oauth

Authorize Decision

The human's act: approve or refuse. This is where a credential becomes possible.

SessionUser and deny_company_scoped_key, exactly as SP-21's approve route: the session-only invariant — a leaked key cannot mint another — has to hold here too, and in this codebase "session" is not a property of a route (current_user authenticates an X-API-Key caller identically). The password re-verify is a third layer and the one that makes zeno:full issuable at all (owner decision O-1): it is a higher bar than the UI's own full-key mint, which needs only a live session.

post/oauth/decision

Request

  • Base URL: https://app.zeno-works.ch (the document declares no server; this is the origin it was published from)
  • URL: https://app.zeno-works.ch/oauth/decision
  • Auth: none declared

Headers

authorizationstring nullable

Cookies

access_tokenstring nullable

Request body

request_idstring required
approveboolean required
scopestring required
passwordstring
company_idstring nullable
acknowledge_fullboolean

Response

Successful Response

redirect_tostring required

Changes

No recorded changes to this operation across all 1 revision of this API.