---
title: "Accept OAuth 2.0 Consent Request"
method: PUT
path: "/admin/oauth2/auth/requests/consent/accept"
tags: ["oAuth2"]
---

# Accept OAuth 2.0 Consent Request

`PUT /admin/oauth2/auth/requests/consent/accept`

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider
to authenticate the subject and then tell Ory now about it. If the subject authenticated, he/she must now be asked if
the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent
provider uses that challenge to fetch information on the OAuth2 request and then tells Ory if the subject accepted
or rejected the request.

This endpoint tells Ory that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf.
The consent provider includes additional information, such as session data for access and ID tokens, and if the
consent request should be used as basis for future requests.

The response contains a redirect URL which the consent provider should redirect the user-agent to.

The default consent provider is available via the Ory Managed Account Experience. To customize the consent provider, please
head over to the OAuth 2.0 documentation.

## Query parameters

- `consent_challenge` string, required

## Request body

- AcceptOAuth2ConsentRequest
  - `context` JSONRawMessage
  - `grant_access_token_audience` string[] — GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`.
  - `grant_scope` string[] — GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`.
  - `remember` boolean — Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope.
  - `remember_for` integer — RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the authorization will be remembered indefinitely.
  - `session` AcceptOAuth2ConsentRequestSession
    - `access_token` object — AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0 Challenge Introspection. If only your services can perform OAuth 2.0 Challenge Introspection, this is usually fine. But if third parties can access that endpoint as well, sensitive data from the session might be exposed to them. Use with care!
    - `id_token` object — IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session'id payloads are readable by anyone that has access to the ID Challenge. Use with care!

## Response `200`

oAuth2RedirectTo

- OAuth2RedirectTo — Contains a redirect URL used to complete a login, consent, or logout request.
  - `redirect_to` string, required — RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed.

## Other responses

- `default` — errorOAuth2

---

[API](https://skmtc.dev/ory/apis/ory-hydra.md) · [All operations](https://skmtc.dev/ory/apis/ory-hydra/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-hydra/revisions/a302a90a0e8a/schema)