---
title: "Grant the access request"
method: POST
path: "/zephr/oauth2/grant"
tags: ["Third-Party Authentication"]
---

# Grant the access request

`POST /zephr/oauth2/grant`

## Request

- Base URL: `https://demo-site`
- URL: `https://demo-site/zephr/oauth2/grant`
- Auth: one of:
  - API key in cookie `blaize_session`
  - API key in query parameter `jwt`
  - API key in header `x-blaize-jwt`
  - API key in header `x-zephr-jwt`
  - HTTP bearer
  - API key in cookie `blaize_jwt`

The resource owner will consent or deny the third party application access request, and Zephr will return an authorization code upon user's consent.

## Request body

- Oauth2RequestBody
  - `client_id` string, required: Zephr Site Oauth2 Client ID
  - `response_type` string, required: Must be set to `code`
  - `redirect_uri` string, required: Client's redirection endpoint. Must be an absolute URI
  - `scope` string, required: The scope of the access request. Supported scopes: user.account:read, user.profile:read and user.profile:update
  - `state` string, required: An opaque value used by the client to maintain state between the request and callback
  - `allow` boolean, required: Resource owner consent

## Response `200`

OK. The template variable "BASICAUTH" is set as the authorization header of "$CLIENTID" and "$CLIENTSECRET". The template variable "AUTHCODE" is set to the response body "code" field.

- object
  - `state` string: State (string)
  - `code` string: Authorization code (string)

## Other responses

- `401`: Unauthorized

---

[API](https://skmtc.dev/zuora/apis/zuora-2.md) - [All operations](https://skmtc.dev/zuora/apis/zuora-2/llms.txt) - [OpenAPI document](https://skmtc.dev/zuora/apis/zuora-2/revisions/678190d04c40?raw)