API by router
Mcp
GET
X-Api-Key?string|nullSuccessful Response
application/json- response
Bounded metadata for MCP-side scope enforcement.
Mirrors what require_scope() reads from request.state so the
MCP server can implement the same exact-match / wildcard-reject /
legacy-bridge semantics without re-fetching the key row.
api_key_id*Api Key Idcustomer_id*Customer Idhash_version*Hash Versionneeds_reissue*Needs Reissuerate_limit_per_hour*Rate Limit Per Hourrate_limit_per_minute*Rate Limit Per Minutescopes*array<string>tenant_id*Tenant Iduser_id*User Idcurl -X GET 'https://example.com/v1/mcp/api-key-context'Example Response
{ "api_key_id": "string", "customer_id": "string", "hash_version": "string", "needs_reissue": true, "rate_limit_per_hour": 0, "rate_limit_per_minute": 0, "scopes": [ "string" ], "tenant_id": "string", "user_id": "string"}POST
X-Api-Key?string|nullapplication/json- body
Fields the MCP server is allowed to send. Server-side stamping fills in the identity columns (api_key_id, user_id, tenant_id, customer_id, scope_kind) — never trust these from the wire.
error_class?|nullhttp_status?|nulllatency_ms?|nullrequest_id?|nullscope_tag?|nullstatus*StatusValue in
"allow""deny_scope""deny_jwt_only""upstream_4xx""upstream_5xx""network_error""exception"tool_name*Tool NameMatch
^[a-z][a-z0-9_]+$Length
length <= 64Successful Response
curl -X POST 'https://example.com/v1/mcp/audit-log' \ -H 'Content-Type: application/json' \ -d '{ "status": "allow", "tool_name": "string"}'Example Response
Empty