Storm MCP Credential Census API

openapi: 3.2.0
info:
  title: MCP Gateway Credential Census API
  description: API for MCP Gateway operations
  version: v1
servers:
- url: https://dev.stormmcp.ai/
tags:
- name: CredentialCensus
paths:
  /api/v1/admin/credential-census:
    get:
      tags:
      - CredentialCensus
      summary: Lists one page of the caller tenant's credential census
      parameters:
      - name: pageNumber
        in: query
        description: The page number (1-based, default 1).
        schema:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          format: int32
          default: 1
      - name: pageSize
        in: query
        description: The page size (default 20, max 1000).
        schema:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          format: int32
          default: 20
      - name: kind
        in: query
        description: 'Optional family: provider_row, custom_server, gateway_app, or dashboard_preference.'
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/CredentialCensusPage'
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialCensusPage'
            text/json:
              schema:
                $ref: '#/components/schemas/CredentialCensusPage'
            text/csv:
              schema:
                $ref: '#/components/schemas/CredentialCensusPage'
            application/csv:
              schema:
                $ref: '#/components/schemas/CredentialCensusPage'
        '400':
          description: Bad Request
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            text/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            text/csv:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            application/csv:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            text/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            text/csv:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            application/csv:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            text/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            text/csv:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
            application/csv:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      operationId: getApiV1AdminCredentialCensus
      x-operation-id-source: derived
components:
  schemas:
    ProblemDetails:
      type: object
      properties:
        type:
          type:
          - 'null'
          - string
        title:
          type:
          - 'null'
          - string
        status:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - 'null'
          - integer
          - string
          format: int32
        detail:
          type:
          - 'null'
          - string
        instance:
          type:
          - 'null'
          - string
    CredentialCensusRow:
      type: object
      properties:
        kind:
          type: string
          description: 'Gets the family: provider_row, custom_server, gateway_app, or dashboard_preference.'
        rowId:
          type: string
          description: Gets the stored row id. For a gateway app this is the gateway id.
          format: uuid
        libraryId:
          type:
          - 'null'
          - string
          description: Gets the library id, when the row has one.
          format: uuid
        binderId:
          type:
          - 'null'
          - string
          description: 'Gets the binder id when the handle resolved to that binder, including a legacy

            credential id that resolved to a different binder. Null is none.'
          format: uuid
        level:
          type:
          - 'null'
          - string
          description: 'Gets the resolved binder level, Personal or Tenant, or the row level when the handle

            did not resolve. Null when the row has no level or the binder level is unknown.'
        resolvable:
          type:
          - 'null'
          - boolean
          description: 'Gets whether the handle resolved to a live binder. Null means a Personal row owned

            by another user was omitted by the store, so the census does not call it missing.'
        eligible:
          type: boolean
          description: 'Gets a value indicating whether a later fill may store this binder id.

            A Personal binder and a Tenant authorization-code binder are never eligible.'
        cutoverClass:
          type:
          - 'null'
          - string
          description: 'Gets the cutover class for a consumer row: legitimate, unconfigured, or unmigrated.'
        shape:
          type:
          - 'null'
          - string
          description: 'Gets the shared-credential shape: personal_pointer, custom_server_key, deleted,

            tenant_authorization_code, v1_credential_id, or level_mismatch.'
        reason:
          type:
          - 'null'
          - string
          description: Gets connection_failed when the store did not answer for this handle.
      description: 'One census row. A binder id names a UCS binder. It is not a credential and it does not

        authorize the caller to read or serve that credential.'
    CredentialCensusCounts:
      type: object
      properties:
        providerRows:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: Gets the number of provider-configuration rows in the caller tenant.
          format: int32
        customServers:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: Gets the number of custom servers in the caller tenant.
          format: int32
        gatewayApps:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: Gets the number of shared-credential entries on live gateways in the caller tenant.
          format: int32
        dashboardPreferences:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: Gets the number of dashboard library preferences in the caller tenant.
          format: int32
        legitimate:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: 'Gets the legitimate-null count: credentialless provider rows, credentialless custom

            servers, and every dashboard preference.'
          format: int32
        unconfigured:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: 'Gets the unconfigured-null count: credential-requiring provider rows and custom servers

            that store no credential handle, plus a gateway library with no entry that links no

            eligible Tenant binder and no anchored Personal binder. Reported by count. Does not

            block cutover. An omitted or faulted handle is not counted here.'
          format: int32
        unmigrated:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: 'Gets the unmigrated count: shared-credential values that are still row ids, personal

            pointers, or deleted ids, plus a gateway library with no entry that already has an

            eligible Tenant binder or an anchored Personal binder, or whose handle could not be

            classified. A value that is already a binder id is not included.'
          format: int32
        absentEntries:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: 'Gets live-gateway libraries with no shared-credential entry whose absence is unmigrated.

            Those entries are included in int CredentialCensusCounts.Unmigrated.'
          format: int32
      description: Tenant-wide counts for the credential census. One aggregate query per family.
    CredentialCensusPage:
      type: object
      properties:
        pageNumber:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: Gets the 1-based page number.
          format: int32
        pageSize:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          description: Gets the page size.
          format: int32
        counts:
          description: Gets the tenant-wide family counts. These are aggregates, not a walk of every handle.
          $ref: '#/components/schemas/CredentialCensusCounts'
        items:
          type: array
          items:
            $ref: '#/components/schemas/CredentialCensusRow'
          description: Gets the rows on this page.
      description: One page of the tenant credential census. Ids and classifications only.