay login.

```json
{
  "iss": "https://idbroker.eu/op",
  "nbf": 1781809378,
  "iat": 1781809378,
  "exp": 1781809678,
  "aud": "e..a",
  "nonce": "639174061751992403.YzE3NTlmYjgtMWVmMi00YzlhLTk3YzQtODdlYmIxMDBlMjQ1ZGZhNDhhNGYtOThiMS00MWVjLTgyNGQtY2U4ZWUwMzRmNjUx",
  "at_hash": "6I60BHbq1XQyXzVZBkV07A",
  "sid": "ef22a6bc-ef47-460b-8912-201572f8761f",
  "sub": "49..5b54",
  "auth_time": 1781809383,
  "idp": "mobilepay",
  "neb_sid": "ef22a6bc-ef47-460b-8912-201572f8761f",
  "transaction_id": "124b9076-9a57-4b0a-8557-43e1076c8703",
  "session_expiry": "1781823778",
  "mobilepay_msn": "2..1",
  "mobilepay_client_id": "b..2",
  "subject_type": "idp_id",
  "rat": "1781809383"
}
```

--------------------------------

### GET https://pp.netseidbroker.dk/op/connect/userinfo

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/troubleshooting.html

Retrieves user information using a valid access token.

```APIDOC
## GET https://pp.netseidbroker.dk/op/connect/userinfo

### Description
Retrieves user information using a valid access token. The access token must be provided as a Bearer token in the request.

### Method
GET

### Endpoint
https://pp.netseidbroker.dk/op/connect/userinfo
```

--------------------------------

### Android Custom-Scheme Fallback

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/native_app_integration.html

Example of a reverse-domain custom scheme used when HTTPS callbacks are unavailable.

```text
com.example.mobile:/oauth/callback
```

--------------------------------

### Example OpenID Connect Authorization URL

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/troubleshooting.html

A sample URL used for the OpenID Connect authentication request, including client ID, redirect URI, scope, and IDP parameters.

```text
https://pp.netseidbroker.dk/op/connect/authorize?client_id=80e5e4c4-d8f1-424f-8411-589caf1c05cd&redirect_uri=https://openidconnect.net/callback&scope=openid%20mitid&response_type=code&idp_values=mitid_erhverv
```

--------------------------------

### JWT Body Example

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/transactionsigning/transaction-signing.html

The body contains identity claims, transaction details, and security assertions.

```json
{
  "mitid.uuid": "6867f..2118",
  "mitid.age": "17",
  "mitid.date_of_birth": "2005-06-03",
  "mitid.identity_name": "Edvard Nielsen",
  "mitid.transaction_id": "bfa627f...cddf99c",
  "amr": "code_app",
  "loa": <https://data.gov.dk/concept/core/nsis/Substantial>,
  "acr": <https://data.gov.dk/concept/core/nsis/Substantial>,
  "ial": <https://data.gov.dk/concept/core/nsis/Substantial>,
  "aal": <https://data.gov.dk/concept/core/nsis/Substantial>,
  "identity_type": "private",
  "idp": "mitid",
  "auth_time": "1663143384",
  "sub": "5cb6c9...2bf7b",
  "transaction_id": "0ee595...9901ad4a",
  "redirect_uri": <https://brokerdemo-pp.signaturgruppen.dk/signin-oidc>,
  "mitid.psd2": "false",
  "transaction_text_type": "pdf",
  "transaction_text_sha256": "BfjQQwVirWIjKj...g/Dak=",
  "transaction_actions": [
    "mitid.login",
    "mitid.transaction_signing"
  ],
  "signing_cert_ocsp_nonce": "LR19s2V2kd25....e58WRUOBerYqg1CZRCfBUbA97EJd0tY=",
  "nbf": 1663143385,
  "exp": 1852532185,
  "iat": 1663143385,
  "iss": <https://pp.netseidbroker.dk/op>,
  "aud": "14148e23-1d32-4d5b-a7ef-8935fdf65836"
}
```

--------------------------------

### Recommended Server Endpoint Structure

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/native_app_integration.html

A clean endpoint structure for managing OAuth authorization, callbacks, and native app deep linking.

```text
/oauth/authorize
/mobile/oauth/callback
/mobile/complete
/mobile/open-app
/mobile/resume
```

--------------------------------

### ID Token Structure

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/controlled-transfer.html

Example of the signed ID token returned after a successful CTT exchange.

```json
{
  "iss": "https://pp.netseidbroker.dk/op",
  "nbf": 1748422689,
  "iat": 1748422689,
  "exp": 1748422989,
  "aud": "DK29915938",
  "ct_claims": "{\"claim_1\":\"value1\",\"claim_2\":\"value2\"}",
  "ct_id": "f06ed0..6d2",
  "ct_sender": "DK..8",
  "ct_sender_traceId": "trace-id-1234"
}
```

--------------------------------

### Access Swagger API Reference

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/controlled-transfer.html

The Swagger API documentation for the PP environment is available at the provided URL.

```text
https://pp.netseidbroker.dk/op/swagger/index.html
```

--------------------------------

### Implement ASWebAuthenticationSession Coordinator

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/native_app_integration.html

A coordinator class implementing ASWebAuthenticationPresentationContextProviding to manage authentication sessions and handle callbacks.

```swift
import AuthenticationServices

final class AuthenticationCoordinator: NSObject,
    ASWebAuthenticationPresentationContextProviding {

    private var session: ASWebAuthenticationSession?

    func start(
        authorizationURL: URL,
        completion: @escaping (Result<URL, Error>) -> Void
    ) {
        let callback = ASWebAuthenticationSession.Callback.https(
            host: "auth.example.com",
            path: "/mobile/oauth/callback"
        )

        let session = ASWebAuthenticationSession(
            url: authorizationURL,
            callback: callback
        ) { callbackURL, error in
            defer { self.session = nil }

            if let callbackURL {
                completion(.success(callbackURL))
                return
            }

            completion(.failure(
                error ?? AuthenticationError.missingCallback
            ))
        }

        session.presentationContextProvider = self

        // Shared browser state is the best default for SSO and passkeys.
        session.prefersEphemeralWebBrowserSession = false

        self.session = session

        guard session.start() else {
            self.session = nil
            completion(.failure(AuthenticationError.failedToStart))
            return
        }
    }

    func presentationAnchor(
        for session: ASWebAuthenticationSession
    ) -> ASPresentationAnchor {
        // Return the active foreground window for the current scene.
        UIApplication.shared.connectedScenes
            .compactMap { $0 as? UIWindowScene }
            .filter { $0.activationState == .foregroundActive }
            .flatMap(\.windows)
            .first { $0.isKeyWindow }
            ?? ASPresentationAnchor()
    }
}

enum AuthenticationError: Error {
    case missingCallback
    case failedToStart
}
```

--------------------------------

### GET /connect/authorize

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/ageverification/av_eu_oidc.html

Initializes the age verification flow by redirecting the user to the OIDC authorization endpoint.

```APIDOC
## GET /connect/authorize

### Description
Initializes the age verification flow using the OIDC interface.

### Method
GET

### Endpoint
https://pp.idbroker.eu/connect/authorize

### Parameters
#### Query Parameters
- **client_id** (string) - Required - Your client identifier
- **redirect_uri** (string) - Required - The URI to redirect to after authorization
- **response_type** (string) - Required - Must be set to 'code'
- **scope** (string) - Required - Must include 'openid' and 'age_over:18'
- **nonce** (string) - Required - A unique string value to associate with the request
```

--------------------------------

### Handle Success Response

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mitid-iframe.html

The API returns an authentication token and the URL required to render the MitID iframe upon successful initialization.

```json
{
    "auth_token": "a1d...a0",
    "auth_token_expiration": 1726564561,
    "iframe_url": "https://netseidbroker.pp.mitid.dk/iframe"
}
```

--------------------------------

### Initiate OIDC flow with signtext_id

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/transactionsigning/transaction-signing.html

Start the OIDC authorization flow by including the signtext_id parameter.

```http
https://pp.netseidbroker.dk/op/connect/authorize?client_id=0a775a87-878c-4b83-abe3-ee29c720c3e7&redirect_uri=https://openidconnect.net/callback&idp_values=mitid&prompt=login&scope=openid+mitid+transaction_token&response_type=code&signtext_id=pdf_ab79c129-099e-4800-826b-8c63891e68f3&prompt=login
```

--------------------------------

### Register Auth Tab Activity Result Launcher

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/native_app_integration.html

Initialize the launcher during Activity or Fragment creation to handle authentication results.

```kotlin
private val authTabLauncher =
    AuthTabIntent.registerActivityResultLauncher(this) { result ->
        when (result.resultCode) {
            AuthTabIntent.RESULT_OK ->
                processAuthorizationCallback(result.resultUri)

            AuthTabIntent.RESULT_CANCELED ->
                handleCancellation()

            AuthTabIntent.RESULT_VERIFICATION_FAILED ->
                handleRedirectAssociationFailure()

            AuthTabIntent.RESULT_VERIFICATION_TIMED_OUT ->
                handleRedirectAssociationTimeout()
        }
    }
```

--------------------------------

### Initiate Signing Flow

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/workflow-signing.html

Endpoint to retrieve a SigntextID required to start the OIDC signing process.

```http
POST /api/workflows/{cvr}/signtextid
```

--------------------------------

### Private Key JWT Structure

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/openid-intro.html

Example of the JSON payload structure for a JWT signed with a private key.

```json
{
  "jti": "ec454782-93c1-4160-8e46-502532df52f2",
  "sub": "bcc7595b-2ed0-445d-a507-42ca21382877",
  "iat": 1619296461,
  "nbf": 1619296461,
  "exp": 1619296581,
  "iss": "bcc7595b-2ed0-445d-a507-42ca21382877",
  "aud": "https://pp.netseidbroker.dk/op"
}
```

--------------------------------

### Initiate MitID signature via PAR

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/workflow-signing-example.html

Performs a PAR request to the broker and navigates the user to the authorization endpoint.

```bash
curl --location 'https://pp.netseidbroker.dk/op/connect/par' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'redirect_uri=[redirect_uri]' \
--data-urlencode 'client_id=[client_id]' \
--data-urlencode 'client_secret=[client_secret]' \
--data-urlencode 'response_type=code' \
--data-urlencode 'scope=openid mitid transaction_token' \
--data-urlencode 'max_age=600' \
--data-urlencode 'signtext_id=signtextid_random_1' \
--data-urlencode 'idp_values=mitid'
```

```json
{
    "request_uri": "urn:ietf:params:oauth:request_uri:C834....7B4",
    "expires_in": 600
}
```

```text
https://pp.netseidbroker.dk/op/connect/authorize?client_id=[client_id]&request_uri=urn:ietf:params:oauth:request_uri:C834....7B4
```

--------------------------------

### POST [AuthorityUrl]/api/v1/iframe/initialize

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mitid-iframe.html

Initializes the iframe authentication flow by requesting an authentication token.

```APIDOC
## POST [AuthorityUrl]/api/v1/iframe/initialize

### Description
Initializes the MitID iframe authentication flow. This endpoint returns an authentication token required to start the iframe session.

### Method
POST

### Endpoint
[AuthorityUrl]/api/v1/iframe/initialize

### Parameters
#### Request Body
- **authenticators** (string) - Optional - Set to "app" for app-only or "app code_token" for app and code token display.
- **iframe_mode** (string) - Optional - Set to "minimized" to adapt the MitID client to small screen sizes.

### Response
#### Success Response (200)
- **iframe_url** (string) - The URL to be used for the iframe source.
- **auth_token** (string) - The token required to initiate the flow via postMessage.
```

--------------------------------

### Signed Authentication Request Object

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/openid-intro.html

Example of a signed authentication request using a JWT-based Request Object.

```text
client_id: bcc7595b-2ed0-445d-a507-42ca21382877

request: eyJhbGciOiJIUzI1NiIsImtpZCI6bnVsbCwidHlwIjoiSldUIn0.eyJjbGllbnRfaWQiOiJiY2M3NTk1Yi0yZWQwLTQ0NWQtYTUwNy00MmNhMjEzODI4NzciLCJyZWRpcmVjdF91cmkiOiJodHRwczovL2xvY2FsaG9zdDo1MDE1L3NpZ25pbi1vaWRjIiwicmVzcG9uc2VfdHlwZSI6ImNvZGUiLCJjb2RlX2NoYWxsZW5nZSI6ImlaWFppX3RMbWhrc2FSZVdsR0JqbERSU1FuLXdrWUVsdXVsak0zbDZRSkUiLCJjb2RlX2NoYWxsZW5nZV9tZXRob2QiOiJTMjU2IiwicmVzcG9uc2VfbW9kZSI6ImZvcm1fcG9zdCIsIm5vbmNlIjoiNjM3NTcwMjAwNDg3MjI4MTg2LlpqUmpOV1V4TWpjdE1tWXdZeTAwTjJZeExXRXlZelF0T0RBek5qY3hZbVV4T0dFek16UTJOak13Wm1F...
```

--------------------------------

### Initialize MitID Iframe via cURL

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mitid-iframe.html

Use this request to initialize the MitID iframe flow in the PP environment. Ensure valid client credentials and test user parameters are provided.

```bash
curl --location 'https://pp.netseidbroker.dk/op/api/v1/iframe/initialize' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_secret=3PzE2SeZ5INHx7TCVyY7KQr1WSozw7ADytm1suAZ/UK1MCh9ZYQGdzN1BEv6hdzRsVn3xnA0/F/6ET9j0mTWWw==' \
--data-urlencode 'client_id=c0cb708e-f742-46a4-b664-9e31e32b145d' \
--data-urlencode 'response_type=code' \
--data-urlencode 'scope=openid mitid' \
--data-urlencode 'idp_values=mitid' \
--data-urlencode 'redirect_uri=https://oidcdebugger.com/debug' \
--data-urlencode 'idp_params={"mitid": {"cpr_hint": "[CPR]", "iframe_mode": "minimized", "authenticators": "app code_token"}}'
```

--------------------------------

### Create a workflow

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/enterprise/workflow-signing-example.html

Uploads a new workflow with a title, list of PDFs, and expiration date.

```http
POST /api/workflows/{cvr}
{
  "title": "Workflow test title",
  "pdfList": [
    {
      "title": "Agreement 1",
      "pdfBase64": "..."
    },
    {
      "title": "",
      "pdfBase64": "..."
    }
  ],
  "expiresAt": "2025-12-01T11:48:48.900Z",
  "showStartOverviewPage": true
}
```

```json
{
  "workflowId": "workflowid1234"
}
```

--------------------------------

### Request Custom Flow Scope

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/idps/mobilepay.html

Example scope parameter configuration to trigger the MobilePay Custom Flow.

```text
scope=openid name phoneNumber mobilepay_customFlow
```

--------------------------------

### Initiate authorization flow

Source: https://signaturgruppen-a-s.github.io/signaturgruppen-broker-documentation/transactionsigning/transaction-signing.html

Redirect the user to the authorize endpoint with the signtext_id to begin the signing process.

```http
https://pp.netseidbroker.dk/op/connect/authorize
?client_id=<CLIENT_ID>
&redirect_uri=https://openidconnect.net/callback
&idp_values=mitid
&prompt=login
&scope=openid+mitid+transaction_token
&response_type=code
&signtext_id=text_e2619d37d45cbf0d78f2f63d5eb..cc53d8e09b0c8
```
Tokens:
Raw