Skip to content
Authrim

Issue a JIT one-time Agent delegation JWT for a DPoP-bound Machine Principal.

POST
/oauth/admin-agent/delegation
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/oauth/admin-agent/delegation \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_id=example \
  --data scope=example \
  --data resource=https://example.com

Requires a DPoP-scheme Admin Machine Access Token and matching DPoP proof. Rechecks the active pre-authorized Grant, explicit tenant scope, Machine Principal and credential, delegator permission ceiling, principal permission ceiling, scope, and feature flag. The returned JWT is audience-bound to the Admin Agent token endpoint, expires within five minutes, and is consumed once during RFC 8693 exchange.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
Media type application/x-www-form-urlencoded
object
grant_id
required
string
>= 1 characters <= 128 characters
scope
string
resource
string format: uri
key
additional properties
Example generated
grant_id=example&scope=example&resource=https%3A%2F%2Fexample.com

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Short-lived one-time delegation JWT.

Media type application/json
object
delegation_token
required
string
delegation_token_type
required
string
Allowed value: urn:authrim:token-type:agent-delegation
expires_in
required
integer
<= 300
scope
required
string
Example 
{
  "delegation_token_type": "urn:authrim:token-type:agent-delegation"
}

400

Section titled “400 ”

OAuth error response.

Media type application/json
object
error
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example"
}

401

Section titled “401 ”

OAuth error response.

Media type application/json
object
error
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example"
}

404

Section titled “404 ”

OAuth error response.

Media type application/json
object
error
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example"
}