MCP server endpoints

11 endpoints at https://api.vaif.studio, generated from the API's OpenAPI document. The REST API page covers authentication, and All endpoints lists every group.

POST /mcp/oauth/register

Register an MCP client (RFC 7591)

Request body (application/json, required)

{
  client_name: string;
  redirect_uris: string[];
  client_uri?: string (uri);
  token_endpoint_auth_method?: "none";
  grant_types?: string[];
  response_types?: string[];
  scope?: string;
}

Response 201 (application/json)

{
  client_id: string;
  client_id_issued_at: number;
  client_name: string;
  redirect_uris: string[];
  token_endpoint_auth_method: "none";
  grant_types: string[];
  response_types: string[];
}

Errors: 400, 429, with the error body.

GET /mcp/oauth/authorize

Start an MCP authorization (redirects to the console consent page)

Parameter	In	Type	Required
response_type	query	string	No
client_id	query	string	Yes
redirect_uri	query	string	Yes
state	query	string	No
code_challenge	query	string	No
code_challenge_method	query	string	No
scope	query	string	No
resource	query	string	No

Response 200

No body.

GET /mcp/oauth/requests/{requestId}

Read a pending MCP authorization request

Parameter	In	Type	Required
requestId	path	string	Yes

Response 200 (application/json)

{
  clientName: string;
  clientId: string;
  redirectHost: string;
  scope: string[];
  wantsWrites: boolean;
  wantsProduction: boolean;
  expiresAt: string;
  options: {
    org: {
      id: string;
      name: string;
    };
    mcpEnabled: boolean;
    disabledReason: null | "mfa_enrollment_required";
    projects: {
      id: string;
      name: string;
      maxAccess: any;
    }[];
  }[];
}

POST /mcp/oauth/requests/{requestId}/approve

Approve a pending MCP authorization for ONE project

Parameter	In	Type	Required
requestId	path	string	Yes

Request body (application/json, required)

{
  projectId: string (uuid);
  allowWrites?: boolean;
  allowProduction?: boolean;
}

Response 200 (application/json)

{
  ok: boolean;
  redirectTo: string;
}

Errors: 400, 403, 404, with the error body.

POST /mcp/oauth/requests/{requestId}/deny

Deny a pending MCP authorization

Parameter	In	Type	Required
requestId	path	string	Yes

Response 200 (application/json)

{
  ok: boolean;
  redirectTo: string;
}

POST /mcp/oauth/token

Exchange an authorization code or refresh token for an MCP access token

Request body (application/json, required)

{
  grant_type: "authorization_code" | "refresh_token";
  code?: string;
  code_verifier?: string;
  redirect_uri?: string;
  client_id?: string;
  refresh_token?: string;
  resource?: string;
}

Response 200 (application/json)

{
  access_token: string;
  token_type: string;
  expires_in: number;
  refresh_token: string;
  scope: string;
}

POST /mcp/oauth/revoke

Revoke an MCP connection by its refresh or access token

Request body (application/json, required)

{
  token: string;
  token_type_hint?: string;
}

Response 200 (application/json)

{
  ok: boolean;
}

GET /mcp/session

Describe the MCP connection behind this access token

Response 200 (application/json)

{
  connectionId: string;
  clientId: string;
  clientName: string;
  userId: string;
  email: string;
  projectId: string;
  projectName: string;
  orgId: string;
  role: "admin" | "developer" | "owner" | "viewer";
  scopes: string[];
  allowWrites: boolean;
  allowProduction: boolean;
  rateLimit: {
    toolCallsPerMinute: number;
  };
}

POST /mcp/audit

Record one MCP tool call in the audit log

Request body (application/json, required)

{
  tool: string;
  argsHash: string;
  status: "ok" | "error" | "refused" | "rate_limited" | "invalid_input";
  durationMs: number;
  errorCode?: string;
}

Response 200

No body.

Response 202 (application/json)

{
  ok: boolean;
}

GET /mcp/connections

List my MCP connections

Parameter	In	Type	Required
status	query	"active" | "all"	No

Response 200 (application/json)

{
  connections: {
    id: string;
    projectId: string;
    project: null | {
      id: string;
      name: string;
    };
    org: null | {
      id: string;
      name: string;
    };
    clientName: string;
    scopes: string[];
    allowWrites: boolean;
    allowProduction: boolean;
    createdAt: string (date-time);
    lastUsedAt: null | string (date-time);
    expiresAt: null | string (date-time);
    revokedAt: null | string (date-time);
  }[];
}

DELETE /mcp/connections/{id}

Revoke one of my MCP connections

Parameter	In	Type	Required
id	path	string (uuid)	Yes

Response 200 (application/json)

{
  ok: boolean;
}