approveOAuthRequest

POST

/api/v1/oauth/approve

curl --request POST \
  --url https://example.com/api/v1/oauth/approve \
  --header 'Content-Type: application/json' \
  --data '{ "client": "example", "redirectUri": "https://example.com", "scope": "example", "state": "example", "challenge": "example", "method": "example" }'

Browser ceremony: requires an enrolled dashboard session and the X-CSRF-Token header, and refuses bearer grants. Records the grant and returns the validated redirect carrying the single-use authorization code, the state, and iss (RFC 9207): the origin of the approval page as the browser reports it in Origin. A tilecast-ios approval without a usable Origin is refused instead of returning a redirect without iss.

Parameters

Header Parameters

X-CSRF-Token

string

Cookie-backed browser requests only, and only on unsafe methods. Bearer grants never send it.

Request Body^required

Media typeapplication/json

object

client

required

string

redirectUri

required

string format: uri

scope

required

string

state

string

challenge

required

string

method

S256, or omitted. The Server rejects any other value.

string

Example^generated

{
  "client": "example",
  "redirectUri": "https://example.com",
  "scope": "example",
  "state": "example",
  "challenge": "example",
  "method": "example"
}

Responses

200

Validated redirect carrying the code

Media typeapplication/json

object

data

required

object

redirectUri

required

string format: uri

Example^generated

{
  "data": {
    "redirectUri": "https://example.com"
  }
}

400

Unknown client, redirect, scope, or challenge

401

Dashboard authentication required

403

CSRF token required