Sign in
The authorization endpoint, the token endpoint, and the routes the hosted consent screen uses on the person's behalf.
10 routes
/v1/oauth/authorize and /v1/oauth/token are yours. The interactions routes are called by the hosted consent screen from the person's own session, and test-sign-in by the developer console; they are listed so the surface is complete, not because your code should call them.
The guide for this family is Your first verified sign-in.
GET /v1/oauth/authorize
GET /v1/oauth/authorizeAuthentication- None
POST /v1/oauth/interactions
POST /v1/oauth/interactionsAuthentication- The person's hosted session
Starts the hosted consent interaction.
The body is checked by the service rather than by a declared class, so its fields are not listed here. The guide linked above describes what it takes.
POST /v1/oauth/interactions/{interactionId}/approve
POST /v1/oauth/interactions/{interactionId}/approveAuthentication- The person's hosted session
The body is checked by the service rather than by a declared class, so its fields are not listed here. The guide linked above describes what it takes.
POST /v1/oauth/interactions/{interactionId}/deny
POST /v1/oauth/interactions/{interactionId}/denyAuthentication- The person's hosted session
The body is checked by the service rather than by a declared class, so its fields are not listed here. The guide linked above describes what it takes.
POST /v1/oauth/interactions/{interactionId}/status
POST /v1/oauth/interactions/{interactionId}/statusAuthentication- The person's hosted session
The body is checked by the service rather than by a declared class, so its fields are not listed here. The guide linked above describes what it takes.
POST /v1/oauth/interactions/silent
POST /v1/oauth/interactions/silentAuthentication- The person's hosted session
Starts the hosted consent interaction.
The body is checked by the service rather than by a declared class, so its fields are not listed here. The guide linked above describes what it takes.
POST /v1/oauth/interactions/silent/refuse
POST /v1/oauth/interactions/silent/refuseAuthentication- The person's hosted session
Starts the hosted consent interaction.
The body is checked by the service rather than by a declared class, so its fields are not listed here. The guide linked above describes what it takes.
POST /v1/oauth/test-sign-in
POST /v1/oauth/test-sign-inAuthentication- Developer console session
{ available, application, testIdentities[] }, or { available: false }.
The body is TestSignInBody; its fields are checked by the service.
POST /v1/oauth/test-sign-in/options
POST /v1/oauth/test-sign-in/optionsAuthentication- Developer console session
{ available, application, testIdentities[] }, or { available: false }.
The body is TestSignInBody; its fields are checked by the service.
POST /v1/oauth/token
POST /v1/oauth/tokenAuthentication- Client authentication (basic, post, or none with PKCE)
The body is checked by the service rather than by a declared class, so its fields are not listed here. The guide linked above describes what it takes.
What this does not do
- Responses are not listed. The API declares no response types, so this page describes what to send and who may send it. Recorded response shapes are on the guides.
- This page is generated. It was read from the API at commit
234dba22. Editing it by hand changes nothing; the next sync overwrites it.
Verified against API commit 234dba22 on 2026-10-18. The routes, scopes, checklist, events and limits on these pages are read from that export, not typed.