# OAuth (MCP)

The Nest-routed, bearer-authed half of the OAuth 2.1 authorization flow (consent context + decision) — see the MCP & OAuth guide for the full flow including the raw RFC endpoints.

Generated from `apps/api/openapi.json`. HTML version: https://docs.institflow.com/en/reference/oauth

2 operations.

## GET /api/v1/oauth/authorize/context

Client name, scope description, and mcp.access-eligible tenants for the consent screen.

- Operation id: `OAuthDecisionController_context_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: not required

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `clientId` | query | string | yes | ≥1 chars |
| `redirectUri` | query | string | yes | ≥1 chars |
| `scope` | query | string | yes | ≥1 chars |

### Responses

**200** — Success.

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `clientName` | string | yes |  |
| `scope` | string | yes |  |
| `memberships` | array<object> | yes |  |

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X GET "https://your-institute.example/api/v1/oauth/authorize/context?clientId=institflow-cli-a1b2c3&redirectUri=string&scope=string" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY"
```

## POST /api/v1/oauth/authorize/decision

Approve or deny an MCP client authorization request.

- Operation id: `OAuthDecisionController_decide_v1`
- Permission: —
- Auth: credential required
- `Idempotency-Key`: required for API-key callers

### Request body

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `clientId` | string | yes | ≥1 chars |
| `redirectUri` | string | yes | ≥1 chars |
| `state` | string | yes |  |
| `codeChallenge` | string | yes | ≥1 chars |
| `codeChallengeMethod` | enum: "S256" | yes |  |
| `scope` | string | yes | ≥1 chars |
| `membershipId` | string (uuid) | no |  |
| `approve` | boolean | yes |  |

```json
{
  "clientId": "institflow-cli-a1b2c3",
  "redirectUri": "string",
  "state": "string",
  "codeChallenge": "string",
  "codeChallengeMethod": "S256",
  "scope": "string",
  "membershipId": "e34c26d7-e34c-734c-84c2-e34c26d7e34c",
  "approve": true
}
```

### Responses

**200** — Success.

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `redirectTo` | string | yes |  |

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X POST "https://your-institute.example/api/v1/oauth/authorize/decision" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "clientId": "institflow-cli-a1b2c3",
    "redirectUri": "string",
    "state": "string",
    "codeChallenge": "string",
    "codeChallengeMethod": "S256",
    "scope": "string",
    "membershipId": "e34c26d7-e34c-734c-84c2-e34c26d7e34c",
    "approve": true
  }'
```