SSO 回调 BFF 化:PKCE code_verifier 换 token → 验 id_token(签名/iss/aud/exp/nonce)+ email_verified=true → 身份主键 (org,issuer,sub):命中直登;首次须既有账号 + 本 org 已邀请成员,经 OTP 二次确认。回调**不再 JSON 返 token**——成功恒 302 携一次性 code(BFF /v1/auth/sso/exchange 换 token),首次关联 302 到 confirm 页携一次性 link;全程 Cache-Control: no-store

GET

/v1/auth/sso/{orgId}/callback

Responses

302

成功:302 到门户回调页(?code=… 一次性登录 code)或 confirm 页(?link=… 首次关联 OTP 二次确认)

Media typeapplication/json

object

key

additional properties

any

Example^generated

{}

400

Bad_request(state 缺失/未知/过期/不属本 org)

Media typeapplication/json

object

error

required

object

code

required

错误码注册表单源派生(src/http/errors.ts ERROR_CODES;码稳定,消费方按码翻译)

string

Allowed values: adjudicator_not_authorized admin_forbidden admin_key_invalid app_disabled app_ip_denied app_key_invalid approval_self_forbidden asr_not_configured asr_quota_exceeded auth_channel_undelivered bad_request conflict content_blocked context_window_exceeded currency_not_supported device_code_denied device_code_expired device_code_pending device_code_slow_down egress_blocked endpoint_disabled envelope_key_undelivered fence_denied forbidden idempotency_conflict idp_untrusted image_not_supported imagegen_not_configured imagegen_quota_exceeded insufficient_balance internal_error invalid_api_key license_required limit_exceeded liquidation_not_enabled model_not_authorized model_not_found nonce_replayed not_found order_state_invalid org_byok_not_available org_ceiling_exceeded otp_invalid otp_rate_limited pay_amount_mismatch pay_channel_undelivered pay_signature_invalid payload_too_large payment_required plan_apps_exceeded plan_concurrency_exceeded plan_end_users_exceeded plan_gate_unavailable plan_members_exceeded plan_required plan_tier_insufficient policy_locked pool_signing_undelivered preflight_required pricing_guard_tripped principal_required protocol_unsupported quota_exceeded rate_limited refund_not_eligible section_not_deliverable session_archived signature_invalid stream_backpressure token_expired tts_not_configured tts_quota_exceeded unauthorized upstream_connect_timeout upstream_disconnected upstream_error upstream_idle_timeout upstream_timeout upstream_total_timeout upstream_ttfb_timeout validation_failed videogen_not_configured videogen_quota_exceeded websearch_not_configured websearch_quota_exceeded

message

required

string

requestId

required

string

detail

object

Example

{
  "error": {
    "code": "adjudicator_not_authorized"
  }
}

401

Unauthorized(码换 token 被拒 / id_token 校验失败 / sub 缺失)

Media typeapplication/json

object

error

required

object

code

required

错误码注册表单源派生(src/http/errors.ts ERROR_CODES;码稳定,消费方按码翻译)

string

Allowed values: adjudicator_not_authorized admin_forbidden admin_key_invalid app_disabled app_ip_denied app_key_invalid approval_self_forbidden asr_not_configured asr_quota_exceeded auth_channel_undelivered bad_request conflict content_blocked context_window_exceeded currency_not_supported device_code_denied device_code_expired device_code_pending device_code_slow_down egress_blocked endpoint_disabled envelope_key_undelivered fence_denied forbidden idempotency_conflict idp_untrusted image_not_supported imagegen_not_configured imagegen_quota_exceeded insufficient_balance internal_error invalid_api_key license_required limit_exceeded liquidation_not_enabled model_not_authorized model_not_found nonce_replayed not_found order_state_invalid org_byok_not_available org_ceiling_exceeded otp_invalid otp_rate_limited pay_amount_mismatch pay_channel_undelivered pay_signature_invalid payload_too_large payment_required plan_apps_exceeded plan_concurrency_exceeded plan_end_users_exceeded plan_gate_unavailable plan_members_exceeded plan_required plan_tier_insufficient policy_locked pool_signing_undelivered preflight_required pricing_guard_tripped principal_required protocol_unsupported quota_exceeded rate_limited refund_not_eligible section_not_deliverable session_archived signature_invalid stream_backpressure token_expired tts_not_configured tts_quota_exceeded unauthorized upstream_connect_timeout upstream_disconnected upstream_error upstream_idle_timeout upstream_timeout upstream_total_timeout upstream_ttfb_timeout validation_failed videogen_not_configured videogen_quota_exceeded websearch_not_configured websearch_quota_exceeded

message

required

string

requestId

required

string

detail

object

Example

{
  "error": {
    "code": "adjudicator_not_authorized"
  }
}

403

Idp_untrusted(issuer 未受信/发现不一致/JWKS 非法)/ forbidden(SSO 停用 / email 未验证 / 无 email / 域不匹配 / 无既有账号 / 非邀请成员 / 账号不可用)

Media typeapplication/json

object

error

required

object

code

required

错误码注册表单源派生(src/http/errors.ts ERROR_CODES;码稳定,消费方按码翻译)

string

Allowed values: adjudicator_not_authorized admin_forbidden admin_key_invalid app_disabled app_ip_denied app_key_invalid approval_self_forbidden asr_not_configured asr_quota_exceeded auth_channel_undelivered bad_request conflict content_blocked context_window_exceeded currency_not_supported device_code_denied device_code_expired device_code_pending device_code_slow_down egress_blocked endpoint_disabled envelope_key_undelivered fence_denied forbidden idempotency_conflict idp_untrusted image_not_supported imagegen_not_configured imagegen_quota_exceeded insufficient_balance internal_error invalid_api_key license_required limit_exceeded liquidation_not_enabled model_not_authorized model_not_found nonce_replayed not_found order_state_invalid org_byok_not_available org_ceiling_exceeded otp_invalid otp_rate_limited pay_amount_mismatch pay_channel_undelivered pay_signature_invalid payload_too_large payment_required plan_apps_exceeded plan_concurrency_exceeded plan_end_users_exceeded plan_gate_unavailable plan_members_exceeded plan_required plan_tier_insufficient policy_locked pool_signing_undelivered preflight_required pricing_guard_tripped principal_required protocol_unsupported quota_exceeded rate_limited refund_not_eligible section_not_deliverable session_archived signature_invalid stream_backpressure token_expired tts_not_configured tts_quota_exceeded unauthorized upstream_connect_timeout upstream_disconnected upstream_error upstream_idle_timeout upstream_timeout upstream_total_timeout upstream_ttfb_timeout validation_failed videogen_not_configured videogen_quota_exceeded websearch_not_configured websearch_quota_exceeded

message

required

string

requestId

required

string

detail

object

Example

{
  "error": {
    "code": "adjudicator_not_authorized"
  }
}

本文是否有帮助?

有帮助没帮助