Skip to content
Authrim

Approve or deny an Admin Agent authorization request.

POST
/oauth/admin-agent/authorize
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/oauth/admin-agent/authorize \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --cookie authrim_admin_session=<authrim_admin_session> \
  --data request_uri=urn:ietf:params:oauth:request_uri:par_123 \
  --data client_id=mcp_client_123 \
  --data decision=approve

Repeats all live checks, atomically consumes the dedicated PAR request, and redirects to the registered client. Approval records delegation and OAuth client consent with a synchronous audit event before issuing a dedicated admin-subject authorization code.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
Media type application/x-www-form-urlencoded
object
request_uri
required
string
client_id
required
string
decision
required
string
Allowed values: approve deny
scope_read

Required interactive self-service configuration-read consent.

string
Allowed value: agent:read
scope_user_data_read

Optional masked user-data consent selected by the Admin.

string
Allowed value: agent:user-data:read
scope_write

Optional configuration-change consent selected by the Admin.

string
Allowed value: agent:write
key
additional properties
Example 
request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3Apar_123&client_id=mcp_client_123&decision=approve

Responses

Section titled “ Responses ”

302

Section titled “302 ”

Redirect to the exact registered redirect URI with code or OAuth error.

Headers

Section titled “Headers ”
Location
string format: uri

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

500

Section titled “500 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}