O Auth Authorise Consent
Read a pending OAuth authorisation code request for a signed-in user before they approve or deny consent. This is a Storyden frontend/API integration endpoint, not an OAuth protocol endpoint. It returns the client, redirect URI, requested scopes, and currently grantable scopes so a caller can render a consent screen or, for headless integrations, decide programmatically. Accepts either a browser session or a personal access key.
/oauth/authorize/consentRead a pending OAuth authorisation code request for a signed-in user before they approve or deny consent.
This is a Storyden frontend/API integration endpoint, not an OAuth protocol endpoint. It returns the client, redirect URI, requested scopes, and currently grantable scopes so a caller can render a consent screen or, for headless integrations, decide programmatically. Accepts either a browser session or a personal access key.
In: cookie
Query Parameters
OAuth authorisation request identifier.
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/oauth/authorize/consent"{
"request_id": "string",
"client_id": "string",
"client_name": "string",
"redirect_uri": "http://example.com",
"expires_at": "2019-08-24T14:15:22Z",
"requested_scopes": [
"string"
],
"granted_scopes": [
"string"
],
"inherits_user_permissions": true
}{
"error": "string",
"error_description": "string"
}{
"type": "string",
"title": "string",
"detail": "string",
"trace_id": "string",
"metadata": {}
}O Auth Authorise GET
Start the OAuth 2.0 Authorization Code flow with PKCE. This endpoint accepts either a browser session (`storyden-session` cookie) or a personal access key (`Authorization: Bearer <key>`), letting a headless script drive the whole flow without ever loading the web frontend. If neither credential is present, Storyden redirects to a login URL instead of returning a protocol redirect to the client application; this defaults to the frontend login route and can be changed with `OAUTH_AUTHORISATION_LOGIN_URL`. Unlike many OAuth servers, Storyden does not render a consent page from this API endpoint. A valid request creates a short-lived pending authorisation request and redirects to the configured authorisation-code consent URL. A script can parse `request_id` out of that redirect's query string and drive `/oauth/authorize/consent` directly instead of following the redirect in a browser. Custom frontends can change this URL with `OAUTH_AUTHORISATION_CODE_CONSENT_URL`. The `scope` parameter follows OAuth 2.0 and is optional. Empty or omitted scope means no requested scopes. Storyden permission scopes are granted only when allowed by the client and by the signed-in account's current permissions.
O Auth Authorise Consent Submit POST
Approve or deny a pending OAuth authorisation code request for the currently signed-in account. On approval this creates a short-lived authorisation code and returns the client redirect URI containing `code` and optional `state`. On denial the returned redirect URI contains `error=access_denied`. Storyden recomputes the granted scope at approval time from current account permissions and client policy. Accepts either a browser session or a personal access key.