POST/api/apps/{app_id}/authorizeAuthenticated

Authorize a client application

Records the caller's consent for a client application to receive tokens on their behalf. Idempotent. The auth server's own app is always authorized and cannot be explicitly authorized (403). The JSON body is optional.

operationId post_api_apps_app_id_authorizeClient applications

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Path parameters

NameTypeDescription
app_id*string

Client application id

Request body

Optional — Optional; unknown fields are rejected.

application/json
AuthorizeAppRequest
PropertyTypeDescription
statestring

The OAuth2 state nonce of the in-flight authorization request. Validated, logged in development, never persisted.

minLength: 1maxLength: 512pattern: ^[\x20-\x7E]+$

JSONExample
"state""string"

Responses

application/json
ResourceCreationResponse
PropertyTypeDescription
success*true
message*string
resource_id*string

Identifier of the created / affected resource

JSONExample
"success"true
"message""string"
"resource_id""string"

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/apps/<app_id>/authorize' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "state": "string"
}'