---
title: "Review a changed External MCP OAuth issuer"
method: POST
path: "/v1/mcp-connections/{connectionId}/oauth/issuer-review"
tags: ["Authentication"]
---

# Review a changed External MCP OAuth issuer

`POST /v1/mcp-connections/{connectionId}/oauth/issuer-review`

Organization-admin-only. Repeats live OAuth discovery and either previews the issuers currently advertised by the MCP resource or explicitly confirms one. Confirmation never trusts an unadvertised issuer. Changing issuers invalidates issuer-bound OAuth clients and credentials so members reconnect cleanly.

## Path parameters

- `connectionId` string, typeid, required

## Request body

- union
  - object
    - `action` 'preview', required
  - object
    - `action` 'confirm', required
    - `expectedUpdatedAt` string, date-time, required
    - `authorizationServerIssuer` string, uri, required

## Response `200`

Issuer review result.

- ExternalMcpIssuerReviewResponse
  - `currentIssuer` string, nullable, required
  - `advertisedIssuers` string[], required
  - `reviewRequired` boolean, required
  - `issuerChanged` boolean
  - `reconnectionRequired` boolean
  - `updatedAt` string, date-time

## Other responses

- `400` — Invalid issuer review request.
- `401` — The caller must be signed in.
- `403` — Only workspace owners and admins can review OAuth issuers.
- `404` — Unknown connection.
- `409` — The connection changed or the requested issuer is not currently advertised.
- `502` — Live OAuth discovery failed.

---

[API](https://skmtc.net/openworklabs/apis/den-api.md) · [All operations](https://skmtc.net/openworklabs/apis/den-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openworklabs/den-api/revisions/0d4ebf20cbde/schema)