oauth

Validate a `callback_url` against the deployment's OAuth PKCE policy without issuing a code. The consent UI calls this on mount and refuses to render if the URL is rejected — closing the gap where a "Deny" click could otherwise redirect to a host the operator denied.

Changed on
get/admin/v1/oauth/preflight

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /admin/v1/oauth/preflight
  • Auth: HTTP bearer

Query parameters

callback_urlstring required

The callback URL the external app intends to use.

Response

Callback URL passes policy

callback_hoststring required

The validated host (lowercased) — useful for surfacing in the UI.

Changes