---
title: "Describe Authorization Request"
method: GET
path: "/api/oauth/authorization-request"
tags: ["oauth"]
---

# Describe Authorization Request

`GET /api/oauth/authorization-request`

## Request

- Base URL: `https://kernelscan.io`
- URL: `https://kernelscan.io/api/oauth/authorization-request`
- Auth: none declared

What the consent page needs to render: who is asking, and for what.

Deliberately unauthenticated: the page calls this before it knows whether
anyone is signed in, and it reveals nothing secret — only a client name the
client chose for itself. Validating here means an invalid request is caught
BEFORE the user logs in, rather than after.

``client_kind`` tells the page how to present the requester: for ``cimd``
the proven ``client_host`` is the identity and ``client_name`` secondary;
for ``dcr`` everything is self-asserted and the page warns. Because this
endpoint has no user, the DCR opt-in cannot be checked here — the page
checks ``oauth_dcr_enabled`` after sign-in for the explanation, and
POST /api/oauth/authorize is where it is enforced.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/kernelscan/apis/kernelscan-api.md) · [All operations](https://skmtc.dev/kernelscan/apis/kernelscan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kernelscan/apis/kernelscan-api/revisions/4fa51d41484e?raw)