Remote consent

The name of the expected recipient of the JWT, in this case, the RCS.

Additional fine-grained authorization requirements, as specified in RFC 9396: OAuth 2.0 Rich Authorization Requests.

The claims the request makes.

A description of the OAuth 2.0 client making the request.

The ID of the OAuth 2.0 client making the request.

The display name of the OAuth 2.0 client making the request.

The URI to which AM directs the resource owner after they’ve provided consent. The response JWT must be sent as a consent_response form parameter in a POST request to this URI.

A unique string that must be returned in the response to help prevent cross-site request forgery (CSRF) attacks.

The expiration time of the JWT.

The creation time of the JWT.

The name of the issuer, configured in the OAuth 2.0 provider service.

Custom properties from the resource owner’s session to include in the remote consent request. To configure the properties to send, map session properties in the Resource Owner Session Properties field in the RCS agent configuration.

Whether to give the user the option to save their consent decision.

The requested scopes.

The username of the authenticated user.

The creation time of the JWT.

The name of the RCS.

The name of the expected recipient of the JWT, in this case, AM acting as the authorization server.

The fine-grained authorization requirements sent to the RCS. Currently, if these details are valid, AM doesn’t process them in the response. There’s no way to allow the RCS to augment the authorization_details in such a way as to have them become part of the authorization grant.

{
  "iss": "rcs",
  "aud": "{amExampleUrl}/oauth2",
  "exp": 1739181167,
  ...
  "error": "invalid_authorization_details",
  "error_description": "The authorization details are invalid.",
  "error_uri": "https://docs.example.com/errors/invalid_authorization_details",
  "state": "xyz123"
}

The expiration time of the JWT.

true if consent was provided, or false if consent was withheld.

The ID of the OAuth 2.0 client making the request, matching the value provided in the request.

The display name of the OAuth 2.0 client making the request.

A description of the OAuth 2.0 client making the request.

An array of allowed scopes.

true if the user chose to save their consent decision, or false if they didn’t.

The URI to which AM returns the resource owner after they’ve provided consent.

Configure several remote consent agent profiles by assigning them to a group.

If the remote consent agent needs to authenticate to AM, enter the password it will use.

The URL to which the user should be redirected during the OAuth 2.0 flow to obtain their consent.

The RCS URL to which AM sends pushed consent requests.

{
    "consent_request":"request JWT"
}

{
    "consent_request_uri":"consent-FVaTaZTWuQGZkQX"
}

The authentication method, which determines whether to send credentials to the RCS for pushed consent requests.

Whether to encrypt the consent request JWT sent to the RCS.

The encryption algorithm used to encrypt the consent request JWT sent to the RCS.

The encryption method used to encrypt the consent request JWT sent to the RCS.

The algorithm used to verify a signed consent response JWT received from the RCS.

The encryption algorithm used to decrypt the consent response JWT received from the RCS.

The algorithm used to sign the consent request JWT sent to the RCS.

The encryption method used to decrypt the consent response JWT received from the RCS.

Whether the RCS provides its public keys using a JWKs_URI, or manually in JWKs format.

The URI from which AM can obtain the RCS’s public keys.

The period of time, in milliseconds, that the content of the JWKs' URI is cached before being refreshed. Caching the content avoids fetching it for every token encryption or validation.

The period of time, in milliseconds, that AM waits before fetching the URI’s content again when a key ID (kid) isn’t in the JWKs that are already cached.

If the Public key selector property is set to JWKs, specify the RCS’s public keys, in JSON Web Key format.

{
  "keys": [
    {
      "kty": "RSA",
      "kid": "RemA6Gw0...LzsJ5zG3E=",
      "use": "enc",
      "alg": "RSA-OAEP-256",
      "n": "AL4kjz74rDo3VQ3Wx...nhch4qJRGt2QnCF7M0",
      "e": "AQAB"
    },
    {
      "kty": "RSA",
      "kid": "wUy3ifIIaL...eM1rP1QM=",
      "use": "sig",
      "alg": "RS256",
      "n": "ANdIhkOZeSHagT9Ze...ciOACVuGUoNTzztlCUk",
      "e": "AQAB"
    }
  ]
}

The period of time, in seconds, for which the consent request JWT sent to the RCS should be considered valid.

Properties to include in the remote consent request, if available in the resource owner’s session. Each entry maps a session property name to the name of the claim for that property in the request.