> ## Documentation Index
> Fetch the complete documentation index at: https://www.posted.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve or deny MCP consent

> The human selects accessLevel. Approval requires recent authentication. When allow is false, omit accessLevel. A client cannot select or approve its own permissions.

A signed-in human session is required. API keys and MCP bearer credentials cannot replace that session.

The human selects accessLevel. Approval requires recent authentication. When allow is false, omit accessLevel. A client cannot select or approve its own permissions.

[Request conventions](/api-reference/overview) · [API keys](/api-keys) · [MCP connections](/mcp-connections)


## OpenAPI

````yaml api-reference/openapi.json POST /api/oauth/consent/{id}
openapi: 3.1.0
info:
  title: Posted HTTP API
  version: 0.2.0
  description: >-
    All registered application, account, OAuth, MCP transport and health
    endpoints. Publishing and draft request schemas come from the shared runtime
    validators. Replace the example server with your installation. Documentation
    uses simple request examples and does not execute live publishing requests.
servers:
  - url: https://posted-api.example.com
security: []
paths:
  /api/oauth/consent/{id}:
    post:
      tags:
        - OAuth and MCP transport
      summary: Approve or deny MCP consent
      description: >-
        The human selects accessLevel. Approval requires recent authentication.
        When allow is false, omit accessLevel. A client cannot select or approve
        its own permissions.


        A signed-in human session is required. API keys and MCP bearer
        credentials cannot replace that session.
      operationId: post_api_oauth_consent_by_id
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: >-
            The id from the corresponding list, record or authorization
            response.
        - name: Origin
          in: header
          required: true
          schema:
            type: string
            format: uri
          description: >-
            The exact configured Posted UI origin. Required for browser
            mutations carrying session cookies.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                allow:
                  type: boolean
                accessLevel:
                  type: string
                  enum:
                    - read
                    - write
                    - admin
              required:
                - allow
              additionalProperties: false
      responses:
        '200':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  redirectTo:
                    type: string
                additionalProperties: true
              example:
                redirectTo: >-
                  https://client.example.test/callback?code=example&state=example
        default:
          description: >-
            OAuth failure with error and error_description. Consent/session
            authority may also return the standard Posted error envelope.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  error_description:
                    type: string
      security:
        - sessionCookie: []
components:
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: posted_session
      description: >-
        Signed-in human browser session; mutation requests also need the exact
        UI Origin

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.