> For the complete documentation index, see [llms.txt](https://docs.defguard.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.defguard.net/for-developers/rest-api/core/oauth2/start-the-oauth2-authorization-flow.md).

# Start the OAuth2 authorization flow

Redirects to the login or consent page when the user is not authenticated or has not yet approved the client. Implements the [OpenID Connect authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).

```json
{"openapi":"3.1.0","info":{"title":"defguard Core API","version":"2.0.3"},"tags":[{"name":"OAuth2","description":"defguard acting as an OAuth2 / OpenID Connect provider for other applications."}],"paths":{"/api/v1/oauth/authorize":{"get":{"tags":["OAuth2"],"summary":"Start the OAuth2 authorization flow","description":"Redirects to the login or consent page when the user is not authenticated or has not\nyet approved the client. Implements the\n[OpenID Connect authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).","operationId":"authorization","parameters":[{"name":"client_id","in":"query","description":"ID of the OAuth2 client.","required":true,"schema":{"type":"string"}},{"name":"redirect_uri","in":"query","description":"Redirect URI registered for the client.","required":true,"schema":{"type":"string"}},{"name":"response_type","in":"query","description":"OAuth2 response type, for example `code`.","required":true,"schema":{"type":"string"}},{"name":"scope","in":"query","description":"Space-separated list of requested scopes.","required":true,"schema":{"type":"string"}},{"name":"state","in":"query","description":"Opaque value returned unchanged to the client.","required":false,"schema":{"type":"string"}},{"name":"nonce","in":"query","description":"Value bound to the ID token to mitigate replay attacks.","required":false,"schema":{"type":"string"}},{"name":"code_challenge","in":"query","description":"PKCE code challenge.","required":false,"schema":{"type":"string"}},{"name":"code_challenge_method","in":"query","description":"PKCE code challenge method, for example `S256`.","required":false,"schema":{"type":"string"}},{"name":"prompt","in":"query","description":"OpenID `prompt` parameter, for example `consent`.","required":false,"schema":{"type":"string"}},{"name":"allow","in":"query","description":"Set by the consent screen to allow or deny the request.","required":false,"schema":{"type":"boolean"}}],"responses":{"302":{"description":"Redirect to the client, to the login page or to the consent page."},"400":{"description":"Invalid authorization request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}},"500":{"description":"Unable to handle authorization request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}}}}}},"components":{"schemas":{"ApiErrorResponse":{"type":"object","description":"Body returned with error responses.","required":["msg"],"properties":{"code":{"type":["string","null"],"description":"Machine-readable error code, returned for selected errors."},"msg":{"type":"string","description":"Human-readable error message."}}}}}}
```