> ## Documentation Index
> Fetch the complete documentation index at: https://differentai-fix-signin-code-field-label.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Discover external MCP connection requirements

> Admin-only, side-effect-free requirements discovery. It performs no client registration, credential write, or connection creation.



## OpenAPI

````yaml /openapi.json post /v1/mcp-connections/discover
openapi: 3.1.0
info:
  title: Den API
  description: >-
    OpenAPI spec for the Den control plane API.


    Authentication:

    - Use `Authorization: Bearer <session-token>` for user-authenticated routes
    that require a Den session.

    - Use `x-api-key: <den-api-key>` for organization API-key calls. API keys
    resolve to the issuing user and the organization member they were scoped to
    when created, so they can call ordinary user and organization routes without
    a separate signed-in session.
      Example: `curl https://api.openworklabs.com/v1/me -H "x-api-key: den_..."`.
    - Session-only flows still require a signed-in user session, including
    organization creation, invitation acceptance, active-organization switching,
    and MCP token minting.

    - Public routes like health and documentation do not require authentication.


    Swagger tip: use the security schemes in the Authorize dialog to set either
    `bearerAuth` or `denApiKey` before trying protected endpoints.
  version: 0.18.46
  contact:
    name: OpenWork
    url: https://openworklabs.com
    email: team@openworklabs.com
  license:
    name: OpenWork Enterprise Edition License
    url: https://github.com/different-ai/openwork/blob/dev/ee/LICENSE
servers:
  - url: https://api.openworklabs.com
security:
  - bearerAuth: []
  - denApiKey: []
tags:
  - name: System
    description: >-
      Service health, readiness, API documentation, and desktop version
      metadata.
  - name: Authentication
    description: >-
      Sign-in discovery, administrator bootstrap, OAuth provider connections,
      and MCP token minting.
  - name: OAuth
    description: >-
      OAuth 2.0 / OpenID Connect authorization-server and protected-resource
      metadata and dynamic client registration (RFC 8414, RFC 9728, RFC 7591),
      used by MCP clients.
  - name: SCIM
    description: >-
      SCIM 2.0 provisioning endpoints for identity providers (RFC 7644) and the
      organization SCIM connector management routes.
  - name: SSO
    description: Organization single sign-on connector management routes.
  - name: Bootstrap
    description: Agent-first provisional workspace setup routes.
  - name: Users
    description: Current user and membership routes.
  - name: Organizations
    description: Organization creation, context, brand assets, and install links.
  - name: Invitations
    description: Invitation preview, acceptance, creation, and cancellation routes.
  - name: Members
    description: Organization member management routes.
  - name: Roles
    description: Organization custom role management routes.
  - name: Teams
    description: Organization team management routes.
  - name: API Keys
    description: Organization API key management routes.
  - name: Desktop Policies
    description: Desktop app policies applied to the organization, members, or teams.
  - name: LLM Providers
    description: Organization LLM provider catalog, configuration, and access routes.
  - name: Inference
    description: Organization inference settings.
  - name: Inference Providers
    description: >-
      Organization inference Gateway providers, model groups, credential sets,
      access grants, member connections, and usage.
  - name: Cloud
    description: Organization Cloud instance lifecycle and browser gateway resolution.
  - name: Workers
    description: Worker lifecycle, billing, and runtime routes.
  - name: Worker Runtime
    description: Worker runtime inspection and upgrade routes.
  - name: Worker Activity
    description: Worker heartbeat and activity reporting routes.
  - name: Automations
    description: Scheduled Automations, their runs, and desktop runner presence.
  - name: Workflows
    description: Saved Workflows (Code Mode scripts), their versions, snapshots, and views.
  - name: Workflow Runs
    description: Durable Workflow run history.
  - name: Codemode Runs
    description: Generated Artifact views produced by Code Mode runs.
  - name: Apps
    description: >-
      Saved reusable apps built from Workflows and Artifact views, and their
      sharing.
  - name: Config Objects
    description: >-
      Versioned configuration objects (skills, workflows, and other plugin
      content).
  - name: Plugins
    description: Plugin packages, access grants, and imports.
  - name: Marketplaces
    description: Marketplaces that distribute plugins to members and teams.
  - name: Resources
    description: >-
      Aggregated snapshot of the resources and marketplace capabilities
      available to the caller.
  - name: Dashboards
    description: Shared dashboards and their access grants.
  - name: Capability Sources
    description: >-
      Native provider capabilities (Google Workspace, Microsoft 365) and
      external MCP connections executed as the calling member.
  - name: Direct uploads
    description: Multipart uploads that stream workspace files straight to a provider.
  - name: Connectors
    description: >-
      Connector accounts and instances (GitHub and other sources) and their sync
      state.
  - name: GitHub
    description: >-
      GitHub App installation, repository discovery, and plugin import from
      GitHub.
  - name: Diagnostics
    description: Controlled egress diagnostics for self-hosted deployments.
  - name: Telemetry
    description: Telemetry event ingestion and adoption analytics.
  - name: Webhooks
    description: Signed inbound webhooks from third-party providers.
  - name: Admin
    description: Platform administration routes for allowlisted OpenWork administrators.
  - name: Deprecated
    description: Removed features that answer with 410 or an empty result for old clients.
paths:
  /v1/mcp-connections/discover:
    post:
      tags:
        - Authentication
      summary: Discover external MCP connection requirements
      description: >-
        Admin-only, side-effect-free requirements discovery. It performs no
        client registration, credential write, or connection creation.
      operationId: postV1McpConnectionsDiscover
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalMcpRequirementsDiscoveryInput'
      responses:
        '200':
          description: Requirements discovery result.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalMcpRequirementsDiscovery'
        '400':
          description: Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidRequestError'
        '401':
          description: The caller must be signed in.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedError'
        '403':
          description: Only workspace owners and admins can discover MCP requirements.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenError'
        '502':
          description: Requirements discovery failed.
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/ExternalMcpRequirementsDiscoveryFailedError
      security:
        - bearerAuth: []
        - denApiKey: []
components:
  schemas:
    ExternalMcpRequirementsDiscoveryInput:
      type: object
      properties:
        url:
          type: string
          maxLength: 2048
          format: uri
      required:
        - url
    ExternalMcpRequirementsDiscovery:
      type: object
      properties:
        status:
          type: string
          enum:
            - ready
            - manual_action_required
            - unsupported
            - unreachable
        server:
          type: object
          properties:
            url:
              type: string
            protocolVersion:
              type: string
            initialize:
              type: string
              enum:
                - succeeded
                - authentication_required
                - failed
          required:
            - url
            - initialize
        authentication:
          type: object
          properties:
            kind:
              type: string
              enum:
                - none
                - oauth
                - manual_bearer
                - unknown
            resource:
              type: string
            protectedResourceMetadataUrl:
              type: string
            authorizationServers:
              type: array
              items:
                type: object
                properties:
                  issuer:
                    type: string
                  authorizationEndpoint:
                    type: string
                  tokenEndpoint:
                    type: string
                  registrationEndpoint:
                    type: string
                  clientIdMetadataDocumentSupported:
                    type: boolean
                  scopesSupported:
                    type: array
                    items:
                      type: string
                  grantTypesSupported:
                    type: array
                    items:
                      type: string
                  codeChallengeMethodsSupported:
                    type: array
                    items:
                      type: string
                  tokenEndpointAuthMethodsSupported:
                    type: array
                    items:
                      type: string
                required:
                  - issuer
                  - clientIdMetadataDocumentSupported
            requiredScopes:
              type: array
              items:
                type: string
            recommendedScopes:
              type: array
              items:
                type: string
            refreshSupport:
              type: string
              enum:
                - supported
                - not_advertised
                - unknown
            availableRegistrationMethods:
              type: array
              items:
                type: string
                enum:
                  - pre_registered
                  - client_metadata
                  - dynamic
            recommendedRegistrationMethod:
              type: string
              enum:
                - client_metadata
                - dynamic
                - pre_registered
          required:
            - kind
            - authorizationServers
            - requiredScopes
            - recommendedScopes
            - refreshSupport
            - availableRegistrationMethods
            - recommendedRegistrationMethod
        tools:
          type: object
          properties:
            visibility:
              type: string
              enum:
                - available_without_auth
                - requires_auth
                - unavailable
            count:
              type: integer
              minimum: 0
              maximum: 9007199254740991
            items:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                  readOnlyHint:
                    type: boolean
                  destructiveHint:
                    type: boolean
                  openWorldHint:
                    type: boolean
                required:
                  - name
          required:
            - visibility
        manualRequirements:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
              label:
                type: string
              reason:
                type: string
              required:
                type: boolean
            required:
              - code
              - label
              - reason
              - required
        warnings:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
              message:
                type: string
            required:
              - code
              - message
      required:
        - status
        - server
        - authentication
        - tools
        - manualRequirements
        - warnings
    InvalidRequestError:
      type: object
      properties:
        error:
          type: string
          const: invalid_request
        details:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
              path:
                type: array
                items:
                  anyOf:
                    - type: string
                    - type: number
            required:
              - message
            additionalProperties: {}
        capability:
          type: string
      required:
        - error
        - details
    UnauthorizedError:
      type: object
      properties:
        error:
          type: string
          const: unauthorized
      required:
        - error
    ForbiddenError:
      type: object
      properties:
        error:
          type: string
          enum:
            - forbidden
            - reauth
        reason:
          type: string
        message:
          type: string
      required:
        - error
    ExternalMcpRequirementsDiscoveryFailedError:
      type: object
      properties:
        error:
          type: string
          const: requirements_discovery_failed
        message:
          type: string
      required:
        - error
        - message
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: session-token
      description: >-
        Session token passed as `Authorization: Bearer <session-token>` for
        user-authenticated Den routes.
    denApiKey:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Organization API key passed as the `x-api-key` header. The raw key is
        the header value; do not prefix it with `Bearer`.

````