Expose selected API operations

Turn selected REST operations into governed MCP tools.

Before you start

Have an OpenAPI 3.x document, an approved target host, and a list of operations the agent actually needs. Identify the upstream credential requirements.

Procedure

1. Open API import. In Spec, provide an OpenAPI document by URL, file or paste, or import one request using cURL. Confirm the API address and allowed hosts.

2. In Access, choose the API’s authentication method. Static API keys and bearer tokens are stored in the vault. For OAuth client credentials, use the matching saved connection or choose Use different credentials. When several connections match, choose one explicitly. A single applicable OpenAPI client-credentials or Swagger application security scheme prefills the token URL and required scopes; both remain editable. Unused or ambiguous schemes do not supply defaults. Enter your client ID and secret, then select Connect. Advanced contains the issuer, token URL, scopes, authentication method and token settings; it opens when a required setting is missing. The gateway verifies token acquisition before showing Connected.

3. In Tools, select the operations agents may call. Inspect the generated tool names and how path, query, headers and request body fields map to the API.

4. Review the audience, owner, authentication and selected operations, then save and publish. The gateway binds the application to the approved server and tools. Governance profiles requiring a reviewer retain their approval requirements.

5. OAuth client-credentials tokens are obtained and cached by the gateway, then replaced when a call needs a fresh token. Configure token lifetime units explicitly if the provider returns milliseconds; the default is seconds. Leave scopes empty only when the provider requires no scopes. Static bearer tokens still need manual replacement.

6. Open the published server and choose Test a tool. The console uses your signed-in identity and workspace access policy. Enter arguments and run the tool to make a real upstream request. API keys and tokens are injected by the gateway. Required business headers remain tool inputs. Inspect the audit record for the result.

Verify the result

A console test verifies the API runtime call, not an external MCP client’s authentication. Separately, connect an authenticated MCP client and call one selected operation through MCP. Also verify an unselected operation cannot be invoked and that malformed input is rejected before upstream execution.

If it does not work

If the same OAuth configuration is already active, the wizard selects that exact saved connection. Select Connect to continue using its stored credentials; the secret entered during the duplicate attempt is not applied. Manage connections opens the existing OAuth → Upstream administration screen for reviewing shared credential changes. A failed connection keeps the secret only in the current form for retry; success or leaving the form clears it.

If import succeeds but execution fails, inspect host allowlists, method mapping, input schema, credential binding, timeout, and size limits. This adapter is not an arbitrary URL proxy.

Read the related concept or consult the Admin API for exact request fields.

Implementation reference

Read the source contract.