Edit connected app
Partial self-service edit of the grant’s mutable fields WITHOUT re-running the browser consent: team_scope_mode, consented_team_sids (full-replace, non-empty when mode=selected), and permissions (full-replace, must stay ⊆ the client ceiling). Each submitted team is re-checked against live membership (403 if not a member). Narrowing is security-positive; you can never exceed the ceiling via update. Changes are frozen-at-mint, so live tokens keep their claims until their short TTL; use revoke for an immediate cut. At least one field required. 404 if not the caller’s own grant.
Contract:
- MCP tool
update_oauth_authorization, registry packagemcp.id/oauth_authorizations, mountid.access. - Operation
update, response envelopeupdate. - Flags: none.
Authorizations
Access token issued by gtm.service.id. Its access_identity claim carries team_sid, actor_sid and actor_type, and that team scope is authoritative.
Team scope for tokens that do not carry one. Ignored when the token already names a team.
Path Parameters
OAuth authorization (grant) sid (id_oa_…).
18^id_oa_Body
Request body of update_oauth_authorization.
selected, all_my_teams FULL replacement; required + non-empty when the effective mode is selected; ignored for all_my_teams.
18^ts_tm_FULL replacement; MUST be ⊆ the client's permission ceiling.
128