Checking whether a user already has a use.id WebID

Let's start with the first screen in the onboarding journey of My Move.

In this screen, the user can enter their email address or WebID in one input field (see below).

To do this, My Move implemented the following procedure:

1. Check whether the user has entered a valid use.id WebID or a valid email address.
   1. In case a valid use.id WebID has been entered:
      Either rely on the Solid OIDC flow or /passwordless/email/sendendpoint (see next pages).
   2. In case a valid email address has been entered:
      Check whether the email address has a use.id account associated with it using the /account/exists endpoint (see example).
      1. In case there is a use.id account associated with the email address
         Use the /passwordless/email/send endpoint (see next pages).
      2. In case there is no use.id account associated with the email address
         Use the /provision endpoint to create a new use.id WebID for the email address (see next pages)
   3. In case a WebID other than use.id has been entered:
      Rely on the Solid OIDC flow (see next pages)

🔒

Checking based on email address

The /account/exists endpoint is used to check whether there is already a use.id WebID associated with it. This endpoint is not part of the Solid standard and is part of use.id's commercial offering. This also means that you can only check whether an email address has a use.id account associated with it and not just any WebID.

The API call to check an email

As you can see, the /account/existsendpoint is essential in the procedure described above.

Suppose that John already has a use.id WebID, but doesn't remember that he made one in the past. John enters his email address that he used to register his use.id WebID in the past and clicks on continue.

In this case, My Move will send the following request:

POST https://sandbox.idp.use.id/account/exists
Content-Type: application/json
Authorization: DPoP eyJhbGciOiJFUzI1NiIsImtpZCI6IjI4YzBkODk5LTg0YTktNDUwOC1hYTliLTJhOTdlMjFmMjVmOCIsInR5cCI6ImF0K2p3dCJ9.eyJodHRwczovL3Rlc3QudXNlLmlkL3dlYmlkIjoiaHR0cHM6Ly90ZXN0LndlYmlkLmlub3guYXBwLyIsImlzcyI6Imh0dHBzOi8vdGVzdC5pZHAudXNlLmlkLyIsInN1YiI6Iml0TGtqYms3Rldpa01kQktkQ0hTVTJVQ0ZrS29iWXlaQGNsaWVudHMiLCJhdWQiOlsiaHR0cHM6Ly91c2VpZC10ZXN0LmV1LmF1dGgwLmNvbS9hcGkvdjIvIiwic29saWQiXSwiaWF0IjoxNjYwODEzODU2LCJleHAiOjE2NjA5MDAyNTYsImF6cCI6Iml0TGtqYms3Rldpa01kQktkQ0hTVTJVQ0ZrS29iWXlaIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIiwiY25mIjp7ImprdCI6ImJ0SUVlM21GbmpERW82VVpxeFh4RHhSUHhTdWpIZWlUQjV5U25sMVpUT28ifSwid2ViaWQiOiJodHRwczovL3Rlc3Qud2ViaWQuaW5veC5hcHAvIiwianRpIjoiZjZhYmQ5NTItM2E0Mi00NTdhLWE3MDEtYWQ4MTI5MDhkMTRiIn0.tZyG7QzSLckxIl6hOWW1EdLSi79tNSrEHo0GxHl1FX-J8W-uniKFFo7YvVnZ2H8-_sUtAwplLklhtUGitYyuNg
DPoP: eyJhbGciOiJFUzI1NiIsImp3ayI6eyJjcnYiOiJQLTI1NiIsImt0eSI6IkVDIiwieCI6Ik5tVjQ2UENzSndBOXFwdW4xeUtvckx0ejFodk4yU2ZKN3h0U2JSTlJQMHciLCJ5IjoiM0wyN040TjRXdy1QQWlXelV2alo2UXFvem9kUkRsUmJERERBU201cGdXbyJ9LCJ0eXAiOiJkcG9wK2p3dCJ9.eyJodG0iOiJQT1NUIiwiaHR1IjoiaHR0cHM6Ly90ZXN0LmFwaS51c2UuaWQvcHJvdmlzaW9uIiwiaWF0IjoxNjYwODEzODY3LCJqdGkiOiJjM2UxNjhmYi1kYmMwLTQ2OGEtYmFkNS02MWM0ZTk4NWI2MGQifQ.KLhm-1LBopY5iq2QHXPikZDnJ5CXeQUwAGCL-oI896o_gtyotzquQGG8QD1LjVQ_wirbvb6_zw3SilJ3EPiQgw
Content-Length: 47

{
    "selector": "email"
    "email": "[email protected]"
}

The use.id API returns the following response, indicating that there is a use.id account associated with that email address.

HTTP/1.1 200 OK
Content-Type: application/json

{
  "email": "[email protected]",
  "username": "john"
}

📘

Access to the account exists endpoint is governed by the data processing agreement between use.id and the customer and is subject to the terms of the provisioning service. We foresee to decommision this endpoint when we notice that people are able to remember their WebID.