Sign in

v51

latestSwagger 2.0raw.githubusercontent.com2026-08-015253175.3 KB
oAuth2

Get OAuth 2.0 Consent Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell Ory now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.

The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells Ory if the subject accepted or rejected the request.

The default consent provider is available via the Ory Managed Account Experience. To customize the consent provider, please head over to the OAuth 2.0 documentation.

get/admin/oauth2/auth/requests/consent

Query parameters

consent_challengestring required

OAuth 2.0 Consent Request Challenge

Response

oAuth2ConsentRequest

acrstring

ACR represents the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it to express that, for example, a user authenticated using two factor authentication.

amrstring[]

AMR is the Authentication Methods References value for this authentication session. You can use it to specify the method a user used to authenticate. For example, if the acr indicates a user used two factor authentication, the amr can express they used a software-secured key.

challengestring required

Challenge is used to retrieve/accept/deny the consent request.

consent_request_idstring

ConsentRequestID is the ID of the consent request.

contextJSONRawMessage
login_challengestring

LoginChallenge is the login challenge this consent challenge belongs to. It can be used to associate a login and consent request in the login & consent app.

login_session_idstring

LoginSessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false) this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back- channel logout. It's value can generally be used to associate consecutive login requests by a certain user.

request_urlstring

RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters.

requested_access_token_audiencestring[]

RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.

requested_scopestring[]

RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client.

skipboolean

Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the consent request using the usual API call.

subjectstring

Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client.

Example response

{
  "client": {
    "scope": "scope1 scope-2 scope.3 scope:4"
  }
}