---
title: "Get Client For Consent"
method: GET
path: "/api/internal/oauth/client/{client_id}"
tags: ["Internal OAuth", "Internal OAuth"]
---

# Get Client For Consent

`GET /api/internal/oauth/client/{client_id}`

## Request

- Base URL: `https://api.thebetterhire.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.thebetterhire.ai/api/internal/oauth/client/{client_id}`
- Auth: none declared

Resolve a client so the consent page can name who is asking.

The consent page only ever sees a client_id in its query string, so the
name and redirect must be resolved here, server-side, against the row we
actually registered — anything carried in the URL is attacker-supplied.

`trusted` is computed from the redirect HOST, never from client_name:
/register is open (MCP spec) and stores whatever name the caller sends,
so an attacker can register as "Claude". See OAUTH_CONFIG.

## Path parameters

- `client_id` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/thebetterhire/apis/interanalysis-b2b-api.md) · [All operations](https://skmtc.dev/thebetterhire/apis/interanalysis-b2b-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thebetterhire/apis/interanalysis-b2b-api/revisions/c8ad03e900ea?raw)