VersolaVersola/docs
versola.kzGitHub
RUEN

RFC 9396 — Rich Authorization Requests

OAuth 2.0 Rich Authorization Requests (authorization_details)

Specification: RFC 9396

Rich Authorization Requests (RAR) allow clients to specify fine-grained authorization requirements using the authorization_details parameter, going beyond simple scopes.

Authorization Request

  • authorization_details parameter — JSON array of authorization details — not yet implemented
  • Custom authorization types — application-specific authorization requirements — not yet implemented

Authorization Details Structure

When implemented, each authorization detail object will contain:

  • type — authorization type (e.g., payment, account_information)
  • locations — target resource servers
  • actions — permitted actions
  • Custom fields per authorization type

Token Response

  • authorization_details in token response — granted authorizations — not yet implemented
  • Access token contains granted authorization details — not yet implemented

Use Cases

Rich Authorization Requests enable:

  • Payment authorization with specific amounts and payees
  • Document access with specific permissions (read/write/delete)
  • Fine-grained API access beyond simple scopes

Status

  • Not yet implemented — planned for future release