.. index:: single: open_id
.. _open_id/0:

.. rst-class:: right

**object**

``open_id``
===========

Facade predicates for a portable OpenID Connect Authorization Code + PKCE client.

| **Availability:** 
|    ``logtalk_load(open_id(loader))``

| **Author:** Paulo Moura
| **Version:** 1:0:0
| **Date:** 2026-07-12

| **Compilation flags:**
|    ``static, context_switching_calls``


| **Uses:**
|    :ref:`open_id_client <open_id_client/0>`
|    :ref:`open_id_jwks_cache <open_id_jwks_cache/0>`
|    :ref:`open_id_jwt <open_id_jwt/0>`
|    :ref:`open_id_logout <open_id_logout/0>`
|    :ref:`open_id_pkce <open_id_pkce/0>`
|    :ref:`open_id_response <open_id_response/0>`

| **Remarks:**
|    (none)

| **Inherited public predicates:**
|    (none)

.. contents::
   :local:
   :backlinks: top

Public predicates
-----------------

.. index:: discover/3
.. _open_id/0::discover/3:

``discover/3``
^^^^^^^^^^^^^^

Discovers and validates OpenID Provider metadata for the given issuer.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``discover(Issuer,Provider,Options)``
| **Mode and number of proofs:**
|    ``discover(+atom,-compound,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    ``Issuer`` is a variable:
|        ``instantiation_error``
|    ``Issuer`` is not an absolute or allowed issuer URL:
|        ``domain_error(open_id_issuer,Issuer)``
|    The discovery endpoint returned a non-success status:
|        ``domain_error(open_id_http_status,Code)``
|    The discovery endpoint response body is not JSON:
|        ``domain_error(open_id_json_response,Body)``
|    The discovered issuer does not match ``Issuer``:
|        ``domain_error(open_id_issuer,DiscoveredIssuer)``
|    A provider metadata URL is not secure:
|        ``domain_error(open_id_provider_metadata_url,URL)``


------------

.. index:: authorization_url/5
.. _open_id/0::authorization_url/5:

``authorization_url/5``
^^^^^^^^^^^^^^^^^^^^^^^

Builds an authorization URL and returns the session data needed for the code exchange and ID-token validation.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``authorization_url(Provider,Request,URL,Session,Options)``
| **Mode and number of proofs:**
|    ``authorization_url(+compound,+compound,-atom,-compound,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Request`` is neither a direct options list nor a request wrapper term containing an options list:
|        ``domain_error(open_id_options,Request)``
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    ``Request`` is missing a required authorization request option:
|        ``domain_error(open_id_authorization_request,missing(Name))``
|    A request value that must be an atom is not an atom:
|        ``type_error(atom,Value)``
|    A scope value is neither an atom nor a list of atoms:
|        ``domain_error(open_id_space_separated_atom,Value)``
|    The PKCE code verifier is a variable:
|        ``instantiation_error``
|    The PKCE code verifier is not valid:
|        ``domain_error(open_id_code_verifier,Verifier)``


------------

.. index:: authorization_response/3
.. _open_id/0::authorization_response/3:

``authorization_response/3``
^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Parses an authorization callback URL into either an authorization response or an authorization error term.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``authorization_response(CallbackURL,Response,Options)``
| **Mode and number of proofs:**
|    ``authorization_response(+atom,-compound,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    ``CallbackURL`` is not a valid callback URL or relative reference:
|        ``domain_error(open_id_authorization_response,CallbackURL)``


------------

.. index:: authorization_code/4
.. _open_id/0::authorization_code/4:

``authorization_code/4``
^^^^^^^^^^^^^^^^^^^^^^^^

Parses an authorization callback URL, validates the session state, and returns the authorization code.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``authorization_code(CallbackURL,Session,Code,Options)``
| **Mode and number of proofs:**
|    ``authorization_code(+atom,+compound,-atom,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    ``Session`` is missing required state data:
|        ``domain_error(open_id_session,missing(Session,state))``
|    The callback response is an authorization error:
|        ``domain_error(open_id_authorization_response,authorization_error(Response))``
|    The callback response state does not match the session state:
|        ``domain_error(open_id_authorization_response,state_mismatch(Expected,Actual))``


------------

.. index:: exchange_code/5
.. _open_id/0::exchange_code/5:

``exchange_code/5``
^^^^^^^^^^^^^^^^^^^

Exchanges an authorization code for token response data.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``exchange_code(Provider,Code,Session,Tokens,Options)``
| **Mode and number of proofs:**
|    ``exchange_code(+compound,+atom,+compound,-compound,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    ``Session`` is missing required authorization-code exchange data:
|        ``domain_error(open_id_session,missing(Session,Name))``
|    The token endpoint returned a non-success status:
|        ``domain_error(open_id_http_status,Code)``
|    The token endpoint response body is not JSON:
|        ``domain_error(open_id_json_response,Body)``
|    The token endpoint JSON response is missing a required member:
|        ``domain_error(open_id_token_response,missing(Name))``


------------

.. index:: refresh_token/4
.. _open_id/0::refresh_token/4:

``refresh_token/4``
^^^^^^^^^^^^^^^^^^^

Exchanges a refresh token for token response data.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``refresh_token(Provider,RefreshToken,Tokens,Options)``
| **Mode and number of proofs:**
|    ``refresh_token(+compound,+atom,-compound,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    The ``client_id`` option is missing:
|        ``domain_error(open_id_refresh_token,missing(client_id))``
|    The token endpoint returned a non-success status:
|        ``domain_error(open_id_http_status,Code)``
|    The token endpoint response body is not JSON:
|        ``domain_error(open_id_json_response,Body)``
|    The token endpoint JSON response is missing a required member:
|        ``domain_error(open_id_token_response,missing(Name))``


------------

.. index:: userinfo/4
.. _open_id/0::userinfo/4:

``userinfo/4``
^^^^^^^^^^^^^^

Fetches UserInfo claims using the given access token.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``userinfo(Provider,AccessToken,Claims,Options)``
| **Mode and number of proofs:**
|    ``userinfo(+compound,+atom,-term,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    The provider metadata is missing a UserInfo endpoint:
|        ``domain_error(open_id_provider,missing(userinfo_endpoint))``
|    The UserInfo endpoint returned a non-success status:
|        ``domain_error(open_id_http_status,Code)``
|    The UserInfo endpoint response body is not JSON:
|        ``domain_error(open_id_json_response,Body)``


------------

.. index:: logout_url/4
.. _open_id/0::logout_url/4:

``logout_url/4``
^^^^^^^^^^^^^^^^

Builds a logout URL for an RP-initiated logout request.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``logout_url(Provider,Request,URL,Options)``
| **Mode and number of proofs:**
|    ``logout_url(+compound,+compound,-atom,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Request`` is neither a direct options list nor a request wrapper term containing an options list:
|        ``domain_error(open_id_options,Request)``
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    The provider metadata is missing an end-session endpoint:
|        ``domain_error(open_id_provider,missing(end_session_endpoint))``
|    A request value that must be an atom is not an atom:
|        ``type_error(atom,Value)``
|    A ``ui_locales`` value is neither an atom nor a list of atoms:
|        ``domain_error(open_id_space_separated_atom,Value)``
|    The ``post_logout_redirect_uri`` is not secure:
|        ``domain_error(open_id_post_logout_redirect_uri,URL)``


------------

.. index:: jwks/3
.. _open_id/0::jwks/3:

``jwks/3``
^^^^^^^^^^

Fetches the JSON Web Key Set for the provider.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``jwks(Provider,JWKSet,Options)``
| **Mode and number of proofs:**
|    ``jwks(+compound,-term,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    The JWKS endpoint returned a non-success status:
|        ``domain_error(open_id_http_status,Code)``
|    The JWKS endpoint response body is not JSON:
|        ``domain_error(open_id_json_response,Body)``


------------

.. index:: cached_jwks/3
.. _open_id/0::cached_jwks/3:

``cached_jwks/3``
^^^^^^^^^^^^^^^^^

Returns a cached JWKS for a provider, refreshing it when needed.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``cached_jwks(Provider,JWKSet,Options)``
| **Mode and number of proofs:**
|    ``cached_jwks(+compound,-term,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    The provider metadata is missing a JWKS endpoint:
|        ``domain_error(open_id_provider,missing(jwks_uri))``
|    The JWKS endpoint returned a non-success status:
|        ``domain_error(open_id_http_status,Code)``
|    The JWKS endpoint response body is not JSON:
|        ``domain_error(open_id_json_response,Body)``


------------

.. index:: verify_id_token/4
.. _open_id/0::verify_id_token/4:

``verify_id_token/4``
^^^^^^^^^^^^^^^^^^^^^

Verifies an ID-token using cached JWKS data, refreshing the JWKS once when the token key identifier is unknown.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``verify_id_token(Token,Provider,Claims,Options)``
| **Mode and number of proofs:**
|    ``verify_id_token(+atom,+compound,-term,+list(compound))`` - ``zero_or_one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    The provider metadata is missing a JWKS endpoint:
|        ``domain_error(open_id_provider,missing(jwks_uri))``
|    The JWKS endpoint returned a non-success status:
|        ``domain_error(open_id_http_status,Code)``
|    The JWKS endpoint response body is not JSON:
|        ``domain_error(open_id_json_response,Body)``
|    ``Token`` is a variable:
|        ``instantiation_error``
|    ``Token`` is neither a variable nor an atom:
|        ``type_error(atom,Token)``
|    ``Token`` is an atom but not a valid compact JWT:
|        ``domain_error(jwt_compact_serialization,Token)``
|    ``Token`` contains Base64URL data with characters outside the Base64URL alphabet:
|        ``representation_error(base64)``
|    The JWT header does not contain a valid ``alg`` member:
|        ``domain_error(jwt_header,Header)``
|    The JWT algorithm is unsupported or disallowed:
|        ``domain_error(open_id_jwt_algorithm,Algorithm)``
|    ``JWKSet`` is not a JSON Web Key Set with a ``keys`` list:
|        ``domain_error(jwt_jwks,JWKSet)``
|    No compatible key exists for the JWT header:
|        ``existence_error(jwt_jwk,Header)``
|    The selected JWK is not a supported public key:
|        ``domain_error(jwt_jwk_public_key,Key)``
|    The ES256 signature is not 64 bytes long:
|        ``domain_error(jwt_es256_signature,Signature)``
|    The OpenSSL executable does not exist:
|        ``existence_error(os_command,Executable)``
|    The ``iss`` claim does not match the provider issuer:
|        ``domain_error(open_id_claim(iss),Value)``
|    A required OpenID ID-token claim is missing:
|        ``domain_error(open_id_claims,missing(Name))``
|    The expected audience option is missing:
|        ``domain_error(open_id_claims,missing(expected_audience))``
|    An OpenID ID-token claim has an invalid value:
|        ``domain_error(open_id_claim(Name),Value)``
|    An OpenID ID-token time claim value is not a number:
|        ``type_error(time_number,Name-Time)``


------------

.. index:: verify_id_token/5
.. _open_id/0::verify_id_token/5:

``verify_id_token/5``
^^^^^^^^^^^^^^^^^^^^^

Verifies an ID-token signature and claims using the given provider metadata and JWKS.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``verify_id_token(Token,Provider,JWKSet,Claims,Options)``
| **Mode and number of proofs:**
|    ``verify_id_token(+atom,+compound,+term,-term,+list(compound))`` - ``zero_or_one_or_error``

| **Exceptions:**
|    ``Options`` is a variable or a partial list:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``
|    ``Token`` is a variable:
|        ``instantiation_error``
|    ``Token`` is neither a variable nor an atom:
|        ``type_error(atom,Token)``
|    ``Token`` is an atom but not a valid compact JWT:
|        ``domain_error(jwt_compact_serialization,Token)``
|    ``Token`` contains Base64URL data with characters outside the Base64URL alphabet:
|        ``representation_error(base64)``
|    The JWT header does not contain a valid ``alg`` member:
|        ``domain_error(jwt_header,Header)``
|    The JWT algorithm is unsupported or disallowed:
|        ``domain_error(open_id_jwt_algorithm,Algorithm)``
|    ``JWKSet`` is not a JSON Web Key Set with a ``keys`` list:
|        ``domain_error(jwt_jwks,JWKSet)``
|    No compatible key exists for the JWT header:
|        ``existence_error(jwt_jwk,Header)``
|    The selected JWK is not a supported public key:
|        ``domain_error(jwt_jwk_public_key,Key)``
|    The ES256 signature is not 64 bytes long:
|        ``domain_error(jwt_es256_signature,Signature)``
|    The OpenSSL executable does not exist:
|        ``existence_error(os_command,Executable)``
|    The ``iss`` claim does not match the provider issuer:
|        ``domain_error(open_id_claim(iss),Value)``
|    A required OpenID ID-token claim is missing:
|        ``domain_error(open_id_claims,missing(Name))``
|    The expected audience option is missing:
|        ``domain_error(open_id_claims,missing(expected_audience))``
|    An OpenID ID-token claim has an invalid value:
|        ``domain_error(open_id_claim(Name),Value)``
|    An OpenID ID-token time claim value is not a number:
|        ``type_error(time_number,Name-Time)``


------------

Protected predicates
--------------------

(no local declarations; see entity ancestors if any)

Private predicates
------------------

(no local declarations; see entity ancestors if any)

Operators
---------

(none)