> ## Documentation Index > Fetch the complete documentation index at: https://docs.stella-commerce.com/llms.txt > Use this file to discover all available pages before exploring further. # Post Consent Request > Start a Device Authorization (RFC 8628) consent flow. The agent calls this with the merchant identified by `X-Site-ID` and the requested capability shape. Stella mints a fresh consent-code row and returns: device_code long opaque secret the agent uses on /poll user_code short 8-char code the customer types verification_uri where the customer goes to type it verification_uri_complete same URL with `?user_code=` baked in expires_in seconds until both codes die interval minimum seconds between polls The decode-resistant `user_code` alphabet (no 0/O/1/I/L) is chosen to minimise customer typing errors. Plaintexts are returned exactly once and never leave this response. ## OpenAPI ````yaml /api-reference/openapi.json post /api/agent/consent/request openapi: 3.1.0 info: title: Agentic Commerce API description: |2- Agentic Commerce API - E-commerce Backend ## APIs ### Dashboard API (`/api/dashboard`) Authenticated endpoints for merchant management: - Products, Variants, Options - Inventory management - Orders and fulfillment - Customers - Collections ### Storefront API (`/api/storefront`) Public endpoints for client websites: - Product catalog - Collections - Cart management - Checkout ### Sync API (`/api/sync`) Integration endpoints for zunkiree-search: - Product sync - Availability checks - Order creation from AI widget version: 1.0.0 servers: [] security: [] paths: /api/agent/consent/request: post: tags: - Agent - Agent Consent summary: Post Consent Request description: |- Start a Device Authorization (RFC 8628) consent flow. The agent calls this with the merchant identified by `X-Site-ID` and the requested capability shape. Stella mints a fresh consent-code row and returns: device_code long opaque secret the agent uses on /poll user_code short 8-char code the customer types verification_uri where the customer goes to type it verification_uri_complete same URL with `?user_code=` baked in expires_in seconds until both codes die interval minimum seconds between polls The decode-resistant `user_code` alphabet (no 0/O/1/I/L) is chosen to minimise customer typing errors. Plaintexts are returned exactly once and never leave this response. operationId: post_consent_request_api_agent_consent_request_post parameters: - name: X-Site-ID in: header required: true schema: type: string title: X-Site-Id requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AgentConsentRequestBody' responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/AgentConsentRequestResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: AgentConsentRequestBody: properties: agent_name: type: string maxLength: 120 minLength: 1 title: Agent Name description: >- Free-form agent identity displayed on the consent screen. The customer's approval is what makes the string trustworthy; Stella does not register or authenticate agent identities in v1. scopes: items: type: string type: array maxItems: 16 title: Scopes description: >- Coarse capability vocabulary the agent is requesting. Phase 6 v1: catalog:read, cart:write, checkout:create, customer:read. Unknown scopes are rejected at validation time (422) so a customer is never asked to approve a permission Stella doesn't honor. budget_cents: type: integer maximum: 10000000 minimum: 0 title: Budget Cents description: >- Hard spending cap in merchant-currency minor units. Decremented at order creation. Refunds do NOT restore. allowed_categories: items: type: string type: array maxItems: 32 title: Allowed Categories description: >- Optional category allowlist. Empty = any category. Match is against Product.product_type / Product.tags case-insensitively. token_ttl_seconds: type: integer maximum: 7776000 minimum: 60 title: Token Ttl Seconds description: >- Requested lifetime for the minted agt_ token, in seconds. Min 1 minute, max 90 days. Default 30 days. default: 2592000 type: object required: - agent_name - budget_cents title: AgentConsentRequestBody description: |- Agent → Stella: start a consent flow. The merchant is identified by the `X-Site-ID` header, NOT by a body field — same convention as `/api/storefront/*`. Multi-merchant agent tokens are out of scope for v1 (see PLAN §A2). AgentConsentRequestResponse: properties: device_code: type: string title: Device Code user_code: type: string title: User Code verification_uri: type: string title: Verification Uri verification_uri_complete: type: string title: Verification Uri Complete expires_in: type: integer title: Expires In description: Seconds until the codes expire. interval: type: integer title: Interval description: >- Minimum seconds between poll calls per RFC 8628 §3.2. Reserved for future `slow_down` cadence enforcement; Phase 6-B currently uses a per-IP token bucket instead. default: 5 type: object required: - device_code - user_code - verification_uri - verification_uri_complete - expires_in title: AgentConsentRequestResponse description: |- Stella → agent: device-flow handshake response per RFC 8628 §3.2. `verification_uri_complete` includes the user_code so the agent can render a single-tap link / QR code; `verification_uri` is the bare endpoint for clients that prefer to display the user_code separately. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError ````