kaiv-ai Credentials API

openapi: 3.2.0
info:
  title: Kaiva Bridge Management Credentials API
  version: 1.0.0
  summary: Create, read and publish managed MCP servers from an OpenAPI spec, a GraphQL API, a database, documents or a remote MCP server.
  description: 'The REST API behind the Kaiva Bridge console and the @kaiva/bridge CLI. It creates managed MCP servers from an OpenAPI or Swagger spec, a GraphQL endpoint, a PostgreSQL, MySQL, MariaDB or SQL Server database, uploaded documents or a remote MCP server, chooses which tools are exposed, publishes the server and creates the keys AI clients use.


    Every request carries a management key: `Authorization: Bearer kv_mgmt_...`. An owner or admin creates one in the console under Keys & access (type Management), or `npx @kaiva/bridge login` approves a machine and saves one. A management key acts on its own workspace only, and it cannot create another management key. Gateway keys (`kv_live_...`) are for calling an MCP server and are refused here.


    A published server is an MCP endpoint (Streamable HTTP) at `https://api.kaiv.ai/api/bridge/mcp/`. AI clients call it with MCP, not with this API. Claude, ChatGPT, Cursor, VS Code and Claude Code can sign in to it with OAuth 2.1 instead of a key.


    Limits: 120 requests a minute per address; 60 document uploads a minute and 12 credential tests a minute per workspace.


    The CLI''s source is public: https://github.com/ai-kaiva/bridge'
  contact:
    name: Kaiva support
    email: support@kaiv.ai
    url: https://kaiv.ai/bridge/docs
  termsOfService: https://kaiv.ai/terms
servers:
- url: https://api.kaiv.ai/api/bridge/v1
  description: Production
security:
- managementKey: []
tags:
- name: Credentials
  description: The credential Bridge sends to your API or MCP server. Stored encrypted, never shown to an AI client.
paths:
  /servers/{id}/upstream-auth:
    parameters:
    - $ref: '#/components/parameters/ServerId'
    put:
      tags:
      - Credentials
      operationId: setServerCredential
      summary: Save or clear the credential sent to your API or MCP server
      description: 'For openapi, graphql and mcp servers. Stored encrypted and sent only to the server''s own source. Send `auth: null` to clear it.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - auth
              properties:
                auth:
                  oneOf:
                  - $ref: '#/components/schemas/Credential'
                  - type: 'null'
      responses:
        '200':
          description: The saved state and the server.
          content:
            application/json:
              schema:
                type: object
                properties:
                  server: {}
                additionalProperties: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /servers/{id}/upstream-auth/test:
    parameters:
    - $ref: '#/components/parameters/ServerId'
    post:
      tags:
      - Credentials
      operationId: testServerCredential
      summary: Test the saved credential with one read call to your API
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                toolId:
                  type:
                  - string
                  - 'null'
                  description: A read tool to call. Bridge picks one when this is left out.
      responses:
        '200':
          description: What the call showed about the API and the credential.
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/RateLimited'
components:
  schemas:
    Error:
      type: object
      properties:
        error:
          type: string
          description: A short code, or a sentence for errors in your request.
        message:
          type: string
    Credential:
      description: What Bridge sends to your API or MCP server. Stored encrypted; never shown to an AI client.
      oneOf:
      - type: object
        title: Bearer token
        required:
        - type
        - token
        properties:
          type:
            const: bearer
          token:
            type: string
      - type: object
        title: Username and password
        required:
        - type
        - username
        properties:
          type:
            const: basic
          username:
            type: string
          password:
            type: string
      - type: object
        title: Header
        required:
        - type
        - name
        - value
        properties:
          type:
            const: header
          name:
            type: string
            examples:
            - X-API-Key
          value:
            type: string
      - type: object
        title: Query parameter
        required:
        - type
        - name
        - value
        properties:
          type:
            const: query
          name:
            type: string
            examples:
            - api_key
          value:
            type: string
  responses:
    RateLimited:
      description: Too many requests; wait a minute.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: No key, an unknown key, or a gateway key (kv_live_) where a management key is needed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: The request is missing something or has a value Bridge cannot use; the answer says which.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  parameters:
    ServerId:
      name: id
      in: path
      required: true
      description: The server's id.
      schema:
        type: string
  securitySchemes:
    managementKey:
      type: http
      scheme: bearer
      bearerFormat: kv_mgmt_
      description: A management key (kv_mgmt_...). Create one in the console under Keys & access, or run `npx @kaiva/bridge login`.
externalDocs:
  description: Kaiva Bridge docs
  url: https://kaiv.ai/bridge/docs