API reference
2 operations in calendar-sync. Raw spec: openapi.json.
POST
/api/v1/calendar-sync/{connection_id}/authorizePOST /api/calendar-sync/{connection_id}/authorize — begin consent.
Returns the vendor URL to send the operator to. The `state` is a server-generated nonce, NOT a client-supplied value: a client that chose its own state would defeat the CSRF protection entirely.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
connection_id | path | string | Yes |
Responses
| Status | Description |
|---|---|
200 |
Security: bearer
GET
/api/v1/calendar-sync/{provider}/callbackGET /api/calendar-sync/{provider}/callback — the vendor's redirect target.
The `state` is matched against the stored nonce, which is what makes the flow CSRF-safe: a callback whose state does not match the connection this browser started is discarded, so an attacker cannot feed a victim's browser a code obtained under someone else's consent.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
provider | path | string | Yes | |
state | query | string | Yes | |
code | query | — | No | |
error | query | — | No | The operator may decline; the vendor then redirects with an error and no code. That is a user choice, not a failure, so it gets its own message instead of "invalid code". |
Responses
| Status | Description |
|---|---|
200 |