OAuth

Record an approved consent and mint the authorization code

Session-only (API tokens are rejected). The active account — the standard x-account-id header — is the account the connector will act on.

post/oauth/authorize/decision

Request

  • Base URL: https://api.nippy.host
  • URL: https://api.nippy.host/oauth/authorize/decision
  • Auth: bearer (a scheme the document does not define)

Request body

clientIdstring uuid required

client_id from the authorize request

redirectUristring required

redirect_uri from the authorize request

statestring

Opaque state relayed back to the client

codeChallengestring required

PKCE S256 code_challenge from the authorize request

accountIdstring uuid

Workspace to bind the grant to. Must be one the caller belongs to; omitted, the active account (x-account-id) is used. Lets the consent page's in-card picker choose a workspace without mutating the ambient web-session selection.

scopesstring[] required

Scopes the user approved (unknown values are ignored; sites:read is always included)

Response

redirectTostring required

Where the consent page must send the browser (carries the code + state)

Changes

No recorded changes to this operation across all 1 revision of this API.