> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpmanager.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Gateways

> Admin API operations for gateways: create, rename, enable, disable, archive, and issue tokens; assign servers with an identity scheme and manage those assignments; and provision gateways to teams.

These operations manage gateways, the server assignments on them, and team provisioning. Because the same server can be assigned to a gateway more than once with different schemes, assignment operations target a specific assignment, not just the server.

<Info>
  **Closed beta.** The MCP Manager Admin API and MCP server are available now to a
  limited set of workspaces through the **MCP Manager Admin API** entitlement
  (`ff-mcpm-admin`), ahead of general availability. If you don't see **Settings →
  MCP & API** in your workspace, it isn't enabled for you yet — ask your MCP Manager
  contact to join the beta.
</Info>

## List Gateways

<Badge color="green">Read-only</Badge>

List the caller's outbound gateways.

Returns each accessible gateway as `{ guid, name, enabled, url }`. The `url` is the public, user-facing connect URL for the gateway (derived, not stored). The set is scoped to the gateways the caller's role and team membership permit, exactly like the gateways overview page.

**MCP tool:** `list_gateways` · **REST:** `GET /api/v1/mcpm-admin/gateways` · **Capability:** View and use all gateways (`viewAllGateways`)

**Parameters:** none.

**Example**

```json theme={null}
{}
```

## Create Gateway

Create a new outbound gateway.

Creates a gateway with the given name, enabled by default, owned by the caller (a `creator` edge to the calling user). Returns the created gateway as `{ guid, name, enabled, url }`. Assigning the gateway to teams (provisioning) is a separate capability and is not performed here.

**MCP tool:** `create_gateway` · **REST:** `POST /api/v1/mcpm-admin/gateways` · **Capability:** Basic gateway management (`basicGatewayManagement`)

**Parameters**

<ParamField body="name" type="string" required>
  A human-readable name for the new gateway (e.g. "Engineering Gateway").
</ParamField>

**Example**

```json theme={null}
{"name":"Engineering Gateway"}
```

## Get Gateway

<Badge color="green">Read-only</Badge>

Fetch a single gateway, including its connect URL.

Returns the gateway as `{ guid, name, enabled, url }`. The `url` is the public, user-facing connect URL (derived from the gateway guid, not stored on the object).

**MCP tool:** `get_gateway` · **REST:** `GET /api/v1/mcpm-admin/gateways/:gatewayGuid` · **Capability:** View and use all gateways (`viewAllGateways`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to fetch (from list\_gateways).
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-..."}
```

## Rename Gateway

Change a gateway's name.

Renames the gateway to `newName`. The gateway is only saved when the name actually changes. Returns the updated gateway as `{ guid, name, enabled, url }`.

**MCP tool:** `rename_gateway` · **REST:** `PATCH /api/v1/mcpm-admin/gateways/:gatewayGuid/name` · **Capability:** Basic gateway management (`basicGatewayManagement`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to rename (from list\_gateways).
</ParamField>

<ParamField body="newName" type="string" required>
  The new name for the gateway.
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-...","newName":"Renamed Gateway"}
```

## Enable Gateway

Enable a gateway.

Sets the gateway to enabled. Only saves when the state actually changes. Returns the updated gateway as `{ guid, name, enabled, url }`.

**MCP tool:** `enable_gateway` · **REST:** `POST /api/v1/mcpm-admin/gateways/:gatewayGuid/enable` · **Capability:** Basic gateway management (`basicGatewayManagement`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to enable (from list\_gateways).
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-..."}
```

## Disable Gateway

Disable a gateway.

Sets the gateway to disabled. Only saves when the state actually changes. Returns the updated gateway as `{ guid, name, enabled, url }`.

**MCP tool:** `disable_gateway` · **REST:** `POST /api/v1/mcpm-admin/gateways/:gatewayGuid/disable` · **Capability:** Basic gateway management (`basicGatewayManagement`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to disable (from list\_gateways).
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-..."}
```

## Issue Gateway Token

Issue an API token for the caller on a specific gateway.

Provisions a per-user connection to the gateway and mints an API token the caller can use to call it. Returns `{ token, tokenId, gatewayGuid, connectionGuid, url }`. The `token` is the plaintext credential — send it to the gateway `url` as the access token; it is returned **once**, so store it securely. The token is always issued for the authenticated caller. Revoke it later by deleting the underlying token (tokenId). If the gateway has any server whose assignment uses the per-user identity scheme ('userIdentity'), pass `serverIdentities` mapping each such inbound server guid to the identity guid to connect with; issuing fails (listing the servers) until each is supplied.

**MCP tool:** `issue_gateway_token` · **REST:** `POST /api/v1/mcpm-admin/gateways/:gatewayGuid/tokens` · **Capability:** Create and manage API tokens (`createAndManageApiTokens`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to issue a token for (from list\_gateways).
</ParamField>

<ParamField body="serverIdentities" type="object">
  Map of inbound server guid -> credential identity guid. REQUIRED for every server on this gateway whose assignment uses identityScheme:'userIdentity' (each user brings their own credential). Find which servers need one (and their guids) via list\_gateway\_assignments, and the identity guids via list\_identities (or create one with add\_identity). Omit when the gateway has no userIdentity servers — issuing without a required selection fails fast rather than minting a token that errors at request time. *(a string → string map)*
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-..."}
```

## List Gateway Assignments

<Badge color="green">Read-only</Badge>

List the servers assigned to a gateway.

Returns each assignment as `{ guid, gatewayGuid, serverGuids, enabled }`. An assignment is the join object that makes a server reachable through the gateway; `serverGuids` are the inbound servers it exposes. Use the `guid` to remove an assignment.

**MCP tool:** `list_gateway_assignments` · **REST:** `GET /api/v1/mcpm-admin/gateways/:gatewayGuid/assignments` · **Capability:** View and use all gateways (`viewAllGateways`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway whose server assignments to list (from list\_gateways).
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-..."}
```

## Assign Server to Gateway

Assign an inbound server to a gateway, making it reachable through it.

Creates an `McpGatewayAssignment` (enabled, all features allowed) wiring the server to the gateway — the link that exposes the server through the gateway. Selects the per-assignment identity: `userIdentity` (each user brings their own) or `sharedIdentity` (one shared credential, via `sharedIdentityGuid`). Returns `{ guid, gatewayGuid, serverGuids, enabled, configured, configurationHint? }`. **Check `configured`**: when false the assignment exists but is not yet usable (the server requires auth and has no identity) — `configurationHint` says exactly how to finish; relay it to the user and offer to complete the setup once an identity is available. A just-created OAuth server has no identity until its browser authorization is approved, so prefer `userIdentity` there (or finish the OAuth flow, then re-assign).

**MCP tool:** `assign_server_to_gateway` · **REST:** `POST /api/v1/mcpm-admin/gateways/:gatewayGuid/assignments` · **Capability:** Basic gateway management (`basicGatewayManagement`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to assign the server to (from list\_gateways).
</ParamField>

<ParamField body="inboundServerGuid" type="string" required>
  The guid of the inbound server to assign (from list\_inbound\_servers).
</ParamField>

<ParamField body="identityScheme" type="string">
  Which credential identity the gateway uses for this server. For a server that requires authentication, SET this so the assignment is usable: 'userIdentity' (each connecting user supplies their own credential — recommended for per-user services like Atlassian/GitHub) makes the assignment complete on its own; 'sharedIdentity' (one shared credential for everyone) also requires `sharedIdentityGuid` (call list\_identities first). Omitting it leaves the assignment in a "Needs configuration" state — usable only for `open` servers that need no auth. One of: `sharedIdentity`, `userIdentity`.
</ParamField>

<ParamField body="sharedIdentityGuid" type="string">
  The guid of the shared identity to use (from list\_identities). Required when `identityScheme` is 'sharedIdentity'.
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-...","inboundServerGuid":"MIS-..."}
```

## Remove Gateway Assignment

<Badge color="red">Destructive</Badge>

Remove a server→gateway assignment.

Deletes the assignment, severing the server’s reachability through that gateway. Returns `{ removed: true, assignmentGuid }`.

**MCP tool:** `remove_gateway_assignment` · **REST:** `DELETE /api/v1/mcpm-admin/assignments/:assignmentGuid` · **Capability:** Basic gateway management (`basicGatewayManagement`)

**Parameters**

<ParamField path="assignmentGuid" type="string" required>
  The guid of the assignment to remove (from list\_gateway\_assignments).
</ParamField>

**Example**

```json theme={null}
{"assignmentGuid":"MGA-..."}
```

## Modify Gateway Assignment

Change an existing assignment's identity scheme.

Reconfigures an existing server→gateway assignment (targeted by its guid, since a server can be assigned more than once): switch its identity scheme between 'userIdentity' and 'sharedIdentity', re-pointing or clearing the shared-identity selection to match. Returns the updated assignment summary. To enable/disable the assignment use enable\_gateway\_assignment / disable\_gateway\_assignment. (The manual token/endpoint scheme is not yet supported.)

**MCP tool:** `modify_gateway_assignment` · **REST:** `PATCH /api/v1/mcpm-admin/assignments/:assignmentGuid` · **Capability:** Basic gateway management (`basicGatewayManagement`)

**Parameters**

<ParamField path="assignmentGuid" type="string" required>
  The guid of the assignment to modify (from list\_gateway\_assignments).
</ParamField>

<ParamField body="identityScheme" type="string">
  The identity scheme to set: 'userIdentity' (each user brings their own credential) or 'sharedIdentity' (one shared credential, requires sharedIdentityGuid). Applies to the server(s) in this assignment. One of: `sharedIdentity`, `userIdentity`.
</ParamField>

<ParamField body="sharedIdentityGuid" type="string">
  The shared credential identity to use (from list\_identities). Required when identityScheme is 'sharedIdentity'; supplying it alone implies that scheme. Ignored for 'userIdentity'.
</ParamField>

**Example**

```json theme={null}
{"assignmentGuid":"MGA-...","identityScheme":"sharedIdentity","sharedIdentityGuid":"MISI-..."}
```

## Enable Gateway Assignment

Enable a server→gateway assignment.

Enables the assignment so its server is reachable through the gateway. Saved only when the state changes. Returns the assignment summary.

**MCP tool:** `enable_gateway_assignment` · **REST:** `POST /api/v1/mcpm-admin/assignments/:assignmentGuid/enable` · **Capability:** Basic gateway management (`basicGatewayManagement`)

**Parameters**

<ParamField path="assignmentGuid" type="string" required>
  The guid of the assignment to enable (from list\_gateway\_assignments).
</ParamField>

**Example**

```json theme={null}
{"assignmentGuid":"MGA-..."}
```

## Disable Gateway Assignment

Disable a server→gateway assignment.

Disables the assignment so its server is no longer reachable through the gateway (the assignment stays, the proxy skips it). Saved only when the state changes. Returns the assignment summary.

**MCP tool:** `disable_gateway_assignment` · **REST:** `POST /api/v1/mcpm-admin/assignments/:assignmentGuid/disable` · **Capability:** Basic gateway management (`basicGatewayManagement`)

**Parameters**

<ParamField path="assignmentGuid" type="string" required>
  The guid of the assignment to disable (from list\_gateway\_assignments).
</ParamField>

**Example**

```json theme={null}
{"assignmentGuid":"MGA-..."}
```

## Archive Gateway

Archive a gateway (and disable it).

Archives the gateway and disables it (an archived gateway is never left enabled), hiding it from the active gateways list. There is no hard delete for gateways — archiving is the delete equivalent, and it is reversible with unarchive\_gateway. Returns `{ guid, name, enabled, url, archived }`.

**MCP tool:** `archive_gateway` · **REST:** `POST /api/v1/mcpm-admin/gateways/:gatewayGuid/archive` · **Capability:** Archive and view archived gateways (`archiveGateway`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to archive (from list\_gateways).
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-..."}
```

## Unarchive Gateway

Unarchive a previously archived gateway.

Clears the archived flag. The gateway stays disabled (unarchiving does not re-enable it) — call enable\_gateway to bring it back online. Returns `{ guid, name, enabled, url, archived }`.

**MCP tool:** `unarchive_gateway` · **REST:** `POST /api/v1/mcpm-admin/gateways/:gatewayGuid/unarchive` · **Capability:** Archive and view archived gateways (`archiveGateway`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to unarchive (from list\_gateways).
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-..."}
```

## Provision Gateway to Team

Provision a gateway to a team (grant the team’s members access).

Wires a `provisionedGateway` edge from the team to the gateway, so the team’s members can use it. Idempotent. Returns `{ assigned: true, gatewayGuid, teamGuid }`.

**MCP tool:** `assign_team_to_gateway` · **REST:** `POST /api/v1/mcpm-admin/gateways/:gatewayGuid/teams/:teamGuid` · **Capability:** Manage team-gateway provisioning (`manageTeamGatewayProvisioning`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to provision (from list\_gateways).
</ParamField>

<ParamField path="teamGuid" type="string" required>
  The guid of the team to grant access (from list\_teams).
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-...","teamGuid":"WST-..."}
```

## Deprovision Gateway from Team

<Badge color="red">Destructive</Badge>

Remove a gateway’s provisioning from a team.

Deletes the team→gateway `provisionedGateway` edge. A no-op (`removed: false`) when the team was not provisioned to the gateway.

**MCP tool:** `remove_team_from_gateway` · **REST:** `DELETE /api/v1/mcpm-admin/gateways/:gatewayGuid/teams/:teamGuid` · **Capability:** Manage team-gateway provisioning (`manageTeamGatewayProvisioning`)

**Parameters**

<ParamField path="gatewayGuid" type="string" required>
  The guid of the gateway to deprovision (from list\_gateways).
</ParamField>

<ParamField path="teamGuid" type="string" required>
  The guid of the team to remove access from (from list\_teams).
</ParamField>

**Example**

```json theme={null}
{"gatewayGuid":"MOG-...","teamGuid":"WST-..."}
```

## Further reading

<CardGroup cols={2}>
  <Card title="People, teams & roles" icon="arrow-right" href="/admin-api/reference/people">
    Where to go next in this section.
  </Card>

  <Card title="Authentication & access" icon="shield-halved" href="/admin-api/authentication">
    Tokens, the entitlement, capability gating, and error codes for every operation here.
  </Card>

  <Card title="Tool & endpoint reference" icon="book" href="/admin-api/reference/overview">
    The full reference index across every domain.
  </Card>

  <Card title="Capabilities" icon="key" href="/deployment/rbac-and-roles/capabilities">
    What each capability named on this page actually allows.
  </Card>
</CardGroup>