Change what an existing agent grant holds

PUT /api/auth/agents/{organizationId}/{clientId}/{userId}

Change what an existing agent grant holds: the person's own, to any scopes they now hold (as a fresh consent would), or anyone's for an owner or admin, who may only narrow it — of what it already holds — since consent to more is the person's alone.

400 AgentGrantEmpty when nothing asked for may be granted, 403 NotAMember for anyone outside the organization and AdminRequired for another person's grant without being an owner or admin, 404 AgentGrantNotFound when the person has no grant for the client here. Appends auth.agent-connected with the grant as it now stands, the caller as its actor. Idempotent by content: scopes the grant already holds are acknowledged and append nothing.

Access

Requires a signed-in session: The person whose grant it is, or an owner or admin of the organization for anyone's, checked against its membership by the route

How scopes come from roles: Scopes and roles. Getting a token: Authentication and app tokens.

Retries

Idempotent by content: scopes the grant already holds are acknowledged and append nothing.

Why every write carries a key: Idempotency and retries.

Facts appended

auth.agent-connected

What a fact is: Facts and the journal.

AI agent tool

No agent tool. What an agent may do is the person's consent, changed in Agents in the admin; an agent never widens or narrows its own grant.

Connecting an agent: AI agents.

Example

curl

curl -X PUT 'https://auth.getmanifold.io/api/auth/agents/org_01a156d2-8680-7738-ab2e-ff985e454887/kQ7vXpLmTsWnhRbyJdcFgzNaeHuVrKoB/usr_01a15709-7582-7646-b491-261a138f0650' \
  -H "Authorization: Bearer $MANIFOLD_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
  "scopes": [
    "orders:read",
    "stock:read"
  ]
}'

JavaScript (fetch)

const response = await fetch("https://auth.getmanifold.io/api/auth/agents/org_01a156d2-8680-7738-ab2e-ff985e454887/kQ7vXpLmTsWnhRbyJdcFgzNaeHuVrKoB/usr_01a15709-7582-7646-b491-261a138f0650", {
  method: "PUT",
  headers: { Authorization: `Bearer ${process.env.MANIFOLD_TOKEN}`, "Content-Type": "application/json" },
  body: JSON.stringify({
    "scopes": [
      "orders:read",
      "stock:read"
    ]
  }),
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);
const answer = await response.json();

Request body · application/json

{
  "scopes": [
    "orders:read",
    "stock:read"
  ]
}

Response · 200 · application/json

{
  "clientId": "kQ7vXpLmTsWnhRbyJdcFgzNaeHuVrKoB",
  "userId": "usr_01a15709-7582-7646-b491-261a138f0650",
  "organizationId": "org_01a156d2-8680-7738-ab2e-ff985e454887",
  "scopes": [
    "stock:read",
    "orders:read"
  ],
  "grantedAt": "2026-10-22T01:12:09.000Z",
  "clientName": "Stockroom Assistant",
  "userEmail": "dana.whitlock@ridgeline-outdoor.example",
  "userName": "Dana Whitlock"
}

The panel writes this call in other languages. It does not send it: Manifold's APIs do not take calls from a web page on another site, so run the call from your own code or terminal. The whole API as OpenAPI: auth-service.openapi.json. Base URL https://auth.getmanifold.io.

Errors

Every refusal is a status and a JSON body whose _tag names it. A refused call changes nothing.

`400`

Refusal	What it means	What to do
`AgentGrantEmpty` reason	Nothing the agent asked for is something you hold.	Connect the agent as someone who holds those scopes.

`401`

Refusal	What it means	What to do
`Unauthorized` reason	The token is missing, expired or not one Manifold issued.	Get a fresh token and send the call again.
`TokenAlreadyUsed` tokenId	A single-use app token was already spent.	Mint a new token for this call.

`402`

Refusal	What it means	What to do
`SubscriptionRequired` status	The organization's subscription has lapsed, so writes are refused.	An owner settles billing. Reads still work meanwhile.

`403`

Refusal	What it means	What to do
`NotAMember`	The person is not a member of this organization.	Check the organization, or invite them first.
`AdminRequired`	Only an owner or admin of the organization may do this.	Ask an owner or admin.
`TenantRequired` userId	The token names no organization.	Choose the organization, then get a new token.
`ScopeRequired` required	The token's roles do not grant the scope this call needs.	Ask an owner or admin for a role that grants it.

`404`

Refusal	What it means	What to do
`AgentGrantNotFound` clientId, userId	The person has no grant for the client here.	Check the id in the path or the body.

`409`

Refusal	What it means	What to do
`MirroredFromSource` source	This area is fed by your source system until the organization goes live.	Make the change in the source system, or go live first.

`503`

Refusal	What it means	What to do
`RequestLogUnavailable` tokenId, reason	The service could not record the request, so it did nothing.	Send the same request again shortly.

How refusals work everywhere: Errors.