User email address. REQUIRED when grant_type=password.

This is the primary login identifier for human users in the AnkaSecure platform.
Must be a valid email format per RFC 5322 and not exceed 320 characters.

OAuth 2.0 grant type per RFC 6749. Determines which authentication flow to use.

Supported values:

• password: User authentication with username/password (RFC 6749 Section 4.3)
• client_credentials: Application authentication with client_id/client_secret (RFC 6749 Section 4.4)
• refresh_token: Token refresh using refresh token (RFC 6749 Section 6)
• urn:ietf:params:oauth:grant-type:token-exchange: Token exchange for impersonation (RFC 8693)

Which assertion profile the client_assertion follows. REQUIRED when
client_assertion is present. Two values are admitted:

• urn:ietf:params:oauth:client-assertion-type:jwt-bearer (RFC 7523 §2.2) — the
  actor signed the assertion itself, with a key registered for it here.
• urn:ankatech:params:oauth:client-assertion-type:federated-jwt (PRD §181) — an
  external issuer this deployment trusts minted the token for the workload, and
  an (issuer, subject) declaration binds it to the actor named by client_id.

This declared value is the ONLY thing that selects between them. The token's own
contents are never inspected to make that choice.

An unrecognised value is a 400 invalid_request, not a credential failure: the
client asked for a profile this server does not implement, which is a malformed
request rather than a wrong credential.

The assertion, in JWS compact serialization. REQUIRED when
grant_type=client_credentials and the actor authenticates with an assertion rather
than a shared secret. Bounded at 16 KiB; a larger value is refused as a credential
failure, indistinguishably from any other.

Under jwt-bearer the actor signed it: iss and sub are both the actor UUID, aud is
the audience this deployment returned when the key was registered, and jti is
single-use.

Under federated-jwt an external issuer signed it: iss is that issuer, sub is the
workload subject bound to the actor, aud is the audience this deployment derived
for the issuer, and jti is optional.

JWT access token to exchange. REQUIRED when grant_type=urn:ietf:params:oauth:grant-type:token-exchange.

This is the platform admin's JWT token that will be exchanged for a tenant-scoped token.
The token must have platform-level privileges to perform impersonation.
Format: JWT with RS256 signature.

Space-delimited list of requested scopes. OPTIONAL for all grant types.

NOTE: Currently not fully implemented. Scopes are automatically derived from
user/application role assignments in the Admin-API.

Future enhancement will support dynamic scope requests for token exchange.
Example: "admin.tenant.user.read admin.tenant.user.update"

Extend refresh token lifetime. OPTIONAL when grant_type=password.

Values:

• true: Refresh token valid for the configured remember-me lifetime (default 7 days, operator-configurable 1-90 days)
• false or omitted: Refresh token valid for the standard session (jwt.refreshExpirationSeconds)

Only applies to password grant. Ignored for client_credentials and refresh_token grants.

Security consideration: Long-lived sessions increase attack surface. Use only when
appropriate for the use case (e.g., mobile apps, trusted devices).

Generated from available response content types