---
title: "Consent"
method: POST
path: "/v1/oauth/consent"
---

# Consent

`POST /v1/oauth/consent`

## Request

- Base URL: `https://api.app.membase.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.app.membase.ai/v1/oauth/consent`
- Auth: none declared

Approval step of the MCP OAuth flow. Three roles share it:
- owner exposing a set of their memory views → mints a provision_view_binding;
- owner exposing their own agent → mints a provision_agent_binding
  (the owner gate lives in provision_*, which is @owner_only);
- buyer connecting a purchased listing (kind='listing') → re-issues the
  existing cross-tenant listing credential, gated by an active grant in
  reissue_memory_listing_credential (never charges, never provisions new
  access). Either way the token is wrapped in a one-time code.

## Request body

- ConsentRequest
  - `client_id` string, required
  - `redirect_uri` string, required
  - `code_challenge` string, required
  - `resource` string
  - `state` string
  - `approve` boolean
  - `kind` string
  - `subject_id` string
  - `subject_ids` string[]
  - `profile_access` boolean

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error
- `default`: Error envelope (ADR 0027)

---

[API](https://skmtc.dev/membase/apis/membase-hosted-api.md) · [All operations](https://skmtc.dev/membase/apis/membase-hosted-api/llms.txt) · [OpenAPI document](https://skmtc.dev/membase/apis/membase-hosted-api/revisions/e0ac58cdb320?raw)