Update OAuth return origins
Replace the set of origins the OAuth consent flow may redirect the browser to. POST /oauth/initiate rejects any return_url whose origin is not in this list, which is what stops the unauthenticated callback from being used as an open redirector.
Origins only — https://portal.example.com, no path. A supplied URL is normalised to its origin, duplicates are collapsed, and non-http(s) or credential-bearing values are rejected. The list starts empty, meaning no return_url is accepted at all until you set it (the callback then renders its own terminal page). Requires an agency key (ak_).
Works on an agency that has never provisioned: the config row is created if it does not exist. That row unlocks nothing on its own — POST /oauth/initiate still requires an active provisioned workspace — it just means you can register return origins before provisioning rather than after.
curl -X PATCH "https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/config" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-d '{
"oauth_return_origins": [
"https://portal.example.com"
]
}'
import requests
import json
url = "https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/config"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
data = {
"oauth_return_origins": [
"https://portal.example.com"
]
}
response = requests.patch(url, headers=headers, json=data)
print(response.json())
const response = await fetch("https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/config", {
method: "PATCH",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
},
body: JSON.stringify({
"oauth_return_origins": [
"https://portal.example.com"
]
})
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
"bytes"
"encoding/json"
)
func main() {
data := []byte(`{
"oauth_return_origins": [
"https://portal.example.com"
]
}`)
req, err := http.NewRequest("PATCH", "https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/config", bytes.NewBuffer(data))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/config')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
request.body = '{
"oauth_return_origins": [
"https://portal.example.com"
]
}'
response = http.request(request)
puts response.body
{
"success": true,
"data": {
"oauth_return_origins": [
"example_string"
]
}
}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"error": "Forbidden",
"message": "You don't have permission to access this resource",
"code": 403
}
/config
Target server for requests. Edit to use your own host.
Agency key as bearer token, format Bearer ak_.... Grants full read-write access scoped to the agency. Agency-wide scoped keys (mcp_ with no fixed location) are accepted too and need airbyte:read or airbyte:write; a client-bound mcp_ key gets 403 agency_key_required. See Using an mcp_ key over HTTP.
Bearer ak_.... Grants full read-write access scoped to the agency. Agency-wide scoped keys (mcp_ with no fixed location) are accepted too and need airbyte:read or airbyte:write; a client-bound mcp_ key gets 403 agency_key_required. See Using an mcp_ key over HTTP.
Location secret key as bearer token, format Bearer sk_.... Grants read-only access; the agency is resolved from the location. Write endpoints return 403.
Bearer sk_.... Grants read-only access; the agency is resolved from the location. Write endpoints return 403.
The media type of the request body
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. Agency key as bearer token, format Bearer ak_.... Grants full read-write access scoped to the agency. Agency-wide scoped keys (mcp_ with no fixed location) are accepted too and need airbyte:read or airbyte:write; a client-bound mcp_ key gets 403 agency_key_required. See Using an mcp_ key over HTTP.
Bearer token. Location secret key as bearer token, format Bearer sk_.... Grants read-only access; the agency is resolved from the location. Write endpoints return 403.