---
title: "POST /{tenantID}/oauth2PermissionGrants"
method: POST
path: "/{tenantID}/oauth2PermissionGrants"
tags: ["OAuth2PermissionGrant_Create"]
---

# POST /{tenantID}/oauth2PermissionGrants

`POST /{tenantID}/oauth2PermissionGrants`

Grants OAuth2 permissions for the relevant resource Ids of an app.

## Path parameters

- `tenantID` string, required

## Query parameters

- `api-version` string, required

## Request body

- OAuth2PermissionGrant
  - `odata.type` string — Microsoft.DirectoryServices.OAuth2PermissionGrant
  - `clientId` string — The id of the resource's service principal granted consent to impersonate the user when accessing the resource (represented by the resourceId property).
  - `objectId` string — The id of the permission grant
  - `consentType` 'AllPrincipals' | 'Principal' — Indicates if consent was provided by the administrator (on behalf of the organization) or by an individual.
  - `principalId` string — When consent type is Principal, this property specifies the id of the user that granted consent and applies only for that user.
  - `resourceId` string — Object Id of the resource you want to grant
  - `scope` string — Specifies the value of the scope claim that the resource application should expect in the OAuth 2.0 access token. For example, User.Read
  - `startTime` string — Start time for TTL
  - `expiryTime` string — Expiry time for TTL

## Response `201`

OK. The operation was successful.

- OAuth2PermissionGrant
  - `odata.type` string — Microsoft.DirectoryServices.OAuth2PermissionGrant
  - `clientId` string — The id of the resource's service principal granted consent to impersonate the user when accessing the resource (represented by the resourceId property).
  - `objectId` string — The id of the permission grant
  - `consentType` 'AllPrincipals' | 'Principal' — Indicates if consent was provided by the administrator (on behalf of the organization) or by an individual.
  - `principalId` string — When consent type is Principal, this property specifies the id of the user that granted consent and applies only for that user.
  - `resourceId` string — Object Id of the resource you want to grant
  - `scope` string — Specifies the value of the scope claim that the resource application should expect in the OAuth 2.0 access token. For example, User.Read
  - `startTime` string — Start time for TTL
  - `expiryTime` string — Expiry time for TTL

---

[API](https://skmtc.net/azure/apis/graphrbacmanagementclient.md) · [All operations](https://skmtc.net/azure/apis/graphrbacmanagementclient/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/graphrbacmanagementclient/revisions/71d95005600e/schema)