---
title: "Approve or decline"
method: POST
path: "/api/oauth/requests/{id}/decision"
tags: ["OAuth"]
---

# Approve or decline

`POST /api/oauth/requests/{id}/decision`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/api/oauth/requests/{id}/decision`
- Auth: `sessionCookie` (a scheme the document does not define)

The workspace and user come from the **session**, never from the request body. That is what
makes it impossible for a client to obtain a grant on an account other than the one whose
owner is looking at the screen.

Approval mints a single-use authorization code and returns the URL for the browser to follow;
declining returns the same URL carrying `access_denied`. A declined request is spent, so
re-opening the consent URL cannot resume it.

## Path parameters

- `id` string, required

## Request body

- object
  - `decision` 'approve' | 'deny', required

## Response `200`

Where to send the browser.

- object
  - `redirectTo` string, uri, required

## Other responses

- `401`: No valid session
- `404`: Resource absent or belongs to another workspace

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)