Begin the authorization code flow
GET
/v1/oauth/authorize
const url = 'https://api.adversarial.com/api/v1/oauth/authorize?client_id=example&redirect_uri=example&response_type=example&code_challenge=example&code_challenge_method=example';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.adversarial.com/api/v1/oauth/authorize?client_id=example&redirect_uri=example&response_type=example&code_challenge=example&code_challenge_method=example'Entry point for the authorization_code grant. Validates params and either redirects to consent (if the user already has a session) or to login first.
Parameters
Section titled “Parameters”Query Parameters
Section titled “Query Parameters”client_id
required
string
redirect_uri
required
string
response_type
required
string
code_challenge
required
string
code_challenge_method
required
string
scope
string | null
Space-separated scopes to request. Omit it and the scope recorded for the client at registration applies; a client that registered none gets read and write access to risks, incidents, and tags. Whatever is asked for, the grant is narrowed to the permissions the consenting user holds.
state
string | null
resource
string | null
RFC 8707 resource indicator — the API the issued token is for. Omit it and the token is bound to this server’s MCP endpoint.
nonce
string | null
OIDC nonce — preserved end-to-end so clients can verify.
Responses
Section titled “Responses”Redirect to consent, onboarding (orgless session), or login
Invalid request