---
title: "Accept OAuth 2.0 Consent Request"
method: PUT
path: "/admin/oauth2/auth/requests/consent/accept"
tags: ["oAuth2"]
---

# Accept OAuth 2.0 Consent Request

`PUT /admin/oauth2/auth/requests/consent/accept`

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider
to authenticate the subject and then tell Ory now about it. If the subject authenticated, he/she must now be asked if
the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent
provider uses that challenge to fetch information on the OAuth2 request and then tells Ory if the subject accepted
or rejected the request.

This endpoint tells Ory that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf.
The consent provider includes additional information, such as session data for access and ID tokens, and if the
consent request should be used as basis for future requests.

The response contains a redirect URL which the consent provider should redirect the user-agent to.

The default consent provider is available via the Ory Managed Account Experience. To customize the consent provider, please
head over to the OAuth 2.0 documentation.

## Query parameters

- `consent_challenge` string, required

## Request body

- AcceptOAuth2ConsentRequest
  - `context` unknown
  - `grant_access_token_audience` string[]
  - `grant_scope` string[]
  - `remember` boolean — Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope.
  - `remember_for` integer — RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the authorization will be remembered indefinitely.
  - `session` AcceptOAuth2ConsentRequestSession
    - `access_token` unknown
    - `id_token` unknown

## Response `200`

oAuth2RedirectTo

- OAuth2RedirectTo — Contains a redirect URL used to complete a login, consent, or logout request.
  - `redirect_to` string, required — RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed.

## Other responses

- `default` — errorOAuth2

## Changes

> 15 revisions in range; 1 could not be searched.

- **2025-11-07** `f270bd3c7f35` — 1 warning
  - removed the request property `handled_at`
- **2024-02-12** `02c4930b8c92` — 1 info
  - added the new optional request property `context`
- **2022-10-27** `4505403da8d7` — 1 info
  - endpoint added
- **2022-02-16** `82d233540486` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/ory/apis/ory-hydra-api/changes/admin/oauth2/auth/requests/consent/accept/put.md)

---

[API](https://skmtc.dev/ory/apis/ory-hydra-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-hydra-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-hydra-api/revisions/ab053e716585/schema)