Authorize

GET /oauth/authorize

Validate, then hand the browser to the console’s consent screen.

Everything is validated before anything is redirected, and the ordering is the open-redirect defence: the client and the exact redirect URI are settled first, so a refusal above that line is rendered here rather than bounced off an address the request supplied. Only after both are known good does this endpoint send the browser anywhere.

The parameters cross to the console in the URL, and there is no pending-request row behind them. The consent endpoint re-validates every one — see AuthorizationParams.

Every parameter is declared optional and then required by :func:_params, including the three that are not. Declared required, FastAPI answers a missing one with a 422 in this platform’s envelope — the second error shape this module exists not to publish, on the one request a client makes before it has any idea what this server is.

No credential

This operation is public: it authenticates by its own mechanism — a webhook signature or a channel token — rather than by a platform credential.

Parameters

Name	In	Type		Notes
client_id	query	string | null	optional	—
redirect_uri	query	string | null	optional	—
code_challenge	query	string | null	optional	—
response_type	query	string	optional	Default "code".
code_challenge_method	query	string	optional	Default "S256".
scope	query	string | null	optional	—
state	query	string | null	optional	—
resource	query	string | null	optional	—

Responses

Status	Description	Body
200	Successful Response	—
422	Validation Error	HTTPValidationError

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

curl -X GET https://your-deployment.example.com/oauth/authorize