Register

Register a new MCP server under an application. Set server_type to HOSTED (C1 runs a catalog integration) or EXTERNAL (a third-party MCP server you point C1 at by URL). Auth credentials are validated and stored securely.

POST /api/v1/apps/{app_id}/mcp_servers

Register

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/operations"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.MCPServer.Register(ctx, operations.C1APIAiGovernanceV1MCPServerServiceRegisterRequest{
        AppID: "<id>",
    })
    if err != nil {
        log.Fatal(err)
    }
    if res.MCPServerServiceRegisterResponse != nil {
        // handle response
    }
}

curl --request POST \
  --url https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/mcp_servers \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "acknowledgedFindingIds": [
    "<string>"
  ],
  "appManagedStateBindingRef": {
    "appId": "<string>",
    "resourceId": "<string>",
    "resourceTypeId": "<string>"
  },
  "description": "<string>",
  "displayName": "<string>",
  "externalConfig": {
    "basicAuth": {
      "password": "<string>",
      "username": "<string>"
    },
    "bearerToken": {
      "token": "<string>"
    },
    "customHeader": {
      "headerName": "<string>",
      "headerValue": "<string>"
    },
    "none": {},
    "oauth2": {
      "authorizeUrl": "<string>",
      "clientId": "<string>",
      "clientSecret": "<string>",
      "codeChallengeMethodsSupported": [
        "<string>"
      ],
      "extraAuthorizeParams": {},
      "extraTokenParams": {},
      "issuerUrl": "<string>",
      "jwtAudience": "<string>",
      "jwtIssuer": "<string>",
      "jwtPrivateKey": "<string>",
      "jwtSubject": "<string>",
      "pkce": "<string>",
      "scopes": [
        "<string>"
      ],
      "scopesSupported": [
        "<string>"
      ],
      "tokenEndpointAuthMethod": "<string>",
      "tokenUrl": "<string>"
    },
    "url": "<string>"
  },
  "hostedConfig": {
    "awsSigv4": {
      "accessKeyId": "<string>",
      "secretAccessKey": "<string>",
      "sessionToken": "<string>"
    },
    "basicAuth": {
      "password": "<string>",
      "username": "<string>"
    },
    "bearerToken": {
      "token": "<string>"
    },
    "configFields": {},
    "customHeader": {
      "headerName": "<string>",
      "headerValue": "<string>"
    },
    "googleServiceAccount": {
      "credentialsJson": "<string>",
      "scopes": [
        "<string>"
      ]
    },
    "mcpServerCatalogId": "<string>",
    "none": {},
    "oauth2": {
      "authorizeUrl": "<string>",
      "clientId": "<string>",
      "clientSecret": "<string>",
      "codeChallengeMethodsSupported": [
        "<string>"
      ],
      "extraAuthorizeParams": {},
      "extraTokenParams": {},
      "issuerUrl": "<string>",
      "jwtAudience": "<string>",
      "jwtIssuer": "<string>",
      "jwtPrivateKey": "<string>",
      "jwtSubject": "<string>",
      "pkce": "<string>",
      "scopes": [
        "<string>"
      ],
      "scopesSupported": [
        "<string>"
      ],
      "tokenEndpointAuthMethod": "<string>",
      "tokenUrl": "<string>"
    },
    "sourceAppId": "<string>"
  },
  "oauthDiagnosticId": "<string>",
  "toolPrefix": "<string>",
  "tunnelApplianceId": "<string>",
  "tunnelPath": "<string>",
  "tunnelServiceName": "<string>",
  "tunneled": true,
  "userIds": [
    "<string>"
  ]
}
'

import requests

url = "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/mcp_servers"

payload = {
    "acknowledgedFindingIds": ["<string>"],
    "appManagedStateBindingRef": {
        "appId": "<string>",
        "resourceId": "<string>",
        "resourceTypeId": "<string>"
    },
    "description": "<string>",
    "displayName": "<string>",
    "externalConfig": {
        "basicAuth": {
            "password": "<string>",
            "username": "<string>"
        },
        "bearerToken": { "token": "<string>" },
        "customHeader": {
            "headerName": "<string>",
            "headerValue": "<string>"
        },
        "none": {},
        "oauth2": {
            "authorizeUrl": "<string>",
            "clientId": "<string>",
            "clientSecret": "<string>",
            "codeChallengeMethodsSupported": ["<string>"],
            "extraAuthorizeParams": {},
            "extraTokenParams": {},
            "issuerUrl": "<string>",
            "jwtAudience": "<string>",
            "jwtIssuer": "<string>",
            "jwtPrivateKey": "<string>",
            "jwtSubject": "<string>",
            "pkce": "<string>",
            "scopes": ["<string>"],
            "scopesSupported": ["<string>"],
            "tokenEndpointAuthMethod": "<string>",
            "tokenUrl": "<string>"
        },
        "url": "<string>"
    },
    "hostedConfig": {
        "awsSigv4": {
            "accessKeyId": "<string>",
            "secretAccessKey": "<string>",
            "sessionToken": "<string>"
        },
        "basicAuth": {
            "password": "<string>",
            "username": "<string>"
        },
        "bearerToken": { "token": "<string>" },
        "configFields": {},
        "customHeader": {
            "headerName": "<string>",
            "headerValue": "<string>"
        },
        "googleServiceAccount": {
            "credentialsJson": "<string>",
            "scopes": ["<string>"]
        },
        "mcpServerCatalogId": "<string>",
        "none": {},
        "oauth2": {
            "authorizeUrl": "<string>",
            "clientId": "<string>",
            "clientSecret": "<string>",
            "codeChallengeMethodsSupported": ["<string>"],
            "extraAuthorizeParams": {},
            "extraTokenParams": {},
            "issuerUrl": "<string>",
            "jwtAudience": "<string>",
            "jwtIssuer": "<string>",
            "jwtPrivateKey": "<string>",
            "jwtSubject": "<string>",
            "pkce": "<string>",
            "scopes": ["<string>"],
            "scopesSupported": ["<string>"],
            "tokenEndpointAuthMethod": "<string>",
            "tokenUrl": "<string>"
        },
        "sourceAppId": "<string>"
    },
    "oauthDiagnosticId": "<string>",
    "toolPrefix": "<string>",
    "tunnelApplianceId": "<string>",
    "tunnelPath": "<string>",
    "tunnelServiceName": "<string>",
    "tunneled": True,
    "userIds": ["<string>"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    acknowledgedFindingIds: ['<string>'],
    appManagedStateBindingRef: {appId: '<string>', resourceId: '<string>', resourceTypeId: '<string>'},
    description: '<string>',
    displayName: '<string>',
    externalConfig: {
      basicAuth: {password: '<string>', username: '<string>'},
      bearerToken: {token: '<string>'},
      customHeader: {headerName: '<string>', headerValue: '<string>'},
      none: {},
      oauth2: {
        authorizeUrl: '<string>',
        clientId: '<string>',
        clientSecret: '<string>',
        codeChallengeMethodsSupported: ['<string>'],
        extraAuthorizeParams: {},
        extraTokenParams: {},
        issuerUrl: '<string>',
        jwtAudience: '<string>',
        jwtIssuer: '<string>',
        jwtPrivateKey: '<string>',
        jwtSubject: '<string>',
        pkce: '<string>',
        scopes: ['<string>'],
        scopesSupported: ['<string>'],
        tokenEndpointAuthMethod: '<string>',
        tokenUrl: '<string>'
      },
      url: '<string>'
    },
    hostedConfig: {
      awsSigv4: {accessKeyId: '<string>', secretAccessKey: '<string>', sessionToken: '<string>'},
      basicAuth: {password: '<string>', username: '<string>'},
      bearerToken: {token: '<string>'},
      configFields: {},
      customHeader: {headerName: '<string>', headerValue: '<string>'},
      googleServiceAccount: {credentialsJson: '<string>', scopes: ['<string>']},
      mcpServerCatalogId: '<string>',
      none: {},
      oauth2: {
        authorizeUrl: '<string>',
        clientId: '<string>',
        clientSecret: '<string>',
        codeChallengeMethodsSupported: ['<string>'],
        extraAuthorizeParams: {},
        extraTokenParams: {},
        issuerUrl: '<string>',
        jwtAudience: '<string>',
        jwtIssuer: '<string>',
        jwtPrivateKey: '<string>',
        jwtSubject: '<string>',
        pkce: '<string>',
        scopes: ['<string>'],
        scopesSupported: ['<string>'],
        tokenEndpointAuthMethod: '<string>',
        tokenUrl: '<string>'
      },
      sourceAppId: '<string>'
    },
    oauthDiagnosticId: '<string>',
    toolPrefix: '<string>',
    tunnelApplianceId: '<string>',
    tunnelPath: '<string>',
    tunnelServiceName: '<string>',
    tunneled: true,
    userIds: ['<string>']
  })
};

fetch('https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/mcp_servers', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/mcp_servers",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'acknowledgedFindingIds' => [
        '<string>'
    ],
    'appManagedStateBindingRef' => [
        'appId' => '<string>',
        'resourceId' => '<string>',
        'resourceTypeId' => '<string>'
    ],
    'description' => '<string>',
    'displayName' => '<string>',
    'externalConfig' => [
        'basicAuth' => [
                'password' => '<string>',
                'username' => '<string>'
        ],
        'bearerToken' => [
                'token' => '<string>'
        ],
        'customHeader' => [
                'headerName' => '<string>',
                'headerValue' => '<string>'
        ],
        'none' => [
                
        ],
        'oauth2' => [
                'authorizeUrl' => '<string>',
                'clientId' => '<string>',
                'clientSecret' => '<string>',
                'codeChallengeMethodsSupported' => [
                                '<string>'
                ],
                'extraAuthorizeParams' => [
                                
                ],
                'extraTokenParams' => [
                                
                ],
                'issuerUrl' => '<string>',
                'jwtAudience' => '<string>',
                'jwtIssuer' => '<string>',
                'jwtPrivateKey' => '<string>',
                'jwtSubject' => '<string>',
                'pkce' => '<string>',
                'scopes' => [
                                '<string>'
                ],
                'scopesSupported' => [
                                '<string>'
                ],
                'tokenEndpointAuthMethod' => '<string>',
                'tokenUrl' => '<string>'
        ],
        'url' => '<string>'
    ],
    'hostedConfig' => [
        'awsSigv4' => [
                'accessKeyId' => '<string>',
                'secretAccessKey' => '<string>',
                'sessionToken' => '<string>'
        ],
        'basicAuth' => [
                'password' => '<string>',
                'username' => '<string>'
        ],
        'bearerToken' => [
                'token' => '<string>'
        ],
        'configFields' => [
                
        ],
        'customHeader' => [
                'headerName' => '<string>',
                'headerValue' => '<string>'
        ],
        'googleServiceAccount' => [
                'credentialsJson' => '<string>',
                'scopes' => [
                                '<string>'
                ]
        ],
        'mcpServerCatalogId' => '<string>',
        'none' => [
                
        ],
        'oauth2' => [
                'authorizeUrl' => '<string>',
                'clientId' => '<string>',
                'clientSecret' => '<string>',
                'codeChallengeMethodsSupported' => [
                                '<string>'
                ],
                'extraAuthorizeParams' => [
                                
                ],
                'extraTokenParams' => [
                                
                ],
                'issuerUrl' => '<string>',
                'jwtAudience' => '<string>',
                'jwtIssuer' => '<string>',
                'jwtPrivateKey' => '<string>',
                'jwtSubject' => '<string>',
                'pkce' => '<string>',
                'scopes' => [
                                '<string>'
                ],
                'scopesSupported' => [
                                '<string>'
                ],
                'tokenEndpointAuthMethod' => '<string>',
                'tokenUrl' => '<string>'
        ],
        'sourceAppId' => '<string>'
    ],
    'oauthDiagnosticId' => '<string>',
    'toolPrefix' => '<string>',
    'tunnelApplianceId' => '<string>',
    'tunnelPath' => '<string>',
    'tunnelServiceName' => '<string>',
    'tunneled' => true,
    'userIds' => [
        '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/mcp_servers")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"acknowledgedFindingIds\": [\n    \"<string>\"\n  ],\n  \"appManagedStateBindingRef\": {\n    \"appId\": \"<string>\",\n    \"resourceId\": \"<string>\",\n    \"resourceTypeId\": \"<string>\"\n  },\n  \"description\": \"<string>\",\n  \"displayName\": \"<string>\",\n  \"externalConfig\": {\n    \"basicAuth\": {\n      \"password\": \"<string>\",\n      \"username\": \"<string>\"\n    },\n    \"bearerToken\": {\n      \"token\": \"<string>\"\n    },\n    \"customHeader\": {\n      \"headerName\": \"<string>\",\n      \"headerValue\": \"<string>\"\n    },\n    \"none\": {},\n    \"oauth2\": {\n      \"authorizeUrl\": \"<string>\",\n      \"clientId\": \"<string>\",\n      \"clientSecret\": \"<string>\",\n      \"codeChallengeMethodsSupported\": [\n        \"<string>\"\n      ],\n      \"extraAuthorizeParams\": {},\n      \"extraTokenParams\": {},\n      \"issuerUrl\": \"<string>\",\n      \"jwtAudience\": \"<string>\",\n      \"jwtIssuer\": \"<string>\",\n      \"jwtPrivateKey\": \"<string>\",\n      \"jwtSubject\": \"<string>\",\n      \"pkce\": \"<string>\",\n      \"scopes\": [\n        \"<string>\"\n      ],\n      \"scopesSupported\": [\n        \"<string>\"\n      ],\n      \"tokenEndpointAuthMethod\": \"<string>\",\n      \"tokenUrl\": \"<string>\"\n    },\n    \"url\": \"<string>\"\n  },\n  \"hostedConfig\": {\n    \"awsSigv4\": {\n      \"accessKeyId\": \"<string>\",\n      \"secretAccessKey\": \"<string>\",\n      \"sessionToken\": \"<string>\"\n    },\n    \"basicAuth\": {\n      \"password\": \"<string>\",\n      \"username\": \"<string>\"\n    },\n    \"bearerToken\": {\n      \"token\": \"<string>\"\n    },\n    \"configFields\": {},\n    \"customHeader\": {\n      \"headerName\": \"<string>\",\n      \"headerValue\": \"<string>\"\n    },\n    \"googleServiceAccount\": {\n      \"credentialsJson\": \"<string>\",\n      \"scopes\": [\n        \"<string>\"\n      ]\n    },\n    \"mcpServerCatalogId\": \"<string>\",\n    \"none\": {},\n    \"oauth2\": {\n      \"authorizeUrl\": \"<string>\",\n      \"clientId\": \"<string>\",\n      \"clientSecret\": \"<string>\",\n      \"codeChallengeMethodsSupported\": [\n        \"<string>\"\n      ],\n      \"extraAuthorizeParams\": {},\n      \"extraTokenParams\": {},\n      \"issuerUrl\": \"<string>\",\n      \"jwtAudience\": \"<string>\",\n      \"jwtIssuer\": \"<string>\",\n      \"jwtPrivateKey\": \"<string>\",\n      \"jwtSubject\": \"<string>\",\n      \"pkce\": \"<string>\",\n      \"scopes\": [\n        \"<string>\"\n      ],\n      \"scopesSupported\": [\n        \"<string>\"\n      ],\n      \"tokenEndpointAuthMethod\": \"<string>\",\n      \"tokenUrl\": \"<string>\"\n    },\n    \"sourceAppId\": \"<string>\"\n  },\n  \"oauthDiagnosticId\": \"<string>\",\n  \"toolPrefix\": \"<string>\",\n  \"tunnelApplianceId\": \"<string>\",\n  \"tunnelPath\": \"<string>\",\n  \"tunnelServiceName\": \"<string>\",\n  \"tunneled\": true,\n  \"userIds\": [\n    \"<string>\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/mcp_servers")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"acknowledgedFindingIds\": [\n    \"<string>\"\n  ],\n  \"appManagedStateBindingRef\": {\n    \"appId\": \"<string>\",\n    \"resourceId\": \"<string>\",\n    \"resourceTypeId\": \"<string>\"\n  },\n  \"description\": \"<string>\",\n  \"displayName\": \"<string>\",\n  \"externalConfig\": {\n    \"basicAuth\": {\n      \"password\": \"<string>\",\n      \"username\": \"<string>\"\n    },\n    \"bearerToken\": {\n      \"token\": \"<string>\"\n    },\n    \"customHeader\": {\n      \"headerName\": \"<string>\",\n      \"headerValue\": \"<string>\"\n    },\n    \"none\": {},\n    \"oauth2\": {\n      \"authorizeUrl\": \"<string>\",\n      \"clientId\": \"<string>\",\n      \"clientSecret\": \"<string>\",\n      \"codeChallengeMethodsSupported\": [\n        \"<string>\"\n      ],\n      \"extraAuthorizeParams\": {},\n      \"extraTokenParams\": {},\n      \"issuerUrl\": \"<string>\",\n      \"jwtAudience\": \"<string>\",\n      \"jwtIssuer\": \"<string>\",\n      \"jwtPrivateKey\": \"<string>\",\n      \"jwtSubject\": \"<string>\",\n      \"pkce\": \"<string>\",\n      \"scopes\": [\n        \"<string>\"\n      ],\n      \"scopesSupported\": [\n        \"<string>\"\n      ],\n      \"tokenEndpointAuthMethod\": \"<string>\",\n      \"tokenUrl\": \"<string>\"\n    },\n    \"url\": \"<string>\"\n  },\n  \"hostedConfig\": {\n    \"awsSigv4\": {\n      \"accessKeyId\": \"<string>\",\n      \"secretAccessKey\": \"<string>\",\n      \"sessionToken\": \"<string>\"\n    },\n    \"basicAuth\": {\n      \"password\": \"<string>\",\n      \"username\": \"<string>\"\n    },\n    \"bearerToken\": {\n      \"token\": \"<string>\"\n    },\n    \"configFields\": {},\n    \"customHeader\": {\n      \"headerName\": \"<string>\",\n      \"headerValue\": \"<string>\"\n    },\n    \"googleServiceAccount\": {\n      \"credentialsJson\": \"<string>\",\n      \"scopes\": [\n        \"<string>\"\n      ]\n    },\n    \"mcpServerCatalogId\": \"<string>\",\n    \"none\": {},\n    \"oauth2\": {\n      \"authorizeUrl\": \"<string>\",\n      \"clientId\": \"<string>\",\n      \"clientSecret\": \"<string>\",\n      \"codeChallengeMethodsSupported\": [\n        \"<string>\"\n      ],\n      \"extraAuthorizeParams\": {},\n      \"extraTokenParams\": {},\n      \"issuerUrl\": \"<string>\",\n      \"jwtAudience\": \"<string>\",\n      \"jwtIssuer\": \"<string>\",\n      \"jwtPrivateKey\": \"<string>\",\n      \"jwtSubject\": \"<string>\",\n      \"pkce\": \"<string>\",\n      \"scopes\": [\n        \"<string>\"\n      ],\n      \"scopesSupported\": [\n        \"<string>\"\n      ],\n      \"tokenEndpointAuthMethod\": \"<string>\",\n      \"tokenUrl\": \"<string>\"\n    },\n    \"sourceAppId\": \"<string>\"\n  },\n  \"oauthDiagnosticId\": \"<string>\",\n  \"toolPrefix\": \"<string>\",\n  \"tunnelApplianceId\": \"<string>\",\n  \"tunnelPath\": \"<string>\",\n  \"tunnelServiceName\": \"<string>\",\n  \"tunneled\": true,\n  \"userIds\": [\n    \"<string>\"\n  ]\n}"

response = http.request(request)
puts response.read_body

200

{
  "mcpServer": {
    "appId": "<string>",
    "awsAccessKeyId": "<string>",
    "awsSecretAccessKeyConfigured": true,
    "awsSessionTokenConfigured": true,
    "basicAuthPasswordConfigured": true,
    "basicAuthUsername": "<string>",
    "bearerTokenConfigured": true,
    "configFieldValues": {},
    "connectorId": "<string>",
    "createdAt": "2023-11-07T05:31:56Z",
    "credentialsSetupUrl": "<string>",
    "customHeaderName": "<string>",
    "customHeaderValueConfigured": true,
    "defaultToolPrefix": "<string>",
    "description": "<string>",
    "displayName": "<string>",
    "endpointUrl": "<string>",
    "lastCalledAt": "2023-11-07T05:31:56Z",
    "mcpServerCatalogId": "<string>",
    "oauth2AuthorizeUrl": "<string>",
    "oauth2ClientId": "<string>",
    "oauth2ClientSecretExpiresAt": "<string>",
    "oauth2CodeChallengeMethodsSupported": [
      "<string>"
    ],
    "oauth2CredentialsConfigured": true,
    "oauth2ExtraAuthorizeParams": {},
    "oauth2ExtraTokenParams": {},
    "oauth2IssuerUrl": "<string>",
    "oauth2JwtAudience": "<string>",
    "oauth2JwtIssuer": "<string>",
    "oauth2JwtPrivateKeyConfigured": true,
    "oauth2JwtSubject": "<string>",
    "oauth2Pkce": "<string>",
    "oauth2Scopes": [
      "<string>"
    ],
    "oauth2ScopesSupported": [
      "<string>"
    ],
    "oauth2ServiceAuthorized": true,
    "oauth2ServiceAuthorizedAsEmail": "<string>",
    "oauth2ServiceAuthorizedAsName": "<string>",
    "oauth2ServiceAuthorizedAt": "2023-11-07T05:31:56Z",
    "oauth2ServiceAuthorizedBy": "<string>",
    "oauth2TokenEndpointAuthMethod": "<string>",
    "oauth2TokenUrl": "<string>",
    "sourceAppId": "<string>",
    "toolPrefix": "<string>",
    "tunnelApplianceId": "<string>",
    "tunnelBridgeId": "<string>",
    "tunnelServiceName": "<string>",
    "tunneled": true,
    "updatedAt": "2023-11-07T05:31:56Z"
  }
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Path Parameters

app_id · string · required

App to register the MCP server under. When empty and app_managed_state_binding_ref is not set, a new managed app is created automatically.

Body

application/json

MCPServerServiceRegisterRequest creates a new MCP server (Connector + config).

acknowledgedFindingIds · string[] | null

finding_ids from the diagnostic the admin acknowledged. Each must cover a blocking-relaxable finding on oauth_diagnostic_id.

appManagedStateBindingRef · App Managed State Binding Ref · object | null

The AppManagedStateBindingRef message.

Show child attributes

dataSensitivity · enum<string>

Data sensitivity classification.

Available options: MCP_SERVER_DATA_SENSITIVITY_UNSPECIFIED, MCP_SERVER_DATA_SENSITIVITY_PUBLIC, MCP_SERVER_DATA_SENSITIVITY_INTERNAL, MCP_SERVER_DATA_SENSITIVITY_CONFIDENTIAL, MCP_SERVER_DATA_SENSITIVITY_RESTRICTED

description · string

Admin-provided description.

displayName · string

Admin-provided display name.

externalConfig · Mcp Server External Config · object | null

MCPServerExternalConfig configures an external MCP server accessed via HTTP transport. The server is routed through the MCP gateway for credential decryption.

This message contains a oneof named auth_config. Only a single field of the following list may be set at a time:

• none
• bearerToken
• oauth2
• customHeader
• basicAuth

Show child attributes

hostedConfig · Mcp Server Hosted Config · object | null

MCPServerHostedConfig configures a hosted MCP server backed by the MCP gateway.

This message contains a oneof named auth_config. Only a single field of the following list may be set at a time:

• none
• bearerToken
• oauth2
• customHeader
• googleServiceAccount
• awsSigv4
• basicAuth

Show child attributes

oauthDiagnosticId · string

When registering a DCR (client_id_mode=DCR) hosted server, the id of the diagnostic returned by DiscoverMCPOAuthConfig that the admin reviewed. When set, the server uses that diagnostic as the canonical discovery result and relaxes only the acknowledged findings. Empty preserves the strict path.

serverType · enum<string>

The type of MCP server being registered.

Available options: MCP_SERVER_TYPE_UNSPECIFIED, MCP_SERVER_TYPE_HOSTED, MCP_SERVER_TYPE_EXTERNAL

toolPrefix · string

Optional prefix for tool names in the C1 MCP server. Tools are exposed as "<tool_prefix>_<tool_name>". When empty, the system uses an auto-derived prefix (service name or hostname).

tunnelApplianceId · string

ID of the bridge (TunnelBridge.id, a KSUID) that proxies this server. Only set when tunneled == true; must match a bridge enrolled for this tenant. The server resolves this at register time to an active credential and persists that on the connector config; runtime routing through the wormhole requester is keyed on the resolved credential.

Cross-field invariant: proto validation uses ignore_empty:true so an empty value passes the regex check. The service layer enforces that this field is non-empty whenever tunneled==true (see applyTunneledRegisterResolution).

tunnelPath · string

Endpoint path on the appliance-side MCP server (e.g. "/sse", "/mcp"). Only used for EXTERNAL servers when tunneled == true: the service synthesizes external_config.url as http://<tunnel_service_name><tunnel_path>, since the tunnel host is the announced service name and only the admin knows the path. Empty defaults to "/". Ignored for HOSTED and non-tunneled.

tunnelServiceName · string

Service name as declared by the appliance via AnnounceServices. Required when tunneled == true (for both EXTERNAL and HOSTED). The frontend populates this from a dropdown of services the picked appliance has announced. At runtime, mcp-gateway uses this name as the wormhole port-name argument to DialByName.

tunneled · boolean

Whether the MCP server is reached over a tunnel to a private appliance instead of a public URL.

userIds · string[] | null

Integration owners for the MCP server connector.

Response

200 - application/json

MCPServerServiceRegisterResponse returns the newly created MCP server.

MCPServerServiceRegisterResponse returns the newly created MCP server.

mcpServer · Mcp Server View · object | null

MCPServerView is the API representation of an MCP server (backed by a Connector).

Show child attributes