---
title: "Approve or deny an authorization transaction"
method: POST
path: "/oauth/partner/transaction/consent"
tags: ["partner-oauth"]
---

# Approve or deny an authorization transaction

`POST /oauth/partner/transaction/consent`

Returns the absolute URL the browser must be sent to. The redirect target is always built from the server-side transaction record.

## Request body

- object
  - `approved_scopes` string[] — Optional. The subset of the requested scopes the patient chose to share. Intersected server-side with what the partner requested and the client is registered for, so it can only narrow. Omit to approve everything requested; selecting none is rejected (deny instead).
  - `decision` 'approve' | 'deny', required
  - `locale` string
  - `transaction_id` string, required

## Response `200`

Decision recorded

- object
  - `decision` 'approve' | 'deny'
  - `redirect_to` string

## Other responses

- `400` — invalid_decision
- `401` — authentication_required
- `403` — client_unavailable / scope_unavailable / patient_unavailable / patient_not_eligible
- `404` — transaction_invalid

---

[API](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server.md) · [All operations](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/llms.txt) · [OpenAPI document](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/revisions/a61b77b30e63?raw)