Browser API

Use these routes from a browser on the configured product origin. This reference covers enabled product BFF installations. The downloadable OpenAPI document contains the request fields, response schemas and status codes.

Start a browser session

First bootstrap the session and obtain the CSRF value. Pass that value on browser writes. Use a sign-in target supplied by your installation and let the browser send the same-origin cookie and Origin header.

const session = await fetch('/auth/session')
if (!session.ok) throw new Error('Could not start session')
const { csrf } = await session.json()
const login = await fetch('/auth/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-Primia-CSRF': csrf },
  body: JSON.stringify({ target: configuredTarget }),
})
if (!login.ok) throw new Error('Could not start sign-in')
const { authorizationUrl } = await login.json()
window.location.assign(authorizationUrl)

The callback redirects to the product with an opaque context. Use this context to read capabilities for the current tab. Send activity for explicit user interaction and submit an empty JSON object to log out. Treat a denied operation as denied even when an earlier capabilities response allowed the screen to appear.

Operations

• GET /auth/session — Bootstrap or resume a browser session
• POST /auth/login — Start authentication for an approved target
• GET /auth/callback — Complete sign-in and redirect with opaque context
• GET /auth/capabilities — Read the current context capabilities
• POST /auth/activity — Record explicit interactive activity
• POST /auth/logout — End the browser session

Download OpenAPI (JSON)