Submit the user's consent decision. If ``confirm`` is present in

the form body the authorization code is minted; otherwise the<br/>request is denied (error=access_denied).

post/v1/oauth/authorize/

Request

Base URL
https://app.iconik.io/API/auth
Auth
none declared. Required headers: App-ID, Auth-Token
TypeScript
https://skmtc.dev/iconik/apis/iconik-auth/docs/v1/oauth/authorize/post.ts
A function with typed inputs. Its response is checked against the schema.

Query parameters

client_idstring required

The OAuth2 application client ID

redirect_uristring required

The URI to redirect to after authorization. Must exactly match one of the URIs registered for the application.

scopestring required

Space-separated list of scopes to request (e.g. "assets:read assets:write"). Unlike the GET describe step, this endpoint requires every requested scope to be within the application's allowed scopes and rejects the whole request otherwise (no partial grants), since this is the step that actually mints the authorization code. Every requested scope must also be one this platform supports. When an admin approves an application that isn't in the domain yet (requires_admin_approval), it is created with exactly these scopes.

response_typestring required

Must be "code" for the Authorization Code flow.

code_challengestring required

PKCE code challenge — the Base64url-encoded SHA-256 hash of the code_verifier. Required for all authorization requests.

code_challenge_methodstring

The method used to derive the code_challenge. Only "S256" is supported; defaults to "S256" if omitted.

Headers

App-IDstring required

Auth-Tokenstring required

Response

Redirect URI containing the authorization code.