Depot oauth

View as Markdown Open in ChatGPT Open in Claude

Registers the authorization server and its consent API on a face mux, outside the license gate, beside the console sign-in routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET `/.well-known/oauth-authorization-server`

GETNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

As metadata

Responses

Status	Body	Description
`200`	`application/json`, object	Success.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/.well-known/oauth-authorization-server' \
  -H 'Accept: application/json'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/.well-known/oauth-authorization-server' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/.well-known/oauth-authorization-server"
headers = {
    "Accept": "application/json",
}

response = requests.get(url, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/.well-known/oauth-authorization-server", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/.well-known/oauth-authorization-server";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/.well-known/oauth-authorization-server");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OPTIONS `/.well-known/oauth-authorization-server`

OPTIONSNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

Oauth preflight

Responses

Status	Body	Description
`204`	None	Success, with no body.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X OPTIONS 'https://depot.example.com/.well-known/oauth-authorization-server'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Options `
    -Uri 'https://depot.example.com/.well-known/oauth-authorization-server'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/.well-known/oauth-authorization-server"

response = requests.options(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodOptions, "https://depot.example.com/.well-known/oauth-authorization-server", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/.well-known/oauth-authorization-server";

const response = await fetch(url, {
  method: "OPTIONS",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Options, "https://depot.example.com/.well-known/oauth-authorization-server");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/.well-known/oauth-protected-resource`

GETNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

Resource metadata

Responses

Status	Body	Description
`200`	`application/json`, object	Success.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/.well-known/oauth-protected-resource' \
  -H 'Accept: application/json'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/.well-known/oauth-protected-resource' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/.well-known/oauth-protected-resource"
headers = {
    "Accept": "application/json",
}

response = requests.get(url, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/.well-known/oauth-protected-resource", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/.well-known/oauth-protected-resource";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/.well-known/oauth-protected-resource");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OPTIONS `/.well-known/oauth-protected-resource`

OPTIONSNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

Oauth preflight

Responses

Status	Body	Description
`204`	None	Success, with no body.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X OPTIONS 'https://depot.example.com/.well-known/oauth-protected-resource'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Options `
    -Uri 'https://depot.example.com/.well-known/oauth-protected-resource'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/.well-known/oauth-protected-resource"

response = requests.options(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodOptions, "https://depot.example.com/.well-known/oauth-protected-resource", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/.well-known/oauth-protected-resource";

const response = await fetch(url, {
  method: "OPTIONS",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Options, "https://depot.example.com/.well-known/oauth-protected-resource");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/.well-known/oauth-protected-resource/mcp`

GETNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

Resource metadata

Responses

Status	Body	Description
`200`	`application/json`, object	Success.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/.well-known/oauth-protected-resource/mcp' \
  -H 'Accept: application/json'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/.well-known/oauth-protected-resource/mcp' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/.well-known/oauth-protected-resource/mcp"
headers = {
    "Accept": "application/json",
}

response = requests.get(url, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/.well-known/oauth-protected-resource/mcp", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/.well-known/oauth-protected-resource/mcp";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/.well-known/oauth-protected-resource/mcp");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OPTIONS `/.well-known/oauth-protected-resource/mcp`

OPTIONSNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

Oauth preflight

Responses

Status	Body	Description
`204`	None	Success, with no body.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X OPTIONS 'https://depot.example.com/.well-known/oauth-protected-resource/mcp'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Options `
    -Uri 'https://depot.example.com/.well-known/oauth-protected-resource/mcp'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/.well-known/oauth-protected-resource/mcp"

response = requests.options(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodOptions, "https://depot.example.com/.well-known/oauth-protected-resource/mcp", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/.well-known/oauth-protected-resource/mcp";

const response = await fetch(url, {
  method: "OPTIONS",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Options, "https://depot.example.com/.well-known/oauth-protected-resource/mcp");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/oauth/device/{userCode}`

GETai:usepublic facehosteditmspremoteIdempotent

Source: [object Object]

getDevice returns the pending device sign-in a user code names.

Parameters

Name	In	Type	Required	Description
`userCode`	path	string	Yes

Responses

Status	Body	Description
`200`	`application/json`, OauthDeviceView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold ai:use.
`404`	`application/problem+json`, ProblemDetails	This request has expired or was already answered.
`500`	`application/problem+json`, ProblemDetails	The request failed.

200 response body

Field	Type	Description
`clientId`required	`string`
`clientName`required	`string`
`createdAt`required	`string (date-time)`
`expiresAt`required	`string (date-time)`
`firstParty`required	`boolean`
`requestIp`required	`string`
`sameNetwork`required	`boolean`
`scope`required	`string`
`userCode`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/oauth/device/<userCode>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/oauth/device/<userCode>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/oauth/device/<userCode>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/oauth/device/<userCode>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/oauth/device/<userCode>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/oauth/device/<userCode>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/oauth/device/{userCode}/approve`

POSTai:usepublic facehosteditmspremote

Source: [object Object]

approveDevice approves a device sign-in under the same rules as consent.

Parameters

Name	In	Type	Required	Description
`userCode`	path	string	Yes

Responses

Status	Body	Description
`200`	`application/json`, OauthDeviceDecision	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold ai:use.
`404`	`application/problem+json`, ProblemDetails	This request has expired or was already answered.
`500`	`application/problem+json`, ProblemDetails	The request failed.

200 response body

Field	Type	Description
`approved`required	`boolean`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/oauth/device/<userCode>/approve' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/oauth/device/<userCode>/approve' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/oauth/device/<userCode>/approve"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/oauth/device/<userCode>/approve", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/oauth/device/<userCode>/approve";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/oauth/device/<userCode>/approve");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/oauth/device/{userCode}/deny`

POSTai:usepublic facehosteditmspremote

Source: [object Object]

denyDevice denies a device sign-in; the CLI’s next poll gets access_denied.

Parameters

Name	In	Type	Required	Description
`userCode`	path	string	Yes

Responses

Status	Body	Description
`200`	`application/json`, OauthDeviceDecision	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold ai:use.
`404`	`application/problem+json`, ProblemDetails	This request has expired or was already answered.
`500`	`application/problem+json`, ProblemDetails	The request failed.

200 response body

Field	Type	Description
`approved`required	`boolean`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/oauth/device/<userCode>/deny' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/oauth/device/<userCode>/deny' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/oauth/device/<userCode>/deny"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/oauth/device/<userCode>/deny", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/oauth/device/<userCode>/deny";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/oauth/device/<userCode>/deny");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/oauth/requests/{id}`

GETai:usepublic facehosteditmspremoteIdempotent

Source: [object Object]

getRequest returns the pending authorization request the consent page shows.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Body	Description
`200`	`application/json`, OauthRequestView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold ai:use.
`404`	`application/problem+json`, ProblemDetails	This request has expired or was already answered.
`500`	`application/problem+json`, ProblemDetails	The request failed.

200 response body

Field	Type	Description
`clientId`required	`string`
`clientName`required	`string`
`expiresAt`required	`string (date-time)`
`firstParty`required	`boolean`
`id`required	`string`
`redirectHost`required	`string`
`scope`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/oauth/requests/<id>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/oauth/requests/<id>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/oauth/requests/<id>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/oauth/requests/<id>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/oauth/requests/<id>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/oauth/requests/<id>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/oauth/requests/{id}/approve`

POSTai:usepublic facehosteditmspremote

Source: [object Object]

approveRequest approves a pending authorization request and returns the URL the SPA navigates to, carrying a single-use code good for 60 seconds.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Body	Description
`200`	`application/json`, OauthRedirectView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold ai:use.
`404`	`application/problem+json`, ProblemDetails	This request has expired or was already answered.
`500`	`application/problem+json`, ProblemDetails	The request failed.

200 response body

Field	Type	Description
`redirectUrl`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/oauth/requests/<id>/approve' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/oauth/requests/<id>/approve' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/oauth/requests/<id>/approve"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/oauth/requests/<id>/approve", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/oauth/requests/<id>/approve";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/oauth/requests/<id>/approve");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/oauth/requests/{id}/deny`

POSTai:usepublic facehosteditmspremote

Source: [object Object]

denyRequest denies a pending authorization request; the client is told access_denied.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Body	Description
`200`	`application/json`, OauthRedirectView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold ai:use.
`404`	`application/problem+json`, ProblemDetails	This request has expired or was already answered.
`500`	`application/problem+json`, ProblemDetails	The request failed.

200 response body

Field	Type	Description
`redirectUrl`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/oauth/requests/<id>/deny' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/oauth/requests/<id>/deny' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/oauth/requests/<id>/deny"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/oauth/requests/<id>/deny", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/oauth/requests/<id>/deny";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/oauth/requests/<id>/deny");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/oauth/authorize`

GETNo permission neededpublic facehosteditmspremoteIdempotentNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

authorize validates the client and its redirect URI FIRST.

Until both are known good, every error is a plain page and never a redirect: a redirect to an unvalidated URI is an open redirector.

Parameters

Name	In	Type	Required
`client_id`	query	string	No
`code_challenge`	query	string	No
`code_challenge_method`	query	string	No
`redirect_uri`	query	string	No
`resource`	query	string	No
`response_type`	query	string	No
`scope`	query	string	No
`state`	query	string	No

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/oauth/authorize?client_id=<client_id>&code_challenge=<code_challenge>&code_challenge_method=<code_challenge_method>&redirect_uri=<redirect_uri>&resource=<resource>&response_type=<response_type>'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/oauth/authorize?client_id=<client_id>&code_challenge=<code_challenge>&code_challenge_method=<code_challenge_method>&redirect_uri=<redirect_uri>&resource=<resource>&response_type=<response_type>'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/oauth/authorize"
params = {
    "client_id": "<client_id>",
    "code_challenge": "<code_challenge>",
    "code_challenge_method": "<code_challenge_method>",
    "redirect_uri": "<redirect_uri>",
    "resource": "<resource>",
    "response_type": "<response_type>",
}

response = requests.get(url, params=params, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/oauth/authorize?client_id=<client_id>&code_challenge=<code_challenge>&code_challenge_method=<code_challenge_method>&redirect_uri=<redirect_uri>&resource=<resource>&response_type=<response_type>", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = new URL("https://depot.example.com/oauth/authorize");
url.searchParams.set("client_id", "<client_id>");
url.searchParams.set("code_challenge", "<code_challenge>");
url.searchParams.set("code_challenge_method", "<code_challenge_method>");
url.searchParams.set("redirect_uri", "<redirect_uri>");
url.searchParams.set("resource", "<resource>");
url.searchParams.set("response_type", "<response_type>");

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/oauth/authorize?client_id=<client_id>&code_challenge=<code_challenge>&code_challenge_method=<code_challenge_method>&redirect_uri=<redirect_uri>&resource=<resource>&response_type=<response_type>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/oauth/device_authorization`

POSTNo permission neededpublic facehosteditmspremoteNot fully resolved

What this page does not know

response-status

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

Device authorization

Parameters

Name	In	Type	Required
`client_id`	query	string	No
`client_secret`	query	string	No
`scope`	query	string	No

Responses

Status	Body	Description
`200`	`application/json`, object	Success.

Request samples

# This operation is public. It takes no credentials.
curl -X POST 'https://depot.example.com/oauth/device_authorization?client_id=<client_id>&client_secret=<client_secret>&scope=<scope>' \
  -H 'Accept: application/json'

# This operation is public. It takes no credentials.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/oauth/device_authorization?client_id=<client_id>&client_secret=<client_secret>&scope=<scope>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.

import requests

url = "https://depot.example.com/oauth/device_authorization"
params = {
    "client_id": "<client_id>",
    "client_secret": "<client_secret>",
    "scope": "<scope>",
}
headers = {
    "Accept": "application/json",
}

response = requests.post(url, params=params, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/oauth/device_authorization?client_id=<client_id>&client_secret=<client_secret>&scope=<scope>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.

const url = new URL("https://depot.example.com/oauth/device_authorization");
url.searchParams.set("client_id", "<client_id>");
url.searchParams.set("client_secret", "<client_secret>");
url.searchParams.set("scope", "<scope>");

const response = await fetch(url, {
  method: "POST",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/oauth/device_authorization?client_id=<client_id>&client_secret=<client_secret>&scope=<scope>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OPTIONS `/oauth/device_authorization`

OPTIONSNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

Oauth preflight

Responses

Status	Body	Description
`204`	None	Success, with no body.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X OPTIONS 'https://depot.example.com/oauth/device_authorization'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Options `
    -Uri 'https://depot.example.com/oauth/device_authorization'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/oauth/device_authorization"

response = requests.options(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodOptions, "https://depot.example.com/oauth/device_authorization", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/oauth/device_authorization";

const response = await fetch(url, {
  method: "OPTIONS",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Options, "https://depot.example.com/oauth/device_authorization");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/oauth/register`

POSTNo permission neededpublic facehosteditmspremoteNot fully resolved

What this page does not know

response-status

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

Register

Request body

Required, sent as application/json.

Field	Type	Description
`client_name`required	`string`
`grant_types`required	`array of string`
`redirect_uris`required	`array of string`
`response_types`required	`array of string`
`software_id`required	`string`
`software_version`required	`string`
`token_endpoint_auth_method`required	`string`

Responses

Status	Body	Description
`200`	`application/json`, object	Success.
`201`	`application/json`, object	Created.
`400`	`application/problem+json`, ProblemDetails	The request body is not acceptable.

Request samples

# This operation is public. It takes no credentials.
curl -X POST 'https://depot.example.com/oauth/register' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data '{
  "client_name": "string",
  "grant_types": [
    "string"
  ],
  "redirect_uris": [
    "string"
  ],
  "response_types": [
    "string"
  ],
  "software_id": "string",
  "software_version": "string",
  "token_endpoint_auth_method": "string"
}'

# This operation is public. It takes no credentials.

$headers = @{
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
}

$body = @'
{
  "client_name": "string",
  "grant_types": [
    "string"
  ],
  "redirect_uris": [
    "string"
  ],
  "response_types": [
    "string"
  ],
  "software_id": "string",
  "software_version": "string",
  "token_endpoint_auth_method": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/oauth/register' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.

import requests

url = "https://depot.example.com/oauth/register"
headers = {
    "Accept": "application/json",
    "Content-Type": "application/json",
}
payload = {
    "client_name": "string",
    "grant_types": [
        "string",
    ],
    "redirect_uris": [
        "string",
    ],
    "response_types": [
        "string",
    ],
    "software_id": "string",
    "software_version": "string",
    "token_endpoint_auth_method": "string",
}

response = requests.post(url, headers=headers, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "client_name": "string",
  "grant_types": [
    "string"
  ],
  "redirect_uris": [
    "string"
  ],
  "response_types": [
    "string"
  ],
  "software_id": "string",
  "software_version": "string",
  "token_endpoint_auth_method": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/oauth/register", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.

const url = "https://depot.example.com/oauth/register";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "client_name": "string",
    "grant_types": [
      "string"
    ],
    "redirect_uris": [
      "string"
    ],
    "response_types": [
      "string"
    ],
    "software_id": "string",
    "software_version": "string",
    "token_endpoint_auth_method": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "client_name": "string",
  "grant_types": [
    "string"
  ],
  "redirect_uris": [
    "string"
  ],
  "response_types": [
    "string"
  ],
  "software_id": "string",
  "software_version": "string",
  "token_endpoint_auth_method": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/oauth/register");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OPTIONS `/oauth/register`

OPTIONSNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

Oauth preflight

Responses

Status	Body	Description
`204`	None	Success, with no body.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X OPTIONS 'https://depot.example.com/oauth/register'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Options `
    -Uri 'https://depot.example.com/oauth/register'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/oauth/register"

response = requests.options(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodOptions, "https://depot.example.com/oauth/register", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/oauth/register";

const response = await fetch(url, {
  method: "OPTIONS",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Options, "https://depot.example.com/oauth/register");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/oauth/revoke`

POSTNo permission neededpublic facehosteditmspremoteNot fully resolved

What this page does not know

response-status

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

Revoke

Parameters

Name	In	Type	Required
`client_id`	query	string	No
`client_secret`	query	string	No
`token`	query	string	No

Responses

Status	Body	Description
`200`	`application/json`, object	Success.

Request samples

# This operation is public. It takes no credentials.
curl -X POST 'https://depot.example.com/oauth/revoke?client_id=<client_id>&client_secret=<client_secret>&token=<token>' \
  -H 'Accept: application/json'

# This operation is public. It takes no credentials.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/oauth/revoke?client_id=<client_id>&client_secret=<client_secret>&token=<token>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.

import requests

url = "https://depot.example.com/oauth/revoke"
params = {
    "client_id": "<client_id>",
    "client_secret": "<client_secret>",
    "token": "<token>",
}
headers = {
    "Accept": "application/json",
}

response = requests.post(url, params=params, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/oauth/revoke?client_id=<client_id>&client_secret=<client_secret>&token=<token>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.

const url = new URL("https://depot.example.com/oauth/revoke");
url.searchParams.set("client_id", "<client_id>");
url.searchParams.set("client_secret", "<client_secret>");
url.searchParams.set("token", "<token>");

const response = await fetch(url, {
  method: "POST",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/oauth/revoke?client_id=<client_id>&client_secret=<client_secret>&token=<token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OPTIONS `/oauth/revoke`

OPTIONSNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

Oauth preflight

Responses

Status	Body	Description
`204`	None	Success, with no body.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X OPTIONS 'https://depot.example.com/oauth/revoke'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Options `
    -Uri 'https://depot.example.com/oauth/revoke'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/oauth/revoke"

response = requests.options(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodOptions, "https://depot.example.com/oauth/revoke", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/oauth/revoke";

const response = await fetch(url, {
  method: "OPTIONS",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Options, "https://depot.example.com/oauth/revoke");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/oauth/token`

POSTNo permission neededpublic facehosteditmspremoteNot fully resolved

What this page does not know

response-status

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

Token

Parameters

Name	In	Type	Required
`client_id`	query	string	No
`client_secret`	query	string	No
`code`	query	string	No
`code_verifier`	query	string	No
`device_code`	query	string	No
`grant_type`	query	string	No
`redirect_uri`	query	string	No
`refresh_token`	query	string	No

Responses

Status	Body	Description
`200`	`application/json`, object	Success.

Request samples

# This operation is public. It takes no credentials.
curl -X POST 'https://depot.example.com/oauth/token?client_id=<client_id>&client_secret=<client_secret>&code=<code>&code_verifier=<code_verifier>&device_code=<device_code>&grant_type=<grant_type>' \
  -H 'Accept: application/json'

# This operation is public. It takes no credentials.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/oauth/token?client_id=<client_id>&client_secret=<client_secret>&code=<code>&code_verifier=<code_verifier>&device_code=<device_code>&grant_type=<grant_type>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.

import requests

url = "https://depot.example.com/oauth/token"
params = {
    "client_id": "<client_id>",
    "client_secret": "<client_secret>",
    "code": "<code>",
    "code_verifier": "<code_verifier>",
    "device_code": "<device_code>",
    "grant_type": "<grant_type>",
}
headers = {
    "Accept": "application/json",
}

response = requests.post(url, params=params, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/oauth/token?client_id=<client_id>&client_secret=<client_secret>&code=<code>&code_verifier=<code_verifier>&device_code=<device_code>&grant_type=<grant_type>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.

const url = new URL("https://depot.example.com/oauth/token");
url.searchParams.set("client_id", "<client_id>");
url.searchParams.set("client_secret", "<client_secret>");
url.searchParams.set("code", "<code>");
url.searchParams.set("code_verifier", "<code_verifier>");
url.searchParams.set("device_code", "<device_code>");
url.searchParams.set("grant_type", "<grant_type>");

const response = await fetch(url, {
  method: "POST",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/oauth/token?client_id=<client_id>&client_secret=<client_secret>&code=<code>&code_verifier=<code_verifier>&device_code=<device_code>&grant_type=<grant_type>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OPTIONS `/oauth/token`

OPTIONSNo permission neededpublic facehosteditmspremoteIdempotent

Source: [object Object]

Oauth preflight

Responses

Status	Body	Description
`204`	None	Success, with no body.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X OPTIONS 'https://depot.example.com/oauth/token'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Options `
    -Uri 'https://depot.example.com/oauth/token'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/oauth/token"

response = requests.options(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodOptions, "https://depot.example.com/oauth/token", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/oauth/token";

const response = await fetch(url, {
  method: "OPTIONS",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Options, "https://depot.example.com/oauth/token");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.

Depot oauth

GET /.well-known/oauth-authorization-server

Responses

Request samples

OPTIONS /.well-known/oauth-authorization-server

Responses

Request samples

GET /.well-known/oauth-protected-resource

Responses

Request samples

OPTIONS /.well-known/oauth-protected-resource

Responses

Request samples

GET /.well-known/oauth-protected-resource/mcp

Responses

Request samples

OPTIONS /.well-known/oauth-protected-resource/mcp

Responses

Request samples

GET /api/v1/oauth/device/{userCode}

Parameters

Responses

Request samples

POST /api/v1/oauth/device/{userCode}/approve

Parameters

Responses

Request samples

POST /api/v1/oauth/device/{userCode}/deny

Parameters

Responses

Request samples

GET /api/v1/oauth/requests/{id}

Parameters

Responses

Request samples

POST /api/v1/oauth/requests/{id}/approve

Parameters

Responses

Request samples

POST /api/v1/oauth/requests/{id}/deny

Parameters

Responses

Request samples

GET /oauth/authorize

Parameters

Responses

Request samples

POST /oauth/device_authorization

Parameters

Responses

Request samples

OPTIONS /oauth/device_authorization

Responses

Request samples

POST /oauth/register

Request body

Responses

Request samples

OPTIONS /oauth/register

Responses

Request samples

POST /oauth/revoke

Parameters

Responses

Request samples

OPTIONS /oauth/revoke

Responses

Request samples

POST /oauth/token

Parameters

Responses

Request samples

OPTIONS /oauth/token

Responses

Request samples

GET `/.well-known/oauth-authorization-server`

OPTIONS `/.well-known/oauth-authorization-server`

GET `/.well-known/oauth-protected-resource`

OPTIONS `/.well-known/oauth-protected-resource`

GET `/.well-known/oauth-protected-resource/mcp`

OPTIONS `/.well-known/oauth-protected-resource/mcp`

GET `/api/v1/oauth/device/{userCode}`

POST `/api/v1/oauth/device/{userCode}/approve`

POST `/api/v1/oauth/device/{userCode}/deny`

GET `/api/v1/oauth/requests/{id}`

POST `/api/v1/oauth/requests/{id}/approve`

POST `/api/v1/oauth/requests/{id}/deny`

GET `/oauth/authorize`

POST `/oauth/device_authorization`

OPTIONS `/oauth/device_authorization`

POST `/oauth/register`

OPTIONS `/oauth/register`

POST `/oauth/revoke`

OPTIONS `/oauth/revoke`

POST `/oauth/token`

OPTIONS `/oauth/token`