/admin/oauth-apps/{appId}/reviewApproving makes the scopes the app has now work for every collector; a write or store scope added later needs another review. Rejecting needs a note for the developer.
collector.reviewOAuthApp()X-Request-IdappIdstring (uuid)requireddecisionenumrequiredapproverejectscopesarray of stringrequiredThe scopes you reviewed (the app’s scopes as you saw them). If the app has changed since, nothing is decided: 409 app_changed.
at most 40 items
notestring or nullFor the developer. Required to reject.
at most 1000 characters
200OKThe app as reviewed.
invalid_request: The query or body doesn’t match the schema (see errors[]).
invalid_json: The body isn’t JSON.
not_found: Not an admin (moderator): the same 404 as a missing route.
app_changed: Its scopes changed since you saw them: review it again.
payload_too_large: The body is over 1,048,576 bytes, this operation’s limit.
rate_limitedtemporarily_blocked
rate_limited: Over the caller’s limit: the per-minute burst or the per-day quota (RateLimit headers; wait Retry-After seconds).
temporarily_blocked: Too many refused requests in a row: blocked for a while (Retry-After says how long).
internal: Something went wrong on our side (quote the requestId).