Share feedback
Answers are generated based on the documentation.

Experimental

Product manualDownload OpenAPI specificationMarkdown

AuthorizeMcpServer authorizes credentials for one named upstream.

POST/v1/mcp-servers/{mcpServer}/authorization/authorize
AuthorizeMcpServer authorizes credentials for one named upstream. Action: authorization runs an interactive grant whose result is not the request body.

Connection and access

API connection and authentication guidance

https://connect.docker.com/sandboxes — The API base URL. Append the /v1 paths while preserving this URL's path prefix.

Use one of these alternatives. Requirements within an alternative apply together.

  • bearer

Parameters

mcpServer path Required

The mcpServer id.

Type: string

All schema constraints and annotations
{
  "type": "string"
}

If-Match header

Optional current authorization etag. A supplied stale value answers 412 with failedPrecondition; omission permits create or convergence, including forced reauthorization.

Type: string

(OPTIONAL) etag optionally pins the current authorization; a supplied stale value refuses.
All schema constraints and annotations
{
  "description": "(OPTIONAL) etag optionally pins the current authorization; a supplied stale value refuses.",
  "title": "If-Match",
  "type": "string"
}

Request and responses

Request

application/json

Type: object

AuthorizeMcpServerRequest starts or refreshes MCP upstream authorization.
forceReauth

Type: boolean

force_reauth starts a fresh flow while existing credentials serve until completion. Repeating a pending flow converges without reminting.
All schema constraints and annotations
{
  "description": "force_reauth starts a fresh flow while existing credentials serve until completion.\nRepeating a pending flow converges without reminting.",
  "type": "boolean"
}
remoteUrl

Type: string | null

remote_url binds authorization to a concrete upstream URL when supplied.
All schema constraints and annotations
{
  "description": "remote_url binds authorization to a concrete upstream URL when supplied.",
  "format": "uri",
  "type": [
    "string",
    "null"
  ]
}
All schema constraints and annotations
{
  "additionalProperties": false,
  "description": "AuthorizeMcpServerRequest starts or refreshes MCP upstream authorization.",
  "properties": {
    "forceReauth": {
      "description": "force_reauth starts a fresh flow while existing credentials serve until completion.\nRepeating a pending flow converges without reminting.",
      "type": "boolean"
    },
    "remoteUrl": {
      "description": "remote_url binds authorization to a concrete upstream URL when supplied.",
      "format": "uri",
      "type": [
        "string",
        "null"
      ]
    }
  },
  "title": "AuthorizeMcpServerRequest",
  "type": "object"
}

Response 200

Success

application/json

Headers

ETag

The etag of the resource this response carries, which the next mutation of it sends as If-Match.

{
  "description": "The etag of the resource this response carries, which the next mutation of it sends as If-Match.",
  "schema": {
    "type": "string"
  }
}
All constraints apply

Schema: McpAuthorization

All schema constraints and annotations
{
  "not": {
    "properties": {
      "status": {
        "enum": [
          "pending"
        ]
      }
    },
    "required": [
      "status"
    ]
  }
}
All schema constraints and annotations
{
  "allOf": [
    {
      "$ref": "#/components/schemas/McpAuthorization"
    },
    {
      "not": {
        "properties": {
          "status": {
            "enum": [
              "pending"
            ]
          }
        },
        "required": [
          "status"
        ]
      }
    }
  ]
}

Response 202

Accepted. The resource is still progressing; read it or follow its events until completion.

application/json

Headers

ETag

The etag of the resource this response carries, which the next mutation of it sends as If-Match.

{
  "description": "The etag of the resource this response carries, which the next mutation of it sends as If-Match.",
  "schema": {
    "type": "string"
  }
}
All constraints apply

Schema: McpAuthorization

status · required
All schema constraints and annotations
{
  "enum": [
    "pending"
  ]
}
All schema constraints and annotations
{
  "properties": {
    "status": {
      "enum": [
        "pending"
      ]
    }
  },
  "required": [
    "status"
  ]
}
All schema constraints and annotations
{
  "allOf": [
    {
      "$ref": "#/components/schemas/McpAuthorization"
    },
    {
      "properties": {
        "status": {
          "enum": [
            "pending"
          ]
        }
      },
      "required": [
        "status"
      ]
    }
  ]
}

Response 412

The precondition is not the resource's current etag. The body carries failedPrecondition naming etag_mismatch and an EtagMismatch detail with the current value.

application/json

Schema: Error

etag_mismatch

{
  "code": "failedPrecondition",
  "details": [
    {
      "@type": "type.googleapis.com/docker.sandboxes.v1.EtagMismatch",
      "currentEtag": "v2"
    }
  ],
  "message": "etag_mismatch: The precondition is not the resource's current etag. The body carries failedPrecondition naming etag_mismatch and an EtagMismatch detail with the current value."
}

Response default

The structured Error body identifies the failure with a stable code and optional typed details.

application/json

Schema: Error

Schema example

{
  "code": "notFound",
  "details": [],
  "message": "sandbox not found"
}

Referenced schemas

#/components/schemas/Error

#/components/schemas/McpAuthorization

Complete operation contract
{
  "description": "AuthorizeMcpServer authorizes credentials for one named upstream.\nAction: authorization runs an interactive grant whose result is not the request body.",
  "operationId": "authorizeMcpServer",
  "parameters": [
    {
      "description": "The mcpServer id.",
      "in": "path",
      "name": "mcpServer",
      "required": true,
      "schema": {
        "type": "string"
      }
    },
    {
      "description": "Optional current authorization etag. A supplied stale value answers 412 with failedPrecondition; omission permits create or convergence, including forced reauthorization.",
      "in": "header",
      "name": "If-Match",
      "schema": {
        "description": "(OPTIONAL) etag optionally pins the current authorization; a supplied stale value refuses.",
        "title": "If-Match",
        "type": "string"
      }
    }
  ],
  "requestBody": {
    "content": {
      "application/json": {
        "schema": {
          "additionalProperties": false,
          "description": "AuthorizeMcpServerRequest starts or refreshes MCP upstream authorization.",
          "properties": {
            "forceReauth": {
              "description": "force_reauth starts a fresh flow while existing credentials serve until completion.\nRepeating a pending flow converges without reminting.",
              "type": "boolean"
            },
            "remoteUrl": {
              "description": "remote_url binds authorization to a concrete upstream URL when supplied.",
              "format": "uri",
              "type": [
                "string",
                "null"
              ]
            }
          },
          "title": "AuthorizeMcpServerRequest",
          "type": "object"
        }
      }
    },
    "required": true
  },
  "responses": {
    "200": {
      "content": {
        "application/json": {
          "schema": {
            "allOf": [
              {
                "$ref": "#/components/schemas/McpAuthorization"
              },
              {
                "not": {
                  "properties": {
                    "status": {
                      "enum": [
                        "pending"
                      ]
                    }
                  },
                  "required": [
                    "status"
                  ]
                }
              }
            ]
          }
        }
      },
      "description": "Success",
      "headers": {
        "ETag": {
          "description": "The etag of the resource this response carries, which the next mutation of it sends as If-Match.",
          "schema": {
            "type": "string"
          }
        }
      }
    },
    "202": {
      "content": {
        "application/json": {
          "schema": {
            "allOf": [
              {
                "$ref": "#/components/schemas/McpAuthorization"
              },
              {
                "properties": {
                  "status": {
                    "enum": [
                      "pending"
                    ]
                  }
                },
                "required": [
                  "status"
                ]
              }
            ]
          }
        }
      },
      "description": "Accepted. The resource is still progressing; read it or follow its events until completion.",
      "headers": {
        "ETag": {
          "description": "The etag of the resource this response carries, which the next mutation of it sends as If-Match.",
          "schema": {
            "type": "string"
          }
        }
      }
    },
    "412": {
      "content": {
        "application/json": {
          "examples": {
            "etag_mismatch": {
              "summary": "The precondition is not the resource's current etag. The body carries failedPrecondition naming etag_mismatch and an EtagMismatch detail with the current value.",
              "value": {
                "code": "failedPrecondition",
                "details": [
                  {
                    "@type": "type.googleapis.com/docker.sandboxes.v1.EtagMismatch",
                    "currentEtag": "v2"
                  }
                ],
                "message": "etag_mismatch: The precondition is not the resource's current etag. The body carries failedPrecondition naming etag_mismatch and an EtagMismatch detail with the current value."
              }
            }
          },
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      },
      "description": "The precondition is not the resource's current etag. The body carries failedPrecondition naming etag_mismatch and an EtagMismatch detail with the current value."
    },
    "default": {
      "content": {
        "application/json": {
          "schema": {
            "$ref": "#/components/schemas/Error"
          }
        }
      },
      "description": "The structured Error body identifies the failure with a stable code and optional typed details."
    }
  },
  "security": [
    {
      "bearer": []
    }
  ],
  "summary": "AuthorizeMcpServer authorizes credentials for one named upstream.",
  "tags": [
    "MCP gateways"
  ],
  "x-sbx-authenticated-only": false,
  "x-sbx-conditional-permissions": [],
  "x-sbx-plane": "control",
  "x-sbx-required-permissions": [
    "mcpWrite"
  ],
  "x-sbx-resource-response": {
    "$ref": "#/components/schemas/McpAuthorization"
  },
  "x-sbx-serving-surface": "management"
}