Deny mcp grant request

POST/v1/mcp/grant-requests/{requestId}:deny

Accepts bearer

The signed-in human denies a pending MCP grant

HUMAN CONSOLE SESSION ONLY (a key, service token or grant-derived token is 403 PERMISSION_DENIED SESSION_REQUIRED).Show more

HUMAN CONSOLE SESSION ONLY (a key, service token or grant-derived token is 403 PERMISSION_DENIED SESSION_REQUIRED). For an authorization-code request the answer carries redirectTo, the client's redirect_uri with error=access_denied, state and iss; for a device flow it is {denied: true} and the agent's next poll answers access_denied. A request that is no longer PENDING is 409 CONFLICT details.reason WRONG_STATE. Emits mcp.grant.denied.

Path parameters

requestIdstringRequired
A pending MCP grant request id, from the consent redirect (?request=) or a user-code lookup.Show more
A pending MCP grant request id, from the consent redirect (?request=) or a user-code lookup. Opaque and unguessable: at least 128 bits from a cryptographic random source, never a sequential or monotonic id, because it is the only handle in the consent URL.

Request body

This operation takes no request body.

Responses

200DeniedMcpGrantRequestDecision
401
UNAUTHENTICATED — missing or expired token.Show more
UNAUTHENTICATED — missing or expired token. Declared on every operation because `security` is declared globally at the document root: every route is authenticated, so every route can answer 401.
ApiErrorResponse
403
PERMISSION_DENIED details.reason SESSION_REQUIRED on the MCP consent routes (/v1/mcp/grant-requests/*, /supplier/v1/mcp/grant-requests/*, /ops/v1/mcp/grant-requests/*): only a signed-in human of the…Show more
PERMISSION_DENIED details.reason SESSION_REQUIRED on the MCP consent routes (/v1/mcp/grant-requests/*, /supplier/v1/mcp/grant-requests/*, /ops/v1/mcp/grant-requests/*): only a signed-in human of the realm reads or decides a grant request. An API key, a service token and an MCP grant-derived token (details.credential mcp-grant) are all refused, so an agent never reads or approves its own consent.
ApiErrorResponse
404NOT_FOUND — unknown or expired ref (unguessable refs, 15)ApiErrorResponse
405
VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge).Show more
VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge). Not retryable as sent.
ApiErrorResponse
409CONFLICT details.reason WRONG_STATE — the grant request is no longer PENDING (already approved or denied, expired, or, for an operator request, AWAITING_SECOND_APPROVAL); details.state says which.ApiErrorResponse
414
VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge).Show more
VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge). Not retryable as sent: send long input in the body of a POST.
ApiErrorResponse
500INTERNAL — a bug, and traceId is the support handle.ApiErrorResponse

Errors you should handle

Branch on code and honour retryable — never on the HTTP status alone.

401	UNAUTHENTICATED The bearer token is expired. Re-authenticate and retry.	not retryable
403	PERMISSION_DENIED Approving agent connections needs a signed-in person. An agent cannot read or approve its own connection.	not retryable
404	NOT_FOUND searchRef SR-F-7b31d0a9 is unknown or has expired; re-search	not retryable
405	VALIDATION This method is not served.	not retryable
409	CONFLICT This agent connection request has already been decided.	not retryable
414	VALIDATION The request URI is longer than 8 KiB.	not retryable
500	INTERNAL An unexpected error occurred. Quote the traceId to support.	retryable