--- schema_version: "1" id: 27548ee6591c640da14e929fae138ee3c05ffb2dcb570b56c0d22b558fd1127c title: API Catalog Connect REST API collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/api-catalog/api-catalog-connectapi/references/generated-api-specs/api-catalog-connectapi.md canonical_url: https://developer.salesforce.com/docs/platform/api-catalog-connectapi/references/api-catalog-connectapi source_site: developer.salesforce.com content_type: documentation content_hash: cb7d7ef850177bebd5c15f48c43c127b27c528ab54bfe323ade83762451f51d4 products: - API Catalog Connect REST API --- API Catalog Connect REST API # API Catalog Connect REST API Use the API Catalog Connect REST API to discover and browse APIs in your org, inspect API versions and operations, and register and manage external MCP servers. **Version:** 67.0 ## Servers * `/services/data/v67.0` ## Operations ### GET getApi `GET /api-catalog/sources/{sourceId}/apis/{apiId}` Operation ID: `getApi`. The resource for getting a specific API. Gets an API. #### Parameters * `apiId` (path, string, required) The ID of the API. * `sourceId` (path, string, required) The ID of the source of the API. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiOutputRepresentation`. ### POST fetchMcpServer `POST /api-catalog/mcp-servers/{id}/fetch` Operation ID: `fetchMcpServer`. Stateless read-through to the external MCP server. Contacts the remote server, fetches its current asset manifest, and returns a merged view of remote assets and locally stored overrides. Does NOT persist anything. Fetch current metadata from the MCP server (stateless). Returns the merged list of remote-advertised assets and locally-stored assets so the caller can decide what to allowlist via PUT /assets. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerFetchOutputRepresentation`. ### GET listMcpServers `GET /api-catalog/mcp-servers` Operation ID: `listMcpServers`. Collection resource for MCP servers. EXTERNAL servers are registered against an external MCP endpoint URL. Lists registered MCP servers. #### Parameters * `label` (query, string) Filter by label (case-insensitive partial match). * `status` (query, string) Filter by connection status. One of `ACTIVE`, `DISCONNECTED`. * `type` (query, string) Filter by server type. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerCollectionRepresentation`. ### POST createMcpServer `POST /api-catalog/mcp-servers` Operation ID: `createMcpServer`. Collection resource for MCP servers. EXTERNAL servers are registered against an external MCP endpoint URL. Registers a new EXTERNAL MCP server. The connection is established and an initial fetch of remote assets is performed; the response includes the discovered assets so the caller can immediately allowlist them via PUT /assets. `type` must be set to `EXTERNAL` in the request body. #### Request body Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.input.McpServerCreateInputRepresentation`. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerCreateOutputRepresentation`. ### GET getMcpServer `GET /api-catalog/mcp-servers/{id}` Operation ID: `getMcpServer`. Single MCP server resource. Gets MCP server metadata. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation`. ### PUT updateMcpServer `PUT /api-catalog/mcp-servers/{id}` Operation ID: `updateMcpServer`. Single MCP server resource. Updates MCP server metadata and/or credentials. Top-level scalars use PATCH semantics; the `authorization` block uses REPLACE semantics. `name` and `type` are immutable. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Request body Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.input.McpServerUpdateInputRepresentation`. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation`. ### DELETE deleteMcpServer `DELETE /api-catalog/mcp-servers/{id}` Operation ID: `deleteMcpServer`. Single MCP server resource. Hard-deletes an MCP server. Cascades to all allowlisted assets and the connection record. Irreversible. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Responses * **200** Success ### GET listMcpServerAssets `GET /api-catalog/mcp-servers/{id}/assets` Operation ID: `listMcpServerAssets`. Allowlisted assets for an MCP server. PUT replaces the full allowlist; GET reads the current allowlist. Lists allowlisted assets on the MCP server. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerAssetCollectionRepresentation`. ### PUT replaceMcpServerAssets `PUT /api-catalog/mcp-servers/{id}/assets` Operation ID: `replaceMcpServerAssets`. Allowlisted assets for an MCP server. PUT replaces the full allowlist; GET reads the current allowlist. Replaces the full set of assets for the server. Assets in the body are stored; previously stored assets omitted from the body are removed from the allowlist. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Request body Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.input.McpServerAssetReplaceInputRepresentation`. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerAssetCollectionRepresentation`. ### GET getApiVersions `GET /api-catalog/sources/{sourceId}/apis/{apiId}/versions` Operation ID: `getApiVersions`. The resource for getting API versions. Gets all the API versions. #### Parameters * `apiId` (path, string, required) The ID of the API. * `sourceId` (path, string, required) The ID of the source of the API. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiVersionCollectionRepresentation`. ### GET getSources `GET /api-catalog/sources` Operation ID: `getSources`. The resource for getting API sources. Gets all the API sources. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiSourceCollectionRepresentation`. ### GET getApis `GET /api-catalog/apis` Operation ID: `getApis`. The resource for getting APIs. Gets all the APIs. #### Parameters * `schemaType` (query, string) The schema type of the APIs to be retrieved. Supported values are REST and MCP. * `source` (query, string) The source of the APIs to be retrieved. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiCollectionRepresentation`. ### GET getApiVersion `GET /api-catalog/sources/{sourceId}/apis/{apiId}/versions/{apiVersionId}` Operation ID: `getApiVersion`. The resource for getting a specific API version. Gets an API version. #### Parameters * `apiId` (path, string, required) The ID of the API. * `apiVersionId` (path, string, required) The ID of the API version. * `sourceId` (path, string, required) The ID of the source of the API. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiVersionOutputRepresentation`. ### GET getApiVersionOperations `GET /api-catalog/sources/{sourceId}/apis/{apiId}/versions/{apiVersionId}/operations` Operation ID: `getApiVersionOperations`. The resource for getting a API version operations. Gets all API version operations. #### Parameters * `apiId` (path, string, required) The ID of the API. * `apiVersionId` (path, string, required) The ID of the API version. * `sourceId` (path, string, required) The ID of the source of the API. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiVersionOperationCollectionRepresentation`. ## Schemas ### sfdc.apicatalog.connect.api.output.ApiOutputRepresentation Represents an API. * `description` (_string_) The description of the API. * `id` (_string_, required) The ID of the API. * `label` (_string_, required) The name of the API. * `properties` (_object_) Additional source-specific properties. For MCP server sources (PLATFORM\_CUSTOM\_MCP\_SERVER, PLATFORM\_STANDARD\_MCP\_SERVER): * serverUrl: The MCP server endpoint URL * isActive: Whether the MCP server is currently active (boolean) For other sources: empty object Additional properties: `object`. * `providerType` (_string_, required) The provider type of the API. ### sfdc.apicatalog.connect.api.output.McpServerFetchOutputRepresentation Read-only merged view returned by POST /fetch. No changes are persisted. * `assets` (_array of sfdc.apicatalog.connect.api.output.McpFetchedAssetRepresentation_, required) Merged list of remote assets and locally stored overrides. ### sfdc.apicatalog.connect.api.output.McpServerCollectionRepresentation A collection of MCP servers. * `mcpServers` (_array of sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation_) MCP server list. ### sfdc.apicatalog.connect.api.input.McpServerCreateInputRepresentation Payload to register a new MCP server. `type` is required and MUST be `EXTERNAL`. `serverUrl` is required and an initial fetch is performed against it. * `authorization` (_sfdc.apicatalog.connect.api.input.McpServerAuthorizationInputRepresentation_) * `description` (_string_) Description of the MCP server. * `label` (_string_) Human-readable label. * `name` (_string_, required) Developer name (unique within the org). Immutable after create. * `serverUrl` (_string_, required) The remote MCP endpoint URL. * `type` (_string_, required) Server type. Required. Must be `EXTERNAL`. ### sfdc.apicatalog.connect.api.output.McpServerCreateOutputRepresentation Response to MCP server registration. Contains the created server and the assets discovered from the remote MCP endpoint during the auto-fetch. * `assets` (_array of sfdc.apicatalog.connect.api.output.McpFetchedAssetRepresentation_, required) Assets discovered during auto-fetch. * `server` (_sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation_, required) ### sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation Represents an MCP server. * `authorization` (_sfdc.apicatalog.connect.api.output.McpServerAuthorizationOutputRepresentation_) * `createdById` (_string_) ID of the creating user. * `createdDate` (_string_) Server creation timestamp (ISO-8601). * `description` (_string_) Description of the MCP server. * `id` (_string_, required) External ID of the MCP server. * `label` (_string_) Human-readable label. * `lastModifiedById` (_string_) ID of the last-modifying user. * `lastModifiedDate` (_string_) Last modification timestamp (ISO-8601). * `name` (_string_, required) Developer name (unique within the org). * `serverUrl` (_string_) The remote MCP endpoint URL. * `status` (_string_, required) Connection status. `ACTIVE` when an external credential is configured for the server; `DISCONNECTED` otherwise. * `type` (_string_, required) Server type. ### sfdc.apicatalog.connect.api.input.McpServerUpdateInputRepresentation Payload to update MCP server metadata or the authorization block. `name` and `type` are immutable. Top-level scalars use PATCH semantics; the `authorization` block uses REPLACE semantics. * `authorization` (_sfdc.apicatalog.connect.api.input.McpServerAuthorizationInputRepresentation_) * `description` (_string_) Description of the MCP server. * `label` (_string_) Human-readable label. * `serverUrl` (_string_) The remote MCP endpoint URL. ### sfdc.apicatalog.connect.api.output.McpServerAssetCollectionRepresentation A collection of allowlisted MCP server assets. * `assets` (_array of sfdc.apicatalog.connect.api.output.McpServerAssetOutputRepresentation_) Allowlisted asset list. ### sfdc.apicatalog.connect.api.input.McpServerAssetReplaceInputRepresentation Full-replacement allowlist input. Listed assets are stored; previously stored assets omitted from the body are removed from the allowlist. Round-trip-compatible with McpServerFetchOutputRepresentation: callers can pass through the assets\[\] from a prior /fetch response unchanged. * `assets` (_array of sfdc.apicatalog.connect.api.input.McpServerAssetReplaceItemRepresentation_, required) Desired asset allowlist. ### sfdc.apicatalog.connect.api.output.ApiVersionCollectionRepresentation Represents a collection of API versions. * `apiVersions` (_array of sfdc.apicatalog.connect.api.output.ApiVersionOutputRepresentation_) API version list. ### sfdc.apicatalog.connect.api.output.ApiSourceCollectionRepresentation Represents a collection of API sources. * `sources` (_array of string_) Sources list. ### sfdc.apicatalog.connect.api.output.ApiCollectionRepresentation Represents a collection of APIs. * `apis` (_array of sfdc.apicatalog.connect.api.output.ApiOutputRepresentation_) API list. ### sfdc.apicatalog.connect.api.output.ApiVersionOutputRepresentation Represents an API version. * `description` (_string_) The description of the API version. * `developerName` (_string_) The developer name of the API version. * `externalSourceIdentifier` (_string_, required) The external source ID of the API version. * `id` (_string_, required) The ID of the API version. * `label` (_string_, required) The label of the API version. * `providerType` (_string_, required) The provider type of the API version. * `version` (_string_, required) The version of the API version. ### sfdc.apicatalog.connect.api.output.ApiVersionOperationCollectionRepresentation Represents a collection of API version operations. * `apiVersionOperations` (_array of sfdc.apicatalog.connect.api.output.ApiVersionOperationOutputRepresentation_) API version operation list. ### sfdc.apicatalog.connect.api.output.McpFetchedAssetRepresentation An asset returned by the registration auto-fetch or POST /fetch. * `active` (_boolean_) Whether the asset is currently active. * `availableAsAgentAction` (_boolean_) True when this asset is exposed as an Agent Action (a `GenAiAction` record exists for the underlying tool). Once true, the asset cannot be deactivated via PUT /assets. To remove it from the allowlist, first delete the associated Agent Action; then PUT /assets without this asset will succeed. Alternatively, deleting the parent server with DELETE /mcp-servers/{id} removes the asset along with the server. * `description` (_string_) Asset description. * `id` (_string_) Identifier of the asset. * `kind` (_string_, required) Asset kind. One of MCP\_TOOL, MCP\_PROMPT, MCP\_RESOURCE. * `label` (_string_) Human-readable label. * `name` (_string_, required) Asset name. * `status` (_string_) Drift status of this asset relative to the remote MCP server's current manifest, from this org's point of view: * `IN_SYNC` – registered in this org and matches the remote definition. * `OUT_OF_SYNC` – registered in this org but the remote definition has changed; in this case `description` reflects the remote's newer value (the server view). * `NOT_REGISTERED` – advertised by the remote, not yet registered in this org. * `ORPHANED` – registered in this org but no longer advertised by the remote. ### sfdc.apicatalog.connect.api.input.McpServerAuthorizationInputRepresentation Authorization payload for an EXTERNAL MCP server. Discriminated by authType. Required fields by authType: OAUTH: identityProvider, clientId, clientSecret, scope NO\_AUTH: authType only. * `authType` (_string_, required) One of OAUTH, NO\_AUTH. * `clientId` (_string_) OAUTH only. OAuth client ID. * `clientSecret` (_string_) OAUTH only. Write-only. * `identityProvider` (_string_) OAUTH only. Identity provider URL: the OAuth 2.0 token endpoint that mints client credentials access tokens used to authenticate to the remote MCP server. * `scope` (_string_) OAUTH only. Space-delimited OAuth scopes. ### sfdc.apicatalog.connect.api.output.McpServerAuthorizationOutputRepresentation Authorization metadata for an EXTERNAL MCP server. Only the authType discriminator and OAUTH non-sensitive fields (identityProvider, scope) are returned on read; the sensitive clientId and clientSecret are stripped. * `authType` (_string_, required) One of OAUTH, NO\_AUTH. * `identityProvider` (_string_) OAUTH only. Identity provider URL (the OAuth 2.0 token endpoint). * `scope` (_string_) OAUTH only. Space-delimited OAuth scopes. ### sfdc.apicatalog.connect.api.output.McpServerAssetOutputRepresentation An allowlisted asset stored for an MCP server. * `active` (_boolean_, required) Whether the asset is currently active and exposed. * `availableAsAgentAction` (_boolean_) True when this asset is exposed as an Agent Action (a `GenAiAction` record exists for the underlying tool). Once true, the asset cannot be deactivated via PUT /assets. To remove it from the allowlist, first delete the associated Agent Action; then PUT /assets without this asset will succeed. Alternatively, deleting the parent server with DELETE /mcp-servers/{id} removes the asset along with the server. * `description` (_string_) Asset description. * `id` (_string_, required) Server-assigned record ID. * `kind` (_string_, required) Asset kind. One of MCP\_TOOL, MCP\_PROMPT, MCP\_RESOURCE. * `label` (_string_) Human-readable label. * `name` (_string_, required) Asset name. Unique within the server. ### sfdc.apicatalog.connect.api.input.McpServerAssetReplaceItemRepresentation One item in an allowlist replacement request. Round-trip-compatible with McpFetchedAssetRepresentation and McpServerAssetOutputRepresentation: callers may take an asset from POST /{id}/fetch (or the assets\[\] returned at create time) and submit it directly here. The output-only `kind` field is accepted as a convenience for round-tripping and ignored on input. At least one of `id` or `name` MUST be supplied; for EXTERNAL servers the asset is resolved by name when `id` is absent. * `active` (_boolean_) Whether the asset should be active. Defaults to true when omitted. * `description` (_string_) Optional description override. * `id` (_string_) Identifier of the asset (taken from /fetch or the create-time assets\[\]). Optional; when omitted or null, `name` is used to resolve the asset. * `kind` (_string_) Output-only on the GET shapes; accepted and ignored on input. * `label` (_string_) Optional label override. * `name` (_string_) Asset name. Required when `id` is absent. For EXTERNAL servers this is the only stable identifier before allowlisting, since the local record id is assigned on first allowlist. ### sfdc.apicatalog.connect.api.output.ApiVersionOperationOutputRepresentation Represents an API version operation. * `description` (_string_) The operation method. * `id` (_string_) The ID of the operation. * `isActive` (_boolean_, required) Flag indicating whether the operation is an invocable action. * `method` (_string_, required) The operation method. * `name` (_string_, required) The name of the operation. * `resource` (_string_, required) The path of the operation.