> ## Documentation Index > Fetch the complete documentation index at: https://docs.swarmd.ai/llms.txt > Use this file to discover all available pages before exploring further. # Register an MCP server from an uploaded OpenAPI spec > **Security Requirements** | Auth Types | Entities | Permissions | Required Roles | |------------|----------|-------------|----------------| | USER | MCP_REGISTRY | WRITE | MCP_REGISTRY:WRITE | ## OpenAPI ````yaml /openapi/swarmd.json post /registry/v1/mcp-servers/openapi openapi: 3.1.0 info: title: Relay version: v0 servers: - url: https://api.dev.swarmd.ai description: Development security: [] tags: - name: Policy Groups x-displayName: Policy Groups - name: Policy Bindings x-displayName: Policy Bindings - name: Evaluation Packs x-displayName: Evaluation Packs - name: Webhooks x-displayName: Webhooks - name: MCP JSON-RPC x-displayName: MCP JSON-RPC - name: Conversations x-displayName: Conversations - name: Human JSON-RPC x-displayName: Human JSON-RPC - name: Channel JSON-RPC x-displayName: Channel JSON-RPC - name: HITL Approvals x-displayName: HITL Approvals - name: Agent JSON-RPC x-displayName: Agent JSON-RPC - name: Tasks x-displayName: Tasks - name: Push Notifications x-displayName: Push Notifications - name: Messaging x-displayName: Messaging - name: LLM Runtime x-displayName: LLM Runtime - name: Agent Discovery x-displayName: Agent Discovery - name: MCP Servers x-displayName: MCP Servers - name: LLM Gateways x-displayName: LLM Gateways - name: Agents x-displayName: Agents - name: User Subscriptions x-displayName: User Subscriptions - name: LLM Providers x-displayName: LLM Providers - name: LLM Gateway Subscriptions x-displayName: LLM Gateway Subscriptions - name: Kill Switches x-displayName: Kill Switches - name: Channels x-displayName: Channels - name: Channel Subscriptions x-displayName: Channel Subscriptions - name: Agent Subscriptions x-displayName: Agent Subscriptions - name: Marketplace x-displayName: Marketplace - name: Identity Providers x-displayName: Identity Providers - name: Groups x-displayName: Groups - name: Authentication x-displayName: Authentication - name: Users x-displayName: Users - name: Tenants x-displayName: Tenants - name: mcp-consent-controller x-displayName: mcp-consent-controller - name: Audit Monitors x-displayName: Audit Monitors - name: Audit Integrity x-displayName: Audit Integrity - name: Audit Events x-displayName: Audit Events - name: Audit Traces x-displayName: Audit Traces - name: audit-rest-controller x-displayName: audit-rest-controller - name: Audit Dashboard x-displayName: Audit Dashboard - name: A2A Payments x-displayName: A2A Payments paths: /registry/v1/mcp-servers/openapi: post: tags: - MCP Servers summary: Register an MCP server from an uploaded OpenAPI spec description: |- **Security Requirements** | Auth Types | Entities | Permissions | Required Roles | |------------|----------|-------------|----------------| | USER | MCP_REGISTRY | WRITE | MCP_REGISTRY:WRITE | operationId: registerOpenApiMcpServer requestBody: content: application/json: schema: $ref: '#/components/schemas/Registry_RegisterOpenApiMcpServerRequest' required: true responses: '201': description: Created content: '*/*': schema: $ref: '#/components/schemas/Registry_McpServerRegisteredResponse' security: - Registry_bearerAuth: [] components: schemas: Registry_RegisterOpenApiMcpServerRequest: type: object properties: name: type: string description: type: string spec: type: string description: Raw OpenAPI 3.x document (JSON or YAML). baseUrlOverride: type: string description: Overrides the spec's servers[] base URL when supplied. visibility: type: string enum: - PUBLIC - INTERNAL - PRIVATE auth: oneOf: - $ref: '#/components/schemas/Registry_ApiKey' - $ref: '#/components/schemas/Registry_Bearer' - $ref: '#/components/schemas/Registry_None' - $ref: '#/components/schemas/Registry_OAuth2AuthorizationCode' - $ref: '#/components/schemas/Registry_OAuth2ClientCredentials' - $ref: '#/components/schemas/Registry_QueryParam' selectedOperationIds: type: array description: >- Restricts exposed operations to these operationIds; all are exposed when empty. items: type: string documentationUrl: type: string healthCheckUrl: type: string version: type: string description: >- Caller-supplied semver for the initial version row; defaults to 1.0.0 when omitted tags: type: array description: Optional user-defined tags for discovery and organization items: type: string required: - auth - name - spec Registry_McpServerRegisteredResponse: type: object properties: mcpServerId: type: string format: uuid Registry_ApiKey: allOf: - $ref: '#/components/schemas/Registry_McpAuthDetails' - type: object properties: header: type: string - $ref: '#/components/schemas/Registry_SubscriptionAuthConfig' - type: object properties: apiKey: $ref: '#/components/schemas/Registry_ApiKeyConfig' - $ref: '#/components/schemas/Registry_McpAuthConfig' - type: object properties: apiKeyValue: type: string description: API key value. apiKeyHeader: type: string description: Header name for the API key, e.g. 'X-Api-Key'. - $ref: '#/components/schemas/Registry_SubscriptionAuthDetailsResponse' - type: object properties: apiKey: $ref: '#/components/schemas/Registry_ApiKeyCredentialsDTO' required: - scheme Registry_Bearer: allOf: - $ref: '#/components/schemas/Registry_McpAuthDetails' - $ref: '#/components/schemas/Registry_SubscriptionAuthConfig' - type: object properties: bearer: $ref: '#/components/schemas/Registry_BearerTokenConfig' - $ref: '#/components/schemas/Registry_McpAuthConfig' - type: object properties: bearerToken: type: string description: Bearer token. - $ref: '#/components/schemas/Registry_SubscriptionAuthDetailsResponse' - type: object properties: bearerToken: type: string required: - scheme Registry_None: allOf: - $ref: '#/components/schemas/Registry_McpAuthDetails' - $ref: '#/components/schemas/Registry_SubscriptionAuthConfig' - $ref: '#/components/schemas/Registry_McpAuthConfig' - $ref: '#/components/schemas/Registry_SubscriptionAuthDetailsResponse' required: - scheme Registry_OAuth2AuthorizationCode: allOf: - $ref: '#/components/schemas/Registry_McpAuthConfig' - type: object properties: oauthClientId: type: string description: >- OAuth2 client ID. Ignored when useDynamicClientRegistration is true. oauthClientSecret: type: string description: >- OAuth2 client secret. Ignored when useDynamicClientRegistration is true. oauthTokenUrl: type: string description: >- OAuth2 token endpoint. Ignored when useDynamicClientRegistration is true. oauthScopes: type: array description: >- OAuth2 scopes. Ignored when useDynamicClientRegistration is true. items: type: string oauthAuthorizationUrl: type: string description: >- OAuth2 authorization endpoint. Ignored when useDynamicClientRegistration is true. useDynamicClientRegistration: type: boolean description: >- When true, the backend runs OAuth metadata discovery + RFC 7591 Dynamic Client Registration against the MCP server URL and ignores any client/url fields supplied by the caller. Absent or false means the manual fields above are required. required: - scheme Registry_OAuth2ClientCredentials: allOf: - $ref: '#/components/schemas/Registry_McpAuthConfig' - type: object properties: oauthClientId: type: string description: OAuth2 client ID. oauthClientSecret: type: string description: OAuth2 client secret. oauthTokenUrl: type: string description: OAuth2 token endpoint. oauthScopes: type: array description: OAuth2 scopes. items: type: string required: - scheme Registry_QueryParam: allOf: - $ref: '#/components/schemas/Registry_McpAuthDetails' - type: object properties: name: type: string - $ref: '#/components/schemas/Registry_SubscriptionAuthConfig' - type: object properties: queryParam: $ref: '#/components/schemas/Registry_QueryParamConfig' - $ref: '#/components/schemas/Registry_McpAuthConfig' - type: object properties: queryParamName: type: string description: Query parameter name, e.g. 'api_key'. queryParamValue: type: string description: Query parameter value/token. - $ref: '#/components/schemas/Registry_SubscriptionAuthDetailsResponse' - type: object properties: queryParam: $ref: '#/components/schemas/Registry_QueryParamCredentialsDTO' required: - scheme Registry_McpAuthDetails: type: object description: >- Non-secret view of the credentials stored for an MCP server. Secret values are never returned. discriminator: propertyName: scheme properties: scheme: type: string description: Auth scheme stored for the MCP server. enum: - NONE - BEARER - API_KEY - QUERY_PARAM - OAUTH2_CLIENT_CREDENTIALS - OAUTH2_AUTHORIZATION_CODE required: - scheme Registry_SubscriptionAuthConfig: type: object description: Authentication configuration for a subscription. discriminator: propertyName: authType properties: authType: type: string enum: - NONE - OAUTH2 - API_KEY - BEARER - QUERY_PARAM required: - authType Registry_ApiKeyConfig: type: object properties: apiKeyValue: type: string apiKeyHeader: type: string Registry_McpAuthConfig: type: object description: >- Outbound credentials supplied by the tenant at registration / rotation time. Secret fields are persisted encrypted at rest and never returned in responses. discriminator: propertyName: scheme properties: scheme: type: string description: Auth scheme used when calling the MCP server. enum: - NONE - BEARER - API_KEY - QUERY_PARAM - OAUTH2_CLIENT_CREDENTIALS - OAUTH2_AUTHORIZATION_CODE required: - scheme Registry_SubscriptionAuthDetailsResponse: type: object description: >- Resolved auth credentials for a subscription. Secret values are encrypted at rest. discriminator: propertyName: authType properties: authType: type: string required: - authType Registry_ApiKeyCredentialsDTO: type: object properties: header: type: string value: type: string Registry_BearerTokenConfig: type: object properties: token: type: string Registry_QueryParamConfig: type: object properties: queryParamName: type: string queryParamValue: type: string Registry_QueryParamCredentialsDTO: type: object properties: name: type: string value: type: string securitySchemes: Registry_bearerAuth: type: http scheme: bearer bearerFormat: JWT description: JWT token (USER, AGENT, or SERVICE auth) ````