> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timbrix.mx/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve authorization and generate code

> ⚠️ SECURITY: User approves OAuth authorization request. Generates an authorization code for the client application. Rate limit: 20 requests per minute.



## OpenAPI

````yaml https://api.timbrix.mx/api/openapi.json post /oauth/authorize/approve
openapi: 3.0.0
info:
  title: Timbrix API
  description: >-
    API de facturación electrónica CFDI 4.0 para México, con servidor OAuth2
    para gestionar organizaciones, miembros y webhooks. Compatible con agentes
    de IA — ver la extensión `x-ai-agent-friendly` en la raíz de esta spec.


    REST API with OAuth2 server for managing organizations, members, and
    webhooks.
  version: '1.0'
  contact: {}
servers: []
security: []
tags:
  - name: organizations
    description: Organization management endpoints
  - name: oauth
    description: OAuth2 authentication and authorization
  - name: webhooks
    description: Webhook configuration and delivery
  - name: users
    description: User information endpoints
  - name: api-keys
    description: API Keys management and validation
paths:
  /oauth/authorize/approve:
    post:
      tags:
        - oauth
      summary: Approve authorization and generate code
      description: >-
        ⚠️ SECURITY: User approves OAuth authorization request. Generates an
        authorization code for the client application. Rate limit: 20 requests
        per minute.
      operationId: OAuthController_approveAuthorization
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApproveAuthorizationDto'
      responses:
        '201':
          description: >-
            Authorization approved. Returns authorization code, state, and
            redirect_uri for client redirect.
        '400':
          description: Invalid request parameters.
        '401':
          description: Authentication required or invalid authorization request.
      security:
        - bearer: []
components:
  schemas:
    ApproveAuthorizationDto:
      type: object
      properties:
        clientId:
          type: string
          description: OAuth application client ID
          example: app_abc123...
        redirectUri:
          type: string
          description: Redirect URI registered with the application
          example: https://example.com/oauth/callback
        scopes:
          description: Approved OAuth scopes
          example:
            - read:user
            - read:organization
          type: array
          items:
            type: string
        state:
          type: string
          description: CSRF protection state parameter
          example: random_state_abc123
        codeChallenge:
          type: string
          description: PKCE code challenge (optional, from authorization request)
          example: E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
        codeChallengeMethod:
          type: string
          description: PKCE code challenge method (optional, from authorization request)
          example: S256
          enum:
            - S256
            - plain
      required:
        - clientId
        - redirectUri
        - scopes
        - state
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http

````