> ## Documentation Index
> Fetch the complete documentation index at: https://www.vitalog.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth approve

> Requires the flow cookie, exact UI_BASE_URL Origin header and matching CSRF token. Allow signs in with ROOT_EMAIL and ROOT_PASSWORD in the JSON body and authorizes the requested scopes. Cancel does not need credentials. Returns the client-bound callback containing iss and the original state when supplied; approval includes a single-use five-minute code. No API key or access token is created until code exchange.



## OpenAPI

````yaml /openapi.json post /oauth/approve
openapi: 3.1.1
info:
  title: Vitalog
  version: 1.0.1
  description: >-
    Single-user structured observations with equivalent REST and MCP domain
    services. Environment AUTH_KEY or revocable personal Bearer keys with
    required name, permissions and explicit expiry (including Never); Primary
    key management requires AUTH_KEY; the UI uses separate, root-verified
    30-minute management sessions. MCP clients use OAuth authorization code with
    S256 PKCE, issued after root sign-in. Clients are resolved through HTTPS
    metadata, pre-registration or dynamic registration. OAuth tokens grant MCP
    access only.
servers:
  - url: https://vitalog-api.example.com
    description: Production REST and MCP API
  - url: http://localhost:3000
    description: Loopback development; production requires TLS ingress
security: []
paths:
  /oauth/approve:
    post:
      tags:
        - OAuth
      summary: OAuth approve
      description: >-
        Requires the flow cookie, exact UI_BASE_URL Origin header and matching
        CSRF token. Allow signs in with ROOT_EMAIL and ROOT_PASSWORD in the JSON
        body and authorizes the requested scopes. Cancel does not need
        credentials. Returns the client-bound callback containing iss and the
        original state when supplied; approval includes a single-use five-minute
        code. No API key or access token is created until code exchange.
      operationId: oauth_approve
      parameters:
        - name: Origin
          in: header
          required: true
          schema:
            type: string
            format: uri
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $schema: https://json-schema.org/draft/2020-12/schema
              oneOf:
                - type: object
                  properties:
                    csrf_token:
                      $ref: '#/components/schemas/Schema_7b76de12ee47___schema0'
                    action:
                      type: string
                      const: allow
                    email:
                      type: string
                      maxLength: 254
                      format: email
                      pattern: >-
                        ^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
                    password:
                      type: string
                      minLength: 1
                  required:
                    - csrf_token
                    - action
                    - email
                    - password
                  additionalProperties: false
                - type: object
                  properties:
                    csrf_token:
                      $ref: '#/components/schemas/Schema_7b76de12ee47___schema0'
                    action:
                      type: string
                      const: deny
                  required:
                    - csrf_token
                    - action
                  additionalProperties: false
      responses:
        '200':
          description: Validated MCP client callback URL; no API key is returned
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                required:
                  - redirect_to
                properties:
                  redirect_to:
                    type: string
                    format: uri
        '400':
          description: OAuth protocol error
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                required:
                  - error
                  - error_description
                properties:
                  error:
                    type: string
                  error_description:
                    type: string
        '401':
          description: Root email or password is incorrect
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Origin rejected
        '413':
          description: Request exceeds 4 KiB
        '429':
          description: 'Approval rate exceeded or sign-in is busy; Retry-After: 60'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '503':
          description: Root sign-in is not configured
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - oauthFlowCookie: []
components:
  schemas:
    Schema_7b76de12ee47___schema0:
      type: string
      pattern: ^[A-Za-z0-9_-]{43}$
    Error:
      type: object
      additionalProperties: false
      required:
        - code
        - message
        - catalog_version
        - issues
      properties:
        code:
          type: string
          enum:
            - VALIDATION_ERROR
            - NOT_FOUND
            - VERSION_CONFLICT
            - IDEMPOTENCY_CONFLICT
            - DAILY_TOTAL_EXISTS
            - CATALOG_VERSION_MISMATCH
            - LIMIT_EXCEEDED
            - UNAUTHORIZED
            - FORBIDDEN
            - RATE_LIMITED
            - UNAVAILABLE
            - TIMEOUT
            - INTERNAL_ERROR
        message:
          type: string
        catalog_version:
          type: string
        issues:
          type: array
          items:
            type: object
            properties:
              path:
                type: string
              reason:
                type: string
              message:
                type: string
              suggested_keys:
                type: array
                items:
                  type: string
              discovery:
                type: object
        existing_id:
          type: string
        current_version:
          type: integer
        current_catalog_version:
          type: string
  securitySchemes:
    oauthFlowCookie:
      type: apiKey
      in: cookie
      name: __Secure-vitalog-oauth
      description: >-
        Signed HttpOnly consent-flow cookie from /oauth/authorize, valid for
        five minutes. Loopback development uses vitalog-oauth.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.