I was working around with Mule project using RAML and API Manager.
by following [procedure given here](http://www.mulesoft.org/documentation/display/current/OAuth+2.0+Provider+and+Token+Validation+Policies#OAuth2.0ProviderandTokenValidationPolicies-ApplyingYourSecurityManagerandOAuthPolicies)

AM using API Manager to handle the service tied with characteristics like

* Simple Security Manager,
* OAuth 2.0 Provider and
* OAuth 2.0 Access Token Enforcement.

I have a separate flow for redirection which does following

1. set 'status' to 302
2. set 'Location' to URL below

`http://localhost:8081/org/oauth/token?grant_type=authorization_code&amp;&amp;client_id=53a406c3e4b0624da8246eed&amp;client_secret=myclientsecret&amp;code=#[message.inboundProperties.code]&amp;redirect_uri=http://localhost:8081/raml-api-with-oauth/redirect`

All goes well till here.

But when I try to hit the url for access token I see a message

{"error":"unauthorized\_client","error\_description":""}

to sumup my question:

1. please help me with 'OAuth dance' procedure
2. How do i set a valid contract with the API to facilitate the communication of the clientId and clientSecret necessary for the OAuth dance.

Please help me where am going wrong.

RAML code:

```
#%RAML 0.8
title: raml-api-with-oauth
version: v1
baseUri: http://localhost:8081/raml-api-with-oauth
securedBy: [oauth_2_0]
securitySchemes:
    - oauth_2_0:
        description: |
            This supports OAuth 2.0 for authenticating all API requests.
        type: OAuth 2.0
        describedBy:
            headers:
                Authorization:
                    description: |
                       Used to send a valid OAuth 2 access token. Do not use
                       with the "access_token" query string parameter.
                    type: string
            queryParameters:
                access_token:
                    description: |
                       Used to send a valid OAuth 2 access token. Do not use together with
                       the "Authorization" header
                    type: string
            responses:
                401:
                    description: |
                        Bad or expired token. This can happen if the user or Dropbox
                        revoked or expired an access token. To fix, you should re-
                        authenticate the user.
                403:
                    description: |
                        Bad OAuth request (wrong consumer key, bad nonce, expired
                        timestamp...). Unfortunately, re-authenticating the user won't help here.
                404:
                  description: Unauthorized
        settings:
          authorizationUri: org/oauth/authorize
          accessTokenUri: org/oauth/token
          authorizationGrants: [code,token]
          scopes:
            - "READ_RESOURCE"
            - "POST_RESOURCE"
            - basic
            - comments
            - relationships
            - likes
mediaType: application/json
/employee:
  get:
    description:
      This is a Get Call which throws some response in json.
    responses:
      200:
        body:
          application/json:
            example: |
              {
                "empcode" : 1,
                "ename": "Rafiq", 
                "company" : "org"
              }

```