#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')

## Abblix\.Oidc\.Server\.Endpoints\.Authorization Namespace

| Classes | |
| :--- | :--- |
| [AuthorizationCodeBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder') | Builds the `code` response\-type component of an authorization endpoint success response — the Authorization Code Flow contributor\. Generates an authorization code via [IAuthorizationCodeService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationCodeService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered by default through `AddAuthorizationEndpoint()`; covers the OAuth 2\.1 \(draft\) recommended flow\. Declares `authorization_code` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder\.GrantTypesSupported') so the discovery endpoint and registration\-time gates aggregate it transparently\. |
| [AuthorizationEndpointMetadataFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationEndpointMetadataFactory 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationEndpointMetadataFactory') | Builds the [AuthorizationEndpointMetadata](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationEndpointMetadata') advertised in discovery from the registered set of [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder'): each builder declares the response\-type it owns, and the supported response\-type combinations are the canonical OAuth/OIDC combos fully covered by the registered builders\. Kept off the request\-handling path so the discovery endpoint does not resolve the authorization handler \(and its request\-time dependencies, such as the JARM response encoder\) merely to read this metadata\. |
| [AuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationHandler') | Handles authorization requests by fetching, validating, processing and encoding the response\. |
| [AuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationRequestProcessor') | Processes authorization requests by coordinating with various services like authentication, consent, and token issuance\. This class handles the logic of determining the appropriate response to an authorization request based on the request's parameters and the current state of the user's session\. |
| [AuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationRequestValidator') | Implements the Chain of Responsibility design pattern for processing authorization requests\. This class delegates the validation of authorization requests to an [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator'), allowing a sequence of validators to handle the request in a decoupled manner\. Each validator in the chain processes the request and potentially passes it along to the next validator\. |
| [AuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationResponseEncoder') | Default [IAuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder')\. Applies the `iss` \(RFC 9207\) and implicit/hybrid `scope` gating, and — for a JARM \(`*.jwt`\) response mode — packs the response parameters into a signed/encrypted `response` JWT and resolves the delivery mode\. Mutates the response in place; the transport layer only maps the encoded response onto the wire\. |
| [ConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.ConsentConstraintEnforcer') | Default [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer')\. Asserts `granted ⊆ requested` for scopes, resources \(including their nested scopes\) and RFC 9396 `authorization_details`, throwing when the consent provider returned anything outside the request\. |

| Interfaces | |
| :--- | :--- |
| [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer') | Defense\-in\-depth backstop that asserts the anti\-escalation invariant on the consent decision: the set granted by [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') MUST be a subset of what the authorization request carried\. This mirrors the strictly narrowing\-only [ITokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenAuthorizationContextEvaluator') at the token endpoint \(RFC 8707 §2\.2\), giving the authorize\-time consent path the same guarantee\. |