---
title: "Authorise"
method: GET
path: "/com/v4/authorize"
tags: ["Myinfo"]
---

# Authorise

`GET /com/v4/authorize`

This API triggers Singpass login and obtain consent for the user to retrieve user's data from Myinfo.
Once the user has authenticated and consented, an authorisation code (authcode) will be returned via the callback URL defined.
The authcode can then be used to retrieve an access token via the Token API.

**Note:** This API is public and should be implemented as a link or button on partner's online webpage.
**Note:** For partners integrating via android mobile application, please ensure that the "setDomStorageEnable" attribute is enabled.

## Query parameters

- `purpose_id` string, required
- `response_type` string, required
- `scope` string[], required
- `code_challenge` string, required
- `code_challenge_method` string, required
- `redirect_uri` string, required
- `client_id` string, required
- `app_launch_url` string
- `subentity_id` string

## Other responses

- `302` — Service will redirect all responses to 'redirect_uri' with additional parameters added as response results. Expected parameters include: - **code**: this is the authorisation code partner will use when calling the token endpoint - **error**: if there are any errors encountered, the error code will be given in this parameter. - **'500'** - Unknown or other server side errors. - **'503'** - Myinfo under maintenance. Error description will also be given in error_description parameter. - **'access_denied'** - When user did not give consent, refer to error_description parameter for the reason. - **'invalid_scope'** - When application requests for scope(s) that is not permitted. - **error_description**: - if error is 'access_denied' i.e. user did not give consent, the description will be 'Resource Owner did not authorize the request'. - if error is 'invalid_scope' i.e. scope requested is not allowed, the description will be either 'Invalid realm scope' or 'Invalid client scope'. **Note:** If user closes the browser window prematurely, there will be no callback to the 'redirect_uri'.

---

[API](https://skmtc.net/singpass/apis/myinfo-api.md) · [All operations](https://skmtc.net/singpass/apis/myinfo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/singpass/myinfo-api/revisions/320a99d164e4/schema)