Skip to main content

Allow or deny an authorization request

POST 
/oauth/authorization

The admin's answer (§5.2). Re-runs every check of the read, then:

  • deny → {redirect_to} carrying error=access_denied, your state and iss;
  • allow → for the chosen workspace_id, the person's admin membership and integrations.manage are judged as that workspace's member, distribution is checked (private: the publisher's home workspace; test: home or a registered test workspace; public: anywhere while listed, or where it is already installed), and the grant is made in one transaction: required scopes plus the optional ones ticked in optional_scopes[], the install created (or upgraded — that is re-consent), its own ingest source, its managed webhook subscription, and a one-time kac_… code (10 minutes) in redirect_to.

The page follows redirect_to only when it is an absolute http(s) URL. Per-workspace refusals are 403 with workspace_suspended, not_available, module_disabled, permission_denied or already_installed (active, on this version, no re-consent pending, every requested scope already answered and every required one held — so an install missing a required scope it declined while it was optional can consent again); 404 workspace_not_found.

A cookie session, no impersonation, the CSRF token, and an Origin that is exactly the app's own (403 invalid_origin otherwise). Throttle: oauth/consent/minute, 30 a minute per session.

Request​

Responses​

Where to send the browser — back to the app, with a code or access_denied.