Answer a version that asks for more

POST 
/app_installs/:id/reconsent

Re-consent happens inside KudosCRM, never through a Kudos-built authorize URL. A release asks an install when the new version requests a scope the install never answered, or requires one it does not hold (one it declined while it was optional included). Until an admin answers, the app keeps its version and grant; its subscription already takes the new version's events, filtered by that grant, and still delivers to the webhook URL the admin agreed to.

allow: the install moves to the pending version with its required scopes plus the optional ones still ticked (optional_scopes[]), the rest declined (and remembered); its subscription and its source follow that version; access tokens are revoked if a scope was removed; the partner's next refresh mints under the new grant. deny: the install stays on its version and grant — its subscription back to exactly that version's events — until a later release asks again. No code, no redirect. Throttle: app_installs/write/minute, 30 a minute.

A cookie session, no impersonation, the CSRF token and an Origin exactly the app's own — 403 cookie_session_required / impersonation_forbidden / invalid_origin. integrations.manage; 422 invalid_decision / not_installed / nothing_pending.

Request

Responses

200

The install.

401

No session or token, or one that is no longer valid. A request that presented a token gets WWW-Authenticate: Bearer realm="KudosCRM", error="invalid_token" (refresh it); one with no credentials and no session cookie gets the bare challenge.

Response Headers

WWW-Authenticate
Example: Bearer realm="KudosCRM", error="invalid_token"

403

The perimeter (cookie_session_required, impersonation_forbidden, invalid_origin), or no integrations.manage.

404

Not found in this workspace — or not something the caller may know exists.

422

The install's lifecycle refused the change: not_installed / already_uninstalled (an uninstalled install), already_paused / not_paused, invalid_decision / nothing_pending (re-consent), install_paused / app_suspended / no_subscription (retries), not_replayable / payload_gone / subscription_inactive / not_granted / not_subscribed (replays), test_unavailable.

429

A throttle refused the request. Wait Retry-After seconds — the time left in the refusing window plus 0–3 s of jitter. The X-RateLimit-* headers describe the bucket that refused it.

Response Headers

Retry-After
X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset

Seconds until the window rolls.