---
title: "Consent to a plugin build in this lane landing in its parent chat"
method: POST
path: "/api/v1/chats/{id}/plugin_request"
tags: ["Chats"]
---

# Consent to a plugin build in this lane landing in its parent chat

`POST /api/v1/chats/{id}/plugin_request`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/v1/chats/{id}/plugin_request`
- Auth: API key in header `api-key`

Not on Oauth::MCP_ALLOWLIST -- a remote-MCP bearer gets the ordinary deny-by-default 403. Security fix, restated by role: the consent tap that replaces "the person wrote any message in the lane within 10 minutes" as the evidence Api::V1::AppsController#create's A1 landing checks. Caller must be a non-observer member of:id (human or agent), which must be a private lane (coaching_for_chat_id present) whose own parent is neither another lane nor an open room. Stamps plugin_requested_at on the caller's lane membership; a landing within the next 30 minutes consumes it. Deliberately unmapped in MandateCapabilityMap -- refused entirely under X-Salt-Act-For.

## Path parameters

- `id` string, required

## Response `200`

OK.

- object
  - `plugin_requested_at` string

## Other responses

- `401`: Missing or invalid credentials.
- `403`: You're not in this chat.
- `404`: Not found.
- `422`: This isn't a private lane. / This lane has nowhere to land a plugin.

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)