---
updatedAt: 2026-05-04T13:07:32.000Z
agentTools:
  projectIndex: https://developer.candis.io/llms.txt
---

# Get Authorization code

Directs the user to this endpoint to begin the authorization process. The client must send the response_type, client_id, redirect_uri, and optionally the scope parameter.

# OpenAPI definition

```json
{
  "openapi": "3.0.0",
  "paths": {
    "/auth": {
      "get": {
        "tags": [
          "OAuth 2.0 Authorization Code Flow"
        ],
        "summary": "Get Authorization code",
        "description": "Directs the user to this endpoint to begin the authorization process. The client must send the response_type, client_id, redirect_uri, and optionally the scope parameter.",
        "parameters": [
          {
            "name": "response_type",
            "in": "query",
            "required": true,
            "description": "Specifies the type of response expected by the client.",
            "schema": {
              "type": "string",
              "enum": [
                "code"
              ]
            }
          },
          {
            "name": "client_id",
            "in": "query",
            "required": true,
            "description": "The client identifier as registered in the OAuth provider's system.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "redirect_uri",
            "in": "query",
            "required": true,
            "description": "The URI to which the response will be sent after authorization.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "scope",
            "in": "query",
            "required": false,
            "description": "A space-delimited list of scopes that the application is requesting access to.<br><br>exports: Export postings from the organization<br>core_data: Access to the organization's core data.<br>offline_access: This scope value requests that when a Refresh Token be issued, offline access should also be enabled too. This in turn would grant a longer life span to the refresh token.",
            "schema": {
              "type": "string",
              "enum": [
                "exports",
                "core_data",
                "offline_access"
              ]
            }
          }
        ],
        "responses": {
          "302": {
            "description": "Redirection to the specified redirect_uri with a code."
          }
        }
      }
    }
  },
  "info": {
    "title": "Candis API",
    "version": "1.0",
    "description": "",
    "contact": {},
    "x-logo": {
      "url": "https://www.candis.io/img/candis-logo-black.svg",
      "altText": "Candis GmbH"
    }
  },
  "tags": [
    {
      "name": "OAuth 2.0 Authorization Code Flow",
      "description": "Endpoints for authorization and token exchange.",
      "externalDocs": {
        "description": "Related (external) documentation OAuth 2.0 Authorization Code Flow.",
        "url": "https://oauth.net/2/grant-types/authorization-code/"
      }
    }
  ],
  "servers": [
    {
      "url": "https://api.candis.io"
    },
    {
      "description": "Candis API Authorization Server.",
      "url": "https://id.my.candis.io/auth/realms/candis/protocol/openid-connect"
    }
  ]
}
```