Skip to content
GitmoapAPIBeta
Identity & platformoauth
GET/oauth/authorizations/{authorization_id}

A consent request waiting for the signed-in person's answer

get_oauth_authorization

The app, where it will return, the service the access is for, each requested scope with what it allows, and when the request expires. Only the person who opened it can read it, from a signed-in browser session; one that is someone else's, already answered or expired is not found.

Parameters

Path
  • authorization_idOAuthAuthorizationId (string · uuid)Consent request ID

Responses

200What the consent page showsapplication/json
  • authorization_idOAuthAuthorizationId (string · uuid)
  • clientOAuthClientView
    • The OAuthClientView schema
    • client_idstring
    • kindOAuthClientKindfirst_partymetadata_documentWhere a client's registration comes from.
    • namestring
    • logo_uristring or nulloptional
    • uristring or nulloptional
  • expires_atstring
  • redirect_hoststringThe host the authorization code is sent to.
  • requestedarray of OAuthRequestedScope
    • The OAuthRequestedScope schema
    • accessOAuthScopeAccessreadwriteWhether a scope reads or changes things.
    • descriptionstringWhat the scope allows, in a sentence.
    • named_onlybooleanNever included in a bundle: it is granted only when chosen on its own.
    • scopestring
    • bundlestring or nulloptionalThe bundle that includes it, when one does.
  • resourcestringThe service the access is for.
200 exampleSynthesized example
{
"authorization_id": "14550939-ca49-45d7-9f9f-10f99f60135a",
"client": {
"client_id": "efd2c6b1-8db6-4cf3-8ef2-1e59a17e3d3d",
"kind": "first_party",
"name": "payments-api",
"logo_uri": "https://gitmoap.example/acme/fa3ebe01",
"uri": "uri-6565"
},
"expires_at": "2026-10-14T05:32:50Z",
"redirect_host": "redirect-host-7825",
"requested": [
{
"access": "read",
"description": "Renders each region as density contours of its operations.",
"named_only": false,
"scope": "scope-373b"
},
{
"access": "read",
"description": "Renders each region as density contours of its operations.",
"named_only": false,
"scope": "scope-5c28"
}
],
"resource": "resource-3888"
}
400Bad request — a path parameter is not a well-formed value of its typeapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-79a0",
"message": "Pin a page's payload to the build that rendered it"
}
}
401Not signed inapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-c748",
"message": "Label every synthesized example"
}
}
403Consent needs a signed-in browser session, not an access tokenapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • SESSION_REQUIREDThis is done from a signed-in browser session, never with an access token
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-c3f5",
"message": "Draw the region map from operation density"
}
}
404Not found, already answered or expiredapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-ffd3",
"message": "Inline scalar newtypes but keep their brand"
}
}

CLI

gitmoap oauth get-oauth-authorization

  • --authorization-ididConsent request ID