Relyingparty: verifyAssertion

Verifies the assertion returned by the IdP.

Request

HTTP request

POST https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyAssertion

Request body

In the request body, supply data with the following structure:

{
  "requestUri": string,
  "postBody": string,
  "pendingIdToken": string
}

Property name	Value	Description
`requestUri`	`string`	The URI to which the IDP redirects the user back. It may contain federated login result params added by the IDP.
`postBody`	`string`	The post body if the request is a HTTP POST.
`pendingIdToken`	`string`	The GITKit token for the non-trusted IDP pending to be confirmed by the user.

Response

If successful, this method returns a response body with the following structure:

{
  "kind": "identitytoolkit#VerifyAssertionResponse",
  "federatedId": string,
  "providerId": string,
  "localId": string,
  "emailRecycled": boolean,
  "emailVerified": boolean,
  "email": string,
  "inputEmail": string,
  "originalEmail": string,
  "oauthRequestToken": string,
  "oauthScope": string,
  "firstName": string,
  "lastName": string,
  "fullName": string,
  "nickName": string,
  "displayName": string,
  "idToken": string,
  "action": string,
  "language": string,
  "timeZone": string,
  "photoUrl": string,
  "dateOfBirth": string,
  "context": string,
  "verifiedProvider": [
    string
  ],
  "needConfirmation": boolean
}

Property name	Value	Description
`kind`	`string`	The fixed string "identitytoolkit#VerifyAssertionResponse".
`federatedId`	`string`	The unique ID identifies the IdP account.
`providerId`	`string`	The IdP ID. For white listed IdPs it's a short domain name e.g. google.com, aol.com, live.net and yahoo.com. If the "providerId" param is set to OpenID OP identifer other than the whilte listed IdPs the OP identifier is returned. If the "identifier" param is federated ID in the createAuthUri request. The domain part of the federated ID is returned.
`localId`	`string`	The RP local ID if it's already been mapped to the IdP account identified by the federated ID.
`emailRecycled`	`boolean`	It's true if the email is recycled.
`emailVerified`	`boolean`	The value is true if the IDP is also the email provider. It means the user owns the email.
`email`	`string`	The email returned by the IdP. NOTE: The federated login user may not own the email.
`inputEmail`	`string`	It's the identifier param in the createAuthUri request if the identifier is an email. It can be used to check whether the user input email is different from the asserted email.
`originalEmail`	`string`	The original email stored in the mapping storage. It's returned when the federated ID is associated to a different email.
`oauthRequestToken`	`string`	The user approved request token for the OpenID OAuth extension.
`oauthScope`	`string`	The scope for the OpenID OAuth extension.
`firstName`	`string`	The first name of the user.
`lastName`	`string`	The last name of the user.
`fullName`	`string`	The full name of the user.
`nickName`	`string`	The nick name of the user.
`displayName`	`string`	The display name of the user.
`idToken`	`string`	The ID token.
`action`	`string`	The action code.
`language`	`string`	The language preference of the user.
`timeZone`	`string`	The timezone of the user.
`dateOfBirth`	`string`	The birth date of the IdP account.
`context`	`string`	The opaque value used by the client to maintain context info between the authentication request and the IDP callback.
`verifiedProvider[]`	`list`	When action is 'map', contains the idps which can be used for confirmation.
`photoUrl`	`string`	The URI of the public accessible profiel picture.
`needConfirmation`	`boolean`	Whether the assertion is from a non-trusted IDP and need account linking confirmation.
`appInstallationUrl`
`appScheme`