Herald
OpenapiOauth

MCP dynamic client registration — gated pass-through form (DEC-mcp-server-007). Advertised from the AS metadata as `registration_endpoint` because mainstream MCP clients refuse to connect without one; after the gate (rate limit + RFC 7591 shape + loopback redirect validation) it returns the realm's preset public `herald-mcp` client and persists NOTHING — the abuse surface therefore equals the preset-client status quo (the real security boundaries stay in authorize's loopback whitelist, mandatory PKCE, and the tool-layer RBAC/scope gates).

POST
/api/oauth/{realmId}/mcp/register

Path Parameters

realmId*string

Realm ID

Request Body

application/json

RFC 7591 registration request. Only client_name (1-100 chars) and redirect_uris (non-empty, every entry an http loopback /callback URL) are validated; other fields are accepted and ignored. Returns the preset public MCP client — no client_secret, no registration state.

TypeScript Definitions

Use the request body type in TypeScript.

client_name?string|null
redirect_uris?array<string>|null

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/oauth/string/mcp/register" \  -H "Content-Type: application/json" \  -d '{}'
{  "client_id": "string",  "client_name": "string",  "grant_types": [    "string"  ],  "redirect_uris": [    "string"  ],  "response_types": [    "string"  ],  "scope": "string",  "token_endpoint_auth_method": "string"}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}