A valid request URL is required to generate request examples{
"status": "success",
"message": "Operation completed successfully"
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"provider": "anthropic",
"model_requested": "<string>",
"request_type": "<string>",
"error_type": "<string>"
}
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"provider": "anthropic",
"model_requested": "<string>",
"request_type": "<string>",
"error_type": "<string>"
}
}Edit MCP client
Updates an existing MCP client’s configuration. All fields are optional (PATCH semantics); connection_type, auth_type, connection_string, stdio_config, and oauth_config_id are immutable after creation. Unlike client creation, tool_pricing can be included to set per-tool execution costs since tools are already fetched. For OAuth-based clients, providing oauth_config rotates the stored OAuth configuration in place and flips every bound token to needs_reauth when a field actually changes (see MCPClientUpdateRequest.oauth_config). Optionally provide vk_configs to manage which virtual keys have access to this MCP server and with which tools. When provided, this fully replaces all existing VK assignments in a single atomic transaction. Set disabled: true to shut down the client’s connection and workers without removing it. Set disabled: false to reconnect a previously disabled client.
A valid request URL is required to generate request examples{
"status": "success",
"message": "Operation completed successfully"
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"provider": "anthropic",
"model_requested": "<string>",
"request_type": "<string>",
"error_type": "<string>"
}
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"provider": "anthropic",
"model_requested": "<string>",
"request_type": "<string>",
"error_type": "<string>"
}
}| Permission | Granted via |
|---|---|
MCPGateway:Update | RBAC role or API key scope |
Authorizations
Management API authentication for /api/* endpoints. Use the Authorization header
with Bearer <token>, where <token> is one of:
- a Bifrost management API key,
- a dashboard session token issued by
POST /api/session/login, - base64 of
<admin-username>:<admin-password>(legacy equivalent ofBasicAuth).
Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs -
the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.
Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a
Required Permissions table (Resource:Operation, for example Dashboard:View) above
its Authorizations section, and the caller's RBAC role or management API key scopes must
include what it lists, otherwise the request is rejected with 403 Forbidden.
A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint. See Required permissions for how permissions are derived and which endpoints are exempt.
Path Parameters
MCP client ID
Body
MCP client configuration for updating an existing client (includes tool_pricing). All fields are optional; omitting a field retains its existing value (PATCH semantics). Immutable fields (connection_type, auth_type, connection_string, stdio_config, oauth_config_id) are not accepted here; they cannot be changed after creation.
Display name for the MCP client
Whether this client is available in code mode
Whether the MCP server supports ping for health checks. If true, uses lightweight ping method for health checks. If false, uses listTools method for health checks instead.
HTTP-only. Only meaningful for auth_type "oauth", "headers", or "none" — per-user auth types are always per-call regardless of this field. When true, Bifrost holds one persistent upstream connection, reused for every tool call. When false, a fresh connection is dialed per tool call. Cannot be set to false for connection_type "sse" or "stdio" — both are always sticky.
Per-client tool-list sync interval in minutes. 0 falls back to the global mcp_tool_sync_interval client config.
x >= 0Per-client tool execution timeout in seconds. 0 falls back to the global mcp_tool_execution_timeout client config.
x >= 0Custom headers to include in requests. Only used when auth_type is "headers". Supports env./vault. references. Values echoed back redacted from a GET response are recognized and preserve the stored value, so a fetch-modify-put round trip is safe.
Show child attributes
Show child attributes
Allowlist of request-level headers callers may forward to this MCP server at execution time. ["*"] => any header may be forwarded [] => no extra headers are forwarded ["header1", "header2"] => only the specified headers
Rotates the stored OAuth configuration in place. Only accepted for auth_type "oauth" or "per_user_oauth" (400 otherwise). Any provided field replaces the stored value; no new config row is created and no re-discovery or re-registration runs. Unset fields preserve stored values: client_id/client_secret follow the SecretVar masked-placeholder convention (send back the redacted placeholder from a GET response to keep the stored secret), while empty strings / empty arrays on the remaining fields mean "not provided".
When any field actually changes, every token bound to the OAuth config is flipped to needs_reauth regardless of auth mode, shared and per-user sessions alike must re-authenticate. A round trip that resolves to the stored values is a no-op and does not cascade. Rotation cannot run while the client is (or is being) disabled (400); send those as two separate requests.
Show child attributes
Show child attributes
Include-only list for tools. ["*"] => all tools are included [] => no tools are included ["tool1", "tool2"] => include only the specified tools
List of tools that can be auto-executed without user approval. Must be a subset of tools_to_execute. ["*"] => all executable tools can be auto-executed [] => no tools are auto-executed ["tool1", "tool2"] => only specified tools can be auto-executed
Per-tool cost in USD for execution. Key is the tool name, value is the cost per execution. Example: {"read_file": 0.001, "write_file": 0.002} Note: Only available when updating an existing client after tools have been fetched.
Show child attributes
Show child attributes
When true, this MCP client's tools are accessible to all virtual keys without requiring explicit per-key assignment. All tools are allowed by default. If a virtual key has an explicit MCP config for this client, that config takes precedence and overrides this behaviour.
For per_user_headers clients only. Cannot be set to an empty list.
Updating this list flips every existing active per-user credential row
to needs_update; callers will be sent back to the submission form on
their next tool call to satisfy the new schema. The retained admin
discovery credential is flipped the same way; repair it by calling
POST /api/mcp/client/{id}/verify-headers with fresh sample values.
For token_exchange clients only. Omitted preserves the stored
configuration. A redacted client_id / client_secret round-tripped
from a prior GET is resolved back to the stored value rather than
overwriting it; any other change re-scopes future exchanges and
invalidates cached exchanged tokens for this client.
Show child attributes
Show child attributes
When true, the client's connection, health monitor, and tool syncer are shut down. The client entry is preserved so it can be re-enabled later by sending disabled: false. Disabled clients do not expose tools to inference requests.
TLS configuration for HTTP and SSE connections. Not applicable to stdio or inprocess connection types.
Show child attributes
Show child attributes
When provided, replaces all virtual key assignments for this MCP client. Each entry specifies a virtual key and the tools it is allowed to call. To remove all VK access, provide an empty array []. Omit this field to leave existing VK assignments unchanged.
Show child attributes
Show child attributes
Was this page helpful?