JumpCloud OIDC callback (issue exchange code)

Overview

JumpCloud redirects the browser to this endpoint after sign-in. The endpoint validates the IdP (identity provider) user against the associated account.

The account must have a matching email address and an associated company. Its auth_methods field (allowed sign-in methods) must include jumpcloud, and its bundle_id must be at least 1. The account must not be locked or inactive.

When validation succeeds, the endpoint issues a single-use SsoExchangeCode. It returns a 302 redirect to FRONTEND_CALLBACK_URL with ?code=<raw>. When validation fails, it redirects with ?error=<reason> instead.

This endpoint never returns JSON; the browser receives the redirect. The web session guard lets Socialite validate the OAuth state during the sign-in round trip.

Prerequisites

• No authentication — this endpoint is public.
• Values for the required query parameter code — see the table below.

Base URL

Endpoint

GET /api/v1/auth/sso/jumpcloud/callback

Authentication

• No bearer token required. This is a public endpoint.
• Socialite validates the OAuth state; the user identity comes from JumpCloud.

Rate limit

• 10 requests/min per IP; public.

Query parameters

How it works

• Always 302. Failure error reasons: sso_failed, sso_no_email, no_user, sso_not_enabled, no_company, role_not_allowed, account_locked, account_inactive. Emits audit SSO_LOGIN_SUCCESS / SSO_LOGIN_FAILED / SSO_LOGIN_BLOCKED_*.

Response

302 Redirect (success) · 302

(empty body)

302 Redirect (error) · 302

(empty body)

Errors

Example request

curl --request GET \
  --url "https://production-api.shoutaboutus.com/api/v1/auth/sso/jumpcloud/callback?code=<oidc_code>&state=<state>"