# Airlock IAM public API request/response contracts # Representative scope: https://mein-portal-registrierung.baloise.de/auth/rest/ # Source: retained Angular client code plus captured requests on the scoped registration tenant. Session and CSRF transport - Browser state uses cookies `AL_SESS-S` and `CSRFT759-S`. - State-changing REST requests send the `CSRFT759-S` value in header `X-CSRFT759` and include `X-Same-Domain: 1`. - Missing or mismatched CSRF state redirects to `/auth/rest/public/invalid/csrf-token`. - Normal API responses use JSON:API-style documents with `meta`, `data` or `errors`; flow responses may include `uiSettings`, `nextAuthStep`, `flowId`, `stepId` and page settings. Application access POST /auth/rest/public/authentication/default-application/access POST /auth/rest/public/authentication/applications/{applicationId}/access - Body: `null` or `{"location": ""}`. - Optional SSO ticket transport: `X-IAM-SSO-Ticket` header. - The application-specific route is also used to continue an existing flow with a null body. POST /auth/rest/public/authentication/location/access POST /auth/rest/public/authentication/location/interpret - JSON body: `{"location": ""}`. - Access returns or continues an authentication flow; interpret returns parsed/ranked location attributes without dereferencing the URL. DELETE /auth/rest/public/authentication/flow - Terminates the current authentication flow. Flow selection and navigation POST /auth/rest/public/self-service/flows/{flowId}/select POST /auth/rest/public/user-self-registration/flows/{flowId}/select - Body: `null`. - Public self-service selection may include `X-Flow-Continuation-Token` when continuing a prior flow. POST /auth/rest/public/{flowType}/goto-targets/{stepId}/goto - Body: `null`. - Response continues the current flow and returns the next step configuration. DELETE /auth/rest/public/self-service/flow DELETE /auth/rest/public/user-self-registration/flow - Cancels the current flow of that type. Password authentication POST /auth/rest/public/authentication/password/check - JSON body fields: `username`, `password`. - The Angular client optionally transforms/encrypts the password according to `e2eEncryptionInformation` returned in page settings before serializing the body. - Empty JSON returns field-level `VALIDATION_FAILED` errors for required username/password values. Password-reset user identification POST /auth/rest/public/self-service/user/identify - JSON body: `{"username": ""}`. - The client/captured flow uses `X-Continue-Flow: true` while continuing password-reset-init. Terms of service POST /auth/rest/public/{flowType}/terms-of-services/retrieve POST /auth/rest/public/{flowType}/terms-of-services/accept-retrieved POST /auth/rest/public/{flowType}/terms-of-services/deny-retrieved - Body: `null`. - `{flowType}` is selected from authentication, registration/user-self-registration, public self-service or protected self-service context. Source-confirmed flow-state handlers POST /auth/rest/public/authentication/oauth2/client/authorization/uri/retrieve POST /auth/rest/public/authentication/kerberos/not-possible - Body: `null` in the Angular client. - Outside their configured step they return `UNEXPECTED_CALL`; the registration tenant preserved the default `PASSWORD_REQUIRED` step. UI configuration GET /auth/rest/public/authentication/ui/configuration/access GET /auth/rest/public/authentication/ui/configuration/logout GET /auth/rest/public/authentication/ui/non-flow/configuration GET /auth/rest/public/authentication/ui/default/application/id GET /auth/rest/public/ui/static/configuration GET /auth/rest/public/ui/languages - Configuration endpoints supply SSO parameter names, logout/non-flow page settings, default application identity, languages and static UI configuration. Further source-confirmed methods - POST `/auth/rest/protected/self-service/approval/airlock-2fa/status/poll` - POST `/auth/rest/public/authentication/airlock-2fa/status/poll` - POST `/auth/rest/public/self-service/approval/airlock-2fa/status/poll` - POST `/auth/rest/public/user-self-registration/airlock-2fa/activation/status/poll` - Generic polling sends a null body and `queryOnly=true`; when the final response is ready it repeats with `queryOnly=false`. - POST `/auth/rest/public/authentication/oauth2/client/authorization/check` - Body: `{"queryString":""}`. - GET `/auth/rest/public/{authentication|self-service|user-self-registration}/ui/on-failure/{flowId}` - GET `/auth/rest/public/user-self-registration/ui/on-completed/{flowId}` - These UI resolvers return failure/completion page attributes for an existing flow ID. Infoportal read-only tenant contracts are recorded in `recon/liferay-airlock-readonly-validation-v4.txt`: access/logout/non-flow/default-application configuration, maintenance state, static configuration and languages return 200 with valid anonymous CSRF state; flow and registration-default lookups return JSON:API 404 outside configured context. Further form-action request contracts recovered from shared Angular services - POST `/auth/rest/public/user-self-registration/message/acknowledge` with a null body. - POST `/auth/rest/public/user-self-registration/verification/email/otp/check` with the OTP form JSON. - POST `/auth/rest/public/user-self-registration/verification/phone-number/otp/check` with the OTP form JSON. - POST `/auth/rest/public/user-self-registration/verification/phone-number/otp/resend` with a null body. - POST `/auth/rest/public/user-self-registration/oath/activation/complete` with JSON containing the entered OTP. - POST `/auth/rest/public/authentication/fido/assertion-response/check` with the serialized WebAuthn assertion response. - POST `/auth/rest/public/authentication/fido/failure/report` with `{"reason":"","message":""}`. - POST `/auth/rest/public/self-service/user/identify` with the username-identification JSON documented above. These are source contracts only; no registration, OTP, FIDO or acknowledgement action was submitted while mapping. Registration selection-option retrieval - POST `/auth/rest/public/user-self-registration/selection/options/retrieve`. - OPTIONS advertises `Allow: POST,OPTIONS`; GET returns a JSON:API 405 document with normal anonymous CSRF state. - The source exposes a companion option-selection template under `/selection/options/{optionId}/select`; no registration-flow POST was submitted while mapping.