Review a specific submission by submission_id and manifest_hash; approval creates an immutable live snapshot.

POST

/v1/mcp-servers/{server_id}/submissions/{submission_id}/review

Authorizations

• oidc

Parameters

Path Parameters

server_id

required

string

submission_id

required

string

Query Parameters

tenant_id

required

string

environment_id

required

string

Request Body ^required

object

toStatus

required

Allowed values: under_review approved rejected

manifestHash

required

string

/^sha256:[0-9a-f]{64}$/

reasonCode

required

string

/^[a-z0-9_]+$/

reason

string

>= 1 characters

actorId

Deprecated compatibility field. Server derives actor identity from /v1/identity/me context and rejects mismatches.

string

>= 1 characters

Responses

202

Submission review accepted. Stale submission and manifest hash mismatch return 409.

object

schema_version

required

server_id

required

string

>= 1 characters

name

required

string

>= 1 characters

lifecycle_state

required

Allowed values: submitted under_review approved rejected disabled archived

approval_status

required

Allowed values: submitted under_review approved rejected disabled archived

registration_status

required

Allowed values: registered disabled deprecated

live_snapshot_id

string

>= 1 characters

live_manifest_hash

string

/^sha256:[0-9a-f]{64}$/

latest_submission

object

submission_id

required

string

>= 1 characters

sequence

required

integer

>= 1

status

required

string

Allowed values: submitted under_review approved rejected superseded

manifest_hash

required

string

/^sha256:[0-9a-f]{64}$/

submitted_by

required

string

>= 1 characters

submitted_at

required

string format: date-time

reviewed_by

string

reviewed_at

string format: date-time

review_reason_code

string

/^[a-z0-9_]+$/

review_reason

string

>= 1 characters

version

required

string

>= 1 characters

max_tool_risk_tier

required

Allowed values: low medium high critical

approved_tool_count

required

integer

denied_candidate_count

required

integer

superseded_by_submission_id

string

created_from_snapshot_id

string

pending_submission

object

submission_id

required

string

>= 1 characters

sequence

required

integer

>= 1

status

required

string

Allowed values: submitted under_review approved rejected superseded

manifest_hash

required

string

/^sha256:[0-9a-f]{64}$/

submitted_by

required

string

>= 1 characters

submitted_at

required

string format: date-time

reviewed_by

string

reviewed_at

string format: date-time

review_reason_code

string

/^[a-z0-9_]+$/

review_reason

string

>= 1 characters

version

required

string

>= 1 characters

max_tool_risk_tier

required

Allowed values: low medium high critical

approved_tool_count

required

integer

denied_candidate_count

required

integer

superseded_by_submission_id

string

created_from_snapshot_id

string

updated_at

required

string format: date-time

last_used_at

required

string format: date-time

nullable

owner

required

object

team

required

string

>= 1 characters

user_id

required

string

>= 1 characters

escalation_contact

required

string

>= 1 characters

oncall_rotation

required

string

>= 1 characters

environment_id

required

string

>= 1 characters

endpoint

string format: uri

transport

required

One of:

object

Any of:

unknown

unknown

object

object

Any of:

unknown

unknown

version

required

string

>= 1 characters

credential_mode

required

Allowed values: service_account user_delegated agent_scoped workload_mapped

max_tool_risk_tier

required

Allowed values: low medium high critical

health

required

object

status

required

Allowed values: healthy degraded unhealthy unknown

route_available

required

boolean

last_checked_at

required

string format: date-time

latency_ms

required

integer

checked_by

required

string

>= 1 characters

failure_reason

required

string

nullable /^[a-z0-9_]+$/

connector_status

required

Allowed values: healthy degraded unhealthy unknown not_configured

approved_tools

required

Array<object>

object

tool_id

required

string

>= 1 characters

name

required

string

>= 1 characters

description

required

string

>= 1 characters

risk_tier

required

Allowed values: low medium high critical

denied_candidates

required

Array<object>

object

tool_id

required

string

>= 1 characters

name

required

string

>= 1 characters

risk_tier

required

Allowed values: low medium high critical

reason_code

required

string

/^[a-z0-9_]+$/

change_history_pointers

required

Array<string>

catalog_visible

required

boolean

409

Stale_submission or manifest_hash_mismatch.