---
title: "Scope Proposal Submit"
method: POST
path: "/v1/mcp/scope-proposal/{proposal_id}/submit"
tags: ["mcp-iframe-scope-proposal"]
---

# Scope Proposal Submit

`POST /v1/mcp/scope-proposal/{proposal_id}/submit`

## Request

- Base URL: `https://api.evidenso.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.evidenso.com/v1/mcp/scope-proposal/{proposal_id}/submit`
- Auth: none declared

Confirm the proposal with the user's final scope_by_integration.

Body shape (JSON in any Content-Type — see below):
    {"scope_by_integration": {<slug>: <ScopeConfig>, ...}}

We read the raw request body and parse JSON ourselves rather than
relying on FastAPI's `Body(...)` because the iframe deliberately
sends the POST WITHOUT `Content-Type: application/json` to keep it
inside the CORS "simple request" rules. Setting Content-Type to
application/json would trigger a browser preflight (OPTIONS), and
Cloudflare quick-tunnel (trycloudflare.com) blocks preflights with
`Origin: https://*.claudemcpcontent.com` — they get 400
"Disallowed CORS origin". Simple requests skip preflight entirely
so the POST gets through to our handler, which returns proper
`Access-Control-Allow-Origin: *` for the response itself.

## Path parameters

- `proposal_id` string, required

## Query parameters

- `sig` string, required: HMAC signature.

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/evidenso/apis/persona-rag-api.md) - [All operations](https://skmtc.dev/evidenso/apis/persona-rag-api/llms.txt) - [OpenAPI document](https://skmtc.dev/evidenso/apis/persona-rag-api/revisions/86408c178d4f?raw)