---
title: "Review a changed External MCP OAuth issuer"
method: POST
path: "/v1/mcp-connections/{connectionId}/oauth/issuer-review"
tags: ["Authentication"]
---

# Review a changed External MCP OAuth issuer

`POST /v1/mcp-connections/{connectionId}/oauth/issuer-review`

## Request

- Base URL: `https://api.openworklabs.com`
- URL: `https://api.openworklabs.com/v1/mcp-connections/{connectionId}/oauth/issuer-review`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer

Requires the Manage connections permission. Repeats live OAuth discovery and either previews the issuers currently advertised by the MCP resource or explicitly confirms one. Confirming an issuer also needs a recent sign-in and is not available to API keys. Confirmation never trusts an unadvertised issuer. Changing issuers invalidates issuer-bound OAuth clients and credentials so members reconnect cleanly.

## Path parameters

- `connectionId` string, typeid, required

## Request body

- union
  - object
    - `action` 'preview', required
  - object
    - `action` 'confirm', required
    - `expectedUpdatedAt` string, date-time, required
    - `authorizationServerIssuer` string, uri, required

## Response `200`

Issuer review result.

- ExternalMcpIssuerReviewResponse
  - `currentIssuer` string, nullable, required
  - `advertisedIssuers` string[], required
  - `reviewRequired` boolean, required
  - `issuerChanged` boolean
  - `reconnectionRequired` boolean
  - `updatedAt` string, date-time

## Other responses

- `400`: Invalid issuer review request.
- `401`: The caller must be signed in.
- `403`: The caller needs the Manage connections permission, and a recent interactive sign-in (not an API key) to confirm an issuer.
- `404`: Unknown connection.
- `409`: The connection changed or the requested issuer is not currently advertised.
- `502`: Live OAuth discovery failed.

## Changes

- **2026-10-01** `df3754993784`: 1 info
  - added the optional property `message` to the response with the `400` status
- **2026-09-11** `bb8ff73e4ad3`: 2 info
  - the endpoint scheme security `bearerAuth` was added to the API
  - the endpoint scheme security `denApiKey` was added to the API
- **2026-09-04** `d3984673ccd1`: 1 info
  - added the optional property `capability` to the response with the `400` status
- **2026-08-20** `93df40e2efd5`: 1 info
  - removed the pattern `^emc_.*` from the `path` request parameter `connectionId`

[Operation history](https://skmtc.dev/openworklabs/apis/den-api/changes/v1/mcp-connections/:connectionId/oauth/issuer-review/post.md)

---

[API](https://skmtc.dev/openworklabs/apis/den-api.md) · [All operations](https://skmtc.dev/openworklabs/apis/den-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openworklabs/apis/den-api/revisions/e6eb4e5ce8a3?raw)