client_id

String

Required

Identifier of the client assigned by TRIDENT to the signature application.

request_uri

String

Required

URI that points to a pushed authorization request previously uploaded by the signature application.

response_type

String

Required

Its value must always be code.

client_id

String

Required

Identifier of the client assigned by TRIDENT to the signature application.

redirect_uri

String

Conditionally required

URL where the TRIDENT must redirect the browser to provide the signature application with the authorization code corresponding to the authorization the user grants.

This must be one of the redirect URIs configured in the TRIDENT for the signature application. This parameter can be omitted if only one redirect URI was registered for the application since this URI is considered the default redirect URI for the signature application in this particular case.

scope

String

Optional

Scope of the authorization requested by the application (see section 3.3 of RFC 6749). Only the service (which is the default) or the credential scopes can be requested.

code_challenge

String

Optional

The value that results from transforming a code_verifier value using the method indicated by the code_challenge_method parameter. The code_verifier value, in turn, must be a random secret value (namely, a high-entropy value with a minimum length of 43 characters and a maximum length of 128 characters) that must be included in the later token request so that the required access token is indeed exchanged for the authorization code grant that is eventually obtained in this operation. See RFC 7636 for more details.

code_challenge_method

String

Optional

Method used to calculate the code_challange parameter's value from the value that is to be put in the code_verifier parameter of the subsequent request to the Obtain an OAuth 2.0 access token operation. The only value supported is "S256". This means that the code_challenge value is obtained by calculating base64url_encode(SHA-256(ASCII(code_verifier)))), where code_verifier is a high-entropy random string between 43 and 128 characters (see [RFC 7636]).

state

String

Optional

Up to 255 random data bytes that the TRIDENT has to return in the response. This value can be used as a transaction identifier or any other application aim. Although this parameter is optional, we recommend its use to protect against cross-site request forgery attacks.

lang

String

Optional

Language in which the signature application prefers that the TRIDENT provides the browser the pages for getting authorization from the user. The language is specified as per RFC 5646. This parameter is optional. If this parameter is not included (or it is, but it specifies an unsupported language), the language set by the browser will be used. However, US English (en-US) will be used if the TRIDENT does not support this language.

credentialID

String

Conditionally required

Identifier of the credential bound to the signing key for which the signature application wants authorization. It must be used only if the scope of the OAuth 2.0 authorization request is credential, when the application requests authorization for generating one or more signatures, it is required.

numSignatures

Number

Conditionally required

Number of signatures for which the signature application asks authorization. This parameter can only be used if the scope of the authorization requested is credential and the hashes parameter is present. If this is the case, including this parameter is mandatory to be granted authorization.

The value of this parameter must be equal to or less than the value of the multisign parameter for the signature credential (credentialID) for which the authorization is being requested (see Obtain a Signature Credential of a User for information on the multisign parameter).

hashes

String

Conditionally required

List (separated by commas) of the hashes of the data to be signed and for which the signature application requests signature generation authorization. Each hash must be encoded in base64. The number of elements in the list must be equal to the value of the numSignatures parameter.

This parameter can only be used if the scope of the authorization requested is credential, a nd when the numSignatures parameter is present .

hashAlgorithmOID

String

Conditionally required

Identifier (OID) of the algorithm with which the hashes were generated based on which the signatures will be generated. It must be used only if the hashes parameter is present (it is mandatory in that case).