---
title: "Approve an agent and mint its authorization code"
method: POST
path: "/agent/consent"
tags: ["Agents"]
---

# Approve an agent and mint its authorization code

`POST /agent/consent`

## Request

- Base URL: `https://api.customdomain.ai/v1`
- URL: `https://api.customdomain.ai/v1/agent/consent`
- Auth: HTTP bearer

Called by the console's server after a person signs in and approves, with that member's tenant API key (a widget token is refused, because it lives in browsers). The key's member needs `agent:manage` (owners and admins), and `member_id` must belong to the workspace. The approved scopes are a subset of what was requested. The grant is bound to one `application_id` of the workspace. `domains:purchase` also needs a `spend_cap_cents` and a saved card. Persistent access is the default; `persist: false` ends it after `expires_days`. The authorization code is single use and is exchanged at `POST /oauth/agent/token`.

## Request body

- AgentConsentApproval: The body is decoded with unknown fields rejected.
  - `request` string, required: The consent request id the browser arrived with (`aqr_...`).
  - `member_id` string, required: The member who approves. It must belong to the workspace.
  - `application_id` string, required: The one application of the workspace the agent will act within.
  - `scopes` AgentScope[], required: What is approved, a subset of what the agent asked for.
  - `can_purchase` boolean: Ignored. Purchase is allowed exactly when `domains:purchase` is among the scopes.
  - `spend_cap_cents` integer: The monthly spend cap in US cents. Required, and above 0, with `domains:purchase`, which also needs a saved card (`409` without one).
  - `persist` boolean: True (the default) keeps the access until it is revoked. False ends it after `expires_days`.
  - `expires_days` integer: With `persist: false`, days until the grant expires.

## Response `200`

The redirect for the agent, with its code

- AgentConsentResult
  - `redirect_uri` string, required: Where to send the person: the agent's redirect URI with `code` and `state` added.
  - `code` string, required: The single use authorization code. It lives 5 minutes.
  - `state` string
  - `grant_id` string, required

## Other responses

- `400`: Error envelope: {code, title, details}.
- `401`: Error envelope: {code, title, details}.
- `403`: Error envelope: {code, title, details}.
- `409`: Error envelope: {code, title, details}.
- `503`: Error envelope: {code, title, details}.

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)