Begin a GitHub App installation

POST/api/github/app/installations/consent

beginGithubAppConsent

Mints a single-use, 15-minute `state` nonce bound to the calling account and returns the `https://github.com/apps/{slug}/installations/new` URL that carries it. Open `install_url` in a browser — do not fetch it. GitHub redirects back to `GET /api/github/app/installations/callback`, which is where the installation is actually recorded. `return_to` must be an absolute path on this site; an absolute URL, a protocol-relative `//host/path`, a `/\host/path`, or anything carrying a control character is refused with `400`. That validation happens here rather than at the callback, so a hostile value never reaches storage. 404 when this deployment has no GitHub App configured.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/github/app/installations/consent' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{}'

fetch

fetch("https://neosource.dev/api/github/app/installations/consent", {
  method: "POST",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({}),
});

Request bodyrequired

application/json

BeginGithubAppConsentRequest

object

Start the App-installation consent round trip.

return_to: string | null
Where to send the browser once GitHub redirects back. Must be an absolute path on this site (`/settings/integrations/github`); an absolute URL, a protocol-relative `//host/path`, or anything containing a control character is refused with `400`. Absent → the callback lands on the integrations settings page.

Responses

200Where to send the browser

application/json

BeginGithubAppConsentResponse

object

Where to send the browser, and the single-use nonce that ties GitHub's redirect back to the account that started it.

install_urlrequired: string
`https://github.com/apps/{slug}/installations/new?state=…` — open it in the browser, do not fetch it.
staterequired: string
The nonce embedded in `install_url`. Returned so a non-browser client can correlate its own flow; it is single-use and expires in 15 minutes.

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget