Delegated agents

Mint connect ticket

Mints a single-use connect code for one of your end users. Show them connectCode and mcpServerUrl; they add the MCP server to their assistant and paste the code on the consent screen. Redeeming it creates a delegated grant that can reach only templates whose scopePath starts with one of scopePrefixes, using only the tools in allowedTools. Every prefix must start with externalTenantId/.

post/v2/organizations/{organizationId}/delegated/tickets

Request

Base URL: https://api.pdfs.build
URL: https://api.pdfs.build/v2/organizations/{organizationId}/delegated/tickets
Auth: HTTP bearer

Request body

externalTenantIdstring required

Billing boundary. Must equal the first segment of every prefix.

externalUserIdstring required

scopePrefixesstring[] required

Access boundary: the grant reaches templates whose scopePath starts with any of these.

allowedToolsstring[]

MCP tools the grant may call. Defaults to the delegated allowlist; tools that escalate access (schema writes, publishing, API keys) are always denied.

labelstring

Shown in your connection list.

expiresInSecondsinteger

Ticket lifetime (default 10 minutes).

grantExpiresInSecondsinteger

Lifetime of the grant created when the ticket is redeemed.

Example request

{
  "scopePrefixes": [
    "acct_9f3/entity_dubai/",
    "acct_9f3/entity_ajman/"
  ]
}

Response

The ticket. connectCode is single-use and short-lived.

ticketIdstring required

connectCodestring required

Show this to the end user (dct_...). Single use.

mcpServerUrlstring uri required

expiresAtstring date-time required

Example response

{
  "mcpServerUrl": "https://backend.pdfs.build/mcp"
}

Changes

No recorded changes to this operation across all 1 revision of this API.