> ## Documentation Index > Fetch the complete documentation index at: https://docs.altss.com/llms.txt > Use this file to discover all available pages before exploring further. # Request explicit human consent for an MCP client > Open this endpoint in the user browser. Public native/web clients identify themselves with an HTTPS Client ID Metadata Document and use S256 PKCE, response_type=code and the exact MCP resource. The server validates the client metadata and callback before starting the browser ceremony. A verified human with current terms, tenant authority and fresh authentication explicitly selects the organization and approves spending/rate limits. Authorization never adds funds or grants unrestricted data. The pending request expires after ten minutes; an approved code is single-use for at most two minutes. Success and validated-client denial redirects carry iss and preserve state when supplied; clients must validate both the expected issuer and their state. Invalid client or redirect metadata yields a local error, never an unvalidated redirect. Browser review, CSRF and consent endpoints are intentionally not modeled as machine-callable operations. ## OpenAPI ````yaml /console-openapi.json get /v1/console/agent-auth/authorize openapi: 3.1.1 info: title: Altss Console machine API version: '2026-11-11' description: >- A separate description of the deployed protected Console REST, MCP and agent-authorization interfaces. The public website and documentation readers remain anonymous and are described separately. company.read is necessary but not sufficient: approved channels, verified tenant admission, current terms, per-tool eligibility, data rights, spending limits, explicit purchase approval and confirmed funding remain enforced. The standard authorization-code flow is limited to the exact protected MCP resource and requires S256 plus a public Client ID Metadata Document. REST retains the existing custom user-claimed/JWT extension grants or manually created credentials. Generic OpenAPI tools may ignore those specification extensions; they do not acquire REST access through the MCP authorization-code flow. x-altss-source-commit: d3e57d85db87165d56106a9a0445b1f9f35bcf3d servers: - url: https://console.altss.com security: [] tags: - name: Console REST - name: Console MCP - name: Console authorization externalDocs: url: https://console.altss.com/auth.md description: Authoritative Console authorization and human-approval guide paths: /v1/console/agent-auth/authorize: get: tags: - Console authorization summary: Request explicit human consent for an MCP client description: >- Open this endpoint in the user browser. Public native/web clients identify themselves with an HTTPS Client ID Metadata Document and use S256 PKCE, response_type=code and the exact MCP resource. The server validates the client metadata and callback before starting the browser ceremony. A verified human with current terms, tenant authority and fresh authentication explicitly selects the organization and approves spending/rate limits. Authorization never adds funds or grants unrestricted data. The pending request expires after ten minutes; an approved code is single-use for at most two minutes. Success and validated-client denial redirects carry iss and preserve state when supplied; clients must validate both the expected issuer and their state. Invalid client or redirect metadata yields a local error, never an unvalidated redirect. Browser review, CSRF and consent endpoints are intentionally not modeled as machine-callable operations. operationId: authorizeConsoleMcpClient parameters: - in: query name: response_type required: true schema: type: string const: code - in: query name: client_id required: true schema: type: string minLength: 1 maxLength: 2048 description: >- Exact HTTPS Client ID Metadata Document URL, with a non-root path and no query, fragment, userinfo or dot segments. The document client_id must equal this string. No normalization or pre-registration is performed. The public client must support token_endpoint_auth_method none. - in: query name: redirect_uri required: true schema: type: string minLength: 1 maxLength: 2048 description: >- Exact registered same-origin HTTPS callback, or registered numeric HTTP loopback 127.0.0.1/[::1] callback with only its port allowed to vary. Must equal the approved redirect_uri at token exchange. - in: query name: resource required: true schema: type: string minLength: 1 maxLength: 2048 const: https://console.altss.com/v1/console/mcp description: >- Mandatory exact canonical MCP resource. No API, other path, query or fragment is accepted. - in: query name: scope required: false schema: default: company.read type: string const: company.read - in: query name: state required: false schema: type: string maxLength: 1024 - in: query name: code_challenge required: true schema: type: string pattern: ^[A-Za-z0-9_-]{43}$ - in: query name: code_challenge_method required: true schema: type: string const: S256 responses: '303': description: >- Validated request redirects to the native Console consent ceremony. This is not evidence of consent or token issuance. headers: Location: schema: type: string '400': description: >- Invalid request, client metadata, callback, scope, resource or PKCE. No redirect to an unvalidated client. '429': description: Bounded client/host/IP rate limit exceeded. '503': description: Authorization unavailable or disabled. No new code is issued. security: [] ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.