POST/api/apps/{app_id}/authorizeAuthenticated

Authorize a client application

Records the caller's consent for a client application to receive tokens on their behalf, and for the API scopes they approved (approved_api_scopes, among those the request's scope asks for of the API server its resource names). Idempotent; consenting again adds scopes, never removes them. The auth server's own app is always authorized and cannot be explicitly authorized (403). The JSON body is optional.

operationId post_api_apps_app_id_authorizeClient applications

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user

Path parameters

Name	Type	Description
app_id*	string	Client application id

Request body

Optional — Optional; unknown fields are rejected.

application/json

AuthorizeAppRequest

Property	Type	Description
state	string	The OAuth2 `state` nonce of the in-flight authorization request. Validated, logged in development, never persisted. minLength: 1maxLength: 512pattern: ^[\x20-\x7E]+$
scope	string	The authorization request's requested scopes. Required for `approved_api_scopes` to take effect. minLength: 1maxLength: 1024pattern: ^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$
resource	string	The authorization request's RFC 8707 resource indicator, whose API scopes `scope` asks for. minLength: 1maxLength: 2048
approved_api_scopes	string[]	The API scopes the user approved on the consent screen. Recorded as the user's consent for those of them the request asks for and the app may be granted; the rest are ignored. Omitted or empty: no API scope is consented (the app is still authorized). maxItems: 100

JSONExample

"state""string"

"scope""string"

"resource""string"

"approved_api_scopes"

"string"

Responses

application/json

ResourceCreationResponse

Property	Type	Description
success*	true
message*	string
resource_id*	string	Identifier of the created / affected resource

JSONExample

"success"true

"message""string"

"resource_id""string"

Example request

bashcurl

curl -X POST 'https://auth.schemavaults.com/api/apps/<app_id>/authorize' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "state": "string",
  "scope": "string",
  "resource": "string",
  "approved_api_scopes": [
    "string"
  ]
}'

Other methods on this path

DELETERevoke a client application's authorization

Authentication & permissionsAuthenticated

Path parameters

Request body

Responses

200The app is authorized for the caller

400The request failed validation (issues lists the offending fields) or was refused by the handler

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The account is disabled, or the credential is valid but not allowed to perform this operation

500Failed to record the authorization

Example request

Other methods on this path