Oauth Consent
Consent submission endpoint.
The frontend submits the opaque consent_request_id obtained from
GET /oauth/authorize (when consent_required=true) after the contact approves.
The server-side pending context is atomically burned (single-use), re-verified
(contact match + redirect_uri still registered + scope still allowed), then the
grant is persisted and the authorization code redirect is issued. The client
cannot influence redirect_uri / scope / contact via this body.
Requires an active contact session (Bearer token).
This is an OAuth2/OIDC standard endpoint — NOT JSON:API.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Body for POST /oauth/consent.
Carries ONLY the opaque consent_request_id. The client cannot supply redirect_uri / scope / contact here — those are read from the server-side context keyed by this id and re-verified before a code is minted.
Response
Successful Response