---
title: "Ms365 Callback"
method: POST
path: "/v1/auth/ms365/callback"
tags: ["auth"]
---

# Ms365 Callback

`POST /v1/auth/ms365/callback`

## Request

- Base URL: `https://app.tokumalabs.com/api`
- URL: `https://app.tokumalabs.com/api/v1/auth/ms365/callback`
- Auth: none declared. Required headers: `x-device-id`

Handle MS365 OAuth callback and exchange code for Tokuma JWT tokens.

## Headers

- `x-device-id` string, required
- `x-device-name` string, nullable
- `x-platform` string, nullable
- `x-app-version` string, nullable

## Request body

- MS365CallbackRequest
  - `code` string, required: Authorization code from Microsoft
  - `state` string, required: OAuth state parameter received from Microsoft
  - `code_verifier` string, required: PKCE code verifier (original random string)
  - `redirect_uri` string, required: Same redirect URI used in initiate request

## Response `200`

Successful Response

- TokenResponse
  - `access_token` string, required: JWT access token
  - `token_type` string: Token type
  - `expires_in_seconds` integer, required: Token expiration time in seconds
  - `scope` string: OAuth2 scopes

## Other responses

- `400`: Validation error or domain rule violation.
- `401`: Missing, expired, or invalid authentication.
- `403`: Authenticated but not permitted.
- `404`: Resource not found.
- `409`: Resource state conflict (duplicate, illegal transition).
- `422`: Request body failed schema validation.
- `500`: Server-side failure.

---

[API](https://skmtc.dev/tokumalabs/apis/tokuma-user-api.md) - [All operations](https://skmtc.dev/tokumalabs/apis/tokuma-user-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tokumalabs/apis/tokuma-user-api/revisions/1f8201af459b?raw)