---
title: "Complete Google consent"
method: POST
path: "/v1/cloud-google-authorizations/{id}/authorize"
tags: ["Cloud observation"]
---

# Complete Google consent

`POST /v1/cloud-google-authorizations/{id}/authorize`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/v1/cloud-google-authorizations/{id}/authorize`
- Auth: HTTP bearer

Called by the hosted Nodus console after its /clouds/google/callback/ page returns state and code through the same-origin browser handoff described by startGoogleCloudAuthorization. Requires the same current team administrator who started consent. Exchanges the one-use code with server-held PKCE. State, current administrator and tenant must match the starting authorization. Replays are rejected. The temporary administrator token is encrypted and never returned.

## Path parameters

- `id` string, required

## Request body

- object
  - `state` string, required
  - `code` string, required

## Response `200`

Complete Google consent

- GoogleCloudAuthorizationResponse
  - `authorization` GoogleCloudAuthorization, required: Temporary setup authorization owned by the consenting team administrator. No Google tokens or private federation configuration are returned.
    - `id` string, required
    - `state` 'consent' | 'exchanging' | 'authorized' | 'connecting' | 'completed' | 'cancelled', required
    - `expires_at` string, date-time, required
    - `session_id` string
    - `step` integer, required
    - `billing_status` 'not_requested' | 'preparing' | 'ready' | 'needs_setup', required
  - `authorization_url` string, uri
  - `projects` GoogleCloudProject[]
    - `id` string, required
    - `name` string, required
  - `next_page_token` string
  - `message` string
  - `session` CloudOnboardingSession: Setup expires after 24 hours. Expired pending records remain readable with their original expiry and cannot complete. Only unexpired pending records appear in the active list.
    - `id` string, required: Opaque server-generated setup identity.
    - `provider` 'aws' | 'gcp', required
    - `name` string, required
    - `regions` string[], required: AWS enabled account regions when empty. Always an array and empty for Google Cloud.
    - `role_name` string, required: Prepared AWS role name. Empty for Google Cloud.
    - `state` 'pending' | 'completed' | 'cancelled', required
    - `expires_at` string, date-time, required
    - `connection_id` string: Present after completion. A later disconnect does not remove this completion receipt.
    - `revision` integer, required
    - `created_at` string, date-time, required
    - `project_id` string: Google Cloud project ID. Required for GCP and omitted for AWS.
    - `billing_location` 'US' | 'EU': Location of the dedicated Google Cloud billing dataset. Defaults to US for GCP and is omitted for AWS.
    - `project_number` string: Google Cloud project number verified for this connection.
  - `connection` CloudObservationConnection
    - `id` string, required
    - `provider` 'aws' | 'gcp' | 'azure', required
    - `scope` string, required
    - `config` CloudObservationConfig, required: Account identity and read scope. Fields depend on the provider. Credentials are never returned.
      - `provider` 'aws' | 'gcp' | 'azure', required
      - `name` string, required
      - `role_arn` string
      - `project_id` string
      - `billing_table` string
      - `billing_location` string
      - `billing_scope` string
      - `directory_id` string
      - `subscription_id` string
      - `client_id` string
      - `regions` string[]
    - `state` 'pending' | 'collecting' | 'ready' | 'partial' | 'error', required
    - `last_attempt_at` string, date-time, nullable, required
    - `last_success_at` string, date-time, nullable, required
    - `created_at` string, date-time, required
  - `next_action` CloudOnboardingAction
    - `type` 'open_provider' | 'unavailable' | 'expired' | 'completed' | 'cancelled', required
    - `url` string, uri: Prepared AWS CloudFormation approval or Google Cloud Shell URL, present for open_provider.
    - `message` string: Explanation when guided setup is unavailable.
    - `setup_command` string: Reviewable Google Cloud Shell setup command. Present only for pending GCP setup. Does not contain credentials.

## Other responses

- `default`: Stable Nodus error and message fields.

---

[API](https://skmtc.dev/nodus-compute/apis/nodus-infrastructure-execution-api.md) - [All operations](https://skmtc.dev/nodus-compute/apis/nodus-infrastructure-execution-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nodus-compute/apis/nodus-infrastructure-execution-api/revisions/a59210899d95?raw)