---
title: "Entra Callback"
method: GET
path: "/v1/auth/entra/callback"
tags: ["auth"]
---

# Entra Callback

`GET /v1/auth/entra/callback`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/auth/entra/callback`
- Auth: none declared

Exchange the code, issue the session, and hand tokens to the dashboard.

One callback path serves two purposes, dispatched by the VERIFIED contents of the signed state,
exactly as the Slack callback does. Sharing the path is deliberate: a second callback would need
a second ``redirect_uri``, which is a change to the live Entra app registration.

The connect-redemption purpose is checked first and is a strictly separate branch — it never
reaches ``service.complete`` and therefore never reaches ``AuthService.login_with_identity``,
which creates a ``User`` and activates a pending membership. Proving who asked for a connect link
must do neither.

## Query parameters

- `code` string, nullable
- `state` string, nullable
- `error` string, nullable

## Other responses

- `307`: Successful Response
- `422`: Validation Error
- `503`: Fixed temporary member-connect page after requester proof; the link was not spent.

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)