Create a pushed authorization request for Admin Agent access.

POST

/oauth/admin-agent/par

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/oauth/admin-agent/par \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id=mcp_client_123 \
  --data redirect_uri=http://127.0.0.1:34127/callback \
  --data response_type=code \
  --data scope=agent:read \
  --data resource=https://tenant.example.com/mcp \
  --data code_challenge=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk \
  --data code_challenge_method=S256

Creates a single-use RFC 9126 request URI bound to the dedicated Admin Agent authorization journey and the tenant MCP resource. Known clients, HTTPS Client ID Metadata Documents, and restricted public-client registrations are supported. PKCE S256 and the exact RFC 8707 resource parameter are required.

Request Body ^required

Media type application/x-www-form-urlencoded

object

client_id

required

string

redirect_uri

required

string format: uri

response_type

required

string

Allowed value: code

scope

required

Space-separated scopes. Interactive self-service accepts agent:read, agent:user-data:read, and agent:write. Advanced managed Grants may use additional advertised extension scopes.

string

resource

required

Exact tenant MCP resource identifier advertised by protected resource metadata.

string format: uri

state

string

code_challenge

required

string

>= 43 characters <= 128 characters /^[A-Za-z0-9_-]+$/

code_challenge_method

required

string

Allowed value: S256

client_secret

string

client_assertion

string

client_assertion_type

string

Allowed value: urn:ietf:params:oauth:client-assertion-type:jwt-bearer

authorization_details

JSON-encoded RFC 9396 array, additionally bounded to 16 KiB and 20 entries at runtime. Only type authrim_admin_agent and max_subjects_per_call from 1 to 50 are accepted in this phase; repeated entries use the narrowest limit.

string

<= 16384 characters

key

additional properties

Example

client_id=mcp_client_123&redirect_uri=http%3A%2F%2F127.0.0.1%3A34127%2Fcallback&response_type=code&scope=agent%3Aread&resource=https%3A%2F%2Ftenant.example.com%2Fmcp&code_challenge=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk&code_challenge_method=S256

Responses

201

Successful JSON response.

Media type application/json

object

request_uri

required

string

expires_in

required

integer

Example

{
  "request_uri": "urn:ietf:params:oauth:request_uri:par_123",
  "expires_in": 90
}

400

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

404

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

500

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

503

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}