[keycloak-user] Authorization of action in application (client of KC)

I have an use case where I have to authorize an action in my application taken by the user. Here is how it should go: The user is logged in at KC and using my application. Now, my application would need to authorize one user action by sending the user to KC, where he would enter his OTP, and then, my application would get some kind of proof that user authorized the action (I don't know what should that be, yet). Do you have any idea how this could be achieved using KC? I guess action SPI would somehow be used. Thank you in advance, Nikola