Submit a Flow Engine capability response.

POST

/api/flow/submit

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/flow/submit \
  --header 'Content-Type: application/json' \
  --data '{ "sessionId": "flow_sess_123", "requestId": "req_123", "capabilityId": "email_code.verify", "response": { "code": "123456" } }'

Submits a capability-specific response and returns the next UI contract, redirect instruction, or flow error.

Request Body ^required

Media type application/json

object

sessionId

required

string

requestId

required

string

capabilityId

required

string

response

required

Capability-specific response payload.

tenantId

string

clientId

string

Example

{
  "sessionId": "flow_sess_123",
  "requestId": "req_123",
  "capabilityId": "email_code.verify",
  "response": {
    "code": "123456"
  }
}

Responses

200

Successful JSON response.

Media type application/json

One of:

object

object

type

required

string

Allowed values: continue

uiContract

required

Server-driven Flow Engine UI contract for the current node.

object

version

string

sessionId

string

nodeId

string

capabilities

Array<object>

object

key

additional properties

key

additional properties

object

object

type

required

string

Allowed values: redirect

redirect

required

object

url

required

string format: uri

method

required

string

Allowed values: GET POST

params

object

key

additional properties

string

object

object

type

required

string

Allowed values: error

error

required

object

code

required

string

message

required

string

details

object

key

additional properties

Example

{
  "type": "continue",
  "uiContract": {
    "version": "0.1",
    "sessionId": "flow_sess_123",
    "nodeId": "email_code",
    "capabilities": []
  }
}

400

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}