Check whether the caller agreed to share data with a client
curl --request GET \
--url https://web-api.dev.soxai.site/oauth2/agreement \
--header 'Authorization: Bearer <token>'import requests
url = "https://web-api.dev.soxai.site/oauth2/agreement"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://web-api.dev.soxai.site/oauth2/agreement', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"agree_flg": true,
"agree_updated_at": "2026-09-01T12:00:00+00:00"
}{
"error": "http-error",
"error_msg": "Invalid authentication credentials. <reason>"
}{
"error": "forbidden",
"error_msg": "Not enough permission"
}{
"error": "not-found",
"error_msg": "Client not found."
}{
"error": "unprocessable-entity",
"error_msg": "body.<field>: <validation message>"
}{
"error": "rate-limited",
"error_msg": "Rate limit exceeded. Retry after <n> seconds."
}{
"error": "internal-server-error",
"error_msg": "Failed to fetch data: <error_message>"
}OAuth2
Check whether the caller agreed to share data with a client
Not callable with a Sandbox key
A request authenticated with a Sandbox soxai-api-key is answered 403 This endpoint is not available in the sandbox., because it belongs to the separate OAuth2 authentication flow. It is published here because the Sandbox runs the same build; use it in Production. See Sandbox.
Report whether the caller has agreed to share their SOXAI data with a given OAuth2 client, and when they last changed that answer.
Parameters
client_id(query, required) - the OAuth2 client to ask about.
Response
200{"agree_flg": bool, "agree_updated_at": ...}.agree_flgis about the caller; it says nothing about any other user’s consent.
Errors
| Status | Condition |
|---|---|
| 404 | client_id is not registered |
Authorization
- Scheme:
Authorization: Bearer <idToken>orsoxai-api-key: <api key>. - Any authenticated caller. The answer is the caller’s own consent record and nobody else’s, so no role is required.
GET
/
oauth2
/
agreement
Check whether the caller agreed to share data with a client
curl --request GET \
--url https://web-api.dev.soxai.site/oauth2/agreement \
--header 'Authorization: Bearer <token>'import requests
url = "https://web-api.dev.soxai.site/oauth2/agreement"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://web-api.dev.soxai.site/oauth2/agreement', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"agree_flg": true,
"agree_updated_at": "2026-09-01T12:00:00+00:00"
}{
"error": "http-error",
"error_msg": "Invalid authentication credentials. <reason>"
}{
"error": "forbidden",
"error_msg": "Not enough permission"
}{
"error": "not-found",
"error_msg": "Client not found."
}{
"error": "unprocessable-entity",
"error_msg": "body.<field>: <validation message>"
}{
"error": "rate-limited",
"error_msg": "Rate limit exceeded. Retry after <n> seconds."
}{
"error": "internal-server-error",
"error_msg": "Failed to fetch data: <error_message>"
}Authorizations
HTTPBearerSoxaiApiKey
Response
Whether the caller has agreed to share data with that client, and when. It says nothing about any other user's consent.