---
title: "Json Authorize"
method: POST
path: "/api/v1/oauth/authorize"
tags: ["oauth-authorize", "oauth-authorize"]
---

# Json Authorize

`POST /api/v1/oauth/authorize`

## Request

- Base URL: `https://api.gnosari.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.gnosari.com/api/v1/oauth/authorize`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-AUTH-TOKEN`

Issue or deny an authorization code via JSON body.

Requires an authenticated session JWT. The ``user_id`` is extracted
from the verified token -- any ``user_id`` in the request body is
ignored (the field is not accepted).

Returns:
    ``JsonAuthorizeResponse`` with ``redirect_url`` containing either
    an authorization code (approve) or error params (deny).

## Request body

- JsonAuthorizeBody: Request body for the JSON authorize endpoint. Note: ``user_id`` is intentionally omitted. It is extracted from the authenticated session JWT to prevent injection.
  - `client_id` string, required
  - `redirect_uri` string, required
  - `scope` string, required
  - `state` string, required
  - `code_challenge` string, required
  - `code_challenge_method` 'S256', required
  - `resource` string, nullable
  - `action` 'approve' | 'deny', required

## Response `200`

Successful Response

- JsonAuthorizeResponse: Response from the JSON authorize helper containing the redirect URL. The ``redirect_url`` contains either an authorization code (on approve) or an error (on deny / validation failure) as query parameters.
  - `redirect_url` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/gnosari/apis/gnosari-api.md) · [All operations](https://skmtc.dev/gnosari/apis/gnosari-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gnosari/apis/gnosari-api/revisions/f299cf53ae5f?raw)