# GET /authenticationserver/authorize

> Request an authorization code or access token like GET /oauth/authorize, redirected to the redirect URI, but never forwarded to other authentication servers.

- **Product:** DS Server
- **Section:** Documentation
- **Kind:** Endpoint
- **Path:** DS Server > API Reference > Web API > Authentication Server > /authorize > GET /authenticationserver/authorize
- **733 words**
- **Web URL:** https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/authorize/get/
- **LLMs URL:** https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/authorize/get/llms.txt
- **LLMs-Full URL:** https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/authorize/get/llms-full.txt

---

`GET` `https://example.com/authenticationserver/authorize`

### Description

Requests an authorization code or an access token like [GET /oauth/authorize](https://docs.textcontrol.com/ds-server/reference/web-api/oauth/authorize/get/llms-full.txt), with the same parameters and responses, but without forwarding an unsuccessful request to the registered authentication servers. The endpoint was added in DS Server 3.1.0.

When `GET /oauth/authorize` can't authorize a request, for example because it doesn't know the client ID, DS Server sends the query parameters to `/authenticationserver/authorize` of the registered authentication servers.

### Examples

The following sample requests an authorization code using the "code" flow. The authorization code is returned to the given redirect URI.

```bash
# Request:
curl --request GET 'https://trial.dsserver.io/authenticationserver/authorize?redirect_uri=https://localhost:5001/callback&client_id=yourclientid&response_type=code&state=teststate'

# Response:
HTTP/1.1 302 Found
Location: https://localhost:5001/callback?code=g0ZGZmNjVmOWIjNTk2NTk4ZTYyZGI3&state=teststate
```

### Request Parameters

| Name | Type | Value | Optional |
|---|---|---|---|
| client\_id | String | The client ID of the security profile. | no |
| response\_type | String | The type of the requested response. Supported values are "code" and "token". | no |
| redirect\_uri | String | The redirect URI must match one of the authorized redirect URIs of the security profile. Upper and lower case are ignored; the scheme, host, port, path and query string must be the same. | no |
| state | String | DS Server echoes back the state value in the redirect. | yes |
| scope | String | The scope of the request. | yes |

### Success Response

| Status | Description |
|---|---|
| 302 | On success, the request is redirected to the given redirect URI with the query parameters `code` and `state` ("code") or `access_token`, `token_type`, `expires_in` and `state` ("token"). |

### Error Response

| Status | Description |
|---|---|
| 400 | A 400 (Bad Request) with the plain text (`text/plain`) "Missing, invalid or mismatching redirection URI." is returned, if the redirect URI is missing or is not one of the authorized redirect URIs of the security profile. |
| 302 | Other errors are returned to the redirect URI in the query parameters `error`, `error_description` and `state`: `unauthorized_client` with an empty description for an unknown client ID, and `unsupported_response_type` "Unsupported response type." for a response type other than "code" or "token". |
| 302 | Without a client ID or a response type, the `Location` header holds only the query string `?error=invalid_request&error_description=...` with "Missing 'client\_id' parameter." or "Missing 'response\_type' parameter.", without the redirect URI and without `state`. |

---

## Nearby

- **Previous:** [/authenticationserver/authorize](https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/authorize/llms-full.txt)
- **Next:** [.NET API](https://docs.textcontrol.com/ds-server/reference/dotnet-api/llms-full.txt)