---
title: "Register an MCP upstream the broker may front (BROKER-1)"
method: POST
path: "/broker/upstreams"
---

# Register an MCP upstream the broker may front (BROKER-1)

`POST /broker/upstreams`

## Request

- Base URL: `https://getsanction.com/api/v1`
- URL: `https://getsanction.com/api/v1/broker/upstreams`
- Auth: API key in header `x-mgmt-key`

Owner-plane. Stores the upstream's URL and optional auth header SEC-1-encrypted under the reserved mcp:<name> vault label. Agents then speak to /mcp/broker/{name} with only their Sanction key; every tools/call is authorized before forwarding and the upstream credential is injected server-side. URL must be public https (SSRF-guarded). Re-registering a name replaces the prior config.

## Request body

- object
  - `wallet_id` string, required
  - `name` string, required
  - `url` string, uri, required
  - `auth_header` string
  - `auth_value` string

## Response `201`

Registered; body carries broker_url

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)