POST
/api/apps/{app_id}/authorizeAuthenticatedAuthorize a client application
Records the caller's consent for a client application to receive tokens on their behalf. Idempotent. The auth server's own app is always authorized and cannot be explicitly authorized (403). The JSON body is optional.
operationId
post_api_apps_app_id_authorizeClient applicationsAuthentication & permissionsAuthenticated
Any authenticated user
- Accepted credentials
- Auth server session (refresh token cookie)
cookie "refresh_token_<auth_server_app_id>" - Access token (cookie)
cookie "access_token_<auth_server_app_id>" - Access token (Bearer)
Authorization: Bearer <JWT>
- Auth server session (refresh token cookie)
- Who may call
- Any authenticated user
Path parameters
| Name | Type | Description |
|---|---|---|
| app_id* | string | Client application id |
Request body
Optional — Optional; unknown fields are rejected.
application/json
AuthorizeAppRequest
| Property | Type | Description |
|---|---|---|
| state | string | The OAuth2 minLength: 1maxLength: 512pattern: ^[\x20-\x7E]+$ |
JSONExample
"state""string"
Responses
application/json
ResourceCreationResponse
| Property | Type | Description |
|---|---|---|
| success* | true | |
| message* | string | |
| resource_id* | string | Identifier of the created / affected resource |
JSONExample
"success"true
"message""string"
"resource_id""string"
Example request
bashcurl
curl -X POST 'https://auth.schemavaults.com/api/apps/<app_id>/authorize' \
-b 'refresh_token_<auth_server_app_id>=<value>' \
-H 'Content-Type: application/json' \
-d '{
"state": "string"
}'