Skip to content
MCP Gateway

Build a metadata-only deny diagnostics bundle from a denied request, audit event, or explicit actor/tool context.

POST
/v1/deny-diagnostics

Reuses audit request bundle, policy simulation, registry, session, credential binding, connector route, environment, and client-surface projections. The response never includes request/response bodies, prompts, payloads, tokens, or secret material.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
object
schemaVersion
required
requestId
required

Admin API request ID for this diagnostics lookup.

string
>= 1 characters
deniedRequestId

Denied runtime request ID. Exactly one of deniedRequestId, auditEventId, or explicitContext is required.

string
>= 1 characters
auditEventId

Audit event ID from search/detail. Exactly one lookup selector is required.

string
>= 1 characters
explicitContext
object
actor
required
object
userId
string
>= 1 characters
groupIds
Array<string>
agentId
string
>= 1 characters
agentInstanceId
string
>= 1 characters
clientSurfaceId
required
string
>= 1 characters
target
required
object
serverId
string
>= 1 characters
apiSourceId
string
>= 1 characters
operationId
string
>= 1 characters
toolId
required
string
>= 1 characters
targetEnvironmentId
required
string
>= 1 characters
policy
required
object
decision
required
denyReason
required
string
/^[a-z0-9_]+$/
policyVersion
required
string
>= 1 characters
matchedRule
object
ruleId
required
string
>= 1 characters
effect
required
Allowed values: allow deny
reason
required
string
/^[a-z0-9_]+$/
missingAllow
required
boolean
explicitDeny
required
boolean
failingConstraints
required
Array<string>
credentialMode
required
string
Allowed values: none service_account user_delegated agent_scoped workload_mapped
remediation
string
>= 1 characters
clientSurface
required
object
clientSurfaceId
required
string
>= 1 characters
lifecycleState
required
Allowed values: submitted under_review approved rejected disabled revoked archived
approvalState
required
string
Allowed values: submitted under_review approved rejected disabled archived
allowedEnvironmentIds
required
Array<string>
mismatch
required
boolean
environment
required
object
actorEnvironmentId
required
string
>= 1 characters
targetEnvironmentId
required
string
>= 1 characters
mismatch
required
boolean
approvals
required
object
agentStatus
required
Allowed values: approved under_review rejected disabled revoked unknown
toolStatus
required
Allowed values: approved under_review rejected disabled revoked unknown
serverStatus
string
Allowed values: submitted under_review approved rejected disabled archived
apiSourceStatus
string
Allowed values: submitted under_review approved rejected disabled archived
credentialBinding
required
object
credentialBindingId
string
>= 1 characters
credentialMode
required
string
Allowed values: none service_account user_delegated agent_scoped workload_mapped
lifecycleState
required
Allowed values: approved disabled revoked missing denied unknown
revocationStatus
required
Allowed values: none disabled revoked unknown
materialReturn
required
connectorRoute
required
object
connectorId
string
>= 1 characters
routeAvailable
required
boolean
routeAvailabilityReason
required
string
/^[a-z0-9_]+$/
healthStatus
required
Allowed values: healthy degraded unhealthy unknown
lifecycleState
required
Allowed values: submitted under_review active disabled revoked archived
revocationReasonCode
string
/^[a-z0-9_]+$/
schemaValidation
object
failed
required
boolean
reasonCode
required
string
/^[a-z0-9_]+$/
schemaRef
required
string
>= 1 characters
fieldPath
string
>= 1 characters
upstreamAttempted
required
boolean
relatedIds
required
object
requestIds
Array<string>
auditEventIds
Array<string>
clientSessionIds
Array<string>
backendSessionIds
Array<string>
policySimulationIds
Array<string>
tenantId

Tenant scope, derived from auth context in production and explicit in deterministic fixtures.

string
>= 1 characters
environmentId

Environment scope to permission-check and hide cross-scope diagnostics.

string
>= 1 characters

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Remediation-ready deny diagnostics bundle with safe metadata only.

object
schemaVersion
required
requestId
required
string
>= 1 characters
diagnosticId
required
string
>= 1 characters
tenantId
required
string
>= 1 characters
environmentId
required
string
>= 1 characters
deniedRequestId
required
string
>= 1 characters
auditEventId
required
string
>= 1 characters
inputMode
required
Allowed values: request_id audit_event_id explicit_context
denyReason
required
string
/^[a-z0-9_]+$/
policy
required
object
decision
required
denyReason
required
string
/^[a-z0-9_]+$/
policyVersion
required
string
>= 1 characters
matchedRule
object
ruleId
required
string
>= 1 characters
effect
required
Allowed values: allow deny
reason
required
string
/^[a-z0-9_]+$/
missingAllow
required
boolean
explicitDeny
required
boolean
failingConstraints
required
Array<string>
credentialMode
required
string
Allowed values: none service_account user_delegated agent_scoped workload_mapped
remediation
string
>= 1 characters
clientSurface
required
object
clientSurfaceId
required
string
>= 1 characters
lifecycleState
required
Allowed values: submitted under_review approved rejected disabled revoked archived
approvalState
required
string
Allowed values: submitted under_review approved rejected disabled archived
allowedEnvironmentIds
required
Array<string>
mismatch
required
boolean
environment
required
object
actorEnvironmentId
required
string
>= 1 characters
targetEnvironmentId
required
string
>= 1 characters
mismatch
required
boolean
approvals
required
object
agentStatus
required
Allowed values: approved under_review rejected disabled revoked unknown
toolStatus
required
Allowed values: approved under_review rejected disabled revoked unknown
serverStatus
string
Allowed values: submitted under_review approved rejected disabled archived
apiSourceStatus
string
Allowed values: submitted under_review approved rejected disabled archived
credentialBinding
required
object
credentialBindingId
string
>= 1 characters
credentialMode
required
string
Allowed values: none service_account user_delegated agent_scoped workload_mapped
lifecycleState
required
Allowed values: approved disabled revoked missing denied unknown
revocationStatus
required
Allowed values: none disabled revoked unknown
materialReturn
required
connectorRoute
required
object
connectorId
string
>= 1 characters
routeAvailable
required
boolean
routeAvailabilityReason
required
string
/^[a-z0-9_]+$/
healthStatus
required
Allowed values: healthy degraded unhealthy unknown
lifecycleState
required
Allowed values: submitted under_review active disabled revoked archived
revocationReasonCode
string
/^[a-z0-9_]+$/
schemaValidation
object
failed
required
boolean
reasonCode
required
string
/^[a-z0-9_]+$/
schemaRef
required
string
>= 1 characters
fieldPath
string
>= 1 characters
upstreamAttempted
required
boolean
relatedIds
required
object
requestIds
Array<string>
auditEventIds
Array<string>
clientSessionIds
Array<string>
backendSessionIds
Array<string>
policySimulationIds
Array<string>
suggestedRemediation
required
string
>= 1 characters
sourceProjections
required
Array
>= 1 items
Allowed values: audit_request_bundle policy_simulation credential_binding connector_registry session_registry registry client_surface_registry environment_registry api_adapter
permissions
required
object
allowedActions
required
Array
Allowed values: deny_diagnostics:read
redactionStatus
required

400

Section titled “400 ”

Request shape, lookup, or safe-metadata validation failed.

object
schemaVersion
required
requestId
required
string
>= 1 characters
status
required
integer
>= 400 <= 599
reasonCode
required
string
/^[a-z0-9_]+$/
message
required
string
>= 1 characters
retryable
required
boolean
machineSafe
required
boolean
redactionStatus
required
Allowed values: redacted metadata_only
field

Optional metadata-only field identifier for validation errors.

string
details

Optional metadata-only diagnostic details. Never include secret material, payloads, prompts, raw endpoint URLs, or customer data.

object
requiredAction
string
>= 1 characters
resourceRef
string
>= 1 characters
key
additional properties
One of:
string

403

Section titled “403 ”

Actor lacks tenant/environment permission to read deny diagnostics.

object
schemaVersion
required
requestId
required
string
>= 1 characters
status
required
integer
>= 400 <= 599
reasonCode
required
string
/^[a-z0-9_]+$/
message
required
string
>= 1 characters
retryable
required
boolean
machineSafe
required
boolean
redactionStatus
required
Allowed values: redacted metadata_only
field

Optional metadata-only field identifier for validation errors.

string
details

Optional metadata-only diagnostic details. Never include secret material, payloads, prompts, raw endpoint URLs, or customer data.

object
requiredAction
string
>= 1 characters
resourceRef
string
>= 1 characters
key
additional properties
One of:
string

404

Section titled “404 ”

Denied request or audit event was unknown, stale, or outside actor scope.

object
schemaVersion
required
requestId
required
string
>= 1 characters
status
required
integer
>= 400 <= 599
reasonCode
required
string
/^[a-z0-9_]+$/
message
required
string
>= 1 characters
retryable
required
boolean
machineSafe
required
boolean
redactionStatus
required
Allowed values: redacted metadata_only
field

Optional metadata-only field identifier for validation errors.

string
details

Optional metadata-only diagnostic details. Never include secret material, payloads, prompts, raw endpoint URLs, or customer data.

object
requiredAction
string
>= 1 characters
resourceRef
string
>= 1 characters
key
additional properties
One of:
string

Type set in Geist, Source Serif 4, and Departure Mono.