---
title: "GET /api/embed-mcp/bootstrap"
method: GET
path: "/api/embed-mcp/bootstrap"
tags: ["/api/embed-mcp"]
---

# GET /api/embed-mcp/bootstrap

`GET /api/embed-mcp/bootstrap`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/embed-mcp/bootstrap`
- Auth: API key in header `X-API-Key`

Everything the MCP Apps iframe needs to mount, so its UI credential never authenticates a general REST endpoint.
   Replaces the iframe's calls to `GET /api/user/current` and `GET /api/session/properties`.

## Request body

- object

## Response `2XX`

Successful response

- object
  - `settings` object, required
  - `user` MetabaseMcpCallbackApiBootstrapUser, required: The projection of the current user the MCP iframe may read. Closed on purpose: a field belongs here only when something the iframe renders reads it, so widening the projection is a decision someone has to make in this file rather than a side effect of the shared `GET /api/user/current` response growing. Deliberately absent: `email`, `login_attributes`, `jwt_attributes`, `attributes`, `sso_source`, `group_ids` and the advanced-permissions flags. Nothing in the visualization reads them, and they are what made the general endpoint a scope-escalation target. The name fields are absent for the same reason: the iframe displays no user, and `common_name` falls back to the email address when a user has neither first nor last name.
    - `id` integer, required: value must be an integer greater than zero.
    - `is_data_analyst` boolean, required
    - `is_qbnewb` boolean, required
    - `is_superuser` boolean, required
    - `locale` string, nullable, required
    - `permissions` object, required
      - `can_create_native_queries` boolean, required
      - `can_create_queries` boolean, required
    - `personal_collection_id` integer, nullable, required: value must be an integer greater than zero.
    - `tenant_id` integer, nullable, required: value must be an integer greater than zero.

## Other responses

- `4XX`: Client error response
- `5XX`: Server error response

## Changes

- **2026-11-04** `2e178f5a7934`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metabase/apis/metabase-api/changes/api/embed-mcp/bootstrap/get.md)

---

[API](https://skmtc.dev/metabase/apis/metabase-api.md) - [All operations](https://skmtc.dev/metabase/apis/metabase-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metabase/apis/metabase-api/revisions/2e178f5a7934?raw)