denyOAuthRequest

POST

/api/v1/oauth/deny

curl --request POST \
  --url https://example.com/api/v1/oauth/deny \
  --header 'Content-Type: application/json' \
  --data '{ "client": "example", "redirectUri": "https://example.com", "scope": "example", "state": "example", "challenge": "example", "method": "example" }'

Requires an enrolled dashboard session and the X-CSRF-Token header. Records nothing and returns the redirect carrying access_denied, the state, and iss. A tilecast-ios denial without a usable Origin is refused instead of returning a redirect without iss.

Parameters

Header Parameters

X-CSRF-Token

string

Cookie-backed browser requests only, and only on unsafe methods. Bearer grants never send it.

Request Body^required

Media typeapplication/json

object

client

required

string

redirectUri

required

string format: uri

scope

required

string

state

string

challenge

required

string

method

S256, or omitted. The Server rejects any other value.

string

Example^generated

{
  "client": "example",
  "redirectUri": "https://example.com",
  "scope": "example",
  "state": "example",
  "challenge": "example",
  "method": "example"
}

Responses

200

Validated redirect carrying access_denied

Media typeapplication/json

object

data

required

object

redirectUri

required

string format: uri

Example^generated

{
  "data": {
    "redirectUri": "https://example.com"
  }
}

400

The authorization request is not valid

401

Dashboard authentication required

403

CSRF token required