Skip to main content
GET
Read the provider's sign-in in flight

Authorizations

Authorization
string
header
required

Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation.

Path Parameters

name
string
required

The provider's name.

Maximum string length: 128
Pattern: ^[a-z0-9][a-z0-9-]*$

Response

The last sign-in attempt for this provider.

A sign-in flow, in flight or finished. When browserUrl is present the client opens it; completion is reflected in the provider's authState.

status
enum<string>
required

pending means the host is still driving the flow — poll getProviderAuth. complete means a credential was probed and stored. failed means this attempt is over and message says why; nothing was stored.

Available options:
pending,
complete,
failed
browserUrl
string<uri>

URL the user opens to complete a browser-based flow.

message
string

Human-readable instruction, for example a device code to enter — and, on a failed status, why the sign-in failed. It never carries the key or token itself.

Maximum string length: 1024
expiresAt
string<date-time>

When the pending flow expires.