Consent administration

Use the account API to automate Agent Consent Flow client registration and revoke user grants. These operations require an account API token.

Consent administration is separate from the public authorization and token protocol documented in Agent Consent Flow.

List clients

GET /api/v1/consent/clients

The response contains the account's registered clients, exact redirect URIs, allowed scopes, public JWK, active status, and creation time.

Register a client

POST /api/v1/consent/clients

curl https://app.gazebohq.com/api/v1/consent/clients \
  -X POST \
  -H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Support agent",
    "redirectUris": ["https://agent.example.com/consent/callback"],
    "allowedScopes": ["issues.read", "issues.create"],
    "publicKeyJwk": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"...\",\"y\":\"...\"}"
  }'

Redirect URIs must be exact HTTPS URLs without fragments or wildcards. localhost is allowed for local development. The public key must be an ES256 P-256 public JWK. Keep the private key outside Gazebo.

Update a client

PATCH /api/v1/consent/clients/{client_id}

Send any subset of name, redirectUris, allowedScopes, and publicKeyJwk. Expanding allowed scopes does not expand an existing grant; the user must approve a new authorization request.

Deactivate a client

DELETE /api/v1/consent/clients/{client_id}

Deactivation immediately revokes the client's grants and active Consent access tokens.

List grants

GET /api/v1/consent/grants

Each grant includes its client ID, approved scopes, status, creation time, and optional expiry.

Revoke a grant

POST /api/v1/consent/grants/{grant_id}/revoke

Revocation immediately invalidates every active Consent access token issued under that grant.