---
title: "Oauth Exchange"
method: POST
path: "/v1/auth/oauth/exchange"
tags: ["auth"]
---

# Oauth Exchange

`POST /v1/auth/oauth/exchange`

## Request

- Base URL: `https://api.actuato.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.actuato.com/v1/auth/oauth/exchange`
- Auth: none declared

The app trades the code from its callback for the session's tokens.

## Request body

- OAuthExchange: What the phone app sends to collect the tokens for a sign-in it started.
  - `code` string, required
  - `code_verifier` string, required

## Response `200`

Successful Response

- AuthResponse
  - `user` UserOut, required
    - `id` string, uuid, required
    - `email` string, email, required
    - `display_name` string, required
    - `phone` string, nullable, required
    - `phone_verified_at` string, date-time, nullable
    - `email_verified_at` string, date-time, nullable
    - `status` 'active' | 'suspended' | 'deleted', required
    - `roles` string[], required
    - `is_worker` boolean, required
    - `identity_verification_status` 'none' | 'pending' | 'verified' | 'failed', required
    - `timezone` string, required
    - `created_at` string, date-time, required
  - `access_token` string, required
  - `refresh_token` string, nullable: Only returned to non-browser clients (no cookie jar).
  - `token_type` string
  - `mfa_required` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/actuato/apis/actuator-api.md) · [All operations](https://skmtc.dev/actuato/apis/actuator-api/llms.txt) · [OpenAPI document](https://skmtc.dev/actuato/apis/actuator-api/revisions/67a742c2308b?raw)