Integration

1. Create a new MAS transaction via POST /mas/new, providing:
   • masOptions (required) — an array of one or more options, each specifying a provider, method, and a unique id. The end-user will be presented with these options to choose from.
   • redirectUrl (required) — the URL the end-user is redirected to after completing the transaction.
   • skipSingleOption (optional, default true) — when set to true, the selection screen is skipped automatically if only one option is provided.
2. From the response, extract accessUrl and id. Send the end user to accessUrl. It can be opened in a popup or redirected to. Embedding in an iframe is not allowed. The end-user picks a provider from the MAS selection screen and completes authentication.
3. Once authentication is complete, the end-user is redirected to redirectUrl. Query transaction completion data via GET /mas/{transaction_id}, where transaction_id is the id from step 1. Use GET /mas/{transaction_id}/full to retrieve the transaction along with all associated metadata.

info

Unlike a standard transaction accessUrl, the MAS accessUrl is long-lived and remains valid for 30 days as long as it has not been opened. Once the end-user visits it, the URL is consumed and cannot be reused.

Cancellation

A MAS transaction can be cancelled via POST /mas/{transaction_id}/cancel.

• Any transaction with status new can be cancelled (before it has been started).
• Only Swedish BankID and Freja transactions can be cancelled after they have been started.
• Transactions that have reached complete or failed cannot be cancelled.

After completion

Once the end-user completes authentication, they are redirected to your redirectUrl with two query parameters appended:

• transaction_id — the MAS transaction ID
• success — true or false

If your redirectUrl contains a URL fragment, the parameters are appended to the fragment instead of the query string.