---
title: "Start a connect: store the window's state, answer the provider's consent page"
method: POST
path: "/v1/calendar/connect"
tags: ["calendar"]
---

# Start a connect: store the window's state, answer the provider's consent page

`POST /v1/calendar/connect`

## Request

- Base URL: `https://api.sixminute.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sixminute.ai/v1/calendar/connect`
- Auth: HTTP bearer

The window made the state and the PKCE verifier and keeps them; this seals the state, the caller and the S256 challenge into `state_token`, good for ten minutes, which the window keeps and hands back with the finish, and answers the consent page with the hosted redirect page of this deploy's page as `redirect_uri`. The state is also stored for ten minutes, for a page that finishes without the token. 409 while the caller has a connected account.

## Request body

- object
  - `provider` 'microsoft' | 'google', required
  - `state` string, required
  - `code_challenge` string, required

## Response `200`

The consent page.

- object
  - `authorize_url` string, uri, required
  - `state_token` string

## Other responses

- `400`: The body, query or path did not validate; `errors` lists the fields.
- `401`: No bearer token, or one that does not verify or has expired.
- `403`: The token verified but may not do this: no organisation, not provisioned, wrong role, or a device problem.
- `409`: The id or the email already belongs to something else.
- `503`: A capability this service was not configured with, or a practice system that could not be reached; the `type` says which.

---

[API](https://skmtc.dev/sixminute/apis/sixminute-api.md) - [All operations](https://skmtc.dev/sixminute/apis/sixminute-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sixminute/apis/sixminute-api/revisions/605577eadc10?raw)