---
title: "Validate hosted OAuth callback state without storing raw code"
method: POST
path: "/oauth/callback-metadata"
---

# Validate hosted OAuth callback state without storing raw code

`POST /oauth/callback-metadata`

## Request

- Base URL: `https://api.gravityads.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.gravityads.dev/oauth/callback-metadata`
- Auth: HTTP bearer

## Request body

- object
  - `state` string, required
  - `code` string: Raw provider code is accepted only for hashing/validation and is never returned.
  - `error` string

## Response `200`

OAuth callback metadata

- object
  - `schema_version` 'gravityads.hosted_oauth_callback_metadata.v1', required
  - `status` 'oauth_callback_validated' | 'oauth_callback_error', required
  - `tenant_id` string, required
  - `platform` string, required
  - `connection_id` string, required
  - `state_hash` string, required
  - `authorization_code_hash` string
  - `provider_error` string
  - `age_seconds` integer
  - `next_step` string, required
  - `raw_authorization_code_forwarded_to_adapter` false, required
  - `writes_platform` false, required

---

[API](https://skmtc.dev/gravityads/apis/gravityads-api.md) · [All operations](https://skmtc.dev/gravityads/apis/gravityads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gravityads/apis/gravityads-api/revisions/124cd07d534d?raw)