# developer API Catalog Connect REST API (api-catalog) - Full Documentation API Catalog Connect REST API # API Catalog Connect REST API Use the API Catalog Connect REST API to discover and browse APIs in your org, inspect API versions and operations, and register and manage external MCP servers. **Version:** 67.0 ## Servers * `/services/data/v67.0` ## Operations ### GET getApi `GET /api-catalog/sources/{sourceId}/apis/{apiId}` Operation ID: `getApi`. The resource for getting a specific API. Gets an API. #### Parameters * `apiId` (path, string, required) The ID of the API. * `sourceId` (path, string, required) The ID of the source of the API. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiOutputRepresentation`. ### POST fetchMcpServer `POST /api-catalog/mcp-servers/{id}/fetch` Operation ID: `fetchMcpServer`. Stateless read-through to the external MCP server. Contacts the remote server, fetches its current asset manifest, and returns a merged view of remote assets and locally stored overrides. Does NOT persist anything. Fetch current metadata from the MCP server (stateless). Returns the merged list of remote-advertised assets and locally-stored assets so the caller can decide what to allowlist via PUT /assets. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerFetchOutputRepresentation`. ### GET listMcpServers `GET /api-catalog/mcp-servers` Operation ID: `listMcpServers`. Collection resource for MCP servers. EXTERNAL servers are registered against an external MCP endpoint URL. Lists registered MCP servers. #### Parameters * `label` (query, string) Filter by label (case-insensitive partial match). * `status` (query, string) Filter by connection status. One of `ACTIVE`, `DISCONNECTED`. * `type` (query, string) Filter by server type. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerCollectionRepresentation`. ### POST createMcpServer `POST /api-catalog/mcp-servers` Operation ID: `createMcpServer`. Collection resource for MCP servers. EXTERNAL servers are registered against an external MCP endpoint URL. Registers a new EXTERNAL MCP server. The connection is established and an initial fetch of remote assets is performed; the response includes the discovered assets so the caller can immediately allowlist them via PUT /assets. `type` must be set to `EXTERNAL` in the request body. #### Request body Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.input.McpServerCreateInputRepresentation`. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerCreateOutputRepresentation`. ### GET getMcpServer `GET /api-catalog/mcp-servers/{id}` Operation ID: `getMcpServer`. Single MCP server resource. Gets MCP server metadata. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation`. ### PUT updateMcpServer `PUT /api-catalog/mcp-servers/{id}` Operation ID: `updateMcpServer`. Single MCP server resource. Updates MCP server metadata and/or credentials. Top-level scalars use PATCH semantics; the `authorization` block uses REPLACE semantics. `name` and `type` are immutable. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Request body Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.input.McpServerUpdateInputRepresentation`. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation`. ### DELETE deleteMcpServer `DELETE /api-catalog/mcp-servers/{id}` Operation ID: `deleteMcpServer`. Single MCP server resource. Hard-deletes an MCP server. Cascades to all allowlisted assets and the connection record. Irreversible. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Responses * **200** Success ### GET listMcpServerAssets `GET /api-catalog/mcp-servers/{id}/assets` Operation ID: `listMcpServerAssets`. Allowlisted assets for an MCP server. PUT replaces the full allowlist; GET reads the current allowlist. Lists allowlisted assets on the MCP server. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerAssetCollectionRepresentation`. ### PUT replaceMcpServerAssets `PUT /api-catalog/mcp-servers/{id}/assets` Operation ID: `replaceMcpServerAssets`. Allowlisted assets for an MCP server. PUT replaces the full allowlist; GET reads the current allowlist. Replaces the full set of assets for the server. Assets in the body are stored; previously stored assets omitted from the body are removed from the allowlist. #### Parameters * `id` (path, string, required) The MCP server identifier. #### Request body Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.input.McpServerAssetReplaceInputRepresentation`. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.McpServerAssetCollectionRepresentation`. ### GET getApiVersions `GET /api-catalog/sources/{sourceId}/apis/{apiId}/versions` Operation ID: `getApiVersions`. The resource for getting API versions. Gets all the API versions. #### Parameters * `apiId` (path, string, required) The ID of the API. * `sourceId` (path, string, required) The ID of the source of the API. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiVersionCollectionRepresentation`. ### GET getSources `GET /api-catalog/sources` Operation ID: `getSources`. The resource for getting API sources. Gets all the API sources. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiSourceCollectionRepresentation`. ### GET getApis `GET /api-catalog/apis` Operation ID: `getApis`. The resource for getting APIs. Gets all the APIs. #### Parameters * `schemaType` (query, string) The schema type of the APIs to be retrieved. Supported values are REST and MCP. * `source` (query, string) The source of the APIs to be retrieved. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiCollectionRepresentation`. ### GET getApiVersion `GET /api-catalog/sources/{sourceId}/apis/{apiId}/versions/{apiVersionId}` Operation ID: `getApiVersion`. The resource for getting a specific API version. Gets an API version. #### Parameters * `apiId` (path, string, required) The ID of the API. * `apiVersionId` (path, string, required) The ID of the API version. * `sourceId` (path, string, required) The ID of the source of the API. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiVersionOutputRepresentation`. ### GET getApiVersionOperations `GET /api-catalog/sources/{sourceId}/apis/{apiId}/versions/{apiVersionId}/operations` Operation ID: `getApiVersionOperations`. The resource for getting a API version operations. Gets all API version operations. #### Parameters * `apiId` (path, string, required) The ID of the API. * `apiVersionId` (path, string, required) The ID of the API version. * `sourceId` (path, string, required) The ID of the source of the API. #### Responses * **200** Success Media type: `application/json`. Schema: `sfdc.apicatalog.connect.api.output.ApiVersionOperationCollectionRepresentation`. ## Schemas ### sfdc.apicatalog.connect.api.output.ApiOutputRepresentation Represents an API. * `description` (_string_) The description of the API. * `id` (_string_, required) The ID of the API. * `label` (_string_, required) The name of the API. * `properties` (_object_) Additional source-specific properties. For MCP server sources (PLATFORM\_CUSTOM\_MCP\_SERVER, PLATFORM\_STANDARD\_MCP\_SERVER): * serverUrl: The MCP server endpoint URL * isActive: Whether the MCP server is currently active (boolean) For other sources: empty object Additional properties: `object`. * `providerType` (_string_, required) The provider type of the API. ### sfdc.apicatalog.connect.api.output.McpServerFetchOutputRepresentation Read-only merged view returned by POST /fetch. No changes are persisted. * `assets` (_array of sfdc.apicatalog.connect.api.output.McpFetchedAssetRepresentation_, required) Merged list of remote assets and locally stored overrides. ### sfdc.apicatalog.connect.api.output.McpServerCollectionRepresentation A collection of MCP servers. * `mcpServers` (_array of sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation_) MCP server list. ### sfdc.apicatalog.connect.api.input.McpServerCreateInputRepresentation Payload to register a new MCP server. `type` is required and MUST be `EXTERNAL`. `serverUrl` is required and an initial fetch is performed against it. * `authorization` (_sfdc.apicatalog.connect.api.input.McpServerAuthorizationInputRepresentation_) * `description` (_string_) Description of the MCP server. * `label` (_string_) Human-readable label. * `name` (_string_, required) Developer name (unique within the org). Immutable after create. * `serverUrl` (_string_, required) The remote MCP endpoint URL. * `type` (_string_, required) Server type. Required. Must be `EXTERNAL`. ### sfdc.apicatalog.connect.api.output.McpServerCreateOutputRepresentation Response to MCP server registration. Contains the created server and the assets discovered from the remote MCP endpoint during the auto-fetch. * `assets` (_array of sfdc.apicatalog.connect.api.output.McpFetchedAssetRepresentation_, required) Assets discovered during auto-fetch. * `server` (_sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation_, required) ### sfdc.apicatalog.connect.api.output.McpServerOutputRepresentation Represents an MCP server. * `authorization` (_sfdc.apicatalog.connect.api.output.McpServerAuthorizationOutputRepresentation_) * `createdById` (_string_) ID of the creating user. * `createdDate` (_string_) Server creation timestamp (ISO-8601). * `description` (_string_) Description of the MCP server. * `id` (_string_, required) External ID of the MCP server. * `label` (_string_) Human-readable label. * `lastModifiedById` (_string_) ID of the last-modifying user. * `lastModifiedDate` (_string_) Last modification timestamp (ISO-8601). * `name` (_string_, required) Developer name (unique within the org). * `serverUrl` (_string_) The remote MCP endpoint URL. * `status` (_string_, required) Connection status. `ACTIVE` when an external credential is configured for the server; `DISCONNECTED` otherwise. * `type` (_string_, required) Server type. ### sfdc.apicatalog.connect.api.input.McpServerUpdateInputRepresentation Payload to update MCP server metadata or the authorization block. `name` and `type` are immutable. Top-level scalars use PATCH semantics; the `authorization` block uses REPLACE semantics. * `authorization` (_sfdc.apicatalog.connect.api.input.McpServerAuthorizationInputRepresentation_) * `description` (_string_) Description of the MCP server. * `label` (_string_) Human-readable label. * `serverUrl` (_string_) The remote MCP endpoint URL. ### sfdc.apicatalog.connect.api.output.McpServerAssetCollectionRepresentation A collection of allowlisted MCP server assets. * `assets` (_array of sfdc.apicatalog.connect.api.output.McpServerAssetOutputRepresentation_) Allowlisted asset list. ### sfdc.apicatalog.connect.api.input.McpServerAssetReplaceInputRepresentation Full-replacement allowlist input. Listed assets are stored; previously stored assets omitted from the body are removed from the allowlist. Round-trip-compatible with McpServerFetchOutputRepresentation: callers can pass through the assets\[\] from a prior /fetch response unchanged. * `assets` (_array of sfdc.apicatalog.connect.api.input.McpServerAssetReplaceItemRepresentation_, required) Desired asset allowlist. ### sfdc.apicatalog.connect.api.output.ApiVersionCollectionRepresentation Represents a collection of API versions. * `apiVersions` (_array of sfdc.apicatalog.connect.api.output.ApiVersionOutputRepresentation_) API version list. ### sfdc.apicatalog.connect.api.output.ApiSourceCollectionRepresentation Represents a collection of API sources. * `sources` (_array of string_) Sources list. ### sfdc.apicatalog.connect.api.output.ApiCollectionRepresentation Represents a collection of APIs. * `apis` (_array of sfdc.apicatalog.connect.api.output.ApiOutputRepresentation_) API list. ### sfdc.apicatalog.connect.api.output.ApiVersionOutputRepresentation Represents an API version. * `description` (_string_) The description of the API version. * `developerName` (_string_) The developer name of the API version. * `externalSourceIdentifier` (_string_, required) The external source ID of the API version. * `id` (_string_, required) The ID of the API version. * `label` (_string_, required) The label of the API version. * `providerType` (_string_, required) The provider type of the API version. * `version` (_string_, required) The version of the API version. ### sfdc.apicatalog.connect.api.output.ApiVersionOperationCollectionRepresentation Represents a collection of API version operations. * `apiVersionOperations` (_array of sfdc.apicatalog.connect.api.output.ApiVersionOperationOutputRepresentation_) API version operation list. ### sfdc.apicatalog.connect.api.output.McpFetchedAssetRepresentation An asset returned by the registration auto-fetch or POST /fetch. * `active` (_boolean_) Whether the asset is currently active. * `availableAsAgentAction` (_boolean_) True when this asset is exposed as an Agent Action (a `GenAiAction` record exists for the underlying tool). Once true, the asset cannot be deactivated via PUT /assets. To remove it from the allowlist, first delete the associated Agent Action; then PUT /assets without this asset will succeed. Alternatively, deleting the parent server with DELETE /mcp-servers/{id} removes the asset along with the server. * `description` (_string_) Asset description. * `id` (_string_) Identifier of the asset. * `kind` (_string_, required) Asset kind. One of MCP\_TOOL, MCP\_PROMPT, MCP\_RESOURCE. * `label` (_string_) Human-readable label. * `name` (_string_, required) Asset name. * `status` (_string_) Drift status of this asset relative to the remote MCP server's current manifest, from this org's point of view: * `IN_SYNC` – registered in this org and matches the remote definition. * `OUT_OF_SYNC` – registered in this org but the remote definition has changed; in this case `description` reflects the remote's newer value (the server view). * `NOT_REGISTERED` – advertised by the remote, not yet registered in this org. * `ORPHANED` – registered in this org but no longer advertised by the remote. ### sfdc.apicatalog.connect.api.input.McpServerAuthorizationInputRepresentation Authorization payload for an EXTERNAL MCP server. Discriminated by authType. Required fields by authType: OAUTH: identityProvider, clientId, clientSecret, scope NO\_AUTH: authType only. * `authType` (_string_, required) One of OAUTH, NO\_AUTH. * `clientId` (_string_) OAUTH only. OAuth client ID. * `clientSecret` (_string_) OAUTH only. Write-only. * `identityProvider` (_string_) OAUTH only. Identity provider URL: the OAuth 2.0 token endpoint that mints client credentials access tokens used to authenticate to the remote MCP server. * `scope` (_string_) OAUTH only. Space-delimited OAuth scopes. ### sfdc.apicatalog.connect.api.output.McpServerAuthorizationOutputRepresentation Authorization metadata for an EXTERNAL MCP server. Only the authType discriminator and OAUTH non-sensitive fields (identityProvider, scope) are returned on read; the sensitive clientId and clientSecret are stripped. * `authType` (_string_, required) One of OAUTH, NO\_AUTH. * `identityProvider` (_string_) OAUTH only. Identity provider URL (the OAuth 2.0 token endpoint). * `scope` (_string_) OAUTH only. Space-delimited OAuth scopes. ### sfdc.apicatalog.connect.api.output.McpServerAssetOutputRepresentation An allowlisted asset stored for an MCP server. * `active` (_boolean_, required) Whether the asset is currently active and exposed. * `availableAsAgentAction` (_boolean_) True when this asset is exposed as an Agent Action (a `GenAiAction` record exists for the underlying tool). Once true, the asset cannot be deactivated via PUT /assets. To remove it from the allowlist, first delete the associated Agent Action; then PUT /assets without this asset will succeed. Alternatively, deleting the parent server with DELETE /mcp-servers/{id} removes the asset along with the server. * `description` (_string_) Asset description. * `id` (_string_, required) Server-assigned record ID. * `kind` (_string_, required) Asset kind. One of MCP\_TOOL, MCP\_PROMPT, MCP\_RESOURCE. * `label` (_string_) Human-readable label. * `name` (_string_, required) Asset name. Unique within the server. ### sfdc.apicatalog.connect.api.input.McpServerAssetReplaceItemRepresentation One item in an allowlist replacement request. Round-trip-compatible with McpFetchedAssetRepresentation and McpServerAssetOutputRepresentation: callers may take an asset from POST /{id}/fetch (or the assets\[\] returned at create time) and submit it directly here. The output-only `kind` field is accepted as a convenience for round-tripping and ignored on input. At least one of `id` or `name` MUST be supplied; for EXTERNAL servers the asset is resolved by name when `id` is absent. * `active` (_boolean_) Whether the asset should be active. Defaults to true when omitted. * `description` (_string_) Optional description override. * `id` (_string_) Identifier of the asset (taken from /fetch or the create-time assets\[\]). Optional; when omitted or null, `name` is used to resolve the asset. * `kind` (_string_) Output-only on the GET shapes; accepted and ignored on input. * `label` (_string_) Optional label override. * `name` (_string_) Asset name. Required when `id` is absent. For EXTERNAL servers this is the only stable identifier before allowlisting, since the local record id is assigned on first allowlist. ### sfdc.apicatalog.connect.api.output.ApiVersionOperationOutputRepresentation Represents an API version operation. * `description` (_string_) The operation method. * `id` (_string_) The ID of the operation. * `isActive` (_boolean_, required) Flag indicating whether the operation is an invocable action. * `method` (_string_, required) The operation method. * `name` (_string_, required) The name of the operation. * `resource` (_string_, required) The path of the operation. # Example: Register and Manage an External MCP Server This example registers an Acme Payments MCP server in API Catalog, reviews its discovered tools, adds tools to the allowlist, refreshes the list when the remote server changes, and updates the server's credentials. Use these steps to automate external MCP server management through the API Catalog Connect REST API. For background on the UI workflow, see [Register External MCP Servers in API Catalog](https://help.salesforce.com/s/articleView?id=platform.api_catalog_manage_manual_external_mcp_servers.htm&type=5). ## 1. Register the MCP Server `POST /api-catalog/mcp-servers` Register the server by providing its name, URL, and credentials. Salesforce connects to the remote endpoint, performs an initial fetch of available tools and returns the discovered assets in the response so you can review them before adding any to the allowlist. Set `type` to `EXTERNAL`. For OAuth 2.0 authentication, include the `authorization` block with `authType`, `identityProvider`, `clientId`, `clientSecret`, and `scope`. For servers that require no authentication, set `authType` to `NO_AUTH` and omit the other authorization fields. Request body: ```json { "name": "AcmePaymentsMcp", "label": "Acme Payments MCP Server", "description": "Connects to Acme Payments MCP server for payment processing tools.", "serverUrl": "https://mcp.acmepayments.example.com/http", "type": "EXTERNAL", "authorization": { "authType": "OAUTH", "identityProvider": "https://auth.acmepayments.example.com/oauth2/token", "scope": "payments:write payments:refund", "clientId": "", "clientSecret": "" } } ``` Response: ```json { "server": { "id": "0MxB000000000001AAA", "name": "AcmePaymentsMcp", "label": "Acme Payments MCP Server", "description": "Connects to Acme Payments MCP server for payment processing tools.", "serverUrl": "https://mcp.acmepayments.example.com/http", "type": "EXTERNAL", "status": "ACTIVE", "authorization": { "authType": "OAUTH", "identityProvider": "https://auth.acmepayments.example.com/oauth2/token", "scope": "payments:write payments:refund" }, "createdById": "005000000000001AAA", "createdDate": "2026-08-03T12:00:00Z", "lastModifiedById": "005000000000001AAA", "lastModifiedDate": "2026-08-03T12:00:00Z" }, "assets": [ { "name": "create_order", "label": "Create Order", "description": "Creates an Acme Payments order for a payment transaction.", "kind": "MCP_TOOL", "status": "NOT_REGISTERED", "active": false, "availableAsAgentAction": false }, { "name": "capture_payment", "label": "Capture Payment", "description": "Captures an authorized payment for an order.", "kind": "MCP_TOOL", "status": "NOT_REGISTERED", "active": false, "availableAsAgentAction": false }, { "name": "refund_payment", "label": "Refund Payment", "description": "Issues a full or partial refund for a captured payment.", "kind": "MCP_TOOL", "status": "NOT_REGISTERED", "active": false, "availableAsAgentAction": false, "securityWarning": "Tool description contains characters that may indicate a tool poisoning risk. Review before adding to the allowlist." } ] } ``` Grab the `id` value from `server.id` in the response. Use it in all subsequent requests. ## 2. Review Discovered Tools This step requires no new request. Review the `assets` array in the Step 1 response. Each asset has a `status` of `NOT_REGISTERED`, meaning Salesforce found the tool on the remote server but hasn't yet added it to the allowlist. When an asset includes a `securityWarning` field, review the tool description carefully before proceeding. The warning indicates that the description contains characters that can signal a tool poisoning risk—for example, invisible characters or mixed scripts that manipulate an Agentforce agent into unexpected behavior. This corresponds to the Risk Assessment panel shown during registration in the UI. In this example, `refund_payment` includes a security warning. Review the tool description and confirm that you accept the risk before adding it to the allowlist in the next step. ## 3. Add Tools to the Allowlist `PUT /api-catalog/mcp-servers/0MxB000000000001AAA/assets` Submit the tools you want to add, with `active` set to `true`. This endpoint uses replace semantics: The assets you include become the full allowlist. Assets currently on the allowlist that are omitted from the request body are removed. Because assets discovered at registration time haven't been assigned local record IDs yet, identify them by `name`. In this example, all three tools are added to the allowlist. Request body: ```json { "assets": [ { "name": "create_order", "active": true }, { "name": "capture_payment", "active": true }, { "name": "refund_payment", "active": true } ] } ``` Response: ```json { "assets": [ { "id": "0TlB000000000001AAA", "name": "create_order", "label": "Create Order", "description": "Creates an Acme Payments order for a payment transaction.", "kind": "MCP_TOOL", "active": true, "availableAsAgentAction": false }, { "id": "0TlB000000000002AAA", "name": "capture_payment", "label": "Capture Payment", "description": "Captures an authorized payment for an order.", "kind": "MCP_TOOL", "active": true, "availableAsAgentAction": false }, { "id": "0TlB000000000003AAA", "name": "refund_payment", "label": "Refund Payment", "description": "Issues a full or partial refund for a captured payment.", "kind": "MCP_TOOL", "active": true, "availableAsAgentAction": false } ] } ``` ## 4. View the Allowlisted Tools `GET /api-catalog/mcp-servers/0MxB000000000001AAA/assets` Retrieve the current allowlist for the server. Response: ```json { "assets": [ { "id": "0TlB000000000001AAA", "name": "create_order", "label": "Create Order", "description": "Creates an Acme Payments order for a payment transaction.", "kind": "MCP_TOOL", "active": true, "availableAsAgentAction": false }, { "id": "0TlB000000000002AAA", "name": "capture_payment", "label": "Capture Payment", "description": "Captures an authorized payment for an order.", "kind": "MCP_TOOL", "active": true, "availableAsAgentAction": false }, { "id": "0TlB000000000003AAA", "name": "refund_payment", "label": "Refund Payment", "description": "Issues a full or partial refund for a captured payment.", "kind": "MCP_TOOL", "active": true, "availableAsAgentAction": false } ] } ``` ## 5. Fetch Current Tools from the Server `POST /api-catalog/mcp-servers/0MxB000000000001AAA/fetch` Contact the remote MCP server to retrieve its latest asset manifest. This request is stateless: It returns a merged view of remote assets and locally stored overrides but doesn't change the allowlist. Use the response to identify drift before deciding which tools to add or remove. The `status` field on each asset describes its sync state: - `IN_SYNC` — on the allowlist and matches the remote server's current definition. - `OUT_OF_SYNC` — on the allowlist, but the remote server's definition has changed. The `description` field reflects the newer remote value. - `NOT_REGISTERED` — the remote server advertises this asset, but it hasn't been added to the allowlist yet. - `ORPHANED` — on the allowlist, but the remote server no longer advertises it. Response: ```json { "assets": [ { "name": "create_order", "label": "Create Order", "description": "Creates an Acme Payments order for a payment transaction.", "kind": "MCP_TOOL", "status": "IN_SYNC", "active": true, "availableAsAgentAction": false }, { "name": "capture_payment", "label": "Capture Payment", "description": "Captures an authorized payment for an order.", "kind": "MCP_TOOL", "status": "IN_SYNC", "active": true, "availableAsAgentAction": false }, { "name": "refund_payment", "label": "Refund Payment", "description": "Issues a full or partial refund. Accepts partial amounts.", "kind": "MCP_TOOL", "status": "OUT_OF_SYNC", "active": true, "availableAsAgentAction": false }, { "name": "list_transactions", "label": "List Transactions", "description": "Lists recent payment transactions for an account.", "kind": "MCP_TOOL", "status": "NOT_REGISTERED", "active": false, "availableAsAgentAction": false } ] } ``` In this example, `refund_payment` is `OUT_OF_SYNC` because its description changed on the remote server, and `list_transactions` is a new tool not yet on the allowlist. The next step updates the allowlist to reflect these changes. ## 6. Remove a Tool from the Allowlist `PUT /api-catalog/mcp-servers/0MxB000000000001AAA/assets` To remove a tool, send a `PUT` request that includes every tool you want to keep. Assets omitted from the request body are removed from the allowlist. In this example, the request removes `refund_payment` and adds the new `list_transactions` tool from Step 5. `create_order` and `capture_payment` are included to keep them on the allowlist. Request body: ```json { "assets": [ { "name": "create_order", "active": true }, { "name": "capture_payment", "active": true }, { "name": "list_transactions", "active": true } ] } ``` Response: ```json { "assets": [ { "id": "0TlB000000000001AAA", "name": "create_order", "label": "Create Order", "description": "Creates an Acme Payments order for a payment transaction.", "kind": "MCP_TOOL", "active": true, "availableAsAgentAction": false }, { "id": "0TlB000000000002AAA", "name": "capture_payment", "label": "Capture Payment", "description": "Captures an authorized payment for an order.", "kind": "MCP_TOOL", "active": true, "availableAsAgentAction": false }, { "id": "0TlB000000000004AAA", "name": "list_transactions", "label": "List Transactions", "description": "Lists recent payment transactions for an account.", "kind": "MCP_TOOL", "active": true, "availableAsAgentAction": false } ] } ``` ## 7. Update Server Settings `PUT /api-catalog/mcp-servers/0MxB000000000001AAA` Update the server's label, description, URL, or credentials. Top-level fields (`label`, `description`, `serverUrl`) use PATCH semantics: Only fields you include are updated. The `authorization` block uses replace semantics: Including it replaces the entire block. The `name` and `type` fields are immutable after registration. In this example, the server is updated from sandbox to production credentials. Request body: ```json { "label": "Acme Payments MCP Server (Production)", "description": "Connects to Acme Payments production MCP server for payment processing.", "serverUrl": "https://mcp.acmepayments.example.com/http", "authorization": { "authType": "OAUTH", "identityProvider": "https://auth.acmepayments.example.com/oauth2/token", "scope": "payments:write payments:refund", "clientId": "", "clientSecret": "" } } ``` Response: ```json { "id": "0MxB000000000001AAA", "name": "AcmePaymentsMcp", "label": "Acme Payments MCP Server (Production)", "description": "Connects to Acme Payments production MCP server for payment processing.", "serverUrl": "https://mcp.acmepayments.example.com/http", "type": "EXTERNAL", "status": "ACTIVE", "authorization": { "authType": "OAUTH", "identityProvider": "https://auth.acmepayments.example.com/oauth2/token", "scope": "payments:write payments:refund" }, "createdById": "005000000000001AAA", "createdDate": "2026-08-03T12:00:00Z", "lastModifiedById": "005000000000001AAA", "lastModifiedDate": "2026-08-03T14:00:00Z" } ``` # Get Started with API Catalog Connect REST API Salesforce API Catalog Connect REST API organizes and simplifies headless, programmatic access to the APIs and Model Context Protocol (MCP) servers registered in your org. Discover available APIs by source or schema type, inspect API versions and their operations, and register and manage external MCP servers and their allowlisted assets. Use API Catalog Connect REST API as part of your headless solutions to make MCP servers available to your Agentforce agents. For information about using Connect REST API, see [Connect REST API Developer Guide](https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/intro_what_is_chatter_connect.htm). For information about using API Catalog through the UI, see [API Catalog for Salesforce Help](https://help.salesforce.com/s/articleView?id=platform.api_catalog.htm).