Consent decision (internal, not a public integration point)

The endpoint GET /oauth/authorize's consent screen's Allow/Deny
buttons submit to, as a same-origin HTML form POST carrying the user's
active session cookie. This is not a surface external OAuth
clients call directly: a real integration only ever redirects the
browser to GET /oauth/authorize and receives the result on its own
redirect_uri; documented here only because it's a real, reachable
endpoint.

Rejects any request whose origin isn't this same site. Every field is
re-validated from scratch: nothing about a prior GET render is
trusted. On success (decision=allow), mints a single-use, 60-second
authorization code and redirects to redirect_uri with ?code=…; on
decision=deny, redirects with ?error=access_denied. An account whose
email address is not yet confirmed is never issued a code, whichever
button was pressed.

Request

Authorization

API Key

Add parameter in header

x-api-key

Example:

x-api-key: ********************

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/x-www-form-urlencodedRequired

Redirect to redirect_uri with ?code=…&state=… (allow) or ?error=access_denied&state=… (deny), or with an OAuth error if a re-validated field turned out invalid.

This response does not have a body.

curl --location 'https://upload.tf/api/v1/api/oauth/authorize' \ --header 'x-api-key: <api-key>' \ --data-urlencode 'client_id=' \ --data-urlencode 'redirect_uri=' \ --data-urlencode 'response_type=' \ --data-urlencode 'scope=' \ --data-urlencode 'code_challenge=' \ --data-urlencode 'code_challenge_method=' \ --data-urlencode 'state=' \ --data-urlencode 'resource=' \ --data-urlencode 'decision='

Consent decision (internal, not a public integration point)

Request

Responses