---
title: "Record an approved consent and mint the authorization code"
method: POST
path: "/oauth/authorize/decision"
tags: ["OAuth"]
---

# Record an approved consent and mint the authorization code

`POST /oauth/authorize/decision`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/oauth/authorize/decision`
- Auth: `bearer` (a scheme the document does not define)

Session-only (API tokens are rejected). The active account — the standard x-account-id header — is the account the connector will act on.

## Request body

- OAuthDecisionDto
  - `clientId` string, uuid, required: client_id from the authorize request
  - `redirectUri` string, required: redirect_uri from the authorize request
  - `state` string: Opaque state relayed back to the client
  - `codeChallenge` string, required: PKCE S256 code_challenge from the authorize request
  - `accountId` string, uuid: Workspace to bind the grant to. Must be one the caller belongs to; omitted, the active account (x-account-id) is used. Lets the consent page's in-card picker choose a workspace without mutating the ambient web-session selection.
  - `scopes` string[], required: Scopes the user approved (unknown values are ignored; sites:read is always included)

## Response `200`

- APIOAuthDecisionResponse
  - `redirectTo` string, required: Where the consent page must send the browser (carries the code + state)

## Other responses

- `401`: Not authenticated

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)