> ## Documentation Index
> Fetch the complete documentation index at: https://www.mill.fyi/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve or deny MCP consent

> The human selects accessLevel. Approval requires recent authentication. When allow is false, omit accessLevel. A client cannot select or approve its own permissions.

A signed-in human session is required. API keys and MCP bearer credentials cannot replace that session.

The human selects accessLevel. Approval requires recent authentication. When allow is false, omit accessLevel. A client cannot select or approve its own permissions.

[Request conventions](https://www.mill.fyi/api-reference/overview.md) · [API keys](https://www.mill.fyi/api-keys.md) · [MCP connections](https://www.mill.fyi/mcp-connections.md)


## OpenAPI

````yaml api-reference/openapi.json POST /api/oauth/consent/{id}
openapi: 3.1.0
info:
  title: Mill HTTP API
  version: 1.0.6
  description: >-
    All registered task-board, account, OAuth, MCP transport and health
    operations. MCP tool schemas come from runtime validators; account
    operations follow their server handlers. Example data is fictional.
    Generation imports routes without issuing requests or connecting to a
    database.
servers:
  - url: https://mill-api.example.com
security: []
paths:
  /api/oauth/consent/{id}:
    post:
      tags:
        - OAuth and MCP transport
      summary: Approve or deny MCP consent
      description: >-
        The human selects accessLevel. Approval requires recent authentication.
        When allow is false, omit accessLevel. A client cannot select or approve
        its own permissions.


        A signed-in human session is required. API keys and MCP bearer
        credentials cannot replace that session.
      operationId: post_api_oauth_consent_by_id
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: >-
            The id from the corresponding list, record or authorization
            response.
        - name: Origin
          in: header
          required: true
          schema:
            type: string
            format: uri
          description: >-
            The exact configured Mill UI origin. Required for browser mutations
            carrying session cookies.
        - name: Idempotency-Key
          in: header
          required: false
          schema:
            type: string
            minLength: 8
            maxLength: 128
            pattern: ^[A-Za-z0-9._:-]+$
          description: >-
            Reuse the same key and exact request bytes for retries of one
            logical mutation; different content conflicts.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                allow:
                  type: boolean
                accessLevel:
                  type: string
                  enum:
                    - read
                    - write
                    - admin
              required:
                - allow
              additionalProperties: false
      responses:
        '200':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  redirectTo:
                    type: string
                additionalProperties: true
                description: >-
                  Illustrative response shape. Fields can be absent in alternate
                  successful flows; see the operation description and example.
              example:
                redirectTo: >-
                  https://client.example.test/callback?code=example&state=example
        default:
          description: >-
            OAuth failure with error and error_description. Consent/session
            authority may also return the standard Mill error envelope.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  error_description:
                    type: string
      security:
        - sessionCookie: []
components:
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: mill_session
      description: >-
        Signed-in human browser session; mutation requests also need the exact
        UI Origin

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.