# Approve an app that signs in with Plotwork

> Page: https://docs.plotwork.dev/api/post-user-apps-approve. Index of every page: https://docs.plotwork.dev/llms.txt

Verifies the signed request, makes a hidden key holding only the scopes asked for, for your own account or an organisation where you may publish, ends your earlier connection of the same app to the same account, and answers redirectTo with a one-time code.

`POST /user/apps/approve`

## TL;DR

| Question | Answer |
|---|---|
| What does it do? | Approve an app that signs in with Plotwork. |
| What does it take? | A JSON body of type [`ApproveAppBody`](https://docs.plotwork.dev/api/schemas.md#approveappbody). |
| What does it return? | Status 200 with a body of type [`AppAnswer`](https://docs.plotwork.dev/api/schemas.md#appanswer). |
| What can go wrong? | `400` the request is malformed, expired (oauth.request_expired), or not signed by this API (oauth.request_invalid); `401` not signed in; `403` the origin may not make changes, you are a reader there (orgs.forbidden), the organisation requires single sign-on (orgs.sso_required), the app is for another organisation's members (oauth.app_members_only), or the organisation allows only approved apps (oauth.app_not_allowed); `404` no such organisation, or you are not a member of it; `409` the sign-in link was already answered (oauth.request_used); `429` too many requests; `503` sign in with Plotwork is not available on this server (oauth.unavailable). Every failure uses the one error envelope. |

## What it does

Verifies the signed request, makes a hidden key holding only the scopes asked for, for your own account or an organisation where you may publish, ends your earlier connection of the same app to the same account, and answers redirectTo with a one-time code. Each link is answered once: 409 oauth.request_used.

## Request body

The body has the type [`ApproveAppBody`](https://docs.plotwork.dev/api/schemas.md#approveappbody).

| Field | Type | Required | Description |
|---|---|---|---|
| `request` | `string` | yes | The signed authorization request, exactly as the API put it in the consent page address. at least 1 character; at most 6144 characters. |
| `organisation` | `string` | no | Connect the app to this organisation, by its id, instead of your own account. Any role but reader may; the app then acts in the organisation's library as you, with your role's diagram permissions. |

## Responses

| Status | Meaning | Body |
|---|---|---|
| 200 | Approved; go to redirectTo. | [`AppAnswer`](https://docs.plotwork.dev/api/schemas.md#appanswer) |
| 400 | The request is malformed, expired (oauth.request_expired), or not signed by this API (oauth.request_invalid). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 401 | Not signed in. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 403 | The origin may not make changes, you are a reader there (orgs.forbidden), the organisation requires single sign-on (orgs.sso_required), the app is for another organisation's members (oauth.app_members_only), or the organisation allows only approved apps (oauth.app_not_allowed). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 404 | No such organisation, or you are not a member of it. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 409 | The sign-in link was already answered (oauth.request_used). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 429 | Too many requests. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 503 | Sign in with Plotwork is not available on this server (oauth.unavailable). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |

## Response body

A 200 answer has the type [`AppAnswer`](https://docs.plotwork.dev/api/schemas.md#appanswer).

| Field | Type | Required | Description |
|---|---|---|---|
| `redirectTo` | `string` | yes | The app's redirect address with code (or error), state and iss. Navigate there. |

## See also

| Doc | Why |
|---|---|
| [API reference](https://docs.plotwork.dev/api/reference.md) | Every endpoint, and the error envelope |
| [Schemas](https://docs.plotwork.dev/api/schemas.md) | Every request and response type |
| [Tool reference](https://docs.plotwork.dev/mcp/tools.md) | The operations as callable tools |