Establish a host-only Admin session on the target tenant issuer.

GET

/oauth/admin-agent/login-handoff/consume

Code sample: Shell / cURL

curl --request GET \
  --url 'https://auth.example.com/oauth/admin-agent/login-handoff/consume?code=example'

Consumes a one-time code only when the request has the tenant-side HttpOnly browser-binding cookie and the central Management API-issued code. It revalidates the source Admin session, user, MFA state, tenant scope, target origin, and expiry. Success sets a host-only derived Admin session cookie and resumes the stored Admin Agent authorization path. Replays and cross-tenant consumption fail closed.

Parameters

Query Parameters

code

required

string

/^ahc_[A-Za-z0-9_-]{43}$/

Responses

302

Resume the exact stored Admin Agent authorization request.

Headers

Location

string format: uri

Set-Cookie

string

Secure, HttpOnly, host-only Admin session cookie.

400

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

410

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}