AlmondTill/G3N API

On this page

approveConnectorAuthorization

mutation · in the family Your own session

What it does

Approve or deny an AI-assistant sign-in — approving connects the assistant to ONE organization as you, with the access you choose (Read, or Read and make changes), and sends it its sign-in code.

Decide ONE connector authorize request: the FULL params re-validate from scratch (the review is never trusted). APPROVE (orgId REQUIRED — an eligible org: ACTIVE, in your group, where you hold a role; access: read [the default] or read_changes) connects the assistant AS YOU: a PERSON-bound grant (no key, no secret — its token is your own session, minted at the token endpoint and on every refresh), expiring twelve months on, plus the single-use PKCE-bound code, answering {redirectTo} with code+state+iss; DENY answers {redirectTo} with error=access_denied+state+iss (RFC 9207 — iss rides every response). At most 10 connected assistants per person per organization (VALIDATION otherwise). Disconnect later with revokeConnectorGrant. Template class SELF.

What happens

The assistant acts as you, within your own role’s access, through the shop’s own authorization: on Read it only reads; on Read and make changes every change is first shown to you as a rehearsal and happens only when you confirm it. You can disconnect it at any time from Connect your AI assistant; the connection expires after twelve months.

Careful

Approve names exactly ONE active organization where you hold a role; at most ten connected assistants per person per organization; the redirect goes only to the client’s registered address.

Who may call it

Capability area: Your own session — What every signed-in person may do for themselves — their session, their profile and their own work.

Arguments

NameTypeRequiredNotes
decisionString String!yesNo further notes.
orgIdIDnoNo further notes.
accessStringnoNo further notes.
responseTypeString String!yesNo further notes.
clientIdString String!yesNo further notes.
redirectUriString String!yesNo further notes.
codeChallengeString String!yesNo further notes.
codeChallengeMethodString String!yesNo further notes.
stateStringnoNo further notes.
scopeStringnoNo further notes.
resourceStringnoNo further notes.

Returns

ConnectorAuthorizationVerdict ConnectorAuthorizationVerdict! — The consent verdict's redirect instruction: send the browser HERE — code+state+iss on approve, error=access_denied+state+iss on deny (RFC 9207: iss rides EVERY authorization response).

Example request

mutation ExampleApproveConnectorAuthorization($decision: String!, $orgId: ID, $responseType: String!, $clientId: String!, $redirectUri: String!, $codeChallenge: String!, $codeChallengeMethod: String!) {
  approveConnectorAuthorization(decision: $decision, orgId: $orgId, responseType: $responseType, clientId: $clientId, redirectUri: $redirectUri, codeChallenge: $codeChallenge, codeChallengeMethod: $codeChallengeMethod) {
    redirectTo
  }
}

Variables:

{
  "decision": "<decision>",
  "orgId": "01900000-0000-7000-8000-b0cf4f3c0000",
  "responseType": "<response type>",
  "clientId": "<client id>",
  "redirectUri": "<redirect uri>",
  "codeChallenge": "<code challenge>",
  "codeChallengeMethod": "<code challenge method>"
}

Send it with the envelope naming the version: "extensions": {"at": {"version": {"name":"genesis","number":0}}}.

Example response

{
  "data": {
    "approveConnectorAuthorization": {
      "redirectTo": "<redirect to>"
    }
  },
  "extensions": {
    "at": {
      "callId": "01EXAMPLE-CALL-ID",
      "version": {
        "requested": {
          "name": "genesis",
          "number": 0
        },
        "serviced": {
          "name": "genesis",
          "number": 0
        }
      }
    }
  }
}

Errors this call can answer

Used in