Skip to main content
Glama

get_authorization

Read-only

Get an authorization by ID. Returns the current state of the authorization including status and usage statistics.

ACCESS: needs a Proof account. Authenticate this client (Claude Code: /mcp → Authenticate), then call this tool again. start_login does NOT open this tool.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "id": "<id>"
    },
    "name": "get_authorization"
  }
}

Input Schema

NameRequiredDescriptionDefault
idYesAuthorization ID

Output Schema

NameRequiredDescriptionDefault
idYesMongoDB ObjectId
bsuidNoWhatsApp Business-Scoped User ID
labelNoOwner-assigned human label for this approver (F22); null when unset. Surfaces lead with it, falling back to the masked recipient.
phoneNo
scopeYesScope of the authorization. `identity_challenge` is the Proof of Me scope.
statusYesStatus of an authorization
channelYesChannel authorized for sending confirmations
hitl_idNo
enrolledYesWhether the approver has enrolled an encryption key. A confirmation can be sealed to an approver only once this is true; consent alone (`status: active`) is not enough.
circle_idNo
denied_atNoWhen the recipient refused — the mirror of `authorized_at` for a `denied` row (a challenger cancellation stamps it too). Absent unless the authorization was denied; before it existed such a row carried no decision time at all, only `updated_at`.
recipientNoChannel-specific recipient identifier (chat_id for Telegram, phone or BSUID for WhatsApp)
created_atYes
expires_atYes
revoked_atNo
updated_atYes
proof_tokenNoSigned proof of the recipient's decision, minted when they approved or refused, for both scopes. Absent while no decision has been made.
last_used_atNo
authorized_atNo
business_nameYes
verification_idNoMongoDB ObjectId
revocation_reasonNo
confirmations_sentYes
recipient_display_nameYesThe approver's own messenger name ("First Last @username"), captured when they approved over Telegram; null when none was captured. Chosen by the approver, not verified.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
      +  "$schema": "http://json-schema.org/draft-07/schema#",
      +  "additionalProperties": {},
      +  "description": "Authorization granting permission to send confirmations via a specific channel",
      +  "properties": {
      +    "authorized_at": {
      +      "type": "string"
      +    },
      +    "bsuid": {
      +      "description": "WhatsApp Business-Scoped User ID",
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "business_name": {
      +      "type": "string"
      +    },
      +    "channel": {
      +      "description": "Channel authorized for sending confirmations",
      +      "type": "string"
      +    },
      +    "circle_id": {
      +      "allOf": [
      +        {
      +          "type": "string"
      +        },
      +        {}
      +      ]
      +    },
      +    "confirmations_sent": {
      +      "maximum": 9007199254740991,
      +      "minimum": -9007199254740991,
      +      "type": "integer"
      +    },
      +    "created_at": {
      +      "type": "string"
      +    },
      +    "denied_at": {
      +      "description": "When the recipient refused — the mirror of `authorized_at` for a `denied` row (a challenger cancellation stamps it too). Absent unless the authorization was denied; before it existed such a row carried no decision time at all, only `updated_at`.",
      +      "type": "string"
      +    },
      +    "enrolled": {
      +      "description": "Whether the approver has enrolled an encryption key. A confirmation can be sealed to an approver only once this is true; consent alone (`status: active`) is not enough.",
      +      "type": "boolean"
      +    },
      +    "expires_at": {
      +      "type": "string"
      +    },
      +    "hitl_id": {
      +      "allOf": [
      +        {
      +          "type": "string"
      +        },
      +        {}
      +      ]
      +    },
      +    "id": {
      +      "description": "MongoDB ObjectId",
      +      "type": "string"
      +    },
      +    "label": {
      +      "description": "Owner-assigned human label for this approver (F22); null when unset. Surfaces lead with it, falling back to the masked recipient.",
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "last_used_at": {
      +      "type": "string"
      +    },
      +    "phone": {
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "proof_token": {
      +      "description": "Signed proof of the recipient's decision, minted when they approved or refused, for both scopes. Absent while no decision has been made.",
      +      "type": "string"
      +    },
      +    "recipient": {
      +      "description": "Channel-specific recipient identifier (chat_id for Telegram, phone or BSUID for WhatsApp)",
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "recipient_display_name": {
      +      "description": "The approver's own messenger name (\"First Last @username\"), captured when they approved over Telegram; null when none was captured. Chosen by the approver, not verified.",
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "revocation_reason": {
      +      "type": "string"
      +    },
      +    "revoked_at": {
      +      "type": "string"
      +    },
      +    "scope": {
      +      "description": "Scope of the authorization. `identity_challenge` is the Proof of Me scope.",
      +      "type": "string"
      +    },
      +    "status": {
      +      "description": "Status of an authorization",
      +      "type": "string"
      +    },
      +    "updated_at": {
      +      "type": "string"
      +    },
      +    "verification_id": {
      +      "description": "MongoDB ObjectId",
      +      "type": "string"
      +    }
      +  },
      +  "required": [
      +    "id",
      +    "status",
      +    "channel",
      +    "scope",
      +    "business_name",
      +    "recipient_display_name",
      +    "enrolled",
      +    "expires_at",
      +    "confirmations_sent",
      +    "created_at",
      +    "updated_at"
      +  ],
      +  "type": "object"
      +}
  2. Changed1 schema field changed
    • removedInput schema / additionalProperties
      Removed value: -false
  3. First observed

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and the description is consistent with that. Beyond annotations it adds the return content (status, usage statistics) and, importantly, the authentication prerequisite plus the anti-pattern warning that start_login does NOT unlock this tool — genuinely useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and return content are front-loaded in two tight sentences. The ACCESS paragraph is longer than the rest but earns its place by preventing a failed auth loop; only minor redundancy in restating the call-again step.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be spelled out, and annotations cover the safety profile; the one parameter is fully documented. The description closes the remaining gap — auth requirements — leaving little an agent would need before invoking it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single documented 'id' parameter, so the schema already carries the meaning. The description only restates 'by ID' and adds no format, source, or lookup hints beyond the schema; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get an authorization by ID') plus what comes back (status and usage statistics). It does not explicitly name list_authorizations or revoke_authorization, so sibling differentiation is left implicit in the 'by ID' phrasing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: you need an authorization ID in hand. There is no explicit guidance on when to prefer this over list_authorizations or export_authorizations. The ACCESS block does give useful operational guidance for getting the client into a callable state, but not task-level routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.