rp_python_sdk 1.4.1__tar.gz → 1.5.0__tar.gz

{rp_python_sdk-1.4.1 → rp_python_sdk-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rp_python_sdk
-Version: 1.4.1
+Version: 1.5.0
 Summary: Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem
 License: Proprietary
 Author: Erik Pragt
@@ -11,7 +11,9 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Requires-Dist: authlib (>=1.7.2,<2.0.0)
+Requires-Dist: certifi (>=2026.4.22,<2027.0.0)
 Requires-Dist: cffi (>=2.0.0,<3.0.0)
 Requires-Dist: cryptography (>=50.0.0)
 Requires-Dist: joserfc (>=1.6.8,<2.0.0)
@@ -414,6 +416,173 @@ The required function parameters are:
 The method will return a `Tokenset` that contains the access_token and id_token with the requested claims along
 with a unique `x-fapi-interaction-id` that was used for this request to the authorisation server.
 
+## Telemetry
+
+The SDK emits non-sensitive telemetry about its PAR, Token and UserInfo endpoint interactions to the
+centralized ConnectID telemetry service over mTLS. Telemetry is **enabled by default** and requires no
+configuration. It is controlled through a `TelemetryConfig` supplied on `CustomConfig`.
+
+### Opting out
+
+To disable telemetry, set `enabled=False` on the `TelemetryConfig`:
+
+```python
+from rp_python_sdk.relying_party_client_sdk import RelyingPartyClientSdk
+from rp_python_sdk.sdk_config import SdkConfig, CustomConfig
+from rp_python_sdk.telemetry.telemetry_config import TelemetryConfig
+
+client = RelyingPartyClientSdk(
+    config=SdkConfig(
+        # ... other SdkConfig fields ...
+        custom_config=CustomConfig(
+            telemetry_config=TelemetryConfig(enabled=False)
+        )
+    ),
+)
+```
+
+When telemetry is disabled the SDK constructs no transport, session, dispatcher, token provider or worker
+threads, so there is no overhead.
+
+### Delivery mode and budget
+
+The `delivery_mode` field selects how events are delivered:
+
+- `TelemetryDeliveryMode.ASYNC` (default): fire-and-forget. Events are placed on a bounded in-memory queue
+  that is drained by daemon worker threads, so the SDK operation returns without waiting for any network I/O.
+- `TelemetryDeliveryMode.SYNC`: events are delivered inline, before the SDK operation returns. Use this for
+  hosts that may freeze or terminate before background work completes (for example AWS Lambda), where a
+  fire-and-forget event could be lost. Inline delivery is bounded by `sync_send_budget_seconds` (default `1.0`).
+
+```python
+from rp_python_sdk.telemetry.telemetry_config import TelemetryConfig, TelemetryDeliveryMode
+
+CustomConfig(
+    telemetry_config=TelemetryConfig(
+        delivery_mode=TelemetryDeliveryMode.SYNC,
+        sync_send_budget_seconds=1.0,
+    )
+)
+```
+
+Note on the SYNC budget: `sync_send_budget_seconds` bounds the **per-phase inactivity** (the connect and read
+timeouts) of the underlying HTTP calls, not the total wall-clock latency of delivery. A degraded telemetry
+endpoint that stays marginally responsive can therefore add more than the configured budget to your SDK call.
+The budget is applied as a remaining-time budget across the token refresh and the event POST, so no single
+phase is given the full budget afresh.
+
+`TelemetryConfig` fields:
+
+| Field | Default | Description |
+| --- | --- | --- |
+| `enabled` | `True` | Master on/off switch for telemetry. |
+| `endpoint_url` | `None` | Override for the telemetry ingest URL. When `None`, the URL is derived from the SDK environment. |
+| `registry_discovery_document_url` | `None` | Override for the Registry OIDC discovery document URL used to obtain a telemetry access token. When `None`, derived from the environment. |
+| `delivery_mode` | `TelemetryDeliveryMode.ASYNC` | `ASYNC` (background dispatch) or `SYNC` (inline delivery). |
+| `sync_send_budget_seconds` | `1.0` | SYNC-only per-phase inactivity budget in seconds. Must be greater than 0. |
+| `queue_capacity` | `200` | ASYNC-only bound on the in-memory event queue. Events are dropped when the queue is full. Must be greater than 0. |
+| `max_concurrent_sends` | `3` | ASYNC-only number of daemon worker threads draining the queue. Must be greater than 0. |
+
+Under `SYNC` the queue is bypassed entirely, so `queue_capacity` and `max_concurrent_sends` are inert.
+
+### What is sent
+
+One event per operation, tagged `par_request`, `token_request` or `userinfo_request`. Every event carries the same
+top-level envelope; the `data` object varies by operation. Optional fields are omitted entirely when absent rather
+than sent as `null`.
+
+#### Top-level fields
+
+| Field                   | Type    | Description                                                                          |
+|-------------------------|---------|--------------------------------------------------------------------------------------|
+| `sourceService`         | string  | The SDK that emitted the event; always `rp-python-sdk`                               |
+| `userAgent`             | string  | The SDK user-agent string, including SDK name and version                            |
+| `sdkVersion`            | string  | SDK version, for diagnosing version-specific issues                                  |
+| `authorisationServerId` | string  | The identity provider the request was sent to                                        |
+| `clientId`              | string  | Your client id, as configured on the SDK                                             |
+| `timestamp`             | string  | When the operation completed (RFC 3339 / ISO-8601, UTC, `Z`-suffixed)                |
+| `xFapiInteractionId`    | string  | The same interaction id returned to you, for correlation                             |
+| `durationMs`            | number  | How long the operation took, in milliseconds                                         |
+| `success`               | boolean | Whether the operation succeeded                                                      |
+| `type`                  | string  | The operation: `par_request`, `token_request` or `userinfo_request`                  |
+| `schemaVersion`         | string  | Telemetry schema version (currently `1.0`)                                           |
+| `data`                  | object  | Per-operation detail (see below)                                                     |
+
+#### `data` by operation
+
+`errorDetails` is present only on failure; `expires_in` / `request_uri` and `transaction_id` are present only on
+success.
+
+**`par_request`**
+
+| Field                        | Type    | Description                                                       |
+|------------------------------|---------|-------------------------------------------------------------------|
+| `state`                      | string  | The OAuth `state` sent on the request                             |
+| `request.purpose`            | string  | The requested purpose                                             |
+| `request.body.claims`        | object  | The requested claims structure (claim *names* only, never values) |
+| `response.statusCode`        | number  | HTTP status code of the PAR response                              |
+| `response.errorDetails`      | string  | Error detail from the response, on failure                        |
+| `response.body.expires_in`   | number  | `expires_in` from the PAR response, on success                    |
+| `response.body.request_uri`  | string  | `request_uri` from the PAR response, on success                   |
+
+**`token_request`**
+
+| Field                     | Type    | Description                                                     |
+|---------------------------|---------|-----------------------------------------------------------------|
+| `state`                   | string  | The OAuth `state` associated with the token exchange            |
+| `request.grant_type`      | string  | The grant type used (e.g. `authorization_code`)                 |
+| `response.statusCode`     | number  | HTTP status code of the token response                          |
+| `response.errorDetails`   | string  | Error detail from the response, on failure                      |
+| `response.transaction_id` | string  | The `txn` transaction identifier from the token response, on success |
+
+**`userinfo_request`**
+
+| Field                     | Type    | Description                                 |
+|---------------------------|---------|---------------------------------------------|
+| `response.statusCode`     | number  | HTTP status code of the userinfo response   |
+| `response.errorDetails`   | string  | Error detail from the response, on failure  |
+
+UserInfo events carry no `state` and no `request` object.
+
+The following are **never** collected:
+
+- no access, refresh or ID tokens
+- no authorization codes
+- no client credentials or client assertions
+- no nonces
+- no code verifiers or code challenges
+- no request-object JWTs
+- no full request or response bodies
+- no claim values (beyond the transaction id)
+
+Events are authenticated with the SDK's existing transport certificate (mutual TLS) and a signed client assertion —
+the same credentials the SDK already uses for the ConnectID Registry — so no extra configuration or credentials are
+needed.
+
+### Releasing telemetry resources (`close()` and context-manager use)
+
+`RelyingPartyClientSdk` exposes a `close()` method and supports the context-manager protocol. Closing signals
+the background dispatcher to stop, discards any queued events, and joins the worker threads within a bounded
+grace period, releasing the transport session. `close()` is idempotent and never raises.
+
+Prefer the context manager so resources are released automatically:
+
+```python
+with RelyingPartyClientSdk(config) as sdk:
+    participants = sdk.get_participants()
+    # telemetry resources are released on exit
+```
+
+Or call `close()` explicitly when you manage the lifecycle yourself:
+
+```python
+sdk = RelyingPartyClientSdk(config)
+try:
+    participants = sdk.get_participants()
+finally:
+    sdk.close()
+```
+
 ## Conformance test
 
 An automated conformance test has been added. To execute the conformance test, a token is required,
@@ -451,6 +620,11 @@ poetry publish
 
 ## Release Notes
 
+### 1.5.0 (Sep 22, 2026)
+- **SDK Telemetry**: Added opt-out telemetry for PAR, Token, and UserInfo endpoint calls — see the [Telemetry](#telemetry) section for full details
+  - Supports ASYNC (default) and SYNC delivery modes
+  - Configurable via `TelemetryConfig` on `CustomConfig` — disable with `TelemetryConfig(enabled=False)`
+
 ### 1.4.1 (Aug 4, 2026)
 - Security: require cryptography 50.0.0 or newer to address CVE-2026-69247 and CVE-2026-69249
 - Removed the cryptography major-version ceiling so consumers can adopt future security releases without waiting for an SDK release

{rp_python_sdk-1.4.1 → rp_python_sdk-1.5.0}/README.md

@@ -393,6 +393,173 @@ The required function parameters are:
 The method will return a `Tokenset` that contains the access_token and id_token with the requested claims along
 with a unique `x-fapi-interaction-id` that was used for this request to the authorisation server.
 
+## Telemetry
+
+The SDK emits non-sensitive telemetry about its PAR, Token and UserInfo endpoint interactions to the
+centralized ConnectID telemetry service over mTLS. Telemetry is **enabled by default** and requires no
+configuration. It is controlled through a `TelemetryConfig` supplied on `CustomConfig`.
+
+### Opting out
+
+To disable telemetry, set `enabled=False` on the `TelemetryConfig`:
+
+```python
+from rp_python_sdk.relying_party_client_sdk import RelyingPartyClientSdk
+from rp_python_sdk.sdk_config import SdkConfig, CustomConfig
+from rp_python_sdk.telemetry.telemetry_config import TelemetryConfig
+
+client = RelyingPartyClientSdk(
+    config=SdkConfig(
+        # ... other SdkConfig fields ...
+        custom_config=CustomConfig(
+            telemetry_config=TelemetryConfig(enabled=False)
+        )
+    ),
+)
+```
+
+When telemetry is disabled the SDK constructs no transport, session, dispatcher, token provider or worker
+threads, so there is no overhead.
+
+### Delivery mode and budget
+
+The `delivery_mode` field selects how events are delivered:
+
+- `TelemetryDeliveryMode.ASYNC` (default): fire-and-forget. Events are placed on a bounded in-memory queue
+  that is drained by daemon worker threads, so the SDK operation returns without waiting for any network I/O.
+- `TelemetryDeliveryMode.SYNC`: events are delivered inline, before the SDK operation returns. Use this for
+  hosts that may freeze or terminate before background work completes (for example AWS Lambda), where a
+  fire-and-forget event could be lost. Inline delivery is bounded by `sync_send_budget_seconds` (default `1.0`).
+
+```python
+from rp_python_sdk.telemetry.telemetry_config import TelemetryConfig, TelemetryDeliveryMode
+
+CustomConfig(
+    telemetry_config=TelemetryConfig(
+        delivery_mode=TelemetryDeliveryMode.SYNC,
+        sync_send_budget_seconds=1.0,
+    )
+)
+```
+
+Note on the SYNC budget: `sync_send_budget_seconds` bounds the **per-phase inactivity** (the connect and read
+timeouts) of the underlying HTTP calls, not the total wall-clock latency of delivery. A degraded telemetry
+endpoint that stays marginally responsive can therefore add more than the configured budget to your SDK call.
+The budget is applied as a remaining-time budget across the token refresh and the event POST, so no single
+phase is given the full budget afresh.
+
+`TelemetryConfig` fields:
+
+| Field | Default | Description |
+| --- | --- | --- |
+| `enabled` | `True` | Master on/off switch for telemetry. |
+| `endpoint_url` | `None` | Override for the telemetry ingest URL. When `None`, the URL is derived from the SDK environment. |
+| `registry_discovery_document_url` | `None` | Override for the Registry OIDC discovery document URL used to obtain a telemetry access token. When `None`, derived from the environment. |
+| `delivery_mode` | `TelemetryDeliveryMode.ASYNC` | `ASYNC` (background dispatch) or `SYNC` (inline delivery). |
+| `sync_send_budget_seconds` | `1.0` | SYNC-only per-phase inactivity budget in seconds. Must be greater than 0. |
+| `queue_capacity` | `200` | ASYNC-only bound on the in-memory event queue. Events are dropped when the queue is full. Must be greater than 0. |
+| `max_concurrent_sends` | `3` | ASYNC-only number of daemon worker threads draining the queue. Must be greater than 0. |
+
+Under `SYNC` the queue is bypassed entirely, so `queue_capacity` and `max_concurrent_sends` are inert.
+
+### What is sent
+
+One event per operation, tagged `par_request`, `token_request` or `userinfo_request`. Every event carries the same
+top-level envelope; the `data` object varies by operation. Optional fields are omitted entirely when absent rather
+than sent as `null`.
+
+#### Top-level fields
+
+| Field                   | Type    | Description                                                                          |
+|-------------------------|---------|--------------------------------------------------------------------------------------|
+| `sourceService`         | string  | The SDK that emitted the event; always `rp-python-sdk`                               |
+| `userAgent`             | string  | The SDK user-agent string, including SDK name and version                            |
+| `sdkVersion`            | string  | SDK version, for diagnosing version-specific issues                                  |
+| `authorisationServerId` | string  | The identity provider the request was sent to                                        |
+| `clientId`              | string  | Your client id, as configured on the SDK                                             |
+| `timestamp`             | string  | When the operation completed (RFC 3339 / ISO-8601, UTC, `Z`-suffixed)                |
+| `xFapiInteractionId`    | string  | The same interaction id returned to you, for correlation                             |
+| `durationMs`            | number  | How long the operation took, in milliseconds                                         |
+| `success`               | boolean | Whether the operation succeeded                                                      |
+| `type`                  | string  | The operation: `par_request`, `token_request` or `userinfo_request`                  |
+| `schemaVersion`         | string  | Telemetry schema version (currently `1.0`)                                           |
+| `data`                  | object  | Per-operation detail (see below)                                                     |
+
+#### `data` by operation
+
+`errorDetails` is present only on failure; `expires_in` / `request_uri` and `transaction_id` are present only on
+success.
+
+**`par_request`**
+
+| Field                        | Type    | Description                                                       |
+|------------------------------|---------|-------------------------------------------------------------------|
+| `state`                      | string  | The OAuth `state` sent on the request                             |
+| `request.purpose`            | string  | The requested purpose                                             |
+| `request.body.claims`        | object  | The requested claims structure (claim *names* only, never values) |
+| `response.statusCode`        | number  | HTTP status code of the PAR response                              |
+| `response.errorDetails`      | string  | Error detail from the response, on failure                        |
+| `response.body.expires_in`   | number  | `expires_in` from the PAR response, on success                    |
+| `response.body.request_uri`  | string  | `request_uri` from the PAR response, on success                   |
+
+**`token_request`**
+
+| Field                     | Type    | Description                                                     |
+|---------------------------|---------|-----------------------------------------------------------------|
+| `state`                   | string  | The OAuth `state` associated with the token exchange            |
+| `request.grant_type`      | string  | The grant type used (e.g. `authorization_code`)                 |
+| `response.statusCode`     | number  | HTTP status code of the token response                          |
+| `response.errorDetails`   | string  | Error detail from the response, on failure                      |
+| `response.transaction_id` | string  | The `txn` transaction identifier from the token response, on success |
+
+**`userinfo_request`**
+
+| Field                     | Type    | Description                                 |
+|---------------------------|---------|---------------------------------------------|
+| `response.statusCode`     | number  | HTTP status code of the userinfo response   |
+| `response.errorDetails`   | string  | Error detail from the response, on failure  |
+
+UserInfo events carry no `state` and no `request` object.
+
+The following are **never** collected:
+
+- no access, refresh or ID tokens
+- no authorization codes
+- no client credentials or client assertions
+- no nonces
+- no code verifiers or code challenges
+- no request-object JWTs
+- no full request or response bodies
+- no claim values (beyond the transaction id)
+
+Events are authenticated with the SDK's existing transport certificate (mutual TLS) and a signed client assertion —
+the same credentials the SDK already uses for the ConnectID Registry — so no extra configuration or credentials are
+needed.
+
+### Releasing telemetry resources (`close()` and context-manager use)
+
+`RelyingPartyClientSdk` exposes a `close()` method and supports the context-manager protocol. Closing signals
+the background dispatcher to stop, discards any queued events, and joins the worker threads within a bounded
+grace period, releasing the transport session. `close()` is idempotent and never raises.
+
+Prefer the context manager so resources are released automatically:
+
+```python
+with RelyingPartyClientSdk(config) as sdk:
+    participants = sdk.get_participants()
+    # telemetry resources are released on exit
+```
+
+Or call `close()` explicitly when you manage the lifecycle yourself:
+
+```python
+sdk = RelyingPartyClientSdk(config)
+try:
+    participants = sdk.get_participants()
+finally:
+    sdk.close()
+```
+
 ## Conformance test
 
 An automated conformance test has been added. To execute the conformance test, a token is required,
@@ -430,6 +597,11 @@ poetry publish
 
 ## Release Notes
 
+### 1.5.0 (Sep 22, 2026)
+- **SDK Telemetry**: Added opt-out telemetry for PAR, Token, and UserInfo endpoint calls — see the [Telemetry](#telemetry) section for full details
+  - Supports ASYNC (default) and SYNC delivery modes
+  - Configurable via `TelemetryConfig` on `CustomConfig` — disable with `TelemetryConfig(enabled=False)`
+
 ### 1.4.1 (Aug 4, 2026)
 - Security: require cryptography 50.0.0 or newer to address CVE-2026-69247 and CVE-2026-69249
 - Removed the cryptography major-version ceiling so consumers can adopt future security releases without waiting for an SDK release

{rp_python_sdk-1.4.1 → rp_python_sdk-1.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rp_python_sdk"
-version = "1.4.1"
+version = "1.5.0"
 description = "Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem"
 authors = ["Erik Pragt <erik.pragt@connectid.com.au>"]
 license = "Proprietary"
@@ -14,11 +14,15 @@ cryptography = ">=50.0.0"
 joserfc = "^1.6.8"
 cffi = "^2.0.0"
 urllib3 = "^2.7.0"
+# Already present transitively via requests; declared explicitly because the telemetry TLS
+# context imports it directly to trust the public roots that sign the Registry endpoints.
+certifi = "^2026.4.22"
 
 [tool.poetry.group.test.dependencies]
 pytest = "^9.0.0"
 httpx = "^0.28.1"
 toml = "^0.10.2"
+jsonschema = { extras = ["format-nongpl"], version = "^4.25.1" }
 
 [tool.poetry.group.dev.dependencies]
 black = "^26.5.1"

{rp_python_sdk-1.4.1 → rp_python_sdk-1.5.0}/rp_python_sdk/endpoints/pushed_authorisation_request.py

@@ -1,6 +1,5 @@
 import json
 import time
-import uuid
 from typing import Any
 from urllib.parse import quote
 
@@ -11,12 +10,16 @@ from authlib.oauth2.rfc7636 import create_s256_code_challenge
 
 from rp_python_sdk.endpoints.get_participants import get_auth_server_details, \
     get_issuer_metadata
+from rp_python_sdk.endpoints.util.client_assertion import create_client_assertion
 from rp_python_sdk.endpoints.util.fapi import create_x_fapi_interaction_id, log_x_fapi_interaction_id_matches
 from rp_python_sdk.model import PARResponse
 from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientSdkException
 from rp_python_sdk.sdk_config import SdkConfig
 from rp_python_sdk.setup_logger import logger
 from rp_python_sdk.cache.http_cache import HttpCache
+from rp_python_sdk.telemetry.telemetry_context import ParTelemetryContext
+from rp_python_sdk.telemetry.telemetry_event_factory import create_par_request_event
+from rp_python_sdk.telemetry.telemetry_sender import NoopTelemetrySender, TelemetrySender
 
 extended_claims = {"over16", "over18", "over21", "over25", "over65", "beneficiary_account_au",
                    "beneficiary_account_au_payid", "beneficiary_account_international"}
@@ -27,7 +30,8 @@ def send_pushed_authorisation_request(config: SdkConfig,
                                       essential_claims: set[str],
                                       voluntary_claims: set[str],
                                       purpose: str,
-                                      cache: HttpCache) -> PARResponse:
+                                      cache: HttpCache,
+                                      telemetry_sender: TelemetrySender = NoopTelemetrySender.instance()) -> PARResponse:
     _check_valid_purpose(purpose)
 
     checked_essential_claims = _ensure_mandatory_claims_present(essential_claims, voluntary_claims)
@@ -39,7 +43,7 @@ def send_pushed_authorisation_request(config: SdkConfig,
     auth_server_url = issuer_metadata.issuer
     x_fapi_interaction_id = create_x_fapi_interaction_id()
 
-    logger.info(
+    logger.debug(
         f"Sending PAR to auth server: {authorisation_server_id} - {authorisation_server.customer_friendly_name}, "
         f"essential claims requested: {checked_essential_claims}, voluntary claims requested: {voluntary_claims}, "
         f"x-fapi-interaction-id: {x_fapi_interaction_id}, purpose: {purpose}")
@@ -57,7 +61,6 @@ def send_pushed_authorisation_request(config: SdkConfig,
     state = generate_token()
     nonce = generate_token()
     scope = "openid"
-    jti = str(uuid.uuid4())
 
     code_verifier = generate_token(48)
     code_challenge = create_s256_code_challenge(code_verifier)
@@ -84,22 +87,12 @@ def send_pushed_authorisation_request(config: SdkConfig,
     jws = JsonWebSignature()
     request_jwt = jws.serialize_compact(header, json.dumps(request_payload), config.signing_key)
 
-    client_assertion_payload = {
-        'sub': client_id,
-        'aud': auth_server_url,
-        'iss': client_id,
-        'exp': exp,
-        'jti': jti,
-        'iat': iat,
-    }
-
-    client_assertion_jwt = jws.serialize_compact(header, json.dumps(client_assertion_payload),
-                                                 config.signing_key)
+    client_assertion_jwt = create_client_assertion(config.signing_key, config.signing_kid, client_id, auth_server_url)
 
     # Data payload
     data = {
         "request": request_jwt.decode("utf-8"),
-        "client_assertion": client_assertion_jwt.decode("utf-8"),
+        "client_assertion": client_assertion_jwt,
         "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
     }
 
@@ -109,25 +102,42 @@ def send_pushed_authorisation_request(config: SdkConfig,
         "x-fapi-interaction-id": x_fapi_interaction_id
     }
 
-    # Making the POST request
-    response = requests.post(par_endpoint, data=data, headers=headers,
-                             cert=(config.transport_pem, config.transport_key),
-                             verify=config.ca_pem)
-
-    log_x_fapi_interaction_id_matches(authorisation_server, "send_pushed_authorisation_request",
-                                      x_fapi_interaction_id, response)
-
-    if not response.ok:
-        raise RelyingPartyClientSdkException(f"Response code for PAR to {authorisation_server_id} not successful, "
-                                             f"was: {response.status_code} x-fapi-interaction-id: {x_fapi_interaction_id}")
-
-    request_uri = response.json()['request_uri']
-    logger.debug(f"PAR was sent, request_uri='{request_uri}'")
+    context = ParTelemetryContext()
+    http_status_code = None
+    try:
+        # Making the POST request
+        response = requests.post(par_endpoint, data=data, headers=headers,
+                                 cert=(config.transport_pem, config.transport_key),
+                                 verify=config.ca_pem)
+        http_status_code = response.status_code
+
+        log_x_fapi_interaction_id_matches(authorisation_server, "send_pushed_authorisation_request",
+                                          x_fapi_interaction_id, response)
+
+        if not response.ok:
+            raise RelyingPartyClientSdkException(
+                f"Response code for PAR to {authorisation_server_id} not successful, "
+                f"was: {response.status_code} x-fapi-interaction-id: {x_fapi_interaction_id}, "
+                f"response body: {response.text}")
+
+        body = response.json()
+        raw_expires_in = body.get("expires_in")
+        expires_in = raw_expires_in if isinstance(raw_expires_in, int) else None
+        request_uri = body['request_uri']
+        logger.debug(f"PAR was sent, request_uri='{request_uri}'")
+
+        context.record_success(http_status_code, expires_in, request_uri)
+    except Exception as exception:
+        context.record_failure(http_status_code, str(exception))
+        raise
+    finally:
+        event = create_par_request_event(config, x_fapi_interaction_id, authorisation_server_id,
+                                         state, purpose, claim_request, context)
+        telemetry_sender.send(event)
 
     return PARResponse(_construct_auth_url(auth_endpoint, client_id, request_uri),
                        code_verifier, state, nonce, x_fapi_interaction_id)
 
-
 def _check_valid_purpose(purpose: str) -> None:
     if len(purpose) < 3 or len(purpose) > 300:
         raise RelyingPartyClientSdkException("Purpose must be between 3 and 300 characters")