---
title: "Thumbtack Oauth Callback"
method: GET
path: "/integrations/thumbtack/callback"
tags: ["integrations"]
---

# Thumbtack Oauth Callback

`GET /integrations/thumbtack/callback`

## Request

- Base URL: `https://api-docs.upsmith.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api-docs.upsmith.com/integrations/thumbtack/callback`
- Auth: none declared

Exchange the authorization code for tokens and finalise the connection.

Always returns a 303 redirect back to the frontend integrations page — the
frontend reads `?thumbtack=connected` or `?thumbtack=error&reason=...` to
drive the post-OAuth UX.

When the user denies consent, Thumbtack's Hydra omits `code`/`state` and
sends `?error=access_denied` instead (per OAuth 2.0). Both `code` and
`state` must therefore be optional so FastAPI doesn't 422 before we get a
chance to redirect the browser back with a friendly message.

## Query parameters

- `code` string, nullable: Authorization code (absent when user denies consent)
- `state` string, nullable: Signed state token originally issued by initiate_thumbtack_oauth
- `error` string, nullable: OAuth 2.0 error code (RFC 6749 §4.1.2.1)
- `error_description` string, nullable: Human-readable error description

## Headers

- `timezone` string
- `x-user-id` string, nullable
- `x-actor-email` string, nullable
- `x-request-source` string, nullable
- `x-operation-id` string, nullable
- `x-commit-message` string, nullable
- `x-confirmation-id` string, nullable
- `x-chat-id` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/upsmith/apis/upsmith-api.md) - [All operations](https://skmtc.dev/upsmith/apis/upsmith-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upsmith/apis/upsmith-api/revisions/cce8b07a5787?raw)