Skip to main content
POST
Approve or deny MCP consent
A signed-in human session is required. API keys and MCP bearer credentials cannot replace that session. The human selects accessLevel. Approval requires recent authentication. When allow is false, omit accessLevel. A client cannot select or approve its own permissions. Request conventions · API keys · MCP connections

Authorizations

mill_session
string
cookie
required

Signed-in human browser session; mutation requests also need the exact UI Origin

Headers

Origin
string<uri>
required

The exact configured Mill UI origin. Required for browser mutations carrying session cookies.

Idempotency-Key
string

Reuse the same key and exact request bytes for retries of one logical mutation; different content conflicts.

Required string length: 8 - 128
Pattern: ^[A-Za-z0-9._:-]+$

Path Parameters

id
string<uuid>
required

The id from the corresponding list, record or authorization response.

Body

application/json
allow
boolean
required
accessLevel
enum<string>
Available options:
read,
write,
admin

Response

Successful response. Examples are illustrative; field values vary by record.

Illustrative response shape. Fields can be absent in alternate successful flows; see the operation description and example.

redirectTo
string