oauth-authorize

Create OAuth2 authorization request

OAuth2 authorization request. If the user grants access, the response redirects back to your redirect_uri with an authorization code in the query string.

That code can then be exchanged for an access token via the /oauth/token endpoint, which provides access to the API.

How to use

Direct the user to the authorization URL in HoorayHR with the query parameters described below.

Example

https://app.hoorayhr.io/oauth/authorize?response_type=code&client_id=1E2E2E8834912E3DCB5F267042E3EB74&redirect_uri=https:%2F%2Fintegration-partner.com&scope=profile_read%20profile_write&state=xcoivjuywkdkhvusuye3kch

post/oauth/authorize

Request

  • Base URL: https://api.hoorayhr.io
  • URL: https://api.hoorayhr.io/oauth/authorize
  • Auth: API key in header authorization

Query parameters

response_typestring required
Example:code

Expected response type. Only "code" is supported for now.

redirect_uristring uri required
Example:https://www.integration-partner.com

The URI to redirect back to once after permission is granted or denied. The url should be registered with HoorayHR.

client_idstring required
Example:00D26507EEA436A3DA9E70B135189A6F

Unique id of the client that performs the request.

scopestring required
Example:profile_read profile_write

Space separated scopes to request access for. Valid scopes include: "availability_read", "contract_read", "documents_write", "employment_terms_read", "external_leave_write", "label_read", "leave_type_read", "profile_read", "profile_write", "sick_leave_read", "sick_leave_write", "team_information", "time_off_read", "time_off_write", "time_tracking_read", "time_tracking_write", "report_attendance_read", "working_today_read"

statestring
Example:xcoivjuywkdkhvusuye3kch

String representing an opaque value used by the client to main the state between the request and the callback. Used to prevent CSRF attacks.

Request body

allowAccessboolean required

boolean indicating if the user allows access.

Example request

{
  "allowAccess": true
}

Response

A successful request results in a redirect, leading the user back to the original application and adding an authorization code - in case the user granted access - the the query params. The code has a lifetime of 60 seconds and can be used just once. The code can be exchanged for an access token using the "oauth/token" endpoint.

string uri required

Example response

"https://www.integration-partner.com/?code=342037d593e90005ce18d49426526fda7b3ca813db3fde00c1bdb674da7205e7&state=xcoivjuywkdkhvusuye3kch"

Changes

No recorded changes to this operation across all 1 revision of this API.