---
title: "OAuth consent context"
method: GET
path: "/oauth/consent/context"
tags: ["OAuth"]
---

# OAuth consent context

`GET /oauth/consent/context`

## Request

- Base URL: `https://api.apphandoff.com/api`
- URL: `https://api.apphandoff.com/api/oauth/consent/context`
- Auth: API key in cookie `sb-access-token`

Facts the consent screen needs before a human decides: client label, redirect target, requested scopes, and whether the client is first-party — true only when every redirect URI the client registered is a trusted CUSTOM-SCHEME native-app callback (the only case the portal may auto-approve). Vendor-hosted https callbacks are never first-party: they relay the code into whichever vendor session began the flow. Requires a first-party portal session JWT in the Authorization header (a delegated OAuth access token is refused with 401); read-only. Unknown or expired authorizations return a generic 404 so the endpoint cannot be used to enumerate authorization ids.

## Query parameters

- `authorization_id` string, required

## Response `200`

Consent context

- object
  - `client_name` string, nullable, required
  - `redirect_uri` string, nullable, required
  - `scopes` string[], required
  - `first_party` boolean, required

## Other responses

- `400`: Invalid request
- `401`: Not authenticated
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/apphandoff/apis/apphandoff-api.md) · [All operations](https://skmtc.dev/apphandoff/apis/apphandoff-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apphandoff/apis/apphandoff-api/revisions/9f138fe46d56?raw)