Skip to main content
POST
Exchange the person's delegation code for the requested grant

Authorizations

X-Ambient-Actor
string
header
required

Provisioned actor identifier.

X-Ambient-Timestamp
string
header
required

Current Unix timestamp in seconds, within the configured clock-skew window.

Authorization
string
header
required

Ambient-HMAC followed by a space and the unpadded base64url HMAC-SHA256 signature. See Authentication and authority for the canonical input.

Body

application/json
challengeId
string
required
code
string
required
Pattern: ^[0-9]{8}$

Response

Returns principalId and delegationId, never a human login token.