---
title: "OAuth 2.1 authorization endpoint"
method: GET
path: "/oauth2/authorize"
tags: ["OAuth"]
---

# OAuth 2.1 authorization endpoint

`GET /oauth2/authorize`

## Request

- Base URL: `https://api.uptimemonitoring.com`
- URL: `https://api.uptimemonitoring.com/oauth2/authorize`
- Auth: none required

Initiates the authorization-code flow (PKCE S256 mandatory). When
the user has no active dispatcher session, redirects to the sign-in
page — `OAUTH_LOGIN_URL` when the operator has set it (with
`return_to=<finalize>` appended to that URL's own query), else the
pre-#315 GitHub-only bridge (`/oauth/github/login?return_to=...`) —
and resumes via `/oauth2/authorize/finalize` after the bridge
completes (by GitHub callback or, when `OAUTH_LOGIN_URL` points at
a page offering it, email sign-in). On success, redirects the
browser to `redirect_uri` with `code` and echoed `state`.

## Query parameters

- `client_id` string, required
- `redirect_uri` string, uri, required
- `response_type` 'code', required
- `code_challenge` string, required
- `code_challenge_method` 'S256', required
- `scope` string
- `state` string

## Response `200`

Reserved. The endpoint always redirects (302) or errors (400);
no 200 body is returned in normal operation.

## Other responses

- `302`: Redirect to GitHub login or to `redirect_uri` with code/error.
- `400`: Invalid request (missing or invalid params).

---

[API](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api.md) · [All operations](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/revisions/ddcb2a8bc70f?raw)