MCP Token API
Manage MCP bearer tokens via REST.
POST /api/mcp/tokens
Request body
| Field | Type | Required |
|---|---|---|
| brandIds | string[] | Yes |
| label | string | Yes |
| scope | string | Yes (view, manage, bookings) |
| permissions | string[] | Yes |
| toolFilters | string[] | No — allow-list of tool names |
| jwk | object | No — for DPoP binding |
GET /api/mcp/tokens
Returns an array of token objects with id, label, scope, permissions, tool_filters, created_at, last_used_at.
DELETE /api/mcp/tokens/{id}
Permanently revokes a token. Returns 204 on success.
PATCH /api/mcp/tokens/{id}
Update a token's label or revoke status.