API Reference

Zero Trust

Access

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

AI Controls

AI ControlsMcp

AI ControlsMcpPortals

List MCP Portals

client.zeroTrust.access.aiControls.mcp.portals.list(PortalListParams { account_id, page, per_page, search } params, RequestOptionsoptions?): V4PagePaginationArray<PortalListResponse { id, hostname, name, 9 more } >

GET/accounts/{account_id}/access/ai-controls/mcp/portals

Create a new MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.create(PortalCreateParams { account_id, id, hostname, 6 more } params, RequestOptionsoptions?): PortalCreateResponse { id, hostname, name, 9 more }

POST/accounts/{account_id}/access/ai-controls/mcp/portals

Read details of an MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.read(stringid, PortalReadParams { account_id } params, RequestOptionsoptions?): PortalReadResponse { id, hostname, name, 9 more }

GET/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

Update an MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.update(stringid, PortalUpdateParams { account_id, allow_code_mode, code_mode, 5 more } params, RequestOptionsoptions?): PortalUpdateResponse { id, hostname, name, 9 more }

PUT/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

Delete an MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.delete(stringid, PortalDeleteParams { account_id } params, RequestOptionsoptions?): PortalDeleteResponse { id, hostname, name, 8 more }

DELETE/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

ModelsExpand Collapse

PortalListResponse { id, hostname, name, 9 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

servers: Array<Server>

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

server_id: string

Unique identifier for the MCP server.

maxLength32

minLength1

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

PortalCreateResponse { id, hostname, name, 9 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

servers: Array<Server>

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

server_id: string

Unique identifier for the MCP server.

maxLength32

minLength1

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

PortalReadResponse { id, hostname, name, 9 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

servers: Array<Server>

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

server_id: string

Unique identifier for the MCP server.

maxLength32

minLength1

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

PortalUpdateResponse { id, hostname, name, 9 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

servers: Array<Server>

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

server_id: string

Unique identifier for the MCP server.

maxLength32

minLength1

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

PortalDeleteResponse { id, hostname, name, 8 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

AI ControlsMcpServers

List MCP Servers

client.zeroTrust.access.aiControls.mcp.servers.list(ServerListParams { account_id, page, per_page, search } params, RequestOptionsoptions?): V4PagePaginationArray<ServerListResponse { id, auth_type, hostname, 19 more } >

GET/accounts/{account_id}/access/ai-controls/mcp/servers

Create a new MCP Server

client.zeroTrust.access.aiControls.mcp.servers.create(ServerCreateParams { account_id, id, auth_type, 9 more } params, RequestOptionsoptions?): ServerCreateResponse { id, auth_type, hostname, 19 more }

POST/accounts/{account_id}/access/ai-controls/mcp/servers

Read the details of an MCP Server

client.zeroTrust.access.aiControls.mcp.servers.read(stringid, ServerReadParams { account_id } params, RequestOptionsoptions?): ServerReadResponse { id, auth_type, hostname, 19 more }

GET/accounts/{account_id}/access/ai-controls/mcp/servers/{id}

Update an MCP Server

client.zeroTrust.access.aiControls.mcp.servers.update(stringid, ServerUpdateParams { account_id, auth_credentials, client_secret, 6 more } params, RequestOptionsoptions?): ServerUpdateResponse { id, auth_type, hostname, 19 more }

PUT/accounts/{account_id}/access/ai-controls/mcp/servers/{id}

Delete an MCP Server

client.zeroTrust.access.aiControls.mcp.servers.delete(stringid, ServerDeleteParams { account_id } params, RequestOptionsoptions?): ServerDeleteResponse { id, auth_type, hostname, 19 more }

DELETE/accounts/{account_id}/access/ai-controls/mcp/servers/{id}

Sync MCP Server Capabilities

client.zeroTrust.access.aiControls.mcp.servers.sync(stringid, ServerSyncParams { account_id } params, RequestOptionsoptions?): ServerSyncResponse { error, error_details, status }

POST/accounts/{account_id}/access/ai-controls/mcp/servers/{id}/sync

ModelsExpand Collapse

ServerListResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerCreateResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerReadResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerUpdateResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerDeleteResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerSyncResponse { error, error_details, status }

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

status?: "waiting" | "ready" | "stale" | "error"

One of the following:

"waiting"

"ready"

"stale"

"error"