---
title: "The account owner's allow / deny"
method: POST
path: "/oauth/consent"
tags: ["OAuth / MCP"]
---

# The account owner's allow / deny

`POST /oauth/consent`

## Request

- Base URL: `https://whatareyoudo.ing/api/v1`
- URL: `https://whatareyoudo.ing/api/v1/oauth/consent`
- Auth: HTTP bearer

Answers with the URL to send the browser to: the client's redirect URI with a code (allow) or `error=access_denied` (deny), plus `state` and `iss`. 422 with `details.reason = token_limit` when the account already holds the maximum number of access tokens.

## Request body

- object
  - `params` object, required
  - `approve` boolean, required

## Response `200`

OK

- object
  - `data` OAuthConsentRedirect, required
    - `redirectTo` string, required
  - `meta` object, required
    - `requestId` string, required

## Other responses

- `403`: The caller is an access token
- `422`: Invalid request, or the per-account token limit is reached

---

[API](https://skmtc.dev/whatareyoudo/apis/whatcha-api.md) · [All operations](https://skmtc.dev/whatareyoudo/apis/whatcha-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whatareyoudo/apis/whatcha-api/revisions/48dd8a54abea?raw)