{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/customdomain-ai/json-schema/customdomain-ai-agent-token-request-schema.json",
  "title": "AgentTokenRequest",
  "x-generated": "2026-11-10",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/customdomain-ai-agents-api-openapi.yml#/components/schemas/AgentTokenRequest",
  "type": "object",
  "required": [
    "grant_type",
    "client_id"
  ],
  "properties": {
    "grant_type": {
      "type": "string",
      "enum": [
        "authorization_code",
        "refresh_token"
      ]
    },
    "client_id": {
      "type": "string"
    },
    "code": {
      "type": "string",
      "description": "With `authorization_code`: the single use code from the redirect. It lives 5 minutes. Presenting a code that already issued tokens is `invalid_grant` and revokes the grant they came from (RFC 6749 §4.1.2)."
    },
    "code_verifier": {
      "type": "string",
      "description": "With `authorization_code`: the PKCE verifier for the `code_challenge` sent to authorize."
    },
    "redirect_uri": {
      "type": "string",
      "format": "uri",
      "description": "With `authorization_code`: exactly the `redirect_uri` sent to authorize."
    },
    "refresh_token": {
      "type": "string",
      "description": "With `refresh_token`: the latest refresh token. It is good for one exchange."
    },
    "resource": {
      "description": "RFC 8707. The resource the token is for. With `authorization_code` it must be the one the person approved; with `refresh_token` it picks the audience of the new access token (the MCP endpoint when omitted). In a form body repeat the field; in JSON send a string or a list.",
      "oneOf": [
        {
          "type": "string",
          "format": "uri"
        },
        {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uri"
          }
        }
      ]
    }
  }
}