find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/agentrux-com:agentrux-com-oauth-device-flow-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: AgenTrux OAUTH Device Flow API
  version: 0.1.0
tags:
- name: oauth-device-flow
paths:
  /oauth/device/authorize:
    post:
      tags:
      - oauth-device-flow
      summary: Device Authorize
      description: 'RFC 8628 §3.2 device authorization response。


        L-A issue_device_code 経由で device_code (dc_ prefix) と user_code を発行し、

        audit_logs.auth.device.issue を同 TX で永続化。'
      operationId: device_authorize_oauth_device_authorize_post
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Body_device_authorize_oauth_device_authorize_post'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Device Authorize Oauth Device Authorize Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /oauth/topology-request:
    post:
      tags:
      - oauth-device-flow
      summary: Topology Request Issue
      description: 'SSOT: docs/04_design/auth/topology_request_v1.md §2-1.


        `authorization_details` (RFC 9396 §2) を受けて `topology_requests` 行を作成し、

        既存 Device Flow と同じ `device_code`/`user_code` を返す。 picker は同じ device_codes

        state machine を共有し、 approve 経路は別 endpoint (`/console/topology-requests/...`)。

        token mint は既存 `/oauth/token` device_code grant をそのまま使う。'
      operationId: topology_request_issue_oauth_topology_request_post
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Body_topology_request_issue_oauth_topology_request_post'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Topology Request Issue Oauth Topology Request Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /device:
    get:
      tags:
      - oauth-device-flow
      summary: Device Verification Page
      description: RFC 8628 §3.3 verification page legacy fallback (SPA /device に redirect).
      operationId: device_verification_page_device_get
      parameters:
      - name: user_code
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: User Code
      responses:
        '200':
          description: Successful Response
          content:
            text/html:
              schema:
                type: string
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /device/verify:
    post:
      tags:
      - oauth-device-flow
      summary: Device Verify
      description: 'user_code を approve / deny。 L-A use case 経由で state-conditional UPDATE。


        P0-3 picker (authz_core.md §3-4 §4-2): SPA は select_script_candidates で取得した

        候補リストを表示し、 user が選んだ script を `selected_script_id` form param で

        渡す。 候補が 1 件のみなら SPA が auto-confirm 可能 (selected_script_id 省略時に

        router が auto-pick)、 複数候補時は SPA に picker 提示要求 (409 + candidates list)。

        `assert_script_accessible` (L-A approve_device_code) で再検証するため、 SPA の

        渡してきた script_id が own/delegated でない場合は 422 reject。'
      operationId: device_verify_device_verify_post
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Body_device_verify_device_verify_post'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Device Verify Device Verify Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /consent:
    get:
      tags:
      - oauth-device-flow
      summary: Consent Screen
      description: 'AS (API origin) 上で完結する consent picker。


        authorize が 302 する `/consent?request_id=...` の着地先。動的値は server 補間せず、

        client-side JS が同 origin の GET/POST /oauth/consent/{request_id}[/decision] を叩いて

        描画・承認・redirect_uri 完走する (詳細は上の block コメント)。


        grant を承認する sensitive page のため clickjacking 防止 header を付与する

        (frame-ancestors ''none'' + X-Frame-Options: DENY)。CSP は frame-ancestors のみに絞り、

        inline script/style は許可したまま (page は inline JS で動く)。'
      operationId: consent_screen_consent_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /consent/decision:
    post:
      tags:
      - oauth-device-flow
      summary: Consent Decision Legacy
      description: W.2.2 以降 deprecated (oauth_router の /oauth/consent/{request_id}/decision に移行).
      operationId: consent_decision_legacy_consent_decision_post
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Body_consent_decision_legacy_consent_decision_post'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Consent Decision Legacy Consent Decision Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /oauth/register:
    post:
      tags:
      - oauth-device-flow
      summary: Dcr Register
      description: RFC 7591 public client registration for MCP/device flow.
      operationId: dcr_register_oauth_register_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DCRRequest'
        required: true
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Dcr Register Oauth Register Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /oauth/register/{client_id}:
    delete:
      tags:
      - oauth-device-flow
      summary: Dcr Delete
      description: 'RFC 7592 §2.3: 動的登録された client を registration_access_token で無効化する。


        Auth: `Authorization: Bearer `。

        成功時 204 No Content。auth 失敗 / client 不在 / 既 revoke は一律 401 (oracle 防止)。

        soft-revoke (revoked_at) のため新規 authorize/token は即停止、既発行 aat_ は TTL まで

        生存、revoked_at+30d で cleanup job が物理削除する。'
      operationId: dcr_delete_oauth_register__client_id__delete
      parameters:
      - name: client_id
        in: path
        required: true
        schema:
          type: string
          title: Client Id
      - name: authorization
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Authorization
      responses:
        '204':
          description: Successful Response
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    Body_consent_decision_legacy_consent_decision_post:
      properties:
        decision:
          type: string
          title: Decision
        client_id:
          type: string
          title: Client Id
          default: ''
        scope:
          type: string
          title: Scope
          default: ''
      type: object
      required:
      - decision
      title: Body_consent_decision_legacy_consent_decision_post
    Body_device_verify_device_verify_post:
      properties:
        user_code:
          type: string
          title: User Code
        decision:
          type: string
          title: Decision
          default: approve
        selected_script_id:
          anyOf:
          - type: string
          - type: 'null'
          title: Selected Script Id
      type: object
      required:
      - user_code
      title: Body_device_verify_device_verify_post
    DCRRequest:
      properties:
        client_name:
          type: string
          maxLength: 200
          minLength: 1
          title: Client Name
        redirect_uris:
          items:
            type: string
            maxLength: 2083
            minLength: 1
            format: uri
          type: array
          title: Redirect Uris
        grant_types:
          items:
            type: string
          type: array
          title: Grant Types
        token_endpoint_auth_method:
          type: string
          title: Token Endpoint Auth Method
          default: client_secret_basic
      additionalProperties: true
      type: object
      required:
      - client_name
      title: DCRRequest
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    Body_topology_request_issue_oauth_topology_request_post:
      properties:
        client_id:
          type: string
          title: Client Id
        authorization_details:
          type: string
          title: Authorization Details
        client_hint:
          anyOf:
          - type: string
          - type: 'null'
          title: Client Hint
      type: object
      required:
      - client_id
      - authorization_details
      title: Body_topology_request_issue_oauth_topology_request_post
    Body_device_authorize_oauth_device_authorize_post:
      properties:
        client_id:
          type: string
          title: Client Id
        scope:
          anyOf:
          - type: string
          - type: 'null'
          title: Scope
      type: object
      required:
      - client_id
      title: Body_device_authorize_oauth_device_authorize_post