External integration probe

General External App with Auth Test

Minimal provider app for verifying the HAG-Tools redirect, exchange, state, introspection, and logout flow.

Start HAG-Tools login
Current handoffWAITING

No local test session exists. Use the button above or open this app through the configured HAG-Tools tool.

Provider checksserver-side
  • Authorization code is exchanged by the backend
  • The browser URL is cleaned after callback
  • Revalidation token never enters the browser
  • Logout calls HAG-Tools revocation
Sanitized protocol trace

Message exchange

Request and response shapes between the browser, this app, and HAG-Tools. Codes and credentials are masked.

  1. 01ready

    Login starten

    Browser → External App
    GET /api/start
    Request
    {
  "action": "Start HAG-Tools login"
}
    Response
    {
  "stateCookie": "HttpOnly, expires in 10 minutes",
  "redirect": "HAG-Tools /api/tools/external/launch"
}
  2. 02after start

    Tool-Launch anfragen

    External App → HAG-Tools
    GET /api/tools/external/launch
    Request
    {
  "toolSlug": "external-tool-test",
  "returnTo": "/tools/overview",
  "state": "[random, signed state]"
}
    Response
    {
  "status": 302,
  "location": "/?code=[redacted]&state=[same state]"
}
  3. 03after callback

    Autorisierungscode eintauschen

    External App Server → HAG-Tools
    POST /api/tools/external/exchange
    Request
    {
  "code": "[redacted]",
  "clientId": "[configured]",
  "clientSecret": "[redacted]"
}
    Response
    {
  "authState": "AUTHENTICATED",
  "subject": "user context",
  "authorization": "granted access",
  "revalidationToken": "[redacted]"
}
  4. 04optional

    Zugriff erneut prüfen

    External App Server → HAG-Tools
    POST /api/tools/external/introspect
    Request
    {
  "token": "[redacted]",
  "clientId": "[configured]",
  "clientSecret": "[redacted]"
}
    Response
    {
  "authState": "current access status",
  "expiresAt": "session expiry"
}
  5. 05optional

    Session beenden

    External App Server → HAG-Tools
    POST /api/tools/external/revoke
    Request
    {
  "token": "[redacted]",
  "clientId": "[configured]",
  "clientSecret": "[redacted]"
}
    Response
    {
  "status": "200 OK (or 401 if already revoked)"
}