Import an OpenAPI spec → MCP

The API‑to‑MCP adapter lets you expose selected operations of an existing REST API as MCP tools — without standing up a separate MCP server. Imported APIs become gateway‑hosted tool facades: input schemas are validated, hosts are allowlisted, credentials are brokered, and only operations you select and approve are ever exposed.

Requires api_source import permissions

You need permission to import API sources and select operations in the target environment.

1. Preview the contract to see candidate operations the adapter can generate.
2. Import with the operations you want, creating tool candidates for approval.
3. Approve the generated tools (Approvals) before they’re discoverable.

1 · Preview candidate operations

Preview an API contract

UIAPICLI

1. Open Govern → API sources → Import.
2. Provide the OpenAPI / Swagger / Postman contract (URL or file) and review the candidate operations the adapter detects.

POST/v1/api-sources/preview

Copy

curl -X POST "$GATEWAY/v1/api-sources/preview" \
-H "authorization: Bearer $TOKEN" \
-H "content-type: application/json" \
--data @openapi-source.json

View previewApiSourceImport in the API reference →

Copy

gatewayctl import-api --preview --spec ./openapi.yaml

import-openapi is an accepted alias for import-api.

2 · Import selected operations

Import selected operations as tool candidates

UIAPICLI

1. Select the operations to expose — leave the rest out.
2. Click Import. Selected operations are persisted as generated‑tool candidates with status awaiting approval.

POST/v1/api-sources/import

Copy

curl -X POST "$GATEWAY/v1/api-sources/import" \
-H "authorization: Bearer $TOKEN" \
-H "content-type: application/json" \
--data @openapi-source.json

View importOpenApiSource in the API reference →

Copy

gatewayctl import-api --spec ./openapi.yaml --operation getDeal --operation updateDeal

Every gatewayctl verb accepts --format text|json.

What the adapter will not do

The adapter imports OpenAPI 3.x, Swagger 2.0, and Postman v2.1 and enforces host allowlists, schema validation, and timeout/size limits. It does not do arbitrary URL routing, gRPC/SOAP conversion, or broad automatic exposure — selection and approval are always required.

Next

Approve the generated tools, after which they’re projected to the data plane and become callable per policy — just like a registered MCP server.