Skip to content
Authrim

Review an Admin Agent authorization request.

GET
/oauth/admin-agent/authorize
Code sample: Shell / cURL 
curl --request GET \
  --url 'https://auth.example.com/oauth/admin-agent/authorize?client_id=example&response_type=code&code_challenge_method=S256' \
  --cookie authrim_admin_session=<authrim_admin_session>

Requires a human Admin UI session. A request_uri resolves the dedicated PAR request without consuming it. A direct Authorization Code with PKCE request is first validated and converted to the same bounded PAR journey with a 302 redirect. RFC 8252 loopback IP callbacks may vary only by port. The consent step displays the exact tenant and lets the Admin approve configuration read, masked user-data read, and configuration write independently. For an interactive client without a Grant, the server atomically creates a seven-day system-managed Grant, Task Set, Scope Policy, both consent records, and audit evidence. Existing managed Grants remain subject to their preconfigured boundary.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “Query Parameters ”
request_uri
string
client_id
required
string
response_type
string
Allowed values: code
redirect_uri
string format: uri
scope
string
resource
string format: uri

Exact MCP resource. Repeated identical values are normalized.

state
string
code_challenge
string
code_challenge_method
string
Allowed values: S256
authorization_details
string
<= 16384 characters

Bounded authrim_admin_agent RAR array.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

HTML consent page.

Media type text/html
string

302

Section titled “302 ”

Direct request normalized to the dedicated PAR journey.

Headers

Section titled “Headers ”
Location
string format: uri

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}