---
title: "Consent Administration API | Gazebo Docs"
description: "Register and manage Agent Consent Flow clients, inspect grants, and revoke access with a Gazebo account API token."
url: "https://gazebohq.com/docs/api/consent-administration"
---

Use the account API to automate Agent Consent Flow client registration and revoke user grants. These operations require an [account API token](/docs/api/authentication).

Consent administration is separate from the public authorization and token protocol documented in [Agent Consent Flow](/docs/consent).

## List clients

```
GET /api/v1/consent/clients
```

The response contains the account's registered clients, exact redirect URIs, allowed scopes, public JWK, active status, and creation time.

## Register a client

```
POST /api/v1/consent/clients
```

```bash
curl https://app.gazebohq.com/api/v1/consent/clients \
  -X POST \
  -H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Support agent",
    "redirectUris": ["https://agent.example.com/consent/callback"],
    "allowedScopes": ["issues.read", "issues.create"],
    "publicKeyJwk": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"...\",\"y\":\"...\"}"
  }'
```

Redirect URIs must be exact HTTPS URLs without fragments or wildcards. `localhost` is allowed for local development. The public key must be an ES256 P-256 public JWK. Keep the private key outside Gazebo.

## Update a client

```
PATCH /api/v1/consent/clients/{client_id}
```

Send any subset of `name`, `redirectUris`, `allowedScopes`, and `publicKeyJwk`. Expanding allowed scopes does not expand an existing grant; the user must approve a new authorization request.

## Deactivate a client

```
DELETE /api/v1/consent/clients/{client_id}
```

Deactivation immediately revokes the client's grants and active Consent access tokens.

## List grants

```
GET /api/v1/consent/grants
```

Each grant includes its client ID, approved scopes, status, creation time, and optional expiry.

## Revoke a grant

```
POST /api/v1/consent/grants/{grant_id}/revoke
```

Revocation immediately invalidates every active Consent access token issued under that grant.