---
title: "Mint connect ticket"
method: POST
path: "/v2/organizations/{organizationId}/delegated/tickets"
tags: ["Delegated agents"]
---

# Mint connect ticket

`POST /v2/organizations/{organizationId}/delegated/tickets`

## Request

- Base URL: `https://api.pdfs.build`
- URL: `https://api.pdfs.build/v2/organizations/{organizationId}/delegated/tickets`
- Auth: HTTP bearer

Mints a single-use connect code for one of your end users. Show them `connectCode` and `mcpServerUrl`; they add the MCP server to their assistant and paste the code on the consent screen. Redeeming it creates a delegated grant that can reach only templates whose `scopePath` starts with one of `scopePrefixes`, using only the tools in `allowedTools`. Every prefix must start with `externalTenantId/`.

## Request body

- ConnectTicketRequest
  - `externalTenantId` string, required: Billing boundary. Must equal the first segment of every prefix.
  - `externalUserId` string, required
  - `scopePrefixes` string[], required: Access boundary: the grant reaches templates whose `scopePath` starts with any of these.
  - `allowedTools` string[]: MCP tools the grant may call. Defaults to the delegated allowlist; tools that escalate access (schema writes, publishing, API keys) are always denied.
  - `label` string: Shown in your connection list.
  - `expiresInSeconds` integer: Ticket lifetime (default 10 minutes).
  - `grantExpiresInSeconds` integer: Lifetime of the grant created when the ticket is redeemed.

## Response `201`

The ticket. `connectCode` is single-use and short-lived.

- ConnectTicket
  - `ticketId` string, required
  - `connectCode` string, required: Show this to the end user (`dct_...`). Single use.
  - `mcpServerUrl` string, uri, required
  - `expiresAt` string, date-time, required

## Other responses

- `400`: `invalid_connect_ticket_request` (with `issues`) or `invalid_scope` (a prefix does not start with the tenant id, or an unknown tool).
- `401`: Missing, invalid or expired API key.
- `403`: `admin_required` (the key's owner is not an organization owner/admin), `delegated_plan_required`, `delegated_access_disabled` (the organization has not opted in), or `organization_scope_mismatch`.
- `502`: The service that owns this resource could not be reached. Safe to retry.

---

[API](https://skmtc.dev/pdfs/apis/pdfs-build-api.md) · [All operations](https://skmtc.dev/pdfs/apis/pdfs-build-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pdfs/apis/pdfs-build-api/revisions/1c7340b9521d?raw)