---
title: "Process Grant Management Request"
method: POST
path: "/api/{serviceId}/gm"
tags: ["Grant Management Endpoint"]
---

# Process Grant Management Request

`POST /api/{serviceId}/gm`

The API is for the implementation of the grant management endpoint which is
defined in "[Grant Management for OAuth 2.0](https://openid.net/specs/fapi-grant-management.html)".

## Path parameters

- `serviceId` string, required

## Request body

- GMRequest
  - `accessToken` string — An access token to introspect.
  - `clientCertificate` string — Client certificate in PEM format, used to validate binding against access tokens using the TLS client certificate confirmation method.
  - `dpop` string — `DPoP` header presented by the client during the request to the resource server. The header contains a signed JWT which includes the public key that is paired with the private key used to sign the JWT. See [OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP)](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop) for details.
  - `htm` string — HTTP method of the request from the client to the protected resource endpoint. This field is used to validate the `DPoP` header. See [OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP)](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop) for details.
  - `htu` string — URL of the protected resource endpoint. This field is used to validate the `DPoP` header. See [OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP)](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop) for details.
  - `gmAction` 'CREATE' | 'QUERY' | 'REPLACE' | 'REVOKE' | 'MERGE' — The grant management action of the device authorization request. The `grant_management_action` request parameter is defined in [Grant Management for OAuth 2.0](https://openid.net/specs/fapi-grant-management.html).
  - `grantId` string — The value of the `grant_id` request parameter of the device authorization request. The `grant_id` request parameter is defined in [Grant Management for OAuth 2.0](https://openid.net/specs/fapi-grant-management.html) , which is supported by Authlete 2.3 and newer versions.
  - `dpopNonceRequired` boolean — The flag indicating whether to require the DPoP proof JWT to include the `nonce` claim. Even if the service's `dpopNonceRequired` property is `false`, calling the `/auth/gm` API with this `dpopNonceRequired` parameter `true` will force the Authlete API to check whether the DPoP proof JWT includes the expected `nonce` value.

## Response `200`

Grant management completed successfully

- GMResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `action` 'OK' | 'NO_CONTENT' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'NOT_FOUND' | 'CALLER_ERROR' | 'AUTHLETE_ERROR' — The next action that the authorization server implementation should take.
  - `responseContent` string — The content that the authorization server implementation is to return to the client application. Its format varies depending on the value of `action` parameter.
  - `dpopNonce` string — Get the expected nonce value for DPoP proof JWT, which should be used as the value of the `DPoP-Nonce` HTTP header.

## Other responses

- `400`
- `401`
- `403`
- `429` — The request exceeded the request rate permitted for the endpoint.
- `500`

## Changes

- **2026-08-03** `7ad74ab64749` — 1 info
  - added the non-success response with the status `429`

[Change history](https://skmtc.dev/authlete/apis/authlete-api/changes/api/:serviceId/gm/post.md)

---

[API](https://skmtc.dev/authlete/apis/authlete-api.md) · [All operations](https://skmtc.dev/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authlete/authlete-api/revisions/7ad74ab64749/schema)