API Reference
OAuth

Authorization endpoint

GET
/oauth/authorize

RFC 6749 §4.1 with PKCE. Redirects the browser to the Sautikit consent screen, which drives GET /v1/oauth/authorization/{req} and POST /v1/oauth/authorization/{req}/decision behind the session cookie. Deliberately not rate-limited: legitimate clients re-authorize.

Response Body

application/json

curl -X GET "https://example.com/oauth/authorize"
Empty
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string",    "details": [      "string"    ]  }}

Dynamic client registration POST

RFC 7591. Unauthenticated, and it WRITES on every hit — a client mints a new registration by calling it — so it is rate-limited per IP (20/minute). That bounds the rate of growth, not the total: stale client rows are not yet swept.

Token endpoint POST

RFC 6749 §3.2. Exchanges an authorization code (with PKCE verifier) or a refresh token.