Approve or deny MCP consent
curl --request POST \
--url https://mill-api.example.com/api/oauth/consent/{id} \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie mill_session= \
--data '{
"allow": true
}'import requests
url = "https://mill-api.example.com/api/oauth/consent/{id}"
payload = { "allow": True }
headers = {
"cookie": "mill_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'mill_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({allow: true})
};
fetch('https://mill-api.example.com/api/oauth/consent/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://mill-api.example.com/api/oauth/consent/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'allow' => true
]),
CURLOPT_COOKIE => "mill_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://mill-api.example.com/api/oauth/consent/{id}"
payload := strings.NewReader("{\n \"allow\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "mill_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://mill-api.example.com/api/oauth/consent/{id}")
.header("cookie", "mill_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"allow\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://mill-api.example.com/api/oauth/consent/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'mill_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"allow\": true\n}"
response = http.request(request)
puts response.read_body{
"redirectTo": "https://client.example.test/callback?code=example&state=example"
}{
"error": "<string>",
"error_description": "<string>"
}Approve or deny MCP consent
The human selects accessLevel. Approval requires recent authentication. When allow is false, omit accessLevel. A client cannot select or approve its own permissions.
POST
/
api
/
oauth
/
consent
/
{id}
Approve or deny MCP consent
curl --request POST \
--url https://mill-api.example.com/api/oauth/consent/{id} \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie mill_session= \
--data '{
"allow": true
}'import requests
url = "https://mill-api.example.com/api/oauth/consent/{id}"
payload = { "allow": True }
headers = {
"cookie": "mill_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'mill_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({allow: true})
};
fetch('https://mill-api.example.com/api/oauth/consent/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://mill-api.example.com/api/oauth/consent/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'allow' => true
]),
CURLOPT_COOKIE => "mill_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://mill-api.example.com/api/oauth/consent/{id}"
payload := strings.NewReader("{\n \"allow\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "mill_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://mill-api.example.com/api/oauth/consent/{id}")
.header("cookie", "mill_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"allow\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://mill-api.example.com/api/oauth/consent/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'mill_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"allow\": true\n}"
response = http.request(request)
puts response.read_body{
"redirectTo": "https://client.example.test/callback?code=example&state=example"
}{
"error": "<string>",
"error_description": "<string>"
}A signed-in human session is required. API keys and MCP bearer credentials cannot replace that session.
The human selects accessLevel. Approval requires recent authentication. When allow is false, omit accessLevel. A client cannot select or approve its own permissions.
Request conventions · API keys · MCP connections
Authorizations
Signed-in human browser session; mutation requests also need the exact UI Origin
Headers
The exact configured Mill UI origin. Required for browser mutations carrying session cookies.
Reuse the same key and exact request bytes for retries of one logical mutation; different content conflicts.
Required string length:
8 - 128Pattern:
^[A-Za-z0-9._:-]+$Path Parameters
The id from the corresponding list, record or authorization response.
Body
application/json
Response
Successful response. Examples are illustrative; field values vary by record.
Illustrative response shape. Fields can be absent in alternate successful flows; see the operation description and example.
Was this page helpful?
