---
title: "Approve or deny a resource grant on the hosted sign-in page"
method: POST
path: "/products/identity/{account_id}/consent"
tags: ["identity"]
---

# Approve or deny a resource grant on the hosted sign-in page

`POST /products/identity/{account_id}/consent`

## Request

- Base URL: `https://api.sparkvault.com/v1`
- URL: `https://api.sparkvault.com/v1/products/identity/{account_id}/consent`
- Auth: API key in cookie `__Host-authsv_sso`
- TypeScript: <https://skmtc.dev/sparkvault/apis/sparkvault-api/docs/products/identity/:account_id/consent/post.ts> (a function with typed inputs; its response is checked against the schema)

Requires the Identity origin, the browser hub cookie, a signed pending authorization request, and its selected identity. The decision spends the request in one conditioned write that records it, then redirects with code or access_denied, state and issuer; an approval the account cannot be read for redirects with server_error and spends the request too. The same decision for the same identity, submitted again while the request lives (a double click on the page), is answered with the same redirect once the code it carries is issued, and issues nothing more; any other decision of a decided request is refused. Resource grants always require an explicit decision, including after SSO. The page is a native form, so every refusal is a page in the browser window, never a JSON error.

## Path parameters

- `account_id` string, required

## Request body `application/x-www-form-urlencoded`

- object
  - `auth_request` string, required
  - `svid` string, required
  - `decision` 'approve' | 'deny', required

## Other responses

- `303`: Return to the validated client callback.
- `400`: A page saying why: a malformed form, or a request that can no longer be decided (it lapsed, it was answered otherwise, or the approval a repeat names issued no code).
- `401`: A page saying why: a submission from another origin, or a browser that no longer proves the selected identity.
- `500`: The sign-in fault page.

## Changes

- **2026-10-28** `97cfadccd0c0`: 2 breaking, 3 info
  - removed the media type `application/json` for the response with the status `400`
  - removed the media type `application/json` for the response with the status `401`
  - added the media type `text/html` for the response with the status `400`
  - added the media type `text/html` for the response with the status `401`
  - …1 more
- **2026-10-28** `a9a10e328ba5`: 8 info
  - the response property `error/details` became required for the status `400`
  - the response property `error/details` became required for the status `401`
  - the response property `meta` became required for the status `400`
  - the response property `meta` became required for the status `401`
  - …4 more
- **2026-10-28** `56d7c265a77a`: 2 breaking
  - the response property `error/details` became nullable for the status `400`
  - the response property `error/details` became nullable for the status `401`
- **2026-10-26** `f84ee4518b07`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/sparkvault/apis/sparkvault-api/changes/products/identity/:account_id/consent/post.md)

---

[API](https://skmtc.dev/sparkvault/apis/sparkvault-api.md) - [All operations](https://skmtc.dev/sparkvault/apis/sparkvault-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sparkvault/apis/sparkvault-api/revisions/97cfadccd0c0?raw)