> ## Documentation Index > Fetch the complete documentation index at: https://swapnice.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Create an authorization code > JSON PKCE authorize used by the SDK and sandbox walkthrough. JSON PKCE authorize used by the SDK and sandbox walkthrough. This is the partner-backend flow. `code_challenge_method` must be `S256`. The code expires in about five minutes and is single-use. See [authentication](/partners/authentication) and the [request walkthrough](/partners/request-walkthrough). ## OpenAPI ````yaml openapi.yaml POST /oauth/authorize openapi: 3.0.3 info: title: Swapnice Partner API version: 0.1.0 description: > Swapnice's partner API lets trusted partner applications connect customer accounts, collect explicit consent, ingest governed events and claims, and synchronously read consent-filtered profile intelligence with provenance. The API is designed for a Cloudflare Workers gateway backed by Durable Objects for short-lived sessions, per-customer ordering, consent coordination, and idempotency, plus D1 for longer-lived partner app configuration, consent archives, token metadata, customer records, and audit history. Public schemas use descriptive field names. Compact Firebase-era storage keys such as `c0`, `p0`, or `upiv` are internal implementation details and must not be exposed. contact: name: Swapnice API Support email: api@swapnice.com license: name: Proprietary url: https://swapnice.com/legal/api-terms servers: - url: https://api.swapnice.com description: Production API - url: https://api.sandbox.swapnice.com description: Sandbox API security: - OAuth2: [] tags: - name: OAuth description: OAuth 2.1 authorization, token, introspection, revocation, and discovery. - name: Apps description: Partner OAuth application configuration and webhook endpoints. - name: Connection Sessions description: Short-lived account-linking sessions coordinated by Durable Objects. - name: Consent description: Consent grants, receipts, effective consent state, and revocation. - name: Customers description: Partner-scoped customer records and metadata. - name: Ontologies description: Ontology contracts and filter-field metadata for entries and events. - name: Entries description: Ontology-backed collectible entries using readable external fields. - name: Events description: Non-blocking ordered event and claim ingestion. - name: Profiles description: Consent-aware synchronous reads for claims, intents, and profile facts. - name: Webhooks description: Partner webhook endpoint registration and delivery status. paths: /oauth/authorize: post: tags: - OAuth summary: Create an authorization code with PKCE description: | Partner-backend JSON authorization. This is the flow the SDK and sandbox walkthrough use. `code_challenge_method` must be `S256`. The response returns a one-time `code` to exchange at `/oauth/token`. operationId: authorizeJson requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AuthorizationRequest' example: response_type: code client_id: swa_client_01HZZZ8KQ2J9X2RW7B8Y4D2FPK redirect_uri: https://partner.example.com/swapnice/callback code_challenge: ImpiCd8pp4MveCNnbIS7-GXEtB0xF5HMIDoWqvGA5ig code_challenge_method: S256 customer_id: sandbox_user_001 scope: connections:write consent:write events:write profile:read state: sandbox-walkthrough responses: '200': description: Authorization code issued. content: application/json: schema: $ref: '#/components/schemas/AuthorizationResponse' example: code: swa_code_01HZZZ9N3K state: sandbox-walkthrough redirect_uri: https://partner.example.com/swapnice/callback expires_in: 300 '400': $ref: '#/components/responses/BadRequest' security: [] components: schemas: AuthorizationRequest: type: object required: - response_type - client_id - redirect_uri - code_challenge - code_challenge_method - customer_id - scope properties: response_type: type: string enum: - code client_id: type: string redirect_uri: type: string format: uri code_challenge: type: string minLength: 43 maxLength: 128 code_challenge_method: type: string enum: - S256 customer_id: type: string scope: type: string example: connections:write consent:write events:write profile:read state: type: string maxLength: 512 AuthorizationResponse: type: object required: - code - redirect_uri - expires_in properties: code: type: string state: type: string redirect_uri: type: string format: uri expires_in: type: integer ErrorResponse: type: object required: - error properties: error: type: object required: - code - message - request_id properties: code: type: string example: consent_denied message: type: string request_id: type: string details: type: array items: $ref: '#/components/schemas/ErrorDetail' ErrorDetail: type: object required: - code - message properties: code: type: string message: type: string field: type: string responses: BadRequest: description: Invalid request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: OAuth2: type: oauth2 description: >- OAuth 2.1 authorization code with PKCE. Implicit and password flows are unsupported. flows: authorizationCode: authorizationUrl: https://api.swapnice.com/oauth/authorize tokenUrl: https://api.swapnice.com/oauth/token refreshUrl: https://api.swapnice.com/oauth/token scopes: offline_access: Issue rotating refresh tokens when allowed. apps:read: Read partner app configuration. apps:write: Manage partner app configuration. connections:read: Read connection sessions. connections:write: Create or cancel connection sessions. consent:read: Read consent receipts and effective consent. consent:write: Create and revoke consent. customers:read: Read partner customers. customers:write: Create or update partner customers. ontologies:read: Read ontologies and field maps. ontologies:write: Rebuild ontology filter metadata. entries:read: Read ontology-backed entries. entries:write: Create or update ontology-backed entries. events:read: Read event status. events:write: Ingest events and claims. profile:read: Read resolved profile facts. profiles:read: Read profile resources. claims:read: Read claims. intents:read: Read intents. webhooks:read: Read webhook endpoints. webhooks:write: Manage webhook endpoints. workflows:read: Read async workflow status. tokens:introspect: Introspect tokens. tokens:revoke: Revoke tokens. ````