Grant Consent

POST /oauth/authorize/consent

Approve or refuse, and answer with where to send the browser.

Authenticated by the console’s ordinary bearer credential, which is also the CSRF answer: it travels in a header the browser does not attach on its own, so a cross-site form cannot forge this call. The refresh cookie is HttpOnly and cannot reach here without one.

Role floor

Requires viewer or above. The floor is a minimum, not a grant: scope filtering still applies on top of it, and a resource in another tenant answers 404 rather than 403.

Request body — ConsentRequest

Field	Type		Notes
params	AuthorizationParams	required	—
approve	boolean	required	—
organization_id	string (uuid) | null	optional	—
workspace_id	string (uuid) | null	optional	—
knowledge_set	string | null	optional	—

Responses

Status	Description	Body
200	Successful Response	—
422	Validation Error	HTTPValidationError

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

The body shows the fields the schema always carries. Which combination is legal is a service rule the schema cannot express, so read the description above before copying this.

curl -X POST https://your-deployment.example.com/oauth/authorize/consent \
  -H "Authorization: Bearer $COBRE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "params": {
         "client_id": "string",
         "redirect_uri": "string",
         "code_challenge": "string"
       },
       "approve": true
     }'