---
title: "Authorize Decision"
method: POST
path: "/oauth/decision"
tags: ["oauth"]
---

# Authorize Decision

`POST /oauth/decision`

## Request

- Base URL: `https://app.zeno-works.ch` (the document declares no server; this is the origin it was published from)
- URL: `https://app.zeno-works.ch/oauth/decision`
- Auth: none declared

The human's act: approve or refuse. **This is where a credential becomes possible.**

``SessionUser`` and ``deny_company_scoped_key``, exactly as SP-21's approve route: the
session-only invariant — a leaked key cannot mint another — has to hold here too, and
in this codebase "session" is not a property of a route (``current_user`` authenticates
an ``X-API-Key`` caller identically). The password re-verify is a *third* layer and the
one that makes ``zeno:full`` issuable at all (owner decision O-1): it is a higher bar
than the UI's own full-key mint, which needs only a live session.

## Headers

- `authorization` string, nullable

## Cookies

- `access_token` string, nullable

## Request body

- AuthorizeDecisionIn: The consent submission. ``password`` is re-verified rather than the session being trusted, for the reason SP-21's approve route documents: the access token carries no ``auth_time`` and refresh mints fresh ones indefinitely, so "recently logged in" cannot be established from a token at all. Asking is the only honest test — and it is the bar that makes ``full`` issuable here at all (owner decision O-1).
  - `request_id` string, required
  - `approve` boolean, required
  - `scope` string, required
  - `password` string
  - `company_id` string, nullable
  - `acknowledge_full` boolean

## Response `200`

Successful Response

- AuthorizeDecisionOut: Where to send the browser next. Never a redirect the server performs itself: the SPA owns navigation, and a 302 out of an XHR is invisible to it.
  - `redirect_to` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/zeno-works/apis/zeno-api.md) · [All operations](https://skmtc.dev/zeno-works/apis/zeno-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zeno-works/apis/zeno-api/revisions/1eb93dde146c?raw)