Skip to content
Authrim

Replace Agent Access settings for the current tenant.

PUT
/api/admin/settings/agent
Code sample: Shell / cURL 
curl --request PUT \
  --url https://auth.example.com/api/admin/settings/agent \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "enabled": true, "maxTokenTtlSeconds": 1, "elevationMode": "self_reauth", "elevationTtlSeconds": 1, "requestRateLimitPerMinute": 1, "sessionInitializationRateLimitPerMinute": 1, "maxConcurrentSessions": 1, "rateLimitPerMinute": 1, "publicClientStandardRateLimitPerMinute": 1, "highRiskPermissionsAdditional": [ "example" ], "publicClientStandardToolIds": [ "example" ], "bulkCanaryProtected": true }'

Requires admin:agent_settings:write and a human Admin actor. Agent and machine actors cannot modify the Agent Access control-plane settings.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
Media type application/json
object
enabled
required
boolean
maxTokenTtlSeconds
required
integer
>= 60 <= 900
elevationMode
required
string
Allowed values: self_reauth approval both
elevationTtlSeconds
required
integer
>= 60 <= 300
requestRateLimitPerMinute
required

Authenticated MCP HTTP requests admitted per Grant and OAuth client each minute.

integer
>= 10 <= 10000
sessionInitializationRateLimitPerMinute
required

New MCP initialize requests admitted per Grant and OAuth client each minute; it cannot exceed requestRateLimitPerMinute.

integer
>= 1 <= 1000
maxConcurrentSessions
required

Active stateful MCP sessions allowed per Grant and OAuth client.

integer
>= 1 <= 1000
rateLimitPerMinute
required
integer
>= 1 <= 1000
publicClientStandardRateLimitPerMinute
required

Per-grant and per-Tool limit for explicitly opted-in standard-risk public Mode A calls; the effective limit never exceeds rateLimitPerMinute.

integer
>= 1 <= 60
highRiskPermissionsAdditional
required

Known Admin permissions classified as high risk in addition to the built-in list.

Array<string>
<= 256 items unique items
publicClientStandardToolIds
required

Stable standard-risk Tool IDs explicitly enabled for public Mode A clients; read-only remains the default.

Array<string>
<= 256 items unique items
bulkCanaryProtected
required

Reject this tenant when selected as a Bulk Plan canary.

boolean
key
additional properties

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Updated settings and monotonically increasing tenant settings version.

Media type application/json
object
settings
required
object
enabled
required
boolean
maxTokenTtlSeconds
required
integer
>= 60 <= 900
elevationMode
required
string
Allowed values: self_reauth approval both
elevationTtlSeconds
required
integer
>= 60 <= 300
requestRateLimitPerMinute
required

Authenticated MCP HTTP requests admitted per Grant and OAuth client each minute.

integer
>= 10 <= 10000
sessionInitializationRateLimitPerMinute
required

New MCP initialize requests admitted per Grant and OAuth client each minute; it cannot exceed requestRateLimitPerMinute.

integer
>= 1 <= 1000
maxConcurrentSessions
required

Active stateful MCP sessions allowed per Grant and OAuth client.

integer
>= 1 <= 1000
rateLimitPerMinute
required
integer
>= 1 <= 1000
publicClientStandardRateLimitPerMinute
required

Per-grant and per-Tool limit for explicitly opted-in standard-risk public Mode A calls; the effective limit never exceeds rateLimitPerMinute.

integer
>= 1 <= 60
highRiskPermissionsAdditional
required

Known Admin permissions classified as high risk in addition to the built-in list.

Array<string>
<= 256 items unique items
publicClientStandardToolIds
required

Stable standard-risk Tool IDs explicitly enabled for public Mode A clients; read-only remains the default.

Array<string>
<= 256 items unique items
bulkCanaryProtected
required

Reject this tenant when selected as a Bulk Plan canary.

boolean
key
additional properties
version
required
integer
>= 1
Example 
{
  "settings": {
    "elevationMode": "self_reauth"
  }
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}