> For the complete documentation index, see [llms.txt](https://docs.defguard.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.defguard.net/for-developers/rest-api/core/oauth2/finish-the-oauth2-authorization-flow-after-user-consent.md).

# Finish the OAuth2 authorization flow after user consent

Called by the consent screen once the user allows or denies the request. On approval it redirects back to the client with an authorization code.

```json
{"openapi":"3.1.0","info":{"title":"defguard Core API","version":"2.0.3"},"tags":[{"name":"OAuth2","description":"defguard acting as an OAuth2 / OpenID Connect provider for other applications."}],"security":[{"cookie":[]},{"api_token":[]}],"components":{"securitySchemes":{"cookie":{"type":"apiKey","in":"cookie","name":"defguard_session"},"api_token":{"type":"http","scheme":"bearer"}},"schemas":{"ApiErrorResponse":{"type":"object","description":"Body returned with error responses.","required":["msg"],"properties":{"code":{"type":["string","null"],"description":"Machine-readable error code, returned for selected errors."},"msg":{"type":"string","description":"Human-readable error message."}}}}},"paths":{"/api/v1/oauth/authorize":{"post":{"tags":["OAuth2"],"summary":"Finish the OAuth2 authorization flow after user consent","description":"Called by the consent screen once the user allows or denies the request. On approval it\nredirects back to the client with an authorization code.","operationId":"secure_authorization","parameters":[{"name":"client_id","in":"query","description":"ID of the OAuth2 client.","required":true,"schema":{"type":"string"}},{"name":"redirect_uri","in":"query","description":"Redirect URI registered for the client.","required":true,"schema":{"type":"string"}},{"name":"response_type","in":"query","description":"OAuth2 response type, for example `code`.","required":true,"schema":{"type":"string"}},{"name":"scope","in":"query","description":"Space-separated list of requested scopes.","required":true,"schema":{"type":"string"}},{"name":"state","in":"query","description":"Opaque value returned unchanged to the client.","required":false,"schema":{"type":"string"}},{"name":"nonce","in":"query","description":"Value bound to the ID token to mitigate replay attacks.","required":false,"schema":{"type":"string"}},{"name":"code_challenge","in":"query","description":"PKCE code challenge.","required":false,"schema":{"type":"string"}},{"name":"code_challenge_method","in":"query","description":"PKCE code challenge method, for example `S256`.","required":false,"schema":{"type":"string"}},{"name":"prompt","in":"query","description":"OpenID `prompt` parameter, for example `consent`.","required":false,"schema":{"type":"string"}},{"name":"allow","in":"query","description":"Set by the consent screen to allow or deny the request.","required":false,"schema":{"type":"boolean"}}],"responses":{"302":{"description":"Redirect to the client redirect URI with an authorization code or an error."},"400":{"description":"Invalid authorization request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}},"401":{"description":"Session is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}},"500":{"description":"Unable to handle authorization request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}}}}}}}
```