kaiv-ai Policies API

openapi: 3.2.0
info:
  title: Kaiva Bridge Management Policies API
  version: 1.0.0
  summary: Create, read and publish managed MCP servers from an OpenAPI spec, a GraphQL API, a database, documents or a remote MCP server.
  description: 'The REST API behind the Kaiva Bridge console and the @kaiva/bridge CLI. It creates managed MCP servers from an OpenAPI or Swagger spec, a GraphQL endpoint, a PostgreSQL, MySQL, MariaDB or SQL Server database, uploaded documents or a remote MCP server, chooses which tools are exposed, publishes the server and creates the keys AI clients use.


    Every request carries a management key: `Authorization: Bearer kv_mgmt_...`. An owner or admin creates one in the console under Keys & access (type Management), or `npx @kaiva/bridge login` approves a machine and saves one. A management key acts on its own workspace only, and it cannot create another management key. Gateway keys (`kv_live_...`) are for calling an MCP server and are refused here.


    A published server is an MCP endpoint (Streamable HTTP) at `https://api.kaiv.ai/api/bridge/mcp/`. AI clients call it with MCP, not with this API. Claude, ChatGPT, Cursor, VS Code and Claude Code can sign in to it with OAuth 2.1 instead of a key.


    Limits: 120 requests a minute per address; 60 document uploads a minute and 12 credential tests a minute per workspace.


    The CLI''s source is public: https://github.com/ai-kaiva/bridge'
  contact:
    name: Kaiva support
    email: support@kaiv.ai
    url: https://kaiv.ai/bridge/docs
  termsOfService: https://kaiv.ai/terms
servers:
- url: https://api.kaiv.ai/api/bridge/v1
  description: Production
security:
- managementKey: []
tags:
- name: Policies
  description: Rules for which tools a key may call.
paths:
  /policies:
    get:
      tags:
      - Policies
      operationId: listPolicies
      summary: List policies
      responses:
        '200':
          description: The workspace's policies.
          content:
            application/json:
              schema:
                type: object
                properties:
                  policies:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      tags:
      - Policies
      operationId: createPolicy
      summary: Create a policy
      description: Rules allow, hold for review or deny tool calls by tool name and, optionally, an argument value. A tool no rule allows is denied.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              - rules
              properties:
                name:
                  type: string
                subjects:
                  type: array
                  items:
                    type: string
                  description: 'Who the policy applies to: key names, or the email addresses of people who sign in (*@yourcompany.com covers a domain). Empty means everyone.'
                rules:
                  type: array
                  items:
                    type: object
                    properties:
                      effect:
                        type: string
                        enum:
                        - allow
                        - review
                        - deny
                      tool:
                        type: string
                        description: A tool name, or a pattern such as get_*.
                    additionalProperties: true
      responses:
        '201':
          description: The policy.
          content:
            application/json:
              schema:
                type: object
                properties:
                  policy:
                    type: object
                    additionalProperties: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  responses:
    Unauthorized:
      description: No key, an unknown key, or a gateway key (kv_live_) where a management key is needed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: The request is missing something or has a value Bridge cannot use; the answer says which.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      properties:
        error:
          type: string
          description: A short code, or a sentence for errors in your request.
        message:
          type: string
  securitySchemes:
    managementKey:
      type: http
      scheme: bearer
      bearerFormat: kv_mgmt_
      description: A management key (kv_mgmt_...). Create one in the console under Keys & access, or run `npx @kaiva/bridge login`.
externalDocs:
  description: Kaiva Bridge docs
  url: https://kaiv.ai/bridge/docs