---
title: "POST authorization.denied"
method: POST
path: "authorization.denied"
---

# POST authorization.denied

`POST authorization.denied` (webhook)

Fired when the recipient of a consent request (an authorization) taps Deny.

## Payload

- AuthorizationWebhookPayload: Body of `authorization.approved` / `authorization.denied` — the recipient's answer to a consent request. The recipient's phone/identifier is not included; join on `authorization_id`.
  - `event` 'authorization.approved' | 'authorization.denied', required: The event type — the same value as the `X-Proof-Event` header
  - `authorization_id` string, required: MongoDB ObjectId
  - `hitl_id` string: HITL configuration the consent was asked for
  - `status` 'active' | 'denied', required: `active` when the recipient allowed, `denied` when they refused
  - `channel` 'whatsapp' | 'telegram' | 'sms' | 'email', required: Channel authorized for sending confirmations
  - `scope` 'confirmations' | 'identity_challenge': Scope of the authorization. `identity_challenge` is the Proof of Me scope.
  - `proof_token` string: Signed proof of the recipient's decision (its `decision` claim is `approve` or `deny`)
  - `decided_at` string, date-time: When the recipient answered
  - `expires_at` string, date-time: When the authorization expires

## Acknowledgement `200`

Webhook received

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/b15f506de696?raw)