Webhooks

Append replay-safe connector consent audit

HMAC-signed endpoint accepting only consent.shown, consent.granted, or consent.denied. It validates every identity and scope against the pending flow and durably deduplicates event_id.

post/oauth-hooks/consent-audit

Request

Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
URL: /oauth-hooks/consent-audit
Auth: API key in header X-Hook-Signature

Request body

audiencestring required

Bound connector audience.

client_idstring required

Bound Hydra client id.

connector_idstring required

Bound connector slug.

consent_session_idstring required

Consent UI session id.

context_request_idstring required

request_id returned by pre-consent.

event'consent.shown' | 'consent.granted' | 'consent.denied' required

Accepted semantic event.

event_idstring required

Globally unique idempotency id.

occurred_atstring required

RFC3339Nano event time.

resultobject

Bounded JSON result object or string. It must not contain credentials.

scopesstring[] required

Shown or granted scope set.

versioninteger required

Hook contract version. Only version 1 is accepted.

workos_user_idstring required

WorkOS user id used to resolve bearer tokens into local users.

Example request

{
  "audience": "mcp:canvas",
  "client_id": "rowboat-desktop",
  "connector_id": "canvas",
  "consent_session_id": "consent_01HABCDEF",
  "context_request_id": "ctx_01HABCDEF",
  "event": "consent.granted",
  "event_id": "evt_01HABCDEF",
  "occurred_at": "2026-08-27T20:00:00Z",
  "scopes": [
    "canvas:invoices.read"
  ],
  "version": 1,
  "workos_user_id": "user_01HABCDEF"
}

Response

Audit event persisted or exactly replayed.

acceptedboolean required

True after persistence or an exact idempotent replay.

Example response

{
  "accepted": true
}

Changes

No operation changes recorded.