Skip to content
Authrim

Create an Agent Access grant.

POST
/api/admin/agent-grants
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/admin/agent-grants \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "client_id": "example", "machine_principal_id": "example", "delegation_mode": "user_consent", "delegator_id": "example", "task_set_id": "example", "task_set_version": 1, "scope_policy_id": "example", "scope_policy_version": 1, "authorization_details": [ { "additionalProperty": "example" } ], "purpose": "example", "expires_at": 1 }'

Creates a tenant-bound delegation after validating the OAuth client, human grantor, client registration for every resolved Agent scope, delegator eligibility, optional Machine Principal boundary, and all permission ceilings. Every Grant must pin a Task Set and Scope Policy pair; the server resolves Tool, permission, scope, resource, and risk snapshots and never accepts caller-supplied permission or scope strings. Grants are never permanent: expires_at defaults to 30 days and must be between one hour and 90 days from creation.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
Media type application/json
object
client_id
required
string
>= 1 characters <= 256 characters
machine_principal_id
string | null
<= 256 characters
delegation_mode

Admin preauthorization requires a Machine Principal and atomically records both delegation and OAuth-client authorization evidence for Mode B.

string
default: user_consent
Allowed values: user_consent admin_pre_authorized
delegator_id
required
string
>= 1 characters <= 256 characters
task_set_id
required
string
>= 1 characters <= 128 characters
task_set_version
required
integer
>= 1
scope_policy_id
required
string
>= 1 characters <= 128 characters
scope_policy_version
required
integer
>= 1
authorization_details
Array<object>
<= 20 items
object
key
additional properties
purpose
string
<= 500 characters
expires_at

Recertification deadline in epoch milliseconds; defaults to 30 days and cannot exceed 90 days.

integer format: int64
key
additional properties

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Agent Grant created. User-consent grants still require interactive consent; admin preauthorized Mode B grants include their authorization records atomically.

Media type application/json
object
grant_id
required
string
status
required
string
Allowed values: active
consent_version
required
integer
>= 1
generation
required
integer
>= 1
consent_required
required
boolean
key
additional properties
Example 
{
  "status": "active"
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

409

Section titled “409 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}