openapi: 3.2.0 info: title: AI Gateway MCP Server Auth API description: Universal MCP Gateway with OAuth integration - Modern Architecture version: 2.0.3290 tags: - name: Auth paths: /auth/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/google: get: summary: Google Auth description: Google OAuth initiation (legacy + service connections) operationId: google_auth_auth_google_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/sso/{provider_key}: get: summary: Sso Auth description: SSO login via named OIDC provider (e.g., /auth/sso/google, /auth/sso/microsoft). operationId: sso_auth_auth_sso__provider_key__get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/notion: get: summary: Notion Auth Simple description: Notion OAuth initiation (simple) operationId: notion_auth_simple_auth_notion_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/gitlab: get: summary: Gitlab Auth Simple description: GitLab OAuth initiation (simple) operationId: gitlab_auth_simple_auth_gitlab_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/jira: get: summary: Jira Auth Simple description: Jira OAuth initiation (simple) operationId: jira_auth_simple_auth_jira_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/slack: get: summary: Slack Auth description: 'Start Slack OAuth flow for User Token (data access) This is SEPARATE from Slack Bot (which uses Bot Token for DM interactions). User Token enables search, read channels, etc. via ChatGPT/MCP/Smart Chat.' operationId: slack_auth_auth_slack_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/figma: get: summary: Figma Auth Simple description: Figma OAuth initiation (simple) operationId: figma_auth_simple_auth_figma_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/jenkins: get: summary: Jenkins Auth description: Redirect to generic per-user auth form (migrated from manual_credential_service). operationId: jenkins_auth_auth_jenkins_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth post: summary: Jenkins Auth description: Redirect to generic per-user auth form (migrated from manual_credential_service). operationId: jenkins_auth_auth_jenkins_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/sentry: get: summary: Sentry Auth description: Redirect to generic per-user auth form (migrated from manual_credential_service). operationId: sentry_auth_auth_sentry_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth post: summary: Sentry Auth description: Redirect to generic per-user auth form (migrated from manual_credential_service). operationId: sentry_auth_auth_sentry_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/gitlab/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_gitlab_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/jira/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_jira_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/notion/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_notion_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/slack/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_slack_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/figma/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_figma_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin_reports: get: summary: Admin Reports Auth Yaml operationId: admin_reports_auth_yaml_auth_admin_reports_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin_reports/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_admin_reports_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin_sdk_reports: get: summary: Admin Sdk Reports Auth Yaml operationId: admin_sdk_reports_auth_yaml_auth_admin_sdk_reports_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin_sdk_reports/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_admin_sdk_reports_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin_sdk: get: summary: Admin Sdk Auth Yaml operationId: admin_sdk_auth_yaml_auth_admin_sdk_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin_sdk/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_admin_sdk_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/amplitude: get: summary: Amplitude Auth Yaml operationId: amplitude_auth_yaml_auth_amplitude_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/amplitude/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_amplitude_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/amplitude_mcp: get: summary: Amplitude Mcp Auth Yaml operationId: amplitude_mcp_auth_yaml_auth_amplitude_mcp_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/amplitude_mcp/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_amplitude_mcp_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/confluence: get: summary: Confluence Auth Yaml operationId: confluence_auth_yaml_auth_confluence_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/confluence/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_confluence_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/figma_mcp: get: summary: Figma Mcp Auth Yaml operationId: figma_mcp_auth_yaml_auth_figma_mcp_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/figma_mcp/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_figma_mcp_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/github: get: summary: Github Auth Yaml operationId: github_auth_yaml_auth_github_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/github/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_github_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/google_ads: get: summary: Google Ads Auth Yaml operationId: google_ads_auth_yaml_auth_google_ads_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/google_ads/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_google_ads_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/ads: get: summary: Ads Auth Yaml operationId: ads_auth_yaml_auth_ads_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/ads/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_ads_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/google_cloud_logging: get: summary: Google Cloud Logging Auth Yaml operationId: google_cloud_logging_auth_yaml_auth_google_cloud_logging_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/google_cloud_logging/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_google_cloud_logging_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/cloud_logging: get: summary: Cloud Logging Auth Yaml operationId: cloud_logging_auth_yaml_auth_cloud_logging_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/cloud_logging/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_cloud_logging_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/logging: get: summary: Logging Auth Yaml operationId: logging_auth_yaml_auth_logging_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/logging/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_logging_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/google_search_console: get: summary: Google Search Console Auth Yaml operationId: google_search_console_auth_yaml_auth_google_search_console_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/google_search_console/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_google_search_console_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/gsc: get: summary: Gsc Auth Yaml operationId: gsc_auth_yaml_auth_gsc_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/gsc/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_gsc_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/search_console: get: summary: Search Console Auth Yaml operationId: search_console_auth_yaml_auth_search_console_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/search_console/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_search_console_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/webmasters: get: summary: Webmasters Auth Yaml operationId: webmasters_auth_yaml_auth_webmasters_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/webmasters/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_webmasters_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/google_tag_manager: get: summary: Google Tag Manager Auth Yaml operationId: google_tag_manager_auth_yaml_auth_google_tag_manager_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/google_tag_manager/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_google_tag_manager_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/gtm: get: summary: Gtm Auth Yaml operationId: gtm_auth_yaml_auth_gtm_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/gtm/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_gtm_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/tag_manager: get: summary: Tag Manager Auth Yaml operationId: tag_manager_auth_yaml_auth_tag_manager_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/tag_manager/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_tag_manager_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/tagmanager: get: summary: Tagmanager Auth Yaml operationId: tagmanager_auth_yaml_auth_tagmanager_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/tagmanager/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_tagmanager_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/hubspot: get: summary: Hubspot Auth Yaml operationId: hubspot_auth_yaml_auth_hubspot_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/hubspot/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_hubspot_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/hubspot_mcp: get: summary: Hubspot Mcp Auth Yaml operationId: hubspot_mcp_auth_yaml_auth_hubspot_mcp_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/hubspot_mcp/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_hubspot_mcp_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/lambdatest_mcp: get: summary: Lambdatest Mcp Auth Yaml operationId: lambdatest_mcp_auth_yaml_auth_lambdatest_mcp_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/lambdatest_mcp/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_lambdatest_mcp_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/microsoft: get: summary: Microsoft Auth Yaml operationId: microsoft_auth_yaml_auth_microsoft_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/microsoft/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_microsoft_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/microsoft_365: get: summary: Microsoft 365 Auth Yaml operationId: microsoft_365_auth_yaml_auth_microsoft_365_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/microsoft_365/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_microsoft_365_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/ms365: get: summary: Ms365 Auth Yaml operationId: ms365_auth_yaml_auth_ms365_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/ms365/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_ms365_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/miro: get: summary: Miro Auth Yaml operationId: miro_auth_yaml_auth_miro_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/miro/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_miro_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/miro_mcp: get: summary: Miro Mcp Auth Yaml operationId: miro_mcp_auth_yaml_auth_miro_mcp_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/miro_mcp/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_miro_mcp_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/notion_mcp: get: summary: Notion Mcp Auth Yaml operationId: notion_mcp_auth_yaml_auth_notion_mcp_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/notion_mcp/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_notion_mcp_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/pipedrive: get: summary: Pipedrive Auth Yaml operationId: pipedrive_auth_yaml_auth_pipedrive_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/pipedrive/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_pipedrive_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/power_bi: get: summary: Power Bi Auth Yaml operationId: power_bi_auth_yaml_auth_power_bi_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/power_bi/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_power_bi_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/power_bi_mcp: get: summary: Power Bi Mcp Auth Yaml operationId: power_bi_mcp_auth_yaml_auth_power_bi_mcp_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/power_bi_mcp/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_power_bi_mcp_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/supernova_mcp: get: summary: Supernova Mcp Auth Yaml operationId: supernova_mcp_auth_yaml_auth_supernova_mcp_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/supernova_mcp/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_supernova_mcp_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/transifex: get: summary: Transifex Auth Yaml operationId: transifex_auth_yaml_auth_transifex_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/transifex/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_transifex_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/windmill: get: summary: Windmill Auth Yaml operationId: windmill_auth_yaml_auth_windmill_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/windmill/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_windmill_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/windmill_mcp: get: summary: Windmill Mcp Auth Yaml operationId: windmill_mcp_auth_yaml_auth_windmill_mcp_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/windmill_mcp/callback: get: summary: Oauth Callback description: OAuth callback handler operationId: oauth_callback_auth_windmill_mcp_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/magic/request: post: summary: Magic Link Request description: 'POST /auth/magic/request Guest enters email -> we send magic link if authorized' operationId: magic_link_request_auth_magic_request_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/magic/verify: get: summary: Magic Link Verify description: 'GET /auth/magic/verify?token=... → Confirmation page (survives Slack unfurl) POST /auth/magic/verify?token=... → Consume token and create session' operationId: magic_link_verify_auth_magic_verify_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth post: summary: Magic Link Verify description: 'GET /auth/magic/verify?token=... → Confirmation page (survives Slack unfurl) POST /auth/magic/verify?token=... → Consume token and create session' operationId: magic_link_verify_auth_magic_verify_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/slack/connect: get: summary: Slack Connect description: 'Slack User ID mapping connection page SECURITY: Manual connection disabled to prevent User ID spoofing. Connection must be initiated from Slack Bot using Magic Link.' operationId: slack_connect_auth_slack_connect_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth post: summary: Slack Connect description: 'Slack User ID mapping connection page SECURITY: Manual connection disabled to prevent User ID spoofing. Connection must be initiated from Slack Bot using Magic Link.' operationId: slack_connect_auth_slack_connect_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/slack/auto-connect: get: summary: Slack Auto Connect description: 'Magic link auto-connect for Slack. Flow: 1. User gets one-time link from Slack bot: /auth/slack/auto-connect?token={ONE_TIME_TOKEN} 2. User clicks link → Gateway authenticates user via OAuth 3. Token is consumed once → mapping created: slack_user_mappings:{USER_ID} → logged_in_email 4. User redirected to Slack with success message' operationId: slack_auto_connect_auth_slack_auto_connect_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/chatgpt: get: summary: Chatgpt Oauth Start description: Start ChatGPT OAuth flow - but first check for existing valid token operationId: chatgpt_oauth_start_auth_chatgpt_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth options: summary: Chatgpt Oauth Options operationId: chatgpt_oauth_options_auth_chatgpt_options responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth head: summary: Chatgpt Oauth Head operationId: chatgpt_oauth_head_auth_chatgpt_head responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/chatgpt/token: post: summary: Chatgpt Oauth Token description: Handle ChatGPT OAuth token exchange operationId: chatgpt_oauth_token_auth_chatgpt_token_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth options: summary: Chatgpt Token Options operationId: chatgpt_token_options_auth_chatgpt_token_options responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth head: summary: Chatgpt Token Head operationId: chatgpt_token_head_auth_chatgpt_token_head responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/chatgpt/callback: get: summary: Chatgpt Oauth Callback description: Handle OAuth callback for ChatGPT Actions (not used - ChatGPT handles its own callbacks) operationId: chatgpt_oauth_callback_auth_chatgpt_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/verify/{service_id}: post: summary: Verify Oauth Connection description: UNIFIED OAuth token verification using UnifiedTokenStorage operationId: verify_oauth_connection_auth_verify__service_id__post parameters: - name: service_id in: path required: true schema: type: string title: Service Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' tags: - Auth /auth/disconnect/{service_id}: post: summary: Disconnect Oauth Service description: Disconnect a service by revoking its OAuth token operationId: disconnect_oauth_service_auth_disconnect__service_id__post parameters: - name: service_id in: path required: true schema: type: string title: Service Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' tags: - Auth /auth/broker: get: summary: Auth Broker Start Get description: GET version of broker login start (for link/button). operationId: auth_broker_start_get_auth_broker_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth post: summary: Auth Broker Start description: Start broker-mediated login. Redirects to broker. operationId: auth_broker_start_auth_broker_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/broker-callback: get: summary: Auth Broker Callback description: 'Callback from broker. Exchange nonce for user info, create session. Reuses redis_utils.create_session — same session creation as SSO login.' operationId: auth_broker_callback_auth_broker_callback_get parameters: - name: nonce in: query required: false schema: type: string default: '' title: Nonce responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' tags: - Auth /auth/admin/guests: get: summary: Guests Redirect operationId: _guests_redirect_auth_admin_guests_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth post: summary: Guests Create description: POST /auth/admin/guests — create invite + optional magic-link delivery. operationId: guests_create_auth_admin_guests_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin/tool-guests: get: summary: Guests Redirect operationId: _guests_redirect_auth_admin_tool_guests_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin/guests/{email_hash}/services: post: summary: Guests Update Services description: POST /auth/admin/guests/{email_hash}/services — replace service list. operationId: guests_update_services_auth_admin_guests__email_hash__services_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin/guests/{email_hash}/resend-link: post: summary: Guests Resend Link description: 'POST /auth/admin/guests/{email_hash}/resend-link. Pure link-generation: mint a fresh magic-link JWT for an existing guest. Two response modes: 1. ``Accept: application/json`` → returns ``{url, email}`` so the row''s Copy button can write directly to the clipboard with JS. No flash, no page reload — one-click UX. 2. Anything else → falls back to flash + 303 redirect for the no-JS path. The flash contains the URL with a Copy button. NO auto-delivery via Slack/SMTP in either mode — the admin shares manually via whichever channel they pick.' operationId: guests_resend_link_auth_admin_guests__email_hash__resend_link_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin/guests/{email_hash}/revoke: post: summary: Guests Revoke description: POST /auth/admin/guests/{email_hash}/revoke. operationId: guests_revoke_auth_admin_guests__email_hash__revoke_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin/allowlist/remove: post: summary: Admin Allowlist Remove description: 'POST /auth/admin/allowlist/remove — drop an address from ADMIN_USERS. The counterpart to the invite form''s "Grant admin access". Promote/demote on the roster needs a stable_id, which only exists once someone has signed in — so an authorised address that never arrived had no way back out. That is exactly the entry worth removing: granted, unused, forgotten.' operationId: admin_allowlist_remove_auth_admin_allowlist_remove_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin/allowlist/add: post: summary: Admin Allowlist Add description: 'POST /auth/admin/allowlist/add — put an address on ADMIN_USERS. The counterpart to /remove, and the reason both exist: the roster''s promote route lives in the OIDC-bootstrap router, so on an install where that is not present the menu entry pointed at a 404. ADMIN_USERS is the documented "single source of admin authority" and the bootstrap promote mirrors into it anyway, so writing it directly works in both shapes.' operationId: admin_allowlist_add_auth_admin_allowlist_add_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/admin/access-levels: post: summary: Access Levels Save description: 'POST /auth/admin/access-levels — one row''s levels, or one group''s. Two shapes through one endpoint, because they are one decision at two scopes: ``subject`` names a person, ``group`` names everyone in a group who carries no exception of their own. The ``levels`` fields arrive as ``:`` with an EMPTY level meaning "no exception here" — a value the form can send rather than an absence the server has to infer from a control the browser chose not to submit. That inference is what made a disabled input delete a grant nobody touched, and this axis does not repeat it. Nothing here can express "no access". Whether a service is reachable at all is the role''s answer, and a level that could deny would be a second, quieter place to revoke — invisible on the page that shows who may reach what.' operationId: access_levels_save_auth_admin_access_levels_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/service/{service_id}: get: summary: Per User Auth description: 'GET: show connect form. POST: store credentials.' operationId: per_user_auth_auth_service__service_id__get parameters: - name: service_id in: path required: true schema: type: string title: Service Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' tags: - Auth post: summary: Per User Auth description: 'GET: show connect form. POST: store credentials.' operationId: per_user_auth_auth_service__service_id__post parameters: - name: service_id in: path required: true schema: type: string title: Service Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' tags: - Auth /auth/service/{service_id}/disconnect: post: summary: Per User Disconnect description: Delete per-user credentials for a service. operationId: per_user_disconnect_auth_service__service_id__disconnect_post parameters: - name: service_id in: path required: true schema: type: string title: Service Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' tags: - Auth /auth/service/{service_id}/verify: get: summary: Per User Verify description: Verify stored per-user credentials by calling verify_endpoint. operationId: per_user_verify_auth_service__service_id__verify_get parameters: - name: service_id in: path required: true schema: type: string title: Service Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' tags: - Auth /auth/authorize: get: summary: Oauth Authorization Endpoint description: OAuth 2.0 Authorization Endpoint for Claude Code MCP integration operationId: oauth_authorization_endpoint_auth_authorize_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/authorize/callback: get: summary: Oauth Authorization Callback description: Complete MCP OAuth authorization after Google login operationId: oauth_authorization_callback_auth_authorize_callback_get responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth /auth/token: post: summary: Oauth Token Endpoint description: OAuth 2.0 Token Endpoint for Claude Code MCP integration operationId: oauth_token_endpoint_auth_token_post responses: '200': description: Successful Response content: application/json: schema: {} tags: - Auth components: schemas: HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError