Skip to content
Authrim

Create a pushed authorization request for Admin Agent access.

POST
/oauth/admin-agent/par
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/oauth/admin-agent/par \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id=mcp_client_123 \
  --data redirect_uri=http://127.0.0.1:34127/callback \
  --data response_type=code \
  --data scope=agent:read \
  --data resource=https://tenant.example.com/mcp \
  --data code_challenge=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk \
  --data code_challenge_method=S256

Creates a single-use RFC 9126 request URI bound to the dedicated Admin Agent authorization journey and the tenant MCP resource. Known clients, HTTPS Client ID Metadata Documents, and restricted public-client registrations are supported. PKCE S256 and the exact RFC 8707 resource parameter are required.

Request Body required

Section titled “Request Body required ”
Media type application/x-www-form-urlencoded
object
client_id
required
string
redirect_uri
required
string format: uri
response_type
required
string
Allowed value: code
scope
required

Space-separated scopes. Interactive self-service accepts agent:read, agent:user-data:read, and agent:write. Advanced managed Grants may use additional advertised extension scopes.

string
resource
required

Exact tenant MCP resource identifier advertised by protected resource metadata.

string format: uri
state
string
code_challenge
required
string
>= 43 characters <= 128 characters /^[A-Za-z0-9_-]+$/
code_challenge_method
required
string
Allowed value: S256
client_secret
string
client_assertion
string
client_assertion_type
string
Allowed value: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
authorization_details

JSON-encoded RFC 9396 array, additionally bounded to 16 KiB and 20 entries at runtime. Only type authrim_admin_agent and max_subjects_per_call from 1 to 50 are accepted in this phase; repeated entries use the narrowest limit.

string
<= 16384 characters
key
additional properties
Example 
client_id=mcp_client_123&redirect_uri=http%3A%2F%2F127.0.0.1%3A34127%2Fcallback&response_type=code&scope=agent%3Aread&resource=https%3A%2F%2Ftenant.example.com%2Fmcp&code_challenge=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk&code_challenge_method=S256

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Successful JSON response.

Media type application/json
object
request_uri
required
string
expires_in
required
integer
Example 
{
  "request_uri": "urn:ietf:params:oauth:request_uri:par_123",
  "expires_in": 90
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

500

Section titled “500 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}