DPF MCP API

openapi: 3.2.0
info:
  title: DPF MCP API
  version: 1.1.0
  description: '## Common error responses


    Unless otherwise noted, any authenticated endpoint may also return the following

    responses, each with the standard `ErrorResponse` body. To avoid repetition they are

    not listed individually on each operation:


    - **400 Bad Request** — malformed JSON, unknown action, or missing/invalid fields

    - **401 Unauthorized** — missing or invalid JWT bearer token

    - **402 Payment Required** — the account has insufficient credits or an inactive subscription

    - **403 Forbidden** — authenticated but not permitted (no access to the resource, or a higher access level / plan tier is required)


    Operation-specific responses (e.g. `404`, `409`) are documented on each endpoint.'
  contact:
    name: Contact DPF
    url: mailto:contact@dpf-it.com
  license:
    name: Proprietary
    url: https://dpf-it.com/#terms
servers:
- url: https://api.dpf-it.com
  description: Production API
security: []
tags:
- name: MCP
  description: 'Remote Streamable HTTP MCP (Model Context Protocol) server. A single JSON-RPC endpoint,

    authenticated with a Bearer token from either the OAuth 2.1 Authorization Server (recommended)

    or a plain `/auth/login` JWT. Stateless — no session is held between requests.'
paths:
  /mcp:
    post:
      tags:
      - MCP
      summary: Remote MCP server (Streamable HTTP, JSON-RPC 2.0)
      description: 'Single endpoint implementing the MCP Streamable HTTP transport, stateless (no session is

        held between requests — every request is independently authenticated and dispatched).

        Responses are always direct JSON (never SSE) since every tool here is a synchronous

        request/response against the DPF REST API.


        **Auth is required on every request, including `initialize`.** Send

        `Authorization: Bearer `, where the token is either an OAuth 2.1 access token (see

        `/oauth/token`) or a plain `/auth/login` JWT. An unauthenticated request gets a `401` with a

        `WWW-Authenticate` header pointing at the authorization/token endpoints — this is what makes

        OAuth-aware clients (VS Code, Cursor, Claude) discover they need to authenticate and run the

        OAuth flow automatically.


        Body is a standard JSON-RPC 2.0 MCP message (`initialize`, `tools/list`, `tools/call`, etc.)

        — see the Model Context Protocol specification for the message format. Tools available:

        list_my_workspaces, create_workspace, list_data, get_status, delete_data_spec, submit_query,

        manage_connection, manage_trigger, onboard_data_source, finish_data_source_onboarding,

        update_data_spec, finish_data_spec_update, run_data_job, finish_data_job,

        setup_scheduled_pull, call_dpf_api.'
      operationId: mcpRemote
      security:
      - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              description: JSON-RPC 2.0 MCP message
      responses:
        '200':
          description: JSON-RPC response
          content:
            application/json:
              schema:
                type: object
        '401':
          description: Missing or invalid Authorization header
        '405':
          description: Method not allowed — only POST is supported on this endpoint
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT token obtained from login or registration