OAuth consent context

Facts the consent screen needs before a human decides: client label, redirect target, requested scopes, and whether the client is first-party — true only when every redirect URI the client registered is a trusted CUSTOM-SCHEME native-app callback (the only case the portal may auto-approve). Vendor-hosted https callbacks are never first-party: they relay the code into whichever vendor session began the flow. Requires a first-party portal session JWT in the Authorization header (a delegated OAuth access token is refused with 401); read-only. Unknown or expired authorizations return a generic 404 so the endpoint cannot be used to enumerate authorization ids.