# OAuth 2.0 authorization endpoints for third-party integrations

## Redirect to React consent page.[Direct link to heading](https://docs.archera.ai/api-reference/public-api/oauth#get-oauth-authorize)
### Get /oauth/authorize

### Query Parameters (handled by Authlib):
- **client_id**: OAuth client identifier  
- **redirect_uri**: Where to redirect after authorization  
- **response_type**: Must be 'code'  
- **scope**: Space-separated list of requested scopes  
- **state**: CSRF protection token (optional but recommended)  
- **code_challenge**: PKCE code challenge  
- **code_challenge_method**: PKCE method (usually 'S256')

### Returns:
Redirect to React consent page with OAuth params and client info

### Responses

- **400 Bad Request**
  - **Content-Type**: application/json
  ```json
  {
    "message": "text",
    "detail": null,
    "code": null,
    "url": null,
    "timestamp": "text",
    "type": "text"
  }
  ```

- **401 Unauthorized**

- **403 Forbidden**

- **404 Not Found**

- **405 Method Not Allowed**

- **409 Conflict**

- **500 Internal Server Error**

- **Default** error response

---

## Handle user authorization decision from React consent page.[Direct link to heading](https://docs.archera.ai/api-reference/public-api/oauth#post-oauth-authorize)
### Post /oauth/authorize

### Query Parameters:
All OAuth params from GET (client_id, redirect_uri, state, etc.)

### Form Parameters:
- **confirm**: 'yes' to authorize, 'no' to deny

### Returns:
Redirect to client with authorization code or error

### Responses

- **401 Unauthorized**

- **403 Forbidden**

- **404 Not Found**

- **405 Method Not Allowed**

- **409 Conflict**

- **500 Internal Server Error**

- **Default** error response

---

## Issue access tokens.[Direct link to heading](https://docs.archera.ai/api-reference/public-api/oauth#post-oauth-token)
### Post /oauth/token

### Form Parameters (authorization_code grant):
- **grant_type**: Must be 'authorization_code'  
- **code**: Authorization code from /authorize  
- **redirect_uri**: Must match original request  
- **client_id**: OAuth client identifier  
- **code_verifier**: PKCE code verifier

### Form Parameters (refresh_token grant):
- **grant_type**: Must be 'refresh_token'  
- **refresh_token**: Valid refresh token  
- **client_id**: OAuth client identifier

### Returns:
JSON response with access_token (JWT), refresh_token, expires_in, etc.

### Responses

- **401 Unauthorized**

- **403 Forbidden**

- **404 Not Found**

- **405 Method Not Allowed**

- **409 Conflict**

- **500 Internal Server Error**

- **Default** error response

---

## List all active OAuth sessions for the current user.[Direct link to heading](https://docs.archera.ai/api-reference/public-api/oauth#get-oauth-sessions)
### Get /oauth/sessions

### Returns:
List of active sessions including client info, creation time, and scope

### Responses

- **200 OK**

- **401 Unauthorized**

- **403 Forbidden**

- **404 Not Found**

- **405 Method Not Allowed**

- **409 Conflict**

- **500 Internal Server Error**

- **Default** error response

---

## Revoke a specific OAuth session by token ID.[Direct link to heading](https://docs.archera.ai/api-reference/public-api/oauth#delete-oauth-sessions-token_id)
### Delete /oauth/sessions/{token_id}

### Args:
- **token_id**: UUID of the OAuth token to revoke

### Returns:
- **204 No Content** on success  
- **404 Not Found** if session doesn't exist or doesn't belong to user

### Path parameters
- **token_id** string · uuid Required

### Responses

- **204 No Content**

- **401 Unauthorized**

- **403 Forbidden**

- **404 Not Found**

- **405 Method Not Allowed**

- **409 Conflict**

- **500 Internal Server Error**

- **Default** error response

---

## Revoke all OAuth sessions (refresh tokens) for the current user across all clients.[Direct link to heading](https://docs.archera.ai/api-reference/public-api/oauth#post-oauth-revoke-all)
### Post /oauth/revoke-all

### Returns:
JSON with message and count of revoked sessions

### Responses

- **200 OK**

- **401 Unauthorized**

- **403 Forbidden**

- **404 Not Found**

- **405 Method Not Allowed**

- **409 Conflict**

- **500 Internal Server Error**

- **Default** error response

---

## Revoke an access token or refresh token.[Direct link to heading](https://docs.archera.ai/api-reference/public-api/oauth#post-oauth-revoke)
### Post /oauth/revoke

### Form Parameters:
- **token**: The token to revoke (access_token or refresh_token)  
- **token_type_hint**: Optional hint about token type ('access_token' or 'refresh_token')

### Returns:
- **200** response (always returns 200 per RFC 7009, even for invalid tokens)

### Responses

- **401 Unauthorized**

- **403 Forbidden**

- **404 Not Found**

- **405 Method Not Allowed**

- **409 Conflict**

- **500 Internal Server Error**

- **Default** error response

---

### Post /oauth/register
### Responses

- **401 Unauthorized**

- **403 Forbidden**

- **404 Not Found**

- **405 Method Not Allowed**

- **409 Conflict**

- **500 Internal Server Error**

- **Default** error response

---

**Last updated** 13 hours ago.