> ## Documentation Index
> Fetch the complete documentation index at: https://docs.altss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange an approved claim or one-time assertion

> Only the two declared extension grants are implemented. Claim exchange requires actual human approval and the original S256 verifier. Selecting the exact MCP resource requires approved MCP and restricts the key to MCP; selecting the API resource preserves approved channels. The selected resource is immutable across rotation. The Console-issued JWT assertion may rotate the same principal once during the original two-minute approval window and returns no replacement assertion. No authorization_code, client_credentials, refresh_token, RFC8628 device grant, external ID-JAG or generic OAuth client-registration flow is implemented.



## OpenAPI

````yaml /console-openapi.json post /v1/console/agent-auth/token
openapi: 3.1.1
info:
  title: Altss Console machine API
  version: '2026-11-11'
  description: >-
    A separate description of the deployed protected Console REST, MCP and
    agent-authorization interfaces. The public website and documentation readers
    remain anonymous and are described separately. company.read is necessary but
    not sufficient: approved channels, verified tenant admission, current terms,
    per-tool eligibility, data rights, spending limits, explicit purchase
    approval and confirmed funding remain enforced. OAuth grant extensions below
    describe implemented protocols; generic OpenAPI tools may ignore extensions
    and cannot infer an authorization-code or device flow.
  x-altss-source-commit: d2432ba2f34a58ed7936598fb5b42dfbf50c6637
servers:
  - url: https://console.altss.com
security: []
tags:
  - name: Console REST
  - name: Console MCP
  - name: Console authorization
externalDocs:
  url: https://console.altss.com/auth.md
  description: Authoritative Console authorization and human-approval guide
paths:
  /v1/console/agent-auth/token:
    post:
      tags:
        - Console authorization
      summary: Exchange an approved claim or one-time assertion
      description: >-
        Only the two declared extension grants are implemented. Claim exchange
        requires actual human approval and the original S256 verifier. Selecting
        the exact MCP resource requires approved MCP and restricts the key to
        MCP; selecting the API resource preserves approved channels. The
        selected resource is immutable across rotation. The Console-issued JWT
        assertion may rotate the same principal once during the original
        two-minute approval window and returns no replacement assertion. No
        authorization_code, client_credentials, refresh_token, RFC8628 device
        grant, external ID-JAG or generic OAuth client-registration flow is
        implemented.
      operationId: exchangeConsoleAgentGrant
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              oneOf:
                - $ref: '#/components/schemas/ClaimTokenRequest'
                - $ref: '#/components/schemas/AssertionTokenRequest'
      responses:
        '200':
          description: >-
            Opaque revocable bearer credential. No scheduled token expiry is
            defined, so expires_in is omitted. Initial claim exchange also
            returns identity_assertion and assertion_expires; assertion exchange
            does not.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: >-
            Protocol refusal, including invalid_request, invalid_grant,
            invalid_target, authorization_pending, slow_down or expired_token.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                required:
                  - error
                additionalProperties: false
        '403':
          description: Human or organization authority denied.
        '429':
          description: Rate limit exceeded.
        '503':
          description: >-
            Temporarily unavailable; token issuance cannot be replayed safely
            after an uncertain response.
      security: []
components:
  schemas:
    ClaimTokenRequest:
      type: object
      properties:
        grant_type:
          const: urn:workos:agent-auth:grant-type:claim
        claim_token:
          type: string
          maxLength: 100
          description: Private claim token returned by registration. Never put it in a URL.
        resource:
          type: string
          enum:
            - https://console.altss.com/v1/console
            - https://console.altss.com/v1/console/mcp
        code_verifier:
          type: string
          pattern: ^[A-Za-z0-9._~-]{43,128}$
      required:
        - grant_type
        - claim_token
        - resource
        - code_verifier
      additionalProperties: false
    AssertionTokenRequest:
      type: object
      properties:
        grant_type:
          const: urn:ietf:params:oauth:grant-type:jwt-bearer
        assertion:
          type: string
          maxLength: 4096
          description: >-
            Only the short-lived assertion issued by this Console is accepted,
            once, during the original approval window. Its audience is the
            authorization-server issuer; its separate resource claim is
            immutable.
        resource:
          type: string
          enum:
            - https://console.altss.com/v1/console
            - https://console.altss.com/v1/console/mcp
        code_verifier:
          type: string
          pattern: ^[A-Za-z0-9._~-]{43,128}$
      required:
        - grant_type
        - assertion
        - resource
        - code_verifier
      additionalProperties: false
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: >-
            Opaque revocable Console credential; not an Auth0 token or a JWT
            access token.
        token_type:
          const: Bearer
        scope:
          const: company.read
        identity_assertion:
          type: string
          description: Returned only by the initial claim exchange.
        assertion_expires:
          type: string
          format: date-time
          description: Returned only with identity_assertion.
      required:
        - access_token
        - token_type
        - scope
      additionalProperties: false

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.