AXIAM PHP SDK

__construct()

Parameters

$baseUrl : string

The AXIAM server's base URL (e.g. https://api.axiam.example).

$tenant : string

The tenant slug — REQUIRED, no nullable default anywhere on this signature (D-13, §5). There is no default tenant; constructing this client without one is a compile-time (missing required argument) error, and an empty string is rejected at runtime as a backstop.

$orgSlug : string|null = null

Organization slug — mutually exclusive with $orgId. The real login/refresh handlers require an org identifier beyond CONTRACT.md §5's tenant-only minimum (mirrors the Python/C# sibling SDKs' org_slug/org_id constructor options).

$orgId : string|null = null

Organization UUID — mutually exclusive with $orgSlug.

$customCa : string|null = null

A CA bundle FILE PATH (PEM-encoded) — the ONLY TLS escape hatch (§6/D-12). Never pass a value here to disable TLS verification; there is no such option on this class.

$clientCert : string|null = null

§6.1 (mTLS): the client's X.509 identity certificate CHAIN as a PEM STRING (not a path). When supplied together with $clientKey, this client presents that certificate for mutual TLS on both the REST and gRPC transports. Purely additive — server verification is never relaxed (§6.1.2). Must be a PEM value; a non-PEM string is rejected at construction. null (default) leaves the default bearer-cookie behavior unchanged (§6.1.5).

$clientKey : string|null = null

§6.1/§7 (mTLS): the PEM STRING of the private key matching $clientCert (PKCS#8 or PKCS#1). Secret material — it is held behind Sensitive and never logged, displayed, or exposed via a getter. $clientCert and $clientKey are all-or-nothing: supplying exactly one throws InvalidArgumentException.

$logger : LoggerInterface|null = null

Injectable logger (D-15: diagnostic-only — status codes and operation names, NEVER a token/credential value). Defaults to a silent NullLogger.

$restOnly : bool|null = null

Force REST-only authz transport. null (default) resolves to true when $grpcTarget is not supplied (there would be nothing to connect the gRPC transport to) and false otherwise — an explicit true/false always wins. REST authz ALWAYS works regardless of this setting (D-03).

$cacheTtlSeconds : int = 300

JwksVerifier's local JWKS TTL cache lifetime.

$grpcTarget : string|null = null

gRPC target host:port (e.g. api.axiam.example:9443), required only to actually use the gRPC authz transport.

$transportHandler : callable|null = null

Test-only seam (NOT part of the public API contract, trailing/optional so it never affects SC#1's "tenant is required" reflection check): a raw Guzzle handler (e.g. GuzzleHttp\Handler\MockHandler) used as the base handler for both internal HandlerStacks instead of Guzzle's default cURL/stream handler. Mirrors the C# sibling SDK's CreateForTesting internal seam, adapted to Guzzle's own documented HandlerStack::create($mockHandler) testing idiom (docs.guzzlephp.org/en/stable/testing.html) — never used by production code.

$oidcClientId : string|null = null

CONTRACT.md §12: the relying party's OAuth2 client_id, used by every oidc*/introspect/revoke operation and matched against an ID token's aud/azp (§12.4 rule 4). Required only by callers that use the §12 OIDC/SSO helpers — omitting it leaves the §1–§11 surface completely unaffected, and a §12 call without one raises AuthError before any wire call.

$oidcClientSecret : Sensitive|string|null = null

CONTRACT.md §12: the confidential client's client_secret, held behind Sensitive (§12.5). Omit for a public client — introspect/revoke/loginClientCredentials REQUIRE it (§12.1 note 4) and raise AuthError when it is absent; oidcExchange/ oidcRefresh omit it from the form body entirely when absent, per §12.1's "MUST omit rather than send empty/null" rule.

$oidcTenantId : string|null = null

CONTRACT.md §12.3 rule 4: the tenant UUID used as the default ?tenant_id= query parameter on /oauth2/* calls when a call does not supply one explicitly. $tenant above is a SLUG (§5's X-Tenant-ID header value) and is never accepted where the wire contract requires a UUID — a §12 call with neither this nor a per-call tenantId raises AuthError client-side, with no wire call.

$expectedIssuer : string|null = null

CONTRACT.md §10.1 rule 5: the iss value local token verification requires. CONDITIONAL and unset by default — null means no issuer check is performed at all; once supplied, a token whose iss differs (or which carries no iss) is rejected. There is no default value and no hardcoded AXIAM issuer anywhere in this SDK.

$expectedAudience : string|null = null

CONTRACT.md §10.1 rule 6: the aud value local token verification requires. CONDITIONAL and unset by default — null means no audience check at all; once supplied, a token whose aud does not contain it (including one with no aud) is rejected. An app guarding a user-facing resource server should generally expect axiam:user; it is not defaulted, because a service-to-service guard legitimately expects a different audience.

$retryEnabled : bool = true

$decisionMemoTtlMs : float = 0.0

$telemetryHook : callable|null = null

__destruct()

§6.1: cleans up the `0600` temp files backing the client-certificate identity when this client is destroyed, so no PEM material (least of all the private key) outlives the object on disk. A no-op when mTLS was not configured.

audit()

Append-only audit log, read-only by construction.

batchCheck()

`batchCheck` — results preserve input order (CONTRACT.md §1).

Parameters

$checks : array<int, array{action: string, resourceId: string, scope?: string|null}>

caCertificates()

Organization CAs and the per-tenant signing CAs chained beneath them.

can()

`can` — the browser/UI-scenario alias for {@see self::checkAccess()} (CONTRACT.md §1 note). Argument order is `(action, resource)` — matching {@see self::checkAccess()} and every other AXIAM SDK's `can`/`Can` (D-09/SDK-Q09; this was previously reversed relative to the rest of the SDK family).

Parameters

$action : string

$resource : string

certificates()

End-entity X.509 certificates -- the ones issued to users, services and IoT devices.

checkAccess()

`checkAccess` — delegates to {@see AuthzDispatcher} (REST default, gRPC when available).

Parameters

$action : string

$resourceId : string

$scope : string|null = null

$subjectId : string|null = null

Additive, optional (CONTRACT.md §11.2.2 — declarative authorization helpers): when given, the check is evaluated for THIS subject (a UUID) rather than whichever identity this client's own session represents. This matters for a framework bridge sharing ONE AxiamClient instance (typically authenticated as a service account, or not authenticated at all) to authorize each inbound HTTP request's OWN end user: passing subjectId: $endUserId here checks the end user's permissions, never the shared client's. null (the default) preserves this method's pre-§11 behavior exactly.

close()

Releases this client's local resources (CONTRACT.md §18).

confirmPasswordReset()

`POST /api/v1/auth/reset/confirm` (CONTRACT.md §25.1) — set the new password.

Parameters

$confirmation : PasswordResetConfirmation

debugClientCertOptions()

Test-only seam (not part of the public API contract, mirroring {@see self::debugVerifyOption()}): exposes the §6.1 client-identity options (`cert` = certificate-chain file, `ssl_key` = private-key file) actually configured on this client's authz Guzzle transport, so tests can assert the mTLS wiring without performing a live TLS handshake. Both entries are `null` when mTLS was not configured. The values are FILE PATHS, never the PEM bytes — this seam never surfaces the private key itself.

debugVerifyOption()

deviceAuthorize()

`POST /oauth2/device_authorization` (CONTRACT.md §14.1) — start the device grant and obtain the code pair.

Parameters

$scope : string|null = null

$tenantId : string|null = null

$configuration : OidcConfiguration|null = null

Tags

throws

AuthError

when the discovery document advertises no device_authorization_endpoint.

deviceLogin()

The composed §14.3 helper: start the grant, hand the caller the user code (before the first poll), poll to completion.

Parameters

$onUserCode : callable(DeviceAuthorization): void

Invoked before the first poll.

$scope : string|null = null

$tenantId : string|null = null

$configuration : OidcConfiguration|null = null

$adoptAsCredential : bool = false

$sleep : callable(int): void|null = null

Injectable sleeper, for tests.

devicePoll()

`POST /oauth2/token` with the device-code grant (CONTRACT.md §14.1) — **one** poll attempt, for an application driving its own loop. Most callers want {@see self::deviceLogin()}.

Parameters

$deviceCode : Sensitive|string

$tenantId : string|null = null

$configuration : OidcConfiguration|null = null

emailConfig()

Transactional-mail transport, configurable at organization level and overridable per tenant.

federation()

Upstream IdP configuration and the per-user links it produces.

getUserInfo()

`getUserInfo` — the gRPC-ONLY OIDC-style userinfo operation (CONTRACT.md §1.1, contract 1.3): returns the authenticated caller's identity claims from `axiam.v1.UserInfoService/GetUserInfo`, the low-latency counterpart of the server's REST `GET /oauth2/userinfo`. Delegates to {@see AuthzDispatcher} — this class never hand-rolls the gRPC transport (D-03).

groups()

Named collections of users. Roles assigned to a group are inherited by every member.

introspect()

`POST /oauth2/introspect` (RFC 7662, CONTRACT.md §12.1) — ask the server whether a token is active and, if so, for its metadata. Requires confidential-client credentials (§12.1 note 4). A `401` here is a client-credential failure surfaced as {@see \Axiam\Sdk\Core\OAuthProtocolError} and NEVER enters the §9 refresh guard (§12.3 rule 3).

Parameters

$token : Sensitive|string

The token to introspect — accepts the wrapped or bare form.

$tokenTypeHint : string|null = null

$tenantId : string|null = null

$configuration : OidcConfiguration|null = null

Tags

throws

AuthError

when no oidcClientSecret was configured.

login()

`POST /api/v1/auth/login` (CONTRACT.md §1). Returns a typed {@see LoginResult} — an MFA challenge (HTTP 202) is an expected outcome, not an exception: callers MUST check {@see LoginResult::$mfaRequired} before assuming a session was established (SC#1).

Parameters

$email : string

$password : string

loginClientCredentials()

`POST /oauth2/token` with `grant_type=client_credentials` (CONTRACT.md §12.1) — service-account machine-to-machine login. Requests no `openid` scope, so the response carries no `id_token`. Pass `$adoptAsCredential: true` to additionally adopt the returned access token as this client's bearer credential for subsequent same-origin REST calls (§12.1, an opt-in MAY) — the token is held behind {@see Sensitive} inside {@see Session} and is NEVER sent to `/oauth2/*`.

Parameters

$scope : string|null = null

$tenantId : string|null = null

$configuration : OidcConfiguration|null = null

$adoptAsCredential : bool = false

Tags

throws

AuthError

when no oidcClientSecret was configured — this grant cannot be performed by a public client (§12.1 note 4).

loginOpaque()

`POST /api/v1/auth/opaque/login/start` followed by `/finish` — OPAQUE login, RFC 9807 (CONTRACT.md §23).

Parameters

$usernameOrEmail : string

$password : string

Tags

throws

NetworkError

if the tenant has OPAQUE disabled (the endpoint answers 404 — a property of the tenant, not of any user), if ext-ffi or libaxiam_opaque_ffi is absent, or if the server names a key-stretching function this SDK cannot ask for. Deliberately not AuthError: reporting a configuration gap as a credential failure would send a user off to reset a password that works, and would stop a caller falling back to self::login()

AuthError

for a wrong password, an account that does not exist, and a server that does not hold the record — indistinguishable by design. Nothing is sent to login/finish in that case (§23.4 rule 7). Raised under mode: "required" and under a response with no mode; under "optional" the exchange is retried over self::login() first and this carries that call's failure instead

logout()

`POST /api/v1/auth/logout` (CONTRACT.md §1) and clears local session state: the shared cookie jar (§4) and the captured CSRF token (§3). The session id comes from the current access token's `jti` claim (unverified decode — an operational hint only, never an authorization decision, mirroring the Python/C# sibling SDKs).

logoutUrl()

Build the RP-initiated logout URL to redirect the user agent to (CONTRACT.md §12.7.2). Does **not** clear this client's own session.

Parameters

$idToken : Sensitive|string

$postLogoutRedirectUri : string|null = null

$state : string|null = null

$configuration : OidcConfiguration|null = null

Tags

throws

AuthError

when the discovery document advertises no end_session_endpoint.

management()

The CONTRACT.md §27 management surface: 147 operations across 24 namespaces.

mfaConfirm()

`POST /api/v1/auth/mfa/confirm` (CONTRACT.md §25.1) — activate the factor {@see self::mfaEnroll()} offered. Returns whether MFA is now enabled.

Parameters

$totpCode : string

mfaEnroll()

`POST /api/v1/auth/mfa/enroll` (CONTRACT.md §25.1) — start voluntary TOTP enrolment for the signed-in user.

mfaSetupConfirm()

`POST /api/v1/auth/mfa/setup/confirm` (CONTRACT.md §25.1) — finish forced enrolment and, with it, the login that was interrupted.

Parameters

$setupToken : Sensitive|string

$totpCode : string

mfaSetupEnroll()

`POST /api/v1/auth/mfa/setup/enroll` (CONTRACT.md §25.1) — start the enrolment a {@see self::login()} demanded.

Parameters

$setupToken : Sensitive|string

notificationRules()

Which events raise a notification, and to whom.

oauth2Clients()

Registered OAuth2/OIDC clients -- the registration half of what §12, §21 and §26 then speak to.

oidcBegin()

Build an authorization request (CONTRACT.md §12.1) — **pure local computation, no network I/O**. Generates a `state`/`nonce` (CSPRNG, ≥128 bits) and a fresh PKCE verifier/challenge pair (**S256 only**), and builds `$configuration`'s `authorization_endpoint` into a redirect URL with exactly the eight SDK-owned query parameters plus any `$extraParams` supplied.

Parameters

$configuration : OidcConfiguration

$redirectUri : string

$scope : string|array<int, string>|null = null

openid is added automatically when absent (§12.1 rule 4). Defaults to openid.

$extraParams : array<string, string> = []

Extra authorization-request parameters (e.g. prompt, login_hint). Throws InvalidArgumentException if one tries to override an SDK-owned parameter (§12.1 rule 5).

oidcDiscover()

`GET /.well-known/openid-configuration` (CONTRACT.md §12.1) — fetch the OIDC discovery document, cached per origin with a ≥5-minute TTL and single-flight de-duplication of concurrent callers (§12.3 rule 6). The document's own `issuer` is authoritative for ID-token validation (§12.4 rule 3) and may legitimately differ from `$baseUrl` behind a proxy — never treated as an error (§12.3 rule 6).

oidcExchange()

`POST /oauth2/token` with `grant_type=authorization_code` (CONTRACT.md §12.1) — exchange an authorization code for a token set, validating the returned ID token in full (§12.4) before returning. `$nonce` is MANDATORY: this grant always requests `openid`, so §12.4 rule 6 always applies. On ANY §12.4 failure the whole token set is discarded and {@see AuthError} is raised with the matching reason code (§12.4 rule 7) — `getReason()` returns one of `invalid_alg`, `unknown_kid`, `invalid_signature`, `invalid_issuer`, `invalid_audience`, `token_expired`, `nonce_mismatch`.

Parameters

$code : string

$codeVerifier : Sensitive|string

The verifier from the matching AuthorizationRequest — accepts the wrapped or bare form.

$redirectUri : string

$nonce : string

$tenantId : string|null = null

Tenant UUID for the required ?tenant_id= query parameter (§12.3 rule 4). Falls back to the client's oidcTenantId.

$configuration : OidcConfiguration|null = null

A pre-fetched discovery document, to avoid re-reading the (cached) one. Fetched via self::oidcDiscover() when omitted.

oidcPar()

`POST /oauth2/par` (CONTRACT.md §26.1) — push the authorization request over the back channel and get an opaque handle to redirect with.

Parameters

$request : AuthorizationRequest

$redirectUri : string

$configuration : OidcConfiguration|null = null

$scope : string|array<int, string>|null = null

$tenantId : string|null = null

oidcRefresh()

`POST /oauth2/token` with `grant_type=refresh_token` (CONTRACT.md §12.1) — refresh an {@see OidcTokenSet} under the SAME §9 single-flight guard {@see self::refresh()} uses. A **distinct operation** from {@see self::refresh()} (the cookie/opaque-token session path) — the two are never merged, aliased, or fall back to one another, but they share ONE guard slot: a concurrent `oidcRefresh()` call finding the guard busy with a cookie-session refresh retries (bounded) rather than returning a stale token set.

Parameters

$refreshToken : Sensitive|string

The refresh token to redeem — accepts the wrapped or bare form.

$scope : string|null = null

$tenantId : string|null = null

$configuration : OidcConfiguration|null = null

opaqueAvailable()

Whether this installation can perform OPAQUE (§23.2).

opaqueEnrollment()

Builds a registration record for `$password`, to send with any request that sets one: `POST /api/v1/users`, `/auth/password/change`, `/auth/reset/confirm` and `/admin/bootstrap`.

Parameters

$password : string

Tags

throws

NetworkError

if the tenant has OPAQUE disabled, if ext-ffi or libaxiam_opaque_ffi is absent, or if the server names a key-stretching function this SDK cannot ask for

opaqueEnrollmentForSelf()

Builds a registration record for the **caller's own** new password, sealed against the tenant the caller's account lives in.

Parameters

$password : string

Tags

throws

NetworkError

when no login has completed on this client yet — the principal tenant is reported by the login response, so there is nothing to seal against before then — and on the same terms as self::opaqueEnrollment() otherwise.

organizations()

Organizations an SDK client may read and configure. Creation and deletion are outside the SDK boundary (§27.0).

passwordResetContext()

`GET /api/v1/auth/reset/context` (CONTRACT.md §25.1) — the OPAQUE policy for the account a reset token belongs to.

Parameters

$token : Sensitive|string

permissions()

Permissions -- an action on a resource, optionally narrowed by a scope.

pgpKeys()

OpenPGP keys used for audit signing and encrypted data export.

platform()

Deployment-level probes and FIDO metadata state. Unauthenticated where the server leaves them so.

privacy()

GDPR self-service: the authenticated account's own export and erasure. Scoped to the caller, never to another user.

reactors()

Registration of §22 AMQP extension actors -- the admin surface §22.9 describes, which no SDK could previously reach.

refresh()

`POST /api/v1/auth/refresh` (CONTRACT.md §1), routed through {@see Session}'s single-flight guard (§9, D-06) — the SAME mechanism {@see RefreshMiddleware} triggers reactively on a `401`. A failure surfaces as {@see AuthError} with no retry (§9.3).

requestPasswordReset()

`POST /api/v1/auth/reset` (CONTRACT.md §25.1) — ask for a reset mail.

Parameters

$request : PasswordResetRequest

resendOwnVerification()

`POST /api/v1/users/me/resend-verification` (CONTRACT.md §25.1, §25.7) — resend the **signed-in caller's own** verification mail, and say what happened.

Tags

throws

AuthError

when there is no session — raised client-side, with no wire call.

AuthzError

on the 409: already verified, or an account state that must not be sent a live token.

NetworkError

on the 429: the daily resend limit is reached.

resendVerification()

`POST /api/v1/auth/resend-verification` (CONTRACT.md §25.1) — the **unauthenticated** resend, for a caller with no session.

Parameters

$email : string

$tenantId : string

resolvedOrgId()

The organization UUID §27 routes substitute for `{org_id}`, or `null` when the client was constructed without one (§27.4 rule 3).

resolvedTenantId()

The tenant UUID §27 routes substitute for `{tenant_id}`, or `null` when the client was constructed without one (§27.4 rule 3).

resources()

The resource hierarchy role assignments cascade down.

revoke()

`POST /oauth2/revoke` (RFC 7009, CONTRACT.md §12.1) — revoke an access or refresh token. Returns nothing. Per RFC 7009 the server answers `200` for an unknown, expired, or already-revoked token too, so this call is **idempotent**: only a `401` (client authentication failed) is an error, surfaced as {@see \Axiam\Sdk\Core\OAuthProtocolError} (§12.1 note 5). A `5xx` still raises {@see NetworkError}.

Parameters

$token : Sensitive|string

The token to revoke — accepts the wrapped or bare form.

$tokenTypeHint : string|null = null

$tenantId : string|null = null

$configuration : OidcConfiguration|null = null

Tags

throws

AuthError

when no oidcClientSecret was configured.

roles()

Roles, their permission sets, and their assignment to users and groups.

scimTokens()

Bearer tokens for the SCIM 2.0 provisioning endpoint.

scopes()

Sub-resource granularity, always addressed under their resource.

serviceAccounts()

Machine identities, their secrets, and the certificate a device-bound one authenticates with.

settings()

Effective settings, and the organization/tenant layers they resolve from.

ssoComplete()

`POST /api/v1/auth/federation/oidc/callback` (CONTRACT.md §12.1) — step 2 of upstream SSO: consumes the single-use `$state`, provisions or links the user, and establishes the session. The session arrives as `Set-Cookie` — not in the response body (§12.1 note 6) — so it is captured automatically via this client's shared §4 cookie jar; the freshly-issued §3 CSRF token is captured too, exactly as {@see self::login()} does. §12.4 does not apply here: no ID token ever reaches the SDK on the federation path.

Parameters

$state : string

$code : string

ssoCompleteHandoff()

`POST /api/v1/auth/federation/handoff` (CONTRACT.md §12.1, contract 1.38) — redeem the single-use `axiam_handoff` code the SAML and Apple flows deliver.

Parameters

$code : string

ssoCompleteOauth2()

`POST /api/v1/auth/federation/oauth2/callback` (CONTRACT.md §12.1, contract 1.38) — step 2 of a plain-OAuth2 login. Same `Set-Cookie` session and same §3 CSRF capture as {@see self::ssoComplete()}. §12.4 does not apply: an `OAuth2` provider issues no ID token at all (§12.1 note 11).

Parameters

$state : string

$code : string

ssoProviders()

`GET /api/v1/auth/federation/providers` (CONTRACT.md §12.1, contract 1.38) — which "Sign in with X" buttons to render for a workspace. The identifiers travel as **query** parameters; this is a `GET` and sends no body.

Parameters

$orgId : string|null = null

$orgSlug : string|null = null

$tenantId : string|null = null

$tenantSlug : string|null = null

ssoStart()

`POST /api/v1/auth/federation/oidc/start` (CONTRACT.md §12.1) — step 1 of first-time SSO against an **upstream** IdP. No JWT required. One tenant form (`$tenantId`/`$tenantSlug`) and one org form (`$orgId`/`$orgSlug`) must be resolvable, from the arguments or from this client's construction options (§5.1) — an unresolvable one raises {@see AuthError} client-side, with no wire call. Redirect the browser to the returned `authorizeUrl` and round-trip `state` back into {@see self::ssoComplete()} unmodified; the server keeps the nonce to itself (§12.1 note 7).

Parameters

$federationConfigId : string

$redirectUri : string

$tenantId : string|null = null

$tenantSlug : string|null = null

$orgId : string|null = null

$orgSlug : string|null = null

ssoStartOauth2()

`POST /api/v1/auth/federation/oauth2/start` (CONTRACT.md §12.1, contract 1.38) — step 1 of a login through a **plain-OAuth2** upstream (GitHub, Facebook, `generic_oauth2`). Call this, rather than {@see self::ssoStart()}, exactly when the provider's `protocol` is `OAuth2` (§12.1 note 10).

Parameters

$federationConfigId : string

$redirectUri : string

$tenantId : string|null = null

$tenantSlug : string|null = null

$orgId : string|null = null

$orgSlug : string|null = null

tenants()

Tenants within an organization -- the isolation boundary every other namespace is scoped to.

tokenExchange()

`POST /oauth2/token` with the RFC 8693 grant (CONTRACT.md §15.1) — exchange a token for a **narrower** one.

Parameters

$subjectToken : Sensitive|string

$subjectTokenType : string

What kind of token $subjectToken is. Required (§15.1): OidcClient::ACCESS_TOKEN_TYPE for an AXIAM access token, or OidcClient::JWT_TOKEN_TYPE for a trusted external issuer's JWT (§15.7). Never inferred from the token.

$actorToken : Sensitive|string|null = null

$scopes : array<int, string>|null = null

$audience : string|null = null

$resource : string|null = null

$tenantId : string|null = null

$configuration : OidcConfiguration|null = null

Tags

throws

AuthError

when no oidcClientSecret was configured.

umaChallengeHeader()

Format a `WWW-Authenticate: UMA` header (CONTRACT.md §20.3, emit half).

Parameters

$realm : string

$asUri : string

$ticket : Sensitive|string

umaDeleteResource()

`DELETE /uma2/rreg/resource_set/{id}` (CONTRACT.md §20.1).

Parameters

$pat : Sensitive|string

$id : string

umaExchangeTicket()

The UMA ticket grant (CONTRACT.md §20.1) — redeem a permission ticket for an RPT.

Parameters

$ticket : Sensitive|string

$claimToken : Sensitive|string

$tenantId : string|null = null

$configuration : OidcConfiguration|null = null

Tags

throws

AuthError

when no oidcClientSecret was configured.

umaListResources()

`GET /uma2/rreg/resource_set` (CONTRACT.md §20.1) — the ids this client registered.

Parameters

$pat : Sensitive|string

umaParseChallenge()

Parse a `WWW-Authenticate: UMA …` header (CONTRACT.md §20.3) — local computation, and deliberately **no** exchange of the ticket it finds.

Parameters

$header : string

umaReadResource()

`GET /uma2/rreg/resource_set/{id}` (CONTRACT.md §20.1).

Parameters

$pat : Sensitive|string

$id : string

umaRegisterResource()

`POST /uma2/rreg/resource_set` (CONTRACT.md §20.1) — register a UMA resource set.

Parameters

$pat : Sensitive|string

A client-credentials token carrying uma_protection (§20.2 rule 1) — never this client's session token.

$name : string

$type : string|null = null

$resourceScopes : array<int, string> = []

umaRequestTicket()

`POST /uma2/perm` (CONTRACT.md §20.1) — mint a permission ticket.

Parameters

$pat : Sensitive|string

$permissions : array<int, RequestedPermission>

umaUpdateResource()

`PUT /uma2/rreg/resource_set/{id}` (CONTRACT.md §20.1) — replace a resource set.

Parameters

$pat : Sensitive|string

$id : string

$name : string

$type : string|null = null

$resourceScopes : array<int, string> = []

users()

Users within the client's tenant, and the administrative side of their second factor and lockout state.

verifyEmail()

`POST /api/v1/auth/verify-email` (CONTRACT.md §25.1).

Parameters

$token : Sensitive|string

$tenantId : string

verifyLocally()

Verify an INBOUND caller's token and nothing else — the seam every request guard must use (CONTRACT.md §10.1 rule 8). Delegates straight to {@see JwksVerifier::verify()}, which applies the full §10.1 minimum local-verification set, and returns `null` on any failure with **no fallback to another credential**.

Parameters

$token : string

$tenant : string

verifyLocallyOrFallback()

Local-first JWT verification with a reactive-refresh fallback (D-02) — for the SDK's own OUTBOUND calls, where the token being verified is this client's own and refreshing it is the intended recovery. Tries {@see JwksVerifier::verify()} first (no network call on the happy path); if that fails (expired/unknown-kid/invalid token), attempts the shared single-flight refresh (§9, D-06) and re-verifies the FRESH access token. Returns `null` — never unverified claims — on any failure.

Parameters

$token : string

$tenant : string

verifyLogoutToken()

Verify a back-channel logout token the OP pushed to this application's `backchannel_logout_uri` (CONTRACT.md §12.7.3).

Parameters

$logoutToken : string

$configuration : OidcConfiguration|null = null

Tags

throws

AuthError

on any failed check.

verifyMfa()

`POST /api/v1/auth/mfa/verify` (CONTRACT.md §1) — completes the two-phase flow started by {@see self::login()} when {@see LoginResult::$mfaRequired} was `true`. `$challengeToken` is the `Sensitive`-wrapped value from that `LoginResult` (D-11: never a raw string on the public surface).

Parameters

$challengeToken : Sensitive

$totpCode : string

webauthnAuthenticateFinish()

`POST /api/v1/auth/webauthn/authenticate/finish` (CONTRACT.md §24.1).

Parameters

$stateToken : Sensitive|string

$response : string

webauthnAuthenticateStart()

`POST /api/v1/auth/webauthn/authenticate/start` (CONTRACT.md §24.1) — begin the **second-factor** ceremony.

Parameters

$challengeToken : Sensitive|string

webauthnDiscoverableFinish()

`POST /api/v1/auth/webauthn/authenticate/discoverable/finish` (CONTRACT.md §24.1).

Parameters

$stateToken : Sensitive|string

$response : string

webauthnDiscoverableStart()

`POST /api/v1/auth/webauthn/authenticate/discoverable/start` (CONTRACT.md §24.1) — begin the usernameless ceremony.

Parameters

$workspace : WebauthnWorkspace|null = null

webauthnPolicy()

Per-tenant attestation policy governing the §24 ceremonies, and the compliance report over it.

webauthnRegisterFinish()

`POST /api/v1/auth/webauthn/register/finish` (CONTRACT.md §24.1) — hand the authenticator's answer back and store the credential.

Parameters

$stateToken : Sensitive|string

$credentialName : string

$response : string

webauthnRegisterStart()

`POST /api/v1/auth/webauthn/register/start` (CONTRACT.md §24.1) — begin enrolling a passkey for the signed-in user.

webhooks()

Outbound event notifications. Delivery signatures are verified with the §13 helper, which this namespace configures.