Load the MCP consent screen

GET

/api/mcp/consent

curl --request GET \
  --url 'https://example.com/api/mcp/consent?client_id=example&redirect_uri=example&response_type=code&code_challenge=example&code_challenge_method=S256' \
  --header 'Remote-User: <Remote-User>'

• Your gotifacts apex (canonical base domain), fronted by your reverse proxy. Any configured alias domains serve the same API and sites, but responses (e.g. base_domain) always report the canonical domain.

Available only when GOTIFACTS_MCP_ENABLED=true. Backs the consent screen the portal renders at /mcp/oauth/authorize. The query string carries the OAuth authorization request; it is validated like the authorize endpoint (known client, registered redirect URI, PKCE with S256) but failures are reported as 400 JSON, never as redirects. The caller must be allowed to grant MCP consent (GOTIFACTS_MCP_ALLOWED_USERS, falling back to the admin users), otherwise 403.

Authorizations

• forwardAuth

Parameters

Query Parameters

client_id

required

string

redirect_uri

required

string

response_type

required

string

Allowed values: code

code_challenge

required

string

code_challenge_method

string

default: S256

Allowed values: S256

state

string

Responses

200

What the consent screen needs.

Media typeapplication/json

Data for the MCP consent screen.

object

client_name

required

The registered client’s display name.

string

user

required

The signed-in user approving the request.

string

base_domain

required

string

default_target

required

Group pre-filled in the first grant (GOTIFACTS_MCP_GROUP).

string

capabilities

required

The capabilities the screen offers per grant, in display order.

Array<string>

Allowed values: publish unpublish rollback patch purge read

csrf

required

CSRF token to send back with the decision.

string

Example

{
  "capabilities": [
    "publish"
  ]
}

400

Invalid request (bad path, malformed body, or missing content).

Media typeapplication/json

object

error

required

string

Example^generated

{
  "error": "example"
}

401

Missing or invalid credentials.

Media typeapplication/json

object

error

required

string

Example^generated

{
  "error": "example"
}

403

Authenticated, but not permitted for this target/capability.

Media typeapplication/json

object

error

required

string

Example^generated

{
  "error": "example"
}