Docs
OverviewGuidesZero & MCPAPI referenceChangelog
OAuth

Decide Consent Request

Approve (a grant for `workspace_id` and a one-time code, 5 minutes) or deny. Granting `admin` needs the admin role; a suspended workspace can't be connected (403 `workspace_suspended`). Audited as `oauth.granted`.

API key access

Not available to API keys or connected apps: only a signed-in person can call this route.
POST/api/v1/oauth/consent

Authorization

AuthorizationBearer <token>

Access token from /api/v1/auth/login, or an API key (ro_pat_..., RO-176) from /api/v1/workspaces/current/api-keys: the key implies its workspace and needs the route's scope. MCP connectors (/api/v1/mcp only) may use an OAuth access token (ro_oat_..., RO-284).

In: header

Request Body

requeststring

The signed request from the consent URL.

Length1 <= length <= 16384
approveboolean
workspace_id?string | null

Required to approve: a workspace the user belongs to (not suspended).

Formatuuid

Response Body

curl -X POST "http://localhost:8000/api/v1/oauth/consent" \  -H "Content-Type: application/json" \  -d '{    "request": "string",    "approve": true  }'
{
  "redirect_to": "string"
}
Empty
Empty
{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "input": null,
      "ctx": {}
    }
  ]
}

Authorize

The authorization endpoint (browser). A valid request is a 302 to the web app's consent screen (`/oauth/consent?request=<signed request>`, 10 minutes); an unknown client or redirect URI is a 302 to the consent screen with `error`; any other problem is a 302 back to the client's redirect URI with `error` and `state` (RFC 6749 §4.1.2.1).

Disconnect App

Revoke the grant and every token of it at once (the app must ask for consent again). Your own apps, or any for admins. Audited as `oauth.revoked`.