---
title: "Consumer controls"
description: "The end-user boundary for OIDC sessions, profile, memory, Actions, and receipts."
---

> Documentation Index
> Fetch the complete documentation index at: https://help.tooluse.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Consumer controls

<p>The consumer API runs under <code>/v1/consumer/applications/{appId}/providers/{providerId}/{command}</code>. It uses OIDC authorization code flow with PKCE and isolates each person’s data inside the application.</p>
<h2 id="command-families">Command families</h2>
<table>
<thead>
<tr>
<th>Family</th>
<th>Purpose</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>start</code>, <code>callback</code>, <code>session</code>, <code>refresh</code>, <code>logout</code></td>
<td>Create, inspect, refresh, or revoke the consumer session</td>
</tr>
<tr>
<td><code>action.review</code>, <code>action.approve</code>, <code>action.reject</code></td>
<td>Review and decide an immutable Action</td>
</tr>
<tr>
<td><code>control.profile</code>, <code>control.profile.update</code></td>
<td>Read or update the signed-in person’s profile</td>
</tr>
<tr>
<td><code>control.memory.*</code></td>
<td>Query, upsert, delete, or export the person’s bounded encrypted memory</td>
</tr>
<tr>
<td><code>control.sessions.*</code></td>
<td>List or revoke the person’s sessions</td>
</tr>
<tr>
<td><code>control.actions.*</code></td>
<td>List, cancel, or read receipts for the person’s Actions</td>
</tr>
</tbody>
</table>
<h2 id="security-model">Security model</h2>
<ul>
<li>Upstream OAuth tokens are encrypted and never returned to an Agent.</li>
<li>A caller cannot select another person’s ownership ID to cross the boundary.</li>
<li>Disabling memory blocks reads and writes; known-item deletion remains available.</li>
<li>Revoking an Tooluse.net session also requests upstream token revocation, but does not sign the person out of every browser session at the identity provider.</li>
</ul>
<h2 id="see-also">See also</h2>
<ul>
<li><a href="/approval/human-approval">Prepare, approve, and execute</a></li>
<li><a href="/reference/api#connections-and-service-execution">Connect an OAuth account</a></li>
</ul>

Source: https://help.tooluse.net/approval/consumer-controls/index.mdx