Depot portaldirconsent

Registers the MSP’s consent link and status routes (clientportal:manage).

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/clients/{clientID}/portal/directory/consent

GETclientportal:managemsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

consentStatus reports which Entra tenants the client’s broker-mode SSO domains name and whether each is connected for directory sync.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalDirectoryConsentStatus	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:manage.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
brokerAvailablerequired	boolean
tenantsrequired	array of PortalDirectoryTenantStatus
tenants[].boundrequired	boolean
tenants[].boundAt	string (date-time) or null
tenants[].emailDomainsrequired	array of string
tenants[].tenantId	string or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/clients/{clientID}/portal/directory/consent

POSTclientportal:managemsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

consentLink mints a single-use link (7 days) that starts the client’s Microsoft tenant consent for portal directory sync.

Send it to the client’s Microsoft administrator, or open it yourself if you are one.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
tenant	string or null

Responses

Status	Body	Description
201	application/json, PortalDirectoryConsentLink	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:manage.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

201 response body

Field	Type	Description
expiresAtrequired	string (date-time)
urlrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "tenant": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "tenant": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "tenant": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "tenant": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "tenant": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "tenant": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/clients/<clientID>/portal/directory/consent");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/public/directory-consent/return

GETNo permission neededpublic facemspIdempotentNot fully resolved

What this page does not know

• response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

consentReturnPage records a granted consent once Core confirms the binding.

Parameters

Name	In	Type	Required	Description
directory_consent	query	string	No
t	query	string	No
tenant	query	string	No

Responses

Status	Body	Description
200	None	Success. The body shape was not resolved; see x-outpost-unresolved.

Request samples

curl

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/public/directory-consent/return?directory_consent=<directory_consent>&t=<t>&tenant=<tenant>'

PowerShell

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/public/directory-consent/return?directory_consent=<directory_consent>&t=<t>&tenant=<tenant>'

$response | ConvertTo-Json -Depth 10

Python

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/public/directory-consent/return"
params = {
    "directory_consent": "<directory_consent>",
    "t": "<t>",
    "tenant": "<tenant>",
}

response = requests.get(url, params=params, timeout=30)
response.raise_for_status()
print(response.json())

Go

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/public/directory-consent/return?directory_consent=<directory_consent>&t=<t>&tenant=<tenant>", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = new URL("https://depot.example.com/api/v1/public/directory-consent/return");
url.searchParams.set("directory_consent", "<directory_consent>");
url.searchParams.set("t", "<t>");
url.searchParams.set("tenant", "<tenant>");

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/public/directory-consent/return?directory_consent=<directory_consent>&t=<t>&tenant=<tenant>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/public/directory-consent/start

GETNo permission neededpublic facemspIdempotentNot fully resolved

What this page does not know

• response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

consentStart opens a consent link: a fresh admin-consent URL from Core, then a redirect to it.

Parameters

Name	In	Type	Required	Description
t	query	string	No

Responses

Status	Body	Description
200	None	Success. The body shape was not resolved; see x-outpost-unresolved.

Request samples

curl

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/public/directory-consent/start?t=<t>'

PowerShell

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/public/directory-consent/start?t=<t>'

$response | ConvertTo-Json -Depth 10

Python

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/public/directory-consent/start"
params = {
    "t": "<t>",
}

response = requests.get(url, params=params, timeout=30)
response.raise_for_status()
print(response.json())

Go

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/public/directory-consent/start?t=<t>", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = new URL("https://depot.example.com/api/v1/public/directory-consent/start");
url.searchParams.set("t", "<t>");

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/public/directory-consent/start?t=<t>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());