---
title: "Approve or deny an app authorization request"
method: POST
path: "/oauth/requests/{requestId}"
tags: ["Auth"]
---

# Approve or deny an app authorization request

`POST /oauth/requests/{requestId}`

## Request

- Base URL: `https://api.flashdata.dev/v2`
- URL: `https://api.flashdata.dev/v2/oauth/requests/{requestId}`
- Auth: API key in cookie `__Host-fd_session` and API key in header `X-CSRF-Token`

Full session, CSRF and allowed Origin required. Consumes the request once. Response is no-store.

## Request body

- object
  - `decision` 'approve' | 'deny', required

## Response `200`

Registered client callback with code or denial, state and issuer

- object
  - `redirectUrl` string, uri, required

## Other responses

- `401`: Authentication required or invalid
- `403`: Authenticated but not permitted, or CSRF validation failed
- `410`: Authorization request unavailable; start a new connection
- `422`: Request validation failed

---

[API](https://skmtc.dev/flashdata/apis/flashdata-customer-api.md) · [All operations](https://skmtc.dev/flashdata/apis/flashdata-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flashdata/apis/flashdata-customer-api/revisions/109179fe9313?raw)