---
title: "Authorize Context"
method: GET
path: "/oauth/authorize/context"
tags: ["oauth"]
---

# Authorize Context

`GET /oauth/authorize/context`

## Request

- Base URL: `https://app.zeno-works.ch` (the document declares no server; this is the origin it was published from)
- URL: `https://app.zeno-works.ch/oauth/authorize/context`
- Auth: none declared

What the consent page renders. **Read-only** — consenting is the POST.

Session-gated: the page needs to know which companies *this* user may grant, and there
is no answer to that before they have signed in. Everything the request asserts is
validated here rather than at decision time, so a malformed authorization fails before
a human is asked to approve anything.

## Query parameters

- `client_id` string, required
- `redirect_uri` string, required
- `code_challenge` string, required
- `resource` string, required
- `code_challenge_method` string
- `scope` string

## Headers

- `authorization` string, nullable

## Cookies

- `access_token` string, nullable

## Response `200`

Successful Response

- AuthorizeContextOut: What the consent page renders. **Everything here is untrusted except the scopes.** ``client_name`` is self-asserted under both CIMD and DCR; ``client_origin`` is the origin of the ``client_id`` URL, which for a CIMD client is the one identity signal a human can actually check. The page must lead with the origin and mark the name as a claim — see the phishing note in `services/oauth`.
  - `request_id` string, required
  - `client_name` string, required
  - `client_origin` string, nullable, required
  - `registration` string, required
  - `scope` string, required
  - `companies` AuthorizeCompanyOut[], required
    - `id` string, required
    - `company_name` string, required
  - `onboarding_only` boolean, required
  - `choose_company` boolean, required
  - `redirect_host` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/zeno-works/apis/zeno-api.md) · [All operations](https://skmtc.dev/zeno-works/apis/zeno-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zeno-works/apis/zeno-api/revisions/1eb93dde146c?raw)