Describe authorization request
Validate an app's authorization request for the consent page, and stash it for the signed-in person. A POST because it stashes: what is approved is exactly what was validated here
Approve authorization request
Let the app act as the signed-in person, as far as the chosen scopes allow. Once the account has a strong second factor, this needs one verified in the last five minutes
Deny authorization request
Turn the app away. It is told the person said no
List OAuth clients
Every app registered with the station, by an operator or by itself
Create OAuth client
Register an app by hand. The secret, for an app that keeps one, is in this response and nowhere else
Revoke OAuth client
Withdraw an app. Every person's approval of it ends, and so does every token it holds
List OAuth grants
The apps the signed-in person has let act as them
Revoke OAuth grant
Disconnect an app. Every token it holds for this person stops working at once