Oauth

7 live operations under /api/oauth. 0 require a machine key; 7 are public. Tagged: Other.

Method	Path	What it does	Auth
POST	/api/oauth/authorize/consent	oauth/authorize/consent (POST) — user clicked Approve or Cancel	public
GET	/api/oauth/authorize	oauth/authorize (GET) — entry point of the vault-issuance ceremony	public
POST	/api/oauth/refresh	5. token NOT in oauth_tokens_revoked (rotation, revoke, or logout).	public
POST	/api/oauth/revoke	Accepts optional token_type_hint ('access_token' | 'refresh_token') — we try both kinds when the hint is wrong or missi	public
POST	/api/oauth/token	7. redeemCodeOnce — single-use enforcement, TOCTOU-safe via DB.	public
GET	/api/oauth/userinfo	—	public
POST	/api/oauth/userinfo	—	public

Generated by scripts/generate-reference.mjs from https://zeq.me/openapi.json.