sealgate-ai Admin API

openapi: 3.2.0
info:
  title: SealGate Admin API
  description: Open-source MCP security, aggregation, and monitoring. Self-hosted MCP proxy.
  version: 0.19.0
tags:
- name: Admin
paths:
  /api/v1/admin/mcp-requests:
    get:
      summary: List All Requests
      description: 'List all MCP server requests (admin: domain-scoped, owner: all).'
      operationId: list_all_requests_api_v1_admin_mcp_requests_get
      security:
      - HTTPBearer: []
      parameters:
      - name: status
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Filter by status
          title: Status
        description: Filter by status
      - name: domain
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Org to view (Super-Owner only, read-only)
          title: Domain
        description: Org to view (Super-Owner only, read-only)
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/McpRequestListResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - Admin
  /api/v1/admin/mcp-requests/{request_id}/approve:
    post:
      summary: Approve Request
      description: Approve a pending MCP server request.
      operationId: approve_request_api_v1_admin_mcp_requests__request_id__approve_post
      security:
      - HTTPBearer: []
      parameters:
      - name: request_id
        in: path
        required: true
        schema:
          type: integer
          title: Request Id
      - name: domain
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Org to view (Super-Owner only, read-only)
          title: Domain
        description: Org to view (Super-Owner only, read-only)
      - name: Idempotency-Key
        in: header
        required: false
        description: Optional client-generated key that makes this write operation safe to retry. Reusing the same key returns the original response instead of performing the operation a second time. Keys are scoped to the caller and expire after 24 hours.
        schema:
          type: string
          maxLength: 255
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - $ref: '#/components/schemas/ApproveMcpRequestBody'
              - type: 'null'
              title: Body
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApproveMcpRequestResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - Admin
  /api/v1/admin/mcp-requests/approve-all:
    post:
      summary: Approve All Requests
      description: Bulk-approve visible pending requests, limited to ``body.request_ids`` when given.
      operationId: approve_all_requests_api_v1_admin_mcp_requests_approve_all_post
      security:
      - HTTPBearer: []
      parameters:
      - name: domain
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Org to view (Super-Owner only, read-only)
          title: Domain
        description: Org to view (Super-Owner only, read-only)
      - name: Idempotency-Key
        in: header
        required: false
        description: Optional client-generated key that makes this write operation safe to retry. Reusing the same key returns the original response instead of performing the operation a second time. Keys are scoped to the caller and expire after 24 hours.
        schema:
          type: string
          maxLength: 255
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - $ref: '#/components/schemas/ApproveAllMcpRequestsBody'
              - type: 'null'
              title: Body
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApproveAllMcpRequestsResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - Admin
  /api/v1/admin/mcp-requests/{request_id}/reject:
    post:
      summary: Reject Request
      description: Reject a pending MCP server request.
      operationId: reject_request_api_v1_admin_mcp_requests__request_id__reject_post
      security:
      - HTTPBearer: []
      parameters:
      - name: request_id
        in: path
        required: true
        schema:
          type: integer
          title: Request Id
      - name: domain
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Org to view (Super-Owner only, read-only)
          title: Domain
        description: Org to view (Super-Owner only, read-only)
      - name: Idempotency-Key
        in: header
        required: false
        description: Optional client-generated key that makes this write operation safe to retry. Reusing the same key returns the original response instead of performing the operation a second time. Keys are scoped to the caller and expire after 24 hours.
        schema:
          type: string
          maxLength: 255
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - $ref: '#/components/schemas/RejectMcpRequestBody'
              - type: 'null'
              title: Body
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RejectMcpRequestResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - Admin
  /api/v1/admin/mcp-requests/{request_id}/validate:
    post:
      summary: Validate Request
      description: 'Validate a pending MCP server request by launching it and discovering capabilities.


        This lets an admin test a requested server *before* approving it, so they

        can see what tools/resources/prompts it exposes and whether it starts at all.'
      operationId: validate_request_api_v1_admin_mcp_requests__request_id__validate_post
      security:
      - HTTPBearer: []
      parameters:
      - name: request_id
        in: path
        required: true
        schema:
          type: integer
          title: Request Id
      - name: domain
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Org to view (Super-Owner only, read-only)
          title: Domain
        description: Org to view (Super-Owner only, read-only)
      - name: Idempotency-Key
        in: header
        required: false
        description: Optional client-generated key that makes this write operation safe to retry. Reusing the same key returns the original response instead of performing the operation a second time. Keys are scoped to the caller and expire after 24 hours.
        schema:
          type: string
          maxLength: 255
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidateMcpRequestResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - Admin
components:
  schemas:
    ApproveAllMcpRequestsResponse:
      properties:
        approved:
          type: integer
          title: Approved
          description: Number of requests approved
        failed:
          type: integer
          title: Failed
          description: Number of requests that failed
        total:
          type: integer
          title: Total
          description: Total pending requests processed
        errors:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          title: Errors
          description: Error messages for failed approvals
      type: object
      required:
      - approved
      - failed
      - total
      title: ApproveAllMcpRequestsResponse
    ApproveMcpRequestBody:
      properties:
        reviewer_notes:
          anyOf:
          - type: string
          - type: 'null'
          title: Reviewer Notes
          description: Optional reviewer notes
        name_override:
          anyOf:
          - type: string
          - type: 'null'
          title: Name Override
          description: Override the server name (for deduplication)
      type: object
      title: ApproveMcpRequestBody
    ApproveMcpRequestResponse:
      properties:
        status:
          type: string
          title: Status
          description: Operation result
          default: success
        message:
          type: string
          title: Message
          description: Human-readable message
        server_id:
          type: integer
          title: Server Id
          description: Created server ID
        request_id:
          type: integer
          title: Request Id
          description: Approved request ID
        server_name:
          type: string
          title: Server Name
          description: Final (sanitized) name of the created server. Lets the dashboard continue straight into the post-approve setup steps (the setup stepper resolves OAuth status via GET /mcp/oauth/status/{name}).
      type: object
      required:
      - message
      - server_id
      - request_id
      - server_name
      title: ApproveMcpRequestResponse
    McpRequestListResponse:
      properties:
        requests:
          items:
            $ref: '#/components/schemas/McpRequestEntry'
          type: array
          title: Requests
          description: List of MCP server requests
      type: object
      required:
      - requests
      title: McpRequestListResponse
    RejectMcpRequestBody:
      properties:
        reviewer_notes:
          anyOf:
          - type: string
          - type: 'null'
          title: Reviewer Notes
          description: Reason for rejection
      type: object
      title: RejectMcpRequestBody
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    ApproveAllMcpRequestsBody:
      properties:
        request_ids:
          anyOf:
          - items:
              type: integer
            type: array
          - type: 'null'
          title: Request Ids
          description: 'Approve only these pending requests: the ones the admin was shown. Omitted means every pending request the caller can see, so a request that arrives while the confirm dialog is open is never approved unseen.'
      type: object
      title: ApproveAllMcpRequestsBody
    McpRequestEntry:
      properties:
        id:
          type: integer
          title: Id
          description: Request ID
        requester_user_id:
          type: string
          title: Requester User Id
          description: Requester user UUID
        name:
          type: string
          title: Name
          description: Proposed server name
        display_name:
          anyOf:
          - type: string
          - type: 'null'
          title: Display Name
          description: Human-readable server label
        command:
          anyOf:
          - type: string
          - type: 'null'
          title: Command
          description: Command for stdio servers
        args:
          items: {}
          type: array
          title: Args
          description: Command-line arguments
        env:
          additionalProperties:
            type: string
          type: object
          title: Env
          description: Environment variables
        url:
          anyOf:
          - type: string
          - type: 'null'
          title: Url
          description: URL for HTTP/SSE servers
        headers:
          additionalProperties:
            type: string
          type: object
          title: Headers
          description: Custom HTTP headers for HTTP/SSE servers
        server_type:
          type: string
          title: Server Type
          description: 'Server type: stdio, sse, or http'
          default: stdio
        source_app:
          anyOf:
          - type: string
          - type: 'null'
          title: Source App
          description: App where server was discovered
        source_path:
          anyOf:
          - type: string
          - type: 'null'
          title: Source Path
          description: Config file path
        roots:
          items:
            type: string
          type: array
          title: Roots
          description: Root paths
        from_marketplace_id:
          anyOf:
          - type: string
          - type: 'null'
          title: From Marketplace Id
          description: Marketplace ID
        justification:
          anyOf:
          - type: string
          - type: 'null'
          title: Justification
          description: User's reason for requesting
        template_fields:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Template Fields
          description: Template field definitions
        status:
          type: string
          title: Status
          description: 'Request status: pending, approved, rejected'
          default: pending
        quarantined:
          type: boolean
          title: Quarantined
          description: True if a non-admin raised the request while the org's auto-quarantine flag was on. Requests filed from the dashboard (origin 'dashboard') are never quarantined. Distinguishes the dashboard's quarantine queue from the new-server-requests queue.
          default: false
        reviewer_user_id:
          anyOf:
          - type: string
          - type: 'null'
          title: Reviewer User Id
          description: Reviewer user UUID
        reviewer_notes:
          anyOf:
          - type: string
          - type: 'null'
          title: Reviewer Notes
          description: Reviewer notes
        icon_url:
          anyOf:
          - type: string
          - type: 'null'
          title: Icon Url
          description: Brand icon URL (e.g. logo.dev) resolved from the server URL at submission time, for rendering in the pending-requests list. Null when no logo could be derived.
        hostname:
          anyOf:
          - type: string
          - type: 'null'
          title: Hostname
          description: Machine the server was discovered on (local/stdio requests)
        device_status:
          anyOf:
          - type: string
          - type: 'null'
          title: Device Status
          description: 'Online status of the host''s stdiod device for a stdio request: ''online'', ''offline'', or ''unknown''. Null for HTTP/SSE requests. The Approve action is only allowed when this is ''online''.'
        created_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Created At
          description: Creation timestamp (ISO 8601)
        updated_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Updated At
          description: Last update timestamp (ISO 8601)
      type: object
      required:
      - id
      - requester_user_id
      - name
      title: McpRequestEntry
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidateMcpRequestResponse:
      properties:
        status:
          type: string
          title: Status
          description: 'Validation status: healthy or unhealthy'
        error:
          anyOf:
          - type: string
          - type: 'null'
          title: Error
          description: Error message if unhealthy
        tools:
          items:
            type: string
          type: array
          title: Tools
          description: Discovered tool names
        resources:
          items:
            type: string
          type: array
          title: Resources
          description: Discovered resource names
        prompts:
          items:
            type: string
          type: array
          title: Prompts
          description: Discovered prompt names
        suggested_url:
          anyOf:
          - type: string
          - type: 'null'
          title: Suggested Url
          description: A sibling URL that responded to an MCP handshake when the requested URL did not (e.g. the origin root when a '/mcp' path 404s). Suggestion only.
      type: object
      required:
      - status
      title: ValidateMcpRequestResponse
    RejectMcpRequestResponse:
      properties:
        status:
          type: string
          title: Status
          description: Operation result
          default: success
        message:
          type: string
          title: Message
          description: Human-readable message
          default: Request rejected successfully
        request_id:
          type: integer
          title: Request Id
          description: Rejected request ID
      type: object
      required:
      - request_id
      title: RejectMcpRequestResponse
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer
    ClientBearer:
      type: http
      description: Opaque ewc_ client installation credential
      scheme: bearer
    ServiceToken:
      type: http
      description: 'A SealGate service token: `sgt_acct_...` (account token) or `sgt_org_...` (org token). Mint an account token in the dashboard.'
      scheme: bearer
    MCPGatewayOAuth:
      type: oauth2
      description: OAuth 2.1 authorization-code flow (PKCE required) against the SealGate MCP gateway's authorization server. Request only the scopes an agent needs; unrequested scopes are not granted.
      flows:
        authorizationCode:
          authorizationUrl: /oauth/authorize
          tokenUrl: /oauth/token
          refreshUrl: /oauth/token
          scopes:
            mcp: Connect to the MCP gateway and call the tools exposed by your enabled servers. Every call is still evaluated by the policy engine.
            offline_access: Issue a refresh token so the client can renew access without a new browser sign-in.