---
title: "Approve one registered OAuth client and reviewed scopes as the current workspace owner."
method: POST
path: "/v1/browser/oauth-grants"
---

# Approve one registered OAuth client and reviewed scopes as the current workspace owner.

`POST /v1/browser/oauth-grants`

## Request

- Base URL: `http://127.0.0.1:8080`
- URL: `http://127.0.0.1:8080/v1/browser/oauth-grants`
- Auth: HTTP bearer

This explicit browser action creates a maximum 30-day internal grant. No automatic first-use grant exists.

## Headers

- `X-Likerts-Workspace` string, required

## Request body

- BrowserOAuthApprovalInput
  - `clientId` string, required
  - `scopes` string[], required

## Response `201`

Grant created.

- OAuthGrant
  - `id` string, uuid, required
  - `workspaceId` string, required
  - `subject` string, required
  - `clientId` string, required
  - `audience` string, required
  - `scopes` OAuthScope[], required
  - `expiresAt` string, date-time, required
  - `revoked` boolean, required

## Other responses

- `400`: Invalid input, resource identifier or workspace selection.
- `401`: Unauthorized.
- `403`: The credential scope, membership or role does not permit this operation.
- `413`: JSON request body exceeds 65536 bytes.
- `415`: Content-Type must be application/json.
- `429`: Admission or collection rate limit reached. Honor Retry-After in seconds; admission usually returns1, the collection minute window returns60.
- `500`: Internal failure; do not assume a write failed. Retry only with its original idempotency key and payload.
- `503`: Distributed request admission is temporarily unavailable. No protected handler ran; honor Retry-After.

---

[API](https://skmtc.dev/likerts/apis/likerts-development-api.md) · [All operations](https://skmtc.dev/likerts/apis/likerts-development-api/llms.txt) · [OpenAPI document](https://skmtc.dev/likerts/apis/likerts-development-api/revisions/c583fa096c07?raw)