---
title: "Start the OAuth authorization flow for an action pack."
method: POST
path: "/rest/api/v1/actions/actionpack/{actionPackId}/auth"
tags: ["Tools"]
---

# Start the OAuth authorization flow for an action pack.

`POST /rest/api/v1/actions/actionpack/{actionPackId}/auth`

Starts the third-party OAuth flow for the specified action pack and returns the
redirect URL that the client should navigate the end user to. After the OAuth
callback completes, the user's browser is redirected back to `returnUrl` with a
status query parameter (`?glean_action_auth=success|error&actionPackId=...`).

`returnUrl` must match the tenant's configured return URL allowlist; otherwise the
request is rejected with 400.

## Request body

- AuthorizeActionPackRequest
  - `returnUrl` string, required — URL on the customer's domain to redirect the end user's browser back to after the third-party OAuth callback completes. Must be present in the tenant's return URL allowlist.

## Response `200`

Successful operation

- AuthorizeActionPackResponse
  - `redirectUrl` string, required — URL that the customer UI should navigate the end user to in order to begin the third-party OAuth flow. After the user consents, control returns to `returnUrl` from the request.

## Other responses

- `400` — Invalid request (e.g. returnUrl not in allowlist, unsupported auth type)
- `401` — Unauthorized
- `403` — User not entitled to the action pack
- `404` — Action pack not found
- `429` — Too Many Requests

---

[API](https://skmtc.dev/gleanwork/apis/glean-client-api.md) · [All operations](https://skmtc.dev/gleanwork/apis/glean-client-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/gleanwork/glean-client-api/revisions/96ef4b1b0820/schema)