Review an Admin Agent authorization request.

GET

/oauth/admin-agent/authorize

Code sample: Shell / cURL

curl --request GET \
  --url 'https://auth.example.com/oauth/admin-agent/authorize?client_id=example&response_type=code&code_challenge_method=S256' \
  --cookie authrim_admin_session=<authrim_admin_session>

Requires a human Admin UI session. A request_uri resolves the dedicated PAR request without consuming it. A direct Authorization Code with PKCE request is first validated and converted to the same bounded PAR journey with a 302 redirect. RFC 8252 loopback IP callbacks may vary only by port. The consent step displays the exact tenant and lets the Admin approve configuration read, masked user-data read, and configuration write independently. For an interactive client without a Grant, the server atomically creates a seven-day system-managed Grant, Task Set, Scope Policy, both consent records, and audit evidence. Existing managed Grants remain subject to their preconfigured boundary.

Authorizations

• adminSessionCookie

Parameters

Query Parameters

request_uri

string

client_id

required

string

response_type

string

Allowed values: code

redirect_uri

string format: uri

scope

string

resource

string format: uri

Exact MCP resource. Repeated identical values are normalized.

state

string

code_challenge

string

code_challenge_method

string

Allowed values: S256

authorization_details

string

<= 16384 characters

Bounded authrim_admin_agent RAR array.

Responses

200

HTML consent page.

Media type text/html

string

302

Direct request normalized to the dedicated PAR journey.

Headers

Location

string format: uri

400

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

404

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

503

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}