---
title: "Scopes granted to the current user's MCP client"
method: GET
path: "/rest/v1/user/mcp_grants"
tags: ["User"]
---

# Scopes granted to the current user's MCP client

`GET /rest/v1/user/mcp_grants`

## Request

- The document declares no server URL.
- Auth: none declared
- TypeScript: <https://skmtc.dev/owasp/apis/opencre-rest-api/docs/rest/v1/user/mcp_grants/get.ts> (a function with typed inputs; its response is checked against the schema)

Requires a browser session. Google's device flow cannot carry OpenCRE scopes, so an MCP client's permissions are recorded here instead of in its token.

## Response `200`

The scopes currently granted

- object
  - `granted` string[], required

## Other responses

- `401`: Not authenticated
- `403`: Requires a browser session

## Changes

- **2026-10-14** `6b7451b341bb`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/owasp/apis/opencre-rest-api/changes/rest/v1/user/mcp_grants/get.md)

---

[API](https://skmtc.dev/owasp/apis/opencre-rest-api.md) - [All operations](https://skmtc.dev/owasp/apis/opencre-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/owasp/apis/opencre-rest-api/revisions/6b7451b341bb?raw)