---
title: "Record Endpoint Check"
method: POST
path: "/gateways/mcps/endpoints/{endpoint_id}/check"
tags: ["Gateway: MCP"]
---

# Record Endpoint Check

`POST /gateways/mcps/endpoints/{endpoint_id}/check`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/gateways/mcps/endpoints/{endpoint_id}/check`
- Auth: API key in header `Authorization`

Record the result of a check the connect sheet ran.

The connection's row can then say when it was last checked and how that went. The
check itself is the sheet's handshake through the relay; agent calls never write
this.

## Path parameters

- `endpoint_id` string, uuid, required

## Request body

- MCPEndpointCheckRequest: The result of a check the connect sheet just ran against the connection.
  - `ok` boolean, required
  - `reason` string, nullable: Why the check failed. Text past 300 characters is cut, not refused.

## Response `200`

Successful Response

- MCPEndpointResponse
  - `count` integer
  - `endpoint` MCPEndpoint
    - `flags` MCPEndpointFlags
      - `is_active` boolean
      - `is_valid` boolean
    - `tags` object, nullable
    - `meta` object, nullable
    - `created_at` string, date-time, nullable
    - `updated_at` string, date-time, nullable
    - `deleted_at` string, date-time, nullable
    - `created_by_id` string, uuid, nullable
    - `updated_by_id` string, uuid, nullable
    - `deleted_by_id` string, uuid, nullable
    - `name` string, nullable
    - `description` string, nullable
    - `slug` string, nullable
    - `id` string, uuid, nullable
    - `auth_mode` 'oauth' | 'api_key' | 'none', required: How the gateway authenticates to an upstream.
    - `namespace` 'builtin' | 'standard' | 'custom': Gateway route namespace.
    - `secret_id` string, uuid, nullable
    - `connection_id` string, uuid, nullable
    - `provider_key` string, nullable
    - `integration_key` string, nullable
    - `data` MCPEndpointData, required
      - `route` MCPEndpointRoute: Route for one MCP server. `credential_binding` says how an API-key endpoint's credential travels. None sends `Authorization: Bearer <key>`, and an OAuth endpoint ignores it because a grant travels under the scheme its authorization server issued it with.
        - `base_url` string, nullable
        - `headers` object, nullable
        - `credential_binding` MCPCredentialBinding: Where an API-key endpoint's credential goes when the relay sends it. Configuration only: the value stays in the vault behind the endpoint's `secret_id`, so this is as readable as `base_url` is. `kind` and `name` match the SDK's `HeaderCredentialBinding`. A `header` binding sends `<name>: <prefix> <value>`, or `<name>: <value>` with no prefix; a `query` binding adds `<name>=<value>` to the upstream URL at request time; a `url` binding puts the value where `base_url` holds `{secret}`. The stored URL never holds the value. The prefix is the scheme word (`Bearer`, `Basic`) a server expects in front of the value, because a raw key under `Authorization` is refused by every server that names a scheme. Valid combinations: a `header` binding needs `name` and may take `prefix`; a `query` binding needs `name` and takes no `prefix`; a `url` binding takes neither `name` nor `prefix`.
          - `kind` 'header' | 'query' | 'url'
          - `name` string, nullable
          - `prefix` string, nullable
      - `tools` GatewayEndpointFilter: Allowlist and denylist filter for models or tools.
        - `allowlist` string[], nullable
        - `denylist` string[], nullable
      - `settings` MCPEndpointSettings: MCP endpoint settings.
        - `timeout_seconds` number, nullable
      - `oauth` MCPOAuthData: Non-secret OAuth discovery metadata.
        - `resource` string, nullable
        - `authorization_server` string, nullable
        - `scopes_offered` string[]
      - `oauth_config` MCPOAuthConfig: What the person chose for an OAuth connection, apart from what discovery found. `client_id` is an OAuth app the person registered with the provider in advance, for a server that registers no clients on its own (GitHub, HubSpot, Asana). It is used before any registration Agenta would make. `client_secret_id` names the project secret that holds the app's secret; the value stays in the vault. `token_endpoint_auth_method` is how the app authenticates at the token endpoint; unset takes RFC 7591's default. `scopes` is the selection the person last asked for, so a reconnect starts from it. What the server offers lives in the discovery cache beside this.
        - `client_id` string, nullable
        - `client_secret_id` string, uuid, nullable
        - `token_endpoint_auth_method` 'client_secret_basic' | 'client_secret_post' | 'none', nullable
        - `scopes` string[], nullable
      - `check` MCPEndpointCheck: The result of the last explicit check of a connection, from the connect sheet or a reconnect. Agent calls never write it, so it says when someone last looked, not how the connection is doing now.
        - `ok` boolean, required
        - `reason` string, nullable
        - `checked_at` string, date-time, required
    - `status` Status
      - `timestamp` string, date-time
      - `type` string, nullable
      - `code` string, nullable
      - `message` string, nullable
      - `stacktrace` string, nullable

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-18** `722c7cc3556b`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/agenta-ai/apis/agenta-api/changes/gateways/mcps/endpoints/:endpoint_id/check/post.md)

---

[API](https://skmtc.dev/agenta-ai/apis/agenta-api.md) - [All operations](https://skmtc.dev/agenta-ai/apis/agenta-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agenta-ai/apis/agenta-api/revisions/ab601a2309da?raw)