Get MCP Access Policy
GET /environments/{env_id}/mcp_policy
GET /environments/{env_id}/mcp_policyInteractive request editor loads with JavaScript.
Authorization
BearerAdminToken Organization-scoped admin token. Read operations require a valid token, and write operations require a token with write permission.
In: header
Path Parameters
Environment ID that scopes the request.
uuidResponse Body
application/json
application/json
application/json
curl -X GET "$AISIX_CP/environments/$ENV_ID/mcp_policy" \ -H "Authorization: Bearer $AISIX_TOKEN"OK
{
"mcp_policy": {
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"scope": "env",
"env_id": "3f917d0d-4dff-42f3-97c4-6a5455dfe8c2",
"team_id": "810007d0-bec5-486c-b5d1-28fcd8a079ba",
"allow": [
"string"
],
"deny": [
"string"
],
"enabled": true,
"created_at": "2019-08-24T14:15:22Z",
"updated_at": "2019-08-24T14:15:22Z"
}
}Missing or invalid bearer.
{
"error": {
"code": "UNAUTHENTICATED",
"message": "no org context"
}
}Resource not found.
{
"error": {
"code": "NOT_FOUND",
"message": "provider key not found"
}
}Complete operation details and schema variants
GET /environments/{env_id}/mcp_policy
Get MCP Access Policy
Fetch the environment layer of the MCP tool ACL. It applies to
every caller API key in the environment, intersected with the
key's team layer and the key's own mcp_access block.
The layer is optional: mcp_policy is null when the
environment configures none, the same way the team layer
reports entitlements.mcp: null. A 404 means the
environment itself was not found.
Parameters
env_id(path, string, required): Environment ID that scopes the request.
Responses
-
200: OK -
mcp_policy(object, required): The environment's MCP ACL layer, ornullwhen the environment configures none. Environments without a layer are the common case, not an error. -
allOf variant 1
-
mcp_policy.id(string, required): Policy ID. -
mcp_policy.scope(string, required): Whether this policy is the environment layer or a team layer. -
mcp_policy.env_id(string, optional): Environment the layer applies to. Present only forscope: env. -
mcp_policy.team_id(string, optional): Team the layer applies to. Present only forscope: team. -
mcp_policy.allow(array, required): Namespacedserver__toolpatterns this layer allows (*,server__*, or an exactserver__tool). An empty list leaves the covered keys no MCP tool access;["*"]narrows nothing, which is what a layer that only means to subtract tools sends alongsidedeny. -
mcp_policy.deny(array, required): Namespacedserver__toolpatterns removed from the effective grant of every caller API key this layer covers. Deny always wins, on any layer. -
mcp_policy.enabled(boolean, required): Whether the policy is applied. A disabled policy is kept but ignored. -
mcp_policy.created_at(string, required): Time when the policy was created. -
mcp_policy.updated_at(string, required): Time when the policy was last updated. -
401: Missing or invalid bearer. -
error(object, required): Error details. -
error.code(string, required): Machine-readable identifier. Examples:UNAUTHENTICATED,INVALID_REQUEST,MASTER_KEY_UNSET,INTERNAL. -
error.message(string, required): Human-readable explanation; safe to surface to operators. -
404: Resource not found. Response fields (application/json): identical toGET /environments/{env_id}/mcp_policy, response 401 above.
cURL
curl -X GET '$AISIX_CP/environments/{env_id}/mcp_policy' -H 'Authorization: Bearer $AISIX_TOKEN'