---
title: "Browser consent decision"
method: POST
path: "/api/oauth/consent"
tags: ["OAuth"]
---

# Browser consent decision

`POST /api/oauth/consent`

## Request

- Base URL: `https://xn--s7y.xn--3ds443g`
- URL: `https://xn--s7y.xn--3ds443g/api/oauth/consent`
- Auth: API key in cookie `duan_session`

Session-cookie endpoint the connect page calls after sign-in. Requires a same-origin Origin (CSRF). JSON body `{txn, decision}` where decision is `allow` or `deny`. Returns `{redirect}` for the browser to follow. This is not a redirect response and not a token endpoint. Requires the `duan_session` cookie. An API key or OAuth access token does not replace it.

## Request body

- object
  - `txn` string, required
  - `decision` 'allow' | 'deny', required

## Response `200`

Browser navigation target

- object
  - `redirect` string, required

## Other responses

- `400`: invalid_json, invalid_request, or invalid_txn
- `401`: auth_required
- `403`: csrf_rejected

---

[API](https://skmtc.dev/xn--s7y/apis/agent-api.md) · [All operations](https://skmtc.dev/xn--s7y/apis/agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xn--s7y/apis/agent-api/revisions/d902f68518e9?raw)