> ## Documentation Index > Fetch the complete documentation index at: https://swapnice.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Start browser authorization > Browser-facing authorize page for hosted connect UX. Browser-facing authorize page for hosted connect UX. Use this only if you are embedding the hosted connection page. Partner backends should call [POST /oauth/authorize](/partners/api-reference/oauth-authorize) instead. ## OpenAPI ````yaml openapi.yaml GET /oauth/authorize openapi: 3.0.3 info: title: Swapnice Partner API version: 0.1.0 description: > Swapnice's partner API lets trusted partner applications connect customer accounts, collect explicit consent, ingest governed events and claims, and synchronously read consent-filtered profile intelligence with provenance. The API is designed for a Cloudflare Workers gateway backed by Durable Objects for short-lived sessions, per-customer ordering, consent coordination, and idempotency, plus D1 for longer-lived partner app configuration, consent archives, token metadata, customer records, and audit history. Public schemas use descriptive field names. Compact Firebase-era storage keys such as `c0`, `p0`, or `upiv` are internal implementation details and must not be exposed. contact: name: Swapnice API Support email: api@swapnice.com license: name: Proprietary url: https://swapnice.com/legal/api-terms servers: - url: https://api.swapnice.com description: Production API - url: https://api.sandbox.swapnice.com description: Sandbox API security: - OAuth2: [] tags: - name: OAuth description: OAuth 2.1 authorization, token, introspection, revocation, and discovery. - name: Apps description: Partner OAuth application configuration and webhook endpoints. - name: Connection Sessions description: Short-lived account-linking sessions coordinated by Durable Objects. - name: Consent description: Consent grants, receipts, effective consent state, and revocation. - name: Customers description: Partner-scoped customer records and metadata. - name: Ontologies description: Ontology contracts and filter-field metadata for entries and events. - name: Entries description: Ontology-backed collectible entries using readable external fields. - name: Events description: Non-blocking ordered event and claim ingestion. - name: Profiles description: Consent-aware synchronous reads for claims, intents, and profile facts. - name: Webhooks description: Partner webhook endpoint registration and delivery status. paths: /oauth/authorize: get: tags: - OAuth summary: Start OAuth authorization code flow with PKCE description: > Browser-facing OAuth 2.1 authorization endpoint. `code_challenge_method` must be `S256`, `redirect_uri` must exactly match a registered URI, and implicit or password grants are not supported. operationId: authorize parameters: - $ref: '#/components/parameters/ClientIdQuery' - name: response_type in: query required: true schema: type: string enum: - code - name: redirect_uri in: query required: true schema: type: string format: uri - name: scope in: query required: true schema: type: string example: openid offline_access profile:read events:write consent:write - name: state in: query required: true schema: type: string minLength: 16 - name: code_challenge in: query required: true schema: type: string minLength: 43 - name: code_challenge_method in: query required: true schema: type: string enum: - S256 - name: connection_session_id in: query required: false schema: type: string description: >- Optional account-linking session to complete after user authorization. responses: '200': description: >- Renders the user authorization and consent page when interaction is required. content: text/html: schema: type: string '302': description: >- Redirects to the exact registered `redirect_uri` with `code` and `state`, or OAuth error parameters. headers: Location: schema: type: string format: uri '400': $ref: '#/components/responses/BadRequest' security: [] components: parameters: ClientIdQuery: name: client_id in: query required: true schema: type: string responses: BadRequest: description: Invalid request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' schemas: ErrorResponse: type: object required: - error properties: error: type: object required: - code - message - request_id properties: code: type: string example: consent_denied message: type: string request_id: type: string details: type: array items: $ref: '#/components/schemas/ErrorDetail' ErrorDetail: type: object required: - code - message properties: code: type: string message: type: string field: type: string securitySchemes: OAuth2: type: oauth2 description: >- OAuth 2.1 authorization code with PKCE. Implicit and password flows are unsupported. flows: authorizationCode: authorizationUrl: https://api.swapnice.com/oauth/authorize tokenUrl: https://api.swapnice.com/oauth/token refreshUrl: https://api.swapnice.com/oauth/token scopes: offline_access: Issue rotating refresh tokens when allowed. apps:read: Read partner app configuration. apps:write: Manage partner app configuration. connections:read: Read connection sessions. connections:write: Create or cancel connection sessions. consent:read: Read consent receipts and effective consent. consent:write: Create and revoke consent. customers:read: Read partner customers. customers:write: Create or update partner customers. ontologies:read: Read ontologies and field maps. ontologies:write: Rebuild ontology filter metadata. entries:read: Read ontology-backed entries. entries:write: Create or update ontology-backed entries. events:read: Read event status. events:write: Ingest events and claims. profile:read: Read resolved profile facts. profiles:read: Read profile resources. claims:read: Read claims. intents:read: Read intents. webhooks:read: Read webhook endpoints. webhooks:write: Manage webhook endpoints. workflows:read: Read async workflow status. tokens:introspect: Introspect tokens. tokens:revoke: Revoke tokens. ````