Documentation/Delayed sharing/Delayed sharing API

Delayed sharing API

Authentication, response format, errors and documents.

Authentication

Get a token with the client_credentials grant and the private:delayed_sharing scope, using your client_id and client_secret (client_secret_basic).

curl -s -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=client_credentials \
  -d scope=private:delayed_sharing \
  https://oidc-sandbox.a3bc.io/oauth2/token

import requests

tok = requests.post(TOKEN_URL, auth=(CLIENT_ID, CLIENT_SECRET),
                    data={"grant_type": "client_credentials", "scope": "private:delayed_sharing"},
                    timeout=15).json()
r = requests.get(delayed_sharing_url,
                 headers={"Authorization": "Bearer " + tok["access_token"]}, timeout=15)

Response (the token lives about 10 minutes in the guide’s example):

{
  "access_token": "MCe6dsjy1ATH12WWuKyEvRH0g7UhcLrkvZo2iGYA9iI....",
  "expires_at": 1781855441,
  "expires_in": 599,
  "scope": "private:delayed_sharing",
  "token_type": "bearer"
}

Then call the URL of the private:delayed_sharing claim with Authorization: Bearer <access_token>. The response is application/json.

Response

Attribute	Type	Description
`claims`	object	The claims and their values, same format as `userinfo`.
`waiting_validation_claims`	list of string	Claims that can be retrieved after validation.
`shared_until`	string	Date after which the API can no longer be consumed.

{
  "claims": {
    "birthdate": "1978-03-12",
    "family_name": "DOE",
    "given_name": "JOHN",
    "private:ssn": "",
    "private:ssn_key": "",
    "private:ssn_verified": ""
  },
  "shared_until": "2026-06-19T08:21:58Z",
  "waiting_validation_claims": ["private:ssn", "private:ssn_key", "private:ssn_verified"]
}

Interpreting missing claims

If waiting_validation_claims is empty, everything that can be shared is present: no more information will be added.
A claim that is missing and was never in waiting_validation_claims was never covered by the consent.
A claim that was there and then disappeared: the credential was never validated, or the user deleted it.

Documents

A document claim returns a URL to consume like the document API, but with the client_credentials token:

{ "claims": { "private:doc.ssn": "http://openui.a3bc.lan/delayed-sharing/c3e8a143-.../doc/ssn",
              "private:doc.ssn.hash": ["sha256:f20a7da2..."] },
  "shared_until": "2026-06-19T08:34:47Z" }

Errors

The error body contains code and message.

Code	Message	HTTP	Description
`00001`	Internal server error	500	Platform error; you can retry.
`00010`	Authentication failed	401	Header missing or malformed, token invalid or without the `private:delayed_sharing` claim.
`00011`	Resource not found	404	User or transaction does not exist.
`00020`	Sharing consent revoked	403	The user revoked the sharing consent.
`00021`	Sharing consent expired	401	The sharing has expired.
`00022`	Unprocessable object	401	Unrecoverable error (malformed or wrong entity type).

Retry only on 00001 and 00010 (after obtaining valid authorization). For the others, apply your business rules (consent revoked or expired).