Closed beta. The MCP Manager Admin API and MCP server are available now to a
limited set of workspaces through the MCP Manager Admin API entitlement
(
ff-mcpm-admin), ahead of general availability. If you don’t see Settings →
MCP & API in your workspace, it isn’t enabled for you yet — ask your MCP Manager
contact to join the beta.List Gateways
Read-only List the caller’s outbound gateways. Returns each accessible gateway as{ guid, name, enabled, url }. The url is the public, user-facing connect URL for the gateway (derived, not stored). The set is scoped to the gateways the caller’s role and team membership permit, exactly like the gateways overview page.
MCP tool: list_gateways · REST: GET /api/v1/mcpm-admin/gateways · Capability: View and use all gateways (viewAllGateways)
Parameters: none.
Example
Create Gateway
Create a new outbound gateway. Creates a gateway with the given name, enabled by default, owned by the caller (acreator edge to the calling user). Returns the created gateway as { guid, name, enabled, url }. Assigning the gateway to teams (provisioning) is a separate capability and is not performed here.
MCP tool: create_gateway · REST: POST /api/v1/mcpm-admin/gateways · Capability: Basic gateway management (basicGatewayManagement)
Parameters
A human-readable name for the new gateway (e.g. “Engineering Gateway”).
Get Gateway
Read-only Fetch a single gateway, including its connect URL. Returns the gateway as{ guid, name, enabled, url }. The url is the public, user-facing connect URL (derived from the gateway guid, not stored on the object).
MCP tool: get_gateway · REST: GET /api/v1/mcpm-admin/gateways/:gatewayGuid · Capability: View and use all gateways (viewAllGateways)
Parameters
The guid of the gateway to fetch (from list_gateways).
Rename Gateway
Change a gateway’s name. Renames the gateway tonewName. The gateway is only saved when the name actually changes. Returns the updated gateway as { guid, name, enabled, url }.
MCP tool: rename_gateway · REST: PATCH /api/v1/mcpm-admin/gateways/:gatewayGuid/name · Capability: Basic gateway management (basicGatewayManagement)
Parameters
The guid of the gateway to rename (from list_gateways).
The new name for the gateway.
Enable Gateway
Enable a gateway. Sets the gateway to enabled. Only saves when the state actually changes. Returns the updated gateway as{ guid, name, enabled, url }.
MCP tool: enable_gateway · REST: POST /api/v1/mcpm-admin/gateways/:gatewayGuid/enable · Capability: Basic gateway management (basicGatewayManagement)
Parameters
The guid of the gateway to enable (from list_gateways).
Disable Gateway
Disable a gateway. Sets the gateway to disabled. Only saves when the state actually changes. Returns the updated gateway as{ guid, name, enabled, url }.
MCP tool: disable_gateway · REST: POST /api/v1/mcpm-admin/gateways/:gatewayGuid/disable · Capability: Basic gateway management (basicGatewayManagement)
Parameters
The guid of the gateway to disable (from list_gateways).
Issue Gateway Token
Issue an API token for the caller on a specific gateway. Provisions a per-user connection to the gateway and mints an API token the caller can use to call it. Returns{ token, tokenId, gatewayGuid, connectionGuid, url }. The token is the plaintext credential — send it to the gateway url as the access token; it is returned once, so store it securely. The token is always issued for the authenticated caller. Revoke it later by deleting the underlying token (tokenId). If the gateway has any server whose assignment uses the per-user identity scheme (‘userIdentity’), pass serverIdentities mapping each such inbound server guid to the identity guid to connect with; issuing fails (listing the servers) until each is supplied.
MCP tool: issue_gateway_token · REST: POST /api/v1/mcpm-admin/gateways/:gatewayGuid/tokens · Capability: Create and manage API tokens (createAndManageApiTokens)
Parameters
The guid of the gateway to issue a token for (from list_gateways).
Map of inbound server guid -> credential identity guid. REQUIRED for every server on this gateway whose assignment uses identityScheme:‘userIdentity’ (each user brings their own credential). Find which servers need one (and their guids) via list_gateway_assignments, and the identity guids via list_identities (or create one with add_identity). Omit when the gateway has no userIdentity servers — issuing without a required selection fails fast rather than minting a token that errors at request time. (a string → string map)
List Gateway Assignments
Read-only List the servers assigned to a gateway. Returns each assignment as{ guid, gatewayGuid, serverGuids, enabled }. An assignment is the join object that makes a server reachable through the gateway; serverGuids are the inbound servers it exposes. Use the guid to remove an assignment.
MCP tool: list_gateway_assignments · REST: GET /api/v1/mcpm-admin/gateways/:gatewayGuid/assignments · Capability: View and use all gateways (viewAllGateways)
Parameters
The guid of the gateway whose server assignments to list (from list_gateways).
Assign Server to Gateway
Assign an inbound server to a gateway, making it reachable through it. Creates anMcpGatewayAssignment (enabled, all features allowed) wiring the server to the gateway — the link that exposes the server through the gateway. Selects the per-assignment identity: userIdentity (each user brings their own) or sharedIdentity (one shared credential, via sharedIdentityGuid). Returns { guid, gatewayGuid, serverGuids, enabled, configured, configurationHint? }. Check configured: when false the assignment exists but is not yet usable (the server requires auth and has no identity) — configurationHint says exactly how to finish; relay it to the user and offer to complete the setup once an identity is available. A just-created OAuth server has no identity until its browser authorization is approved, so prefer userIdentity there (or finish the OAuth flow, then re-assign).
MCP tool: assign_server_to_gateway · REST: POST /api/v1/mcpm-admin/gateways/:gatewayGuid/assignments · Capability: Basic gateway management (basicGatewayManagement)
Parameters
The guid of the gateway to assign the server to (from list_gateways).
The guid of the inbound server to assign (from list_inbound_servers).
Which credential identity the gateway uses for this server. For a server that requires authentication, SET this so the assignment is usable: ‘userIdentity’ (each connecting user supplies their own credential — recommended for per-user services like Atlassian/GitHub) makes the assignment complete on its own; ‘sharedIdentity’ (one shared credential for everyone) also requires
sharedIdentityGuid (call list_identities first). Omitting it leaves the assignment in a “Needs configuration” state — usable only for open servers that need no auth. One of: sharedIdentity, userIdentity.The guid of the shared identity to use (from list_identities). Required when
identityScheme is ‘sharedIdentity’.Remove Gateway Assignment
Destructive Remove a server→gateway assignment. Deletes the assignment, severing the server’s reachability through that gateway. Returns{ removed: true, assignmentGuid }.
MCP tool: remove_gateway_assignment · REST: DELETE /api/v1/mcpm-admin/assignments/:assignmentGuid · Capability: Basic gateway management (basicGatewayManagement)
Parameters
The guid of the assignment to remove (from list_gateway_assignments).
Modify Gateway Assignment
Change an existing assignment’s identity scheme. Reconfigures an existing server→gateway assignment (targeted by its guid, since a server can be assigned more than once): switch its identity scheme between ‘userIdentity’ and ‘sharedIdentity’, re-pointing or clearing the shared-identity selection to match. Returns the updated assignment summary. To enable/disable the assignment use enable_gateway_assignment / disable_gateway_assignment. (The manual token/endpoint scheme is not yet supported.) MCP tool:modify_gateway_assignment · REST: PATCH /api/v1/mcpm-admin/assignments/:assignmentGuid · Capability: Basic gateway management (basicGatewayManagement)
Parameters
The guid of the assignment to modify (from list_gateway_assignments).
The identity scheme to set: ‘userIdentity’ (each user brings their own credential) or ‘sharedIdentity’ (one shared credential, requires sharedIdentityGuid). Applies to the server(s) in this assignment. One of:
sharedIdentity, userIdentity.The shared credential identity to use (from list_identities). Required when identityScheme is ‘sharedIdentity’; supplying it alone implies that scheme. Ignored for ‘userIdentity’.
Enable Gateway Assignment
Enable a server→gateway assignment. Enables the assignment so its server is reachable through the gateway. Saved only when the state changes. Returns the assignment summary. MCP tool:enable_gateway_assignment · REST: POST /api/v1/mcpm-admin/assignments/:assignmentGuid/enable · Capability: Basic gateway management (basicGatewayManagement)
Parameters
The guid of the assignment to enable (from list_gateway_assignments).
Disable Gateway Assignment
Disable a server→gateway assignment. Disables the assignment so its server is no longer reachable through the gateway (the assignment stays, the proxy skips it). Saved only when the state changes. Returns the assignment summary. MCP tool:disable_gateway_assignment · REST: POST /api/v1/mcpm-admin/assignments/:assignmentGuid/disable · Capability: Basic gateway management (basicGatewayManagement)
Parameters
The guid of the assignment to disable (from list_gateway_assignments).
Archive Gateway
Archive a gateway (and disable it). Archives the gateway and disables it (an archived gateway is never left enabled), hiding it from the active gateways list. There is no hard delete for gateways — archiving is the delete equivalent, and it is reversible with unarchive_gateway. Returns{ guid, name, enabled, url, archived }.
MCP tool: archive_gateway · REST: POST /api/v1/mcpm-admin/gateways/:gatewayGuid/archive · Capability: Archive and view archived gateways (archiveGateway)
Parameters
The guid of the gateway to archive (from list_gateways).
Unarchive Gateway
Unarchive a previously archived gateway. Clears the archived flag. The gateway stays disabled (unarchiving does not re-enable it) — call enable_gateway to bring it back online. Returns{ guid, name, enabled, url, archived }.
MCP tool: unarchive_gateway · REST: POST /api/v1/mcpm-admin/gateways/:gatewayGuid/unarchive · Capability: Archive and view archived gateways (archiveGateway)
Parameters
The guid of the gateway to unarchive (from list_gateways).
Provision Gateway to Team
Provision a gateway to a team (grant the team’s members access). Wires aprovisionedGateway edge from the team to the gateway, so the team’s members can use it. Idempotent. Returns { assigned: true, gatewayGuid, teamGuid }.
MCP tool: assign_team_to_gateway · REST: POST /api/v1/mcpm-admin/gateways/:gatewayGuid/teams/:teamGuid · Capability: Manage team-gateway provisioning (manageTeamGatewayProvisioning)
Parameters
The guid of the gateway to provision (from list_gateways).
The guid of the team to grant access (from list_teams).
Deprovision Gateway from Team
Destructive Remove a gateway’s provisioning from a team. Deletes the team→gatewayprovisionedGateway edge. A no-op (removed: false) when the team was not provisioned to the gateway.
MCP tool: remove_team_from_gateway · REST: DELETE /api/v1/mcpm-admin/gateways/:gatewayGuid/teams/:teamGuid · Capability: Manage team-gateway provisioning (manageTeamGatewayProvisioning)
Parameters
The guid of the gateway to deprovision (from list_gateways).
The guid of the team to remove access from (from list_teams).
Further reading
People, teams & roles
Where to go next in this section.
Authentication & access
Tokens, the entitlement, capability gating, and error codes for every operation here.
Tool & endpoint reference
The full reference index across every domain.
Capabilities
What each capability named on this page actually allows.