URI validation

Rejects a redirect or client URI that does not parse.

• Control id: uri_validation
• Shape: deny. Segment bindings do not reach this control, because its Rego does not read settings through pbac.segments.settings.
• Entry points: authorize, register

Policy data

This control owns no policy data row.

Reads

• context.client.redirect_uri
• request.redirect_uris
• request.client_uri

Emits

• deny
• reason
• deny_reasons

Reason codes

Code	Category	Entry point	Setting
malformed_uri	invariant	register	none
malformed_redirect_uri	invariant	authorize	none

Implementation

Kind	Reference	Files	Role
rego_package	utils.uri	opa/policies/utils/uri.rego	decides
rego_package	oauth.denylist	opa/policies/oauth/denylist.rego	decides