---
title: "Grant the access request"
method: POST
path: "/zephr/oauth2/grant"
tags: ["Third-Party Authentication"]
---

# Grant the access request

`POST /zephr/oauth2/grant`

The resource owner will consent or deny the third party application access request, and Zephr will return an authorization code upon user's consent.

## Request body

- Oauth2RequestBody
  - `client_id` string, required — Zephr Site Oauth2 Client ID
  - `response_type` string, required — Must be set to `code`
  - `redirect_uri` string, required — Client's redirection endpoint. Must be an absolute URI
  - `scope` string, required — The scope of the access request. Supported scopes: user.account:read, user.profile:read and user.profile:update
  - `state` string, required — An opaque value used by the client to maintain state between the request and callback
  - `allow` boolean, required — Resource owner consent

## Response `200`

OK. The template variable "BASICAUTH" is set as the authorization header of "$CLIENTID" and "$CLIENTSECRET". The template variable "AUTHCODE" is set to the response body "code" field.

## Other responses

- `401` — Unauthorized

---

[API](https://skmtc.net/zuora/apis/public-api-reference.md) · [All operations](https://skmtc.net/zuora/apis/public-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/zuora/public-api-reference/revisions/0400dd83950b/schema)