---
title: "Load a pending request"
method: GET
path: "/api/oauth/requests/{id}"
tags: ["OAuth"]
---

# Load a pending request

`GET /api/oauth/requests/{id}`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/api/oauth/requests/{id}`
- Auth: `sessionCookie` (a scheme the document does not define)

First-party, session-authenticated: what the consent screen renders. Returns the client's
name, the literal host the code will be sent to, and one plain-language sentence per scope,
because "codes:write" has not obtained informed consent from a restaurant owner whose printed
menus are at stake.

Answers `404` — never `403`, and never a description — for an unknown, expired or already
decided request, so a signed-in stranger cannot probe which requests exist.

## Path parameters

- `id` string, required

## Response `200`

The consent view.

- object
  - `requestId` string, required
  - `clientName` string, required: Attacker-supplied text. Control characters are stripped and the length capped; it is rendered as text next to the literal redirect host.
  - `clientUri` string, uri, nullable
  - `redirectHost` string, required
  - `policyUri` string, uri, nullable
  - `tosUri` string, uri, nullable
  - `workspaceName` string
  - `scopes` object[], required
    - `id` 'codes:read' | 'codes:write' | 'analytics:read' | 'pages:write': `codes:write` is the dangerous one — it can repoint a code that is already printed on physical media. Grant it only to a service you control. `pages:write` is reserved; hosted pages are not enabled on this deployment.
    - `description` string
    - `consequential` boolean: True for scopes that can change something already printed.

## Other responses

- `401`: No valid session
- `404`: Resource absent or belongs to another workspace

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)