Overview

Access information later when its credential was not yet validated.

Delayed sharing lets a user share information from credentials that are not yet validated. You then retrieve it asynchronously once they are.

Principle

• Consent follows the usual authorization_code flow, with the private:delayed_sharing scope.
• The user can select credentials that are still pending validation.
• A new claim, private:delayed_sharing, contains the URL of the delayed sharing API.
• This API stays accessible after the code and tokens have expired, for a duration set by a TTL. It exposes again the consented information; claims of credentials now validated appear.
• It is called with a token obtained through the client_credentials flow, using the same credentials as the authorization_code flow.
• If all credentials are already validated, the API simply returns the same information as the initial transaction.

Limitations

Even with this scope, you may never receive all the information:

• the user has no credential to share (validated or pending);
• a credential validation failed;
• the user deletes a credential (before or after validation) or revokes their consent;
• the sharing TTL has expired.

The initial OIDC result does not explain why a claim is missing; the delayed sharing API tells whether a claim relates to a credential still pending validation.

Implementation strategy

1. Collect and store every available claim right after consent: do not count on reading it again later.
2. If an expected claim is missing, call the delayed sharing API immediately to see whether it may arrive.
3. Then react to webhooks to query the API again.
4. Collect claims as soon as they appear: they may disappear later.
5. Plan business rules for the case where the claim never arrives.

Configuration on A3BC’s side

Done by A3BC in the back office, on your request:

• adding the private:delayed_sharing scope to the authorized scopes;
• adding client_credentials (and optionally refresh_token) to the grants, authorization_code remaining selected;
• setting delayed_sharing_ttl, the sharing duration in seconds.

Consent example

With scopes profile private:ssn.fr private:delayed_sharing, a user who consents with a validated identity document and a social security number still pending gets:

{
  "birthdate": "1978-03-12",
  "family_name": "DOE",
  "gender": "male",
  "given_name": "JOHN",
  "private:delayed_sharing": "http://openui.a3bc.lan/delayed-sharing/dddb6b7c-2730-4f52-bc5b-76c5e7faf549",
  "private:ssn": "",
  "private:ssn_key": "",
  "private:ssn_verified": "",
  "sub": "f997cfff165741f98038628f103fedb3"
}

The private:ssn* claims are present but empty: this is the standard response when no value is available. The private:delayed_sharing claim gives the URL to query.