{"openapi":"3.1.0","info":{"title":"PlatformPilot MCP Gateway","description":"Marketplace gateway for self-hosted MCP server backends","version":"0.3.0"},"paths":{"/health":{"get":{"summary":"Health","operationId":"health_health_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/.well-known/oauth-protected-resource":{"get":{"summary":"Protected Resource Metadata Root","description":"RFC 9728 at the origin root, for the configured default server.","operationId":"protected_resource_metadata_root__well_known_oauth_protected_resource_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Protected Resource Metadata Root  Well Known Oauth Protected Resource Get"}}}}}}},"/.well-known/oauth-authorization-server":{"get":{"summary":"Authorization Server Metadata Root","description":"RFC 8414 at the origin root, for the configured default server.","operationId":"authorization_server_metadata_root__well_known_oauth_authorization_server_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Authorization Server Metadata Root  Well Known Oauth Authorization Server Get"}}}}}}},"/.well-known/openid-configuration":{"get":{"summary":"Openid Configuration Root","description":"OIDC discovery at the origin root, for the configured default server.","operationId":"openid_configuration_root__well_known_openid_configuration_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"additionalProperties":true,"type":"object","title":"Response Openid Configuration Root  Well Known Openid Configuration Get"}}}}}}},"/{server_name}/.well-known/oauth-protected-resource":{"get":{"summary":"Protected Resource Metadata","description":"RFC 9728 — tells MCP clients which AS authorizes this resource.","operationId":"protected_resource_metadata__server_name___well_known_oauth_protected_resource_get","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Protected Resource Metadata  Server Name   Well Known Oauth Protected Resource Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/{server_name}/.well-known/oauth-authorization-server":{"get":{"summary":"Authorization Server Metadata","description":"RFC 8414 — AS metadata.","operationId":"authorization_server_metadata__server_name___well_known_oauth_authorization_server_get","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Authorization Server Metadata  Server Name   Well Known Oauth Authorization Server Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/{server_name}/.well-known/openid-configuration":{"get":{"summary":"Openid Configuration","description":"OIDC discovery alias — MCP TS SDK falls back to this if RFC 8414 fails.","operationId":"openid_configuration__server_name___well_known_openid_configuration_get","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Openid Configuration  Server Name   Well Known Openid Configuration Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/.well-known/oauth-authorization-server/{server_path}":{"get":{"summary":"As Metadata Path Suffix","description":"RFC 8414 path-suffix variant of AS metadata.","operationId":"as_metadata_path_suffix__well_known_oauth_authorization_server__server_path__get","parameters":[{"name":"server_path","in":"path","required":true,"schema":{"type":"string","title":"Server Path"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response As Metadata Path Suffix  Well Known Oauth Authorization Server  Server Path  Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/.well-known/openid-configuration/{server_path}":{"get":{"summary":"Oidc Metadata Path Suffix","description":"OIDC discovery, path-suffix variant.","operationId":"oidc_metadata_path_suffix__well_known_openid_configuration__server_path__get","parameters":[{"name":"server_path","in":"path","required":true,"schema":{"type":"string","title":"Server Path"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Oidc Metadata Path Suffix  Well Known Openid Configuration  Server Path  Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/.well-known/oauth-protected-resource/{server_path}":{"get":{"summary":"Protected Resource Metadata Path Suffix","description":"RFC 9728 path-suffix variant.\n\nThe discovery URL embeds the *full* resource path\n(e.g. `/brain/mcp`), not just the server name (`/brain`). We strip\neverything after the first segment.","operationId":"protected_resource_metadata_path_suffix__well_known_oauth_protected_resource__server_path__get","parameters":[{"name":"server_path","in":"path","required":true,"schema":{"type":"string","title":"Server Path"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response Protected Resource Metadata Path Suffix  Well Known Oauth Protected Resource  Server Path  Get"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/{server_name}/oauth/register":{"post":{"summary":"Register","description":"Stateless DCR: return the pre-registered upstream client_id for the server.\n\nThe gateway holds one Auth0 native app per OAuth-aware backend; DCR\nis purely a façade so MCP clients (Claude Code, Cursor, …) can\ndiscover the credential to use without operators hand-configuring\neach install.","operationId":"register__server_name__oauth_register_post","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DCRRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DCRResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/{server_name}/oauth/authorize":{"get":{"summary":"Authorize","description":"Relay the client's authorize call to Auth0 with the gateway callback.\n\nThe client's ``redirect_uri`` + ``state`` + PKCE challenge are folded\ninto an HMAC-signed ``state`` token so we can recover them after the\nAuth0 round-trip without server-side storage.","operationId":"authorize__server_name__oauth_authorize_get","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/{server_name}/oauth/callback":{"get":{"summary":"Oauth Callback","description":"Receive Auth0's code, exchange it server-side, return a new code to the client.","operationId":"oauth_callback__server_name__oauth_callback_get","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/{server_name}/oauth/token":{"post":{"summary":"Token","description":"Token endpoint.\n\nauthorization_code redeems the gateway-minted code; refresh proxies\ntransparently to Auth0 using the gateway's upstream credentials.\n\nReads the raw application/x-www-form-urlencoded body via\n``parse_qsl`` rather than FastAPI's ``Form()`` dependency or\n``request.form()`` — both require ``python-multipart`` even when the\nrequest isn't multipart. OAuth token endpoints are form-urlencoded\nby spec (RFC 6749 §4.1.3), never multipart.","operationId":"token__server_name__oauth_token_post","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/{server_name}/{path}":{"get":{"summary":"Proxy","description":"Forward MCP requests to the appropriate backend.\n\nGateway key validates the caller is PlatformPilot infrastructure.\nMCP OAuth tokens in the Authorization header are passed through\nto the backend for user-level authorization.","operationId":"proxy_get","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}},{"name":"path","in":"path","required":true,"schema":{"type":"string","title":"Path"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"BearerToken":[]},{"GatewayKey":[]}]},"post":{"summary":"Proxy","description":"Forward MCP requests to the appropriate backend.\n\nGateway key validates the caller is PlatformPilot infrastructure.\nMCP OAuth tokens in the Authorization header are passed through\nto the backend for user-level authorization.","operationId":"proxy_post","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}},{"name":"path","in":"path","required":true,"schema":{"type":"string","title":"Path"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"BearerToken":[]},{"GatewayKey":[]}]},"put":{"summary":"Proxy","description":"Forward MCP requests to the appropriate backend.\n\nGateway key validates the caller is PlatformPilot infrastructure.\nMCP OAuth tokens in the Authorization header are passed through\nto the backend for user-level authorization.","operationId":"proxy_put","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}},{"name":"path","in":"path","required":true,"schema":{"type":"string","title":"Path"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"BearerToken":[]},{"GatewayKey":[]}]},"delete":{"summary":"Proxy","description":"Forward MCP requests to the appropriate backend.\n\nGateway key validates the caller is PlatformPilot infrastructure.\nMCP OAuth tokens in the Authorization header are passed through\nto the backend for user-level authorization.","operationId":"proxy_delete","parameters":[{"name":"server_name","in":"path","required":true,"schema":{"type":"string","title":"Server Name"}},{"name":"path","in":"path","required":true,"schema":{"type":"string","title":"Path"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}},"security":[{"BearerToken":[]},{"GatewayKey":[]}]}}},"components":{"schemas":{"DCRRequest":{"properties":{"redirect_uris":{"items":{"type":"string"},"type":"array","minItems":1,"title":"Redirect Uris"},"client_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Client Name"},"grant_types":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Grant Types"},"response_types":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Response Types"},"token_endpoint_auth_method":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Token Endpoint Auth Method"},"application_type":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Application Type"},"software_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Software Id"},"software_version":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Software Version"},"scope":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Scope"}},"type":"object","required":["redirect_uris"],"title":"DCRRequest","description":"RFC 7591 Client Registration Request (subset)."},"DCRResponse":{"properties":{"client_id":{"type":"string","title":"Client Id"},"client_id_issued_at":{"type":"integer","title":"Client Id Issued At"},"redirect_uris":{"items":{"type":"string"},"type":"array","title":"Redirect Uris"},"grant_types":{"items":{"type":"string"},"type":"array","title":"Grant Types"},"response_types":{"items":{"type":"string"},"type":"array","title":"Response Types"},"token_endpoint_auth_method":{"type":"string","title":"Token Endpoint Auth Method"},"application_type":{"type":"string","title":"Application Type"},"client_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Client Name"},"software_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Software Id"}},"type":"object","required":["client_id","client_id_issued_at","redirect_uris","grant_types","response_types","token_endpoint_auth_method","application_type"],"title":"DCRResponse","description":"RFC 7591 Client Information Response (public-client subset)."},"HTTPValidationError":{"properties":{"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"type":"array","title":"Detail"}},"type":"object","title":"HTTPValidationError"},"ValidationError":{"properties":{"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"type":"array","title":"Location"},"msg":{"type":"string","title":"Message"},"type":{"type":"string","title":"Error Type"},"input":{"title":"Input"},"ctx":{"type":"object","title":"Context"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError"}},"securitySchemes":{"BearerToken":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"GatewayKey":{"type":"apiKey","in":"header","name":"X-Gateway-Key"},"OAuth2":{"type":"oauth2","flows":{"authorizationCode":{"authorizationUrl":"https://mcp.platformpilot.ai/brain/oauth/authorize","tokenUrl":"https://mcp.platformpilot.ai/brain/oauth/token","scopes":{"openid":"OpenID Connect sign-in","profile":"Profile claims","email":"Email claim","offline_access":"Refresh tokens"}}}}}},"servers":[{"url":"https://mcp.platformpilot.ai"}]}