Issue Mode A tokens or exchange a Mode B machine actor delegation.

POST

/oauth/admin-agent/token

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/oauth/admin-agent/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data code=example \
  --data redirect_uri=https://example.com \
  --data client_id=example \
  --data client_secret=example \
  --data client_assertion=example \
  --data client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
  --data code_verifier=example \
  --data resource=https://example.com

Consumes only authorization codes bound to the dedicated Admin Agent issuer, admin subject namespace, exact tenant MCP resource, Grant generation, and consent version. The endpoint rechecks client authentication, PKCE, the active Grant, both consent records, current delegator permissions, scopes, and optional DPoP before issuing a tenant-capped access token and rotating refresh token. Refresh grants additionally require an active DB_ADMIN family row and the current RefreshTokenRotator version; public clients have a 12-hour idle and 7-day absolute limit, while confidential clients have a 24-hour idle and 30-day limit.

Request Body ^required

Media type application/x-www-form-urlencoded

One of:

object

object

grant_type

required

string

Allowed value: authorization_code

code

required

string

/^aac_/

redirect_uri

required

string format: uri

client_id

required

string

client_secret

string

client_assertion

string

client_assertion_type

string

Allowed value: urn:ietf:params:oauth:client-assertion-type:jwt-bearer

code_verifier

required

string

>= 43 characters <= 128 characters

resource

required

string format: uri

key

additional properties

object

object

grant_type

required

string

Allowed value: refresh_token

refresh_token

required

string

scope

string

client_id

required

string

client_secret

string

client_assertion

string

client_assertion_type

string

Allowed value: urn:ietf:params:oauth:client-assertion-type:jwt-bearer

resource

string format: uri

key

additional properties

object

object

grant_type

required

string

Allowed value: urn:ietf:params:oauth:grant-type:token-exchange

subject_token

required

string

subject_token_type

required

string

Allowed value: urn:authrim:token-type:agent-delegation

actor_token

required

string

actor_token_type

required

string

Allowed value: urn:ietf:params:oauth:token-type:access_token

requested_token_type

string

Allowed value: urn:ietf:params:oauth:token-type:access_token

client_id

string

scope

string

resource

required

string format: uri

key

additional properties

Responses

200

Successful JSON response.

Media type application/json

object

access_token

required

string

token_type

required

string

Allowed values: Bearer DPoP

expires_in

required

integer

id_token

string

refresh_token

string

refresh_token_expires_in

integer

refresh_token_expires_at

string format: date-time

refresh_token_expires_at_unix

integer

scope

string

issued_token_type

string

authorization_details

RFC 9396 authorization details preserved in the issued token grant.

Array<object>

object

type

required

string

key

additional properties

key

additional properties

Example

{
  "access_token": "eyJhbGciOiJSUzI1NiJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "id_token": "eyJhbGciOiJSUzI1NiJ9...",
  "refresh_token": "refresh_123",
  "scope": "openid profile"
}

400

OAuth error response.

Media type application/json

object

error

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

401

OAuth error response.

Media type application/json

object

error

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

404

OAuth error response.

Media type application/json

object

error

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

503

OAuth error response.

Media type application/json

object

error

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example"
}