API reference
mcp
19 endpoints in this area. Each one has its own page with its parameters, its response and a request you can run.
| Method | Path | What it does | Permission |
|---|---|---|---|
| GET | /.well-known/oauth-authorization-server | OAuth 2.1 authorization-server metadata for AI apps (RFC 8414). | No API key |
| GET | /.well-known/oauth-authorization-server/v1/mcp | The authorization-server metadata, for clients that append the resource path. | No API key |
| GET | /.well-known/oauth-protected-resource | OAuth 2.1 protected-resource metadata for the MCP server (RFC 9728). | No API key |
| GET | /.well-known/oauth-protected-resource/v1/mcp | The MCP server's protected-resource metadata at its path-qualified URL (RFC 9728 §3.1). | No API key |
| GET | /.well-known/openai-apps-challenge | ChatGPT app-directory domain-verification token (plain text). | No API key |
| GET | /.well-known/openid-configuration | The authorization-server metadata at the OpenID discovery path. | No API key |
| POST | /v1/mcp | The MCP JSON-RPC 2.0 protocol endpoint. | Its own token |
| GET | /v1/mcp/connections | List the organization's MCP connections. | mcp.manage |
| POST | /v1/mcp/connections | Create an MCP connection (Connect AI tool). | mcp.manage |
| DELETE | /v1/mcp/connections/{connectionId} | Revoke an MCP connection. | mcp.manage |
| GET | /v1/mcp/connections/{connectionId} | Get an MCP connection. | mcp.manage |
| GET | /v1/mcp/oauth/requests/{requestId} | What an AI app asking to connect wants (the consent screen's data). | mcp.manage |
| POST | /v1/mcp/oauth/requests/{requestId}/approve | Approve an AI app — creates the connection and returns the app's redirect. | mcp.manage |
| POST | /v1/mcp/oauth/requests/{requestId}/deny | Decline an AI app — returns the app's redirect carrying access_denied. | Any API key |
| GET | /v1/mcp/scopes | The permissions worth granting an AI tool. | mcp.manage |
| GET | /v1/oauth/authorize | Start an AI app's sign-in (OAuth 2.1 authorization endpoint). | No API key |
| POST | /v1/oauth/register | Register an AI app as an OAuth client (RFC 7591 dynamic client registration). | No API key |
| POST | /v1/oauth/revoke | Revoke an AI app's access (RFC 7009). | No API key |
| POST | /v1/oauth/token | Exchange a code or refresh token for MCP access tokens (OAuth 2.1 token endpoint). | No API key |