ICiconik

Validate the authorization request and return consent metadata

(client name, authorizing user, system domain, scopes, redirect_uri,<br/>state). No code is minted.

get/v1/oauth/authorize/

Request

Query parameters

client_idstring required

The OAuth2 application client ID

redirect_uristring required

The URI to redirect to after authorization. Must exactly match one of the URIs registered for the application.

scopestring required

Space-separated list of scopes to request (e.g. "assets:read assets:write"). The returned scopes field is filtered down to the intersection of the requested scopes and the application's allowed scopes - it may be empty if none overlap. This endpoint never rejects a request just because it asked for scopes the application isn't allowed to have; every requested scope must still be one this platform supports, though.

response_typestring required

Must be "code" for the Authorization Code flow.

code_challengestring required

PKCE code challenge — the Base64url-encoded SHA-256 hash of the code_verifier. Required for all authorization requests.

code_challenge_methodstring

The method used to derive the code_challenge. Only "S256" is supported; defaults to "S256" if omitted.

Headers

App-IDstring required
Auth-Tokenstring required

Response

Consent metadata (client name, authorizing user, system domain, scopes, redirect_uri, state).

redirect_uristring required
requires_admin_approvalboolean
scopesstring[] required
statestring nullable

Changes

No recorded changes to this operation across all 1 revision of this API.