---
title: "Authorization endpoint (start the auth-code flow)."
method: GET
path: "/api/oauth/authorize"
tags: ["OAuth"]
---

# Authorization endpoint (start the auth-code flow).

`GET /api/oauth/authorize`

## Request

- Base URL: `https://app.tracepass.eu`
- URL: `https://app.tracepass.eu/api/oauth/authorize`
- Auth: none required

RFC 6749 §4.1.1. Validates the request, then redirects the
logged-in user to the consent screen; on approval the browser
is redirected back to `redirect_uri` with a single-use `code`.
PKCE is mandatory (`code_challenge_method=S256`). An unknown
client or unregistered `redirect_uri` returns 400 (no redirect);
other parameter errors redirect back with `?error=`.

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string, uri, required
- `scope` string
- `state` string
- `code_challenge` string, required
- `code_challenge_method` 'S256', required

## Other responses

- `302`: Redirect to the consent screen, or back to the client with code / error.
- `400`: Unknown client or unregistered redirect_uri.

---

[API](https://skmtc.dev/tracepass/apis/tracepass-api.md) · [All operations](https://skmtc.dev/tracepass/apis/tracepass-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tracepass/apis/tracepass-api/revisions/60ddeb25638b?raw)