> ## Documentation Index
> Fetch the complete documentation index at: https://gproxy.leenhawk.com/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /v1/oauth/authorize



## OpenAPI

````yaml /generated/openapi.json post /v1/oauth/authorize
openapi: 3.1.0
info:
  description: >-
    Forwarding, management, portal and OAuth APIs generated from Rust types.
    Input and output schemas preserve their respective Serde contracts.
    Streaming events and WebSocket messages are documented alongside HTTP
    payloads.
  title: GPROXY HTTP API
  version: 4.2.1
servers: []
security:
  - bearer: []
  - anthropicKey: []
  - googleKey: []
  - queryKey: []
paths:
  /v1/oauth/authorize:
    post:
      tags:
        - OAuth
      summary: POST /v1/oauth/authorize
      parameters:
        - description: ''
          in: query
          name: client_id
          required: false
          schema:
            default: ''
            type: string
        - description: The base64url SHA-256 of the client's verifier (RFC 7636 §4.2).
          in: query
          name: code_challenge
          required: false
          schema:
            default: ''
            description: The base64url SHA-256 of the client's verifier (RFC 7636 §4.2).
            type: string
        - description: Must be `S256`.
          in: query
          name: code_challenge_method
          required: false
          schema:
            default: ''
            description: Must be `S256`.
            type: string
        - description: Matched **exactly** against `oauth_clients.redirect_uris`.
          in: query
          name: redirect_uri
          required: false
          schema:
            default: ''
            description: Matched **exactly** against `oauth_clients.redirect_uris`.
            type: string
        - description: Must be `code`. This issuer has no implicit and no hybrid flow.
          in: query
          name: response_type
          required: false
          schema:
            default: ''
            description: Must be `code`. This issuer has no implicit and no hybrid flow.
            type: string
        - description: Space-delimited, per RFC 6749 §3.3. Empty asks for no scope.
          in: query
          name: scope
          required: false
          schema:
            default: ''
            description: Space-delimited, per RFC 6749 §3.3. Empty asks for no scope.
            type: string
        - description: >-
            Opaque client value, echoed back untouched on both outcomes. It is
            the

            client's CSRF defence and this issuer never interprets it.
          in: query
          name: state
          required: false
          schema:
            default: null
            description: >-
              Opaque client value, echoed back untouched on both outcomes. It is
              the

              client's CSRF defence and this issuer never interprets it.
            type:
              - string
              - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Input_DecisionBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  location:
                    type: string
                  outcome:
                    $ref: '#/components/schemas/Output_AuthorizeOutcome'
                required:
                  - location
                  - outcome
                type: object
          description: Success
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Output_OAuthErrorBody'
          description: OAuth error
      security:
        - consoleSession: []
        - bearer: []
        - anthropicKey: []
        - googleKey: []
components:
  schemas:
    Input_DecisionBody:
      properties:
        decision:
          $ref: '#/components/schemas/Input_ConsentDecision'
      required:
        - decision
      type: object
    Output_AuthorizeOutcome:
      description: |-
        The result of a consent decision: in both directions, a redirect back to
        the client.
      oneOf:
        - $ref: '#/components/schemas/Output_AuthorizationIssued'
          properties:
            outcome:
              const: issued
              type: string
          required:
            - outcome
          type: object
        - $ref: '#/components/schemas/Output_AuthorizationDenied'
          properties:
            outcome:
              const: denied
              type: string
          required:
            - outcome
          type: object
    Output_OAuthErrorBody:
      description: RFC 6749 §5.2's error body, which RFC 7009 and RFC 8628 reuse.
      properties:
        error:
          type: string
        error_description:
          type: string
      required:
        - error
        - error_description
      type: object
    Input_ConsentDecision:
      description: |-
        What the person at the consent screen chose.

        Named `ConsentDecision` rather than `Decision` because
        [`snapshot::Decision`](crate::snapshot::Decision) is the permission
        evaluator's verdict, and the two appear in the same files.
      enum:
        - approve
        - deny
      type: string
    Output_AuthorizationIssued:
      description: An approved authorization. `code` is plaintext and exists only here.
      properties:
        code:
          type: string
        redirect_uri:
          type: string
        state:
          type:
            - string
            - 'null'
      required:
        - code
        - redirect_uri
        - state
      type: object
    Output_AuthorizationDenied:
      description: >-
        A refused authorization, as RFC 6749 §4.1.2.1's error redirect.


        The refusal goes to the client's registered redirect URI rather than to
        the

        browser as an error page, because the client is what has to learn the

        outcome — and it only ever goes there once the redirect URI has been
        proven

        registered. A request whose `client_id` or `redirect_uri` is itself
        invalid

        is refused before any of this exists, so a forged redirect target cannot
        be

        used to bounce an error (and a `state`) to an attacker.
      properties:
        error:
          description: Usually `access_denied`.
          type: string
        error_description:
          type: string
        redirect_uri:
          type: string
        state:
          type:
            - string
            - 'null'
      required:
        - redirect_uri
        - state
        - error
        - error_description
      type: object
  securitySchemes:
    bearer:
      scheme: bearer
      type: http
    anthropicKey:
      in: header
      name: x-api-key
      type: apiKey
    googleKey:
      in: header
      name: x-goog-api-key
      type: apiKey
    queryKey:
      in: query
      name: key
      type: apiKey
    consoleSession:
      in: cookie
      name: gproxy_session
      type: apiKey

````

## Related topics

- [GET /v1/oauth/authorize](https://gproxy.leenhawk.com/api-reference/oauth/get-v1oauthauthorize.md)
- [POST /v1/oauth/revoke](https://gproxy.leenhawk.com/api-reference/oauth/post-v1oauthrevoke.md)
- [POST /v1/oauth/token](https://gproxy.leenhawk.com/api-reference/oauth/post-v1oauthtoken.md)
- [POST /v1/oauth/device/code](https://gproxy.leenhawk.com/api-reference/oauth/post-v1oauthdevicecode.md)
- [POST /v1/conversations](https://gproxy.leenhawk.com/api-reference/forwarding/post-v1conversations.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.