Auth Connections
Create an auth connection
Stores the gateway credentials and generates the key pair the DPoP proofs are signed with. The private half never leaves the server and there is no endpoint that accepts one, so a connection can only ever be bound to a key this server made. The token URL must be https, since the client secret is posted to it.
Authorization
bearerAuth In: header
Query Parameters
Organization to act on. Defaults to the caller's own when omitted or empty. Only a SUPERADMIN may name a different one; an ADMIN doing so is refused with 403, and a value that is not an ObjectId is refused with 400 rather than falling back to the caller's own organization.
^[a-f\d]{24}$Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/auth-connections" \ -H "Content-Type: application/json" \ -d '{ "name": "Spring Underwriting", "tokenUrl": "https://auth.example.com/oauth2/token", "clientId": "client-abc", "clientSecret": "REDACTED", "scopes": [ "underwriting.read" ], "allowedHosts": [ "gateway.example.com" ] }'{ "success": true, "data": { "_id": "6ab3d1f2c4e5a60123456789", "name": "Spring Underwriting", "type": "oauth2_client_credentials_dpop", "tokenUrl": "https://auth.example.com/oauth2/token", "clientId": "client-abc", "scopes": [ "underwriting.read" ], "allowedHosts": [ "gateway.example.com" ], "authorizationScheme": "DPoP", "jwkThumbprint": "5MBNqyGaaNaWVo3c-W7Q5HorbYFA6tHxRlglvb7JDBI", "isActive": true }}