mcp-servers

Finish an OAuth connect (hop 2)

Redeems the one-time capability from the callback, exchanges the authorization code, and installs the server. Requires the same person who started the ceremony.

post/v1/mcp-servers/oauth/finalize

Request

  • Base URL: https://api.patricia.app (the document declares no server; this is the origin it was published from)
  • URL: https://api.patricia.app/v1/mcp-servers/oauth/finalize
  • Auth: HTTP bearer

Headers

X-Tenant-Idstring nullable

Request body

capabilitystring required
protocol_version2 nullable

Response

Successful Response

integration_account_idstring required
external_account_idstring required
base_urlstring required
auth_modestring required
header_namestring nullable
negotiated_protocol_versionstring nullable
connection_generationinteger required
refreshingboolean required
last_error_classstring nullable
needs_reauthboolean
connected_bystring nullable
visibilitystring required
is_mineboolean
can_manageboolean
can_disconnectboolean
can_reconsentboolean
can_share_to_teamboolean
can_make_privateboolean
share_to_team_unavailable_reason'already_shared' | 'managed_account' | 'scope_sealed_at_connect' | 'missing_edit_permission' | 'not_your_account' | 'mcp_share_needs_reconnect'

Why can_share_to_team is False for this caller. Null when it is True.

The value names the first term of that answer that fails, in the order account_capabilities states:

  • already_shared: the connection is shared with the whole workspace already.
  • managed_account: Patricia manages the connection. The visibility write refuses a managed connection for every caller.
  • scope_sealed_at_connect: the connection's credential is sealed to the sharing it was connected with (core.scope_sealed_credentials), and both visibility writes refuse to move it in either direction. Its refusal message carries the remedy, core.scope_sealed_credentials.SCOPE_SEALED_REMEDY.
  • missing_edit_permission: the caller does not hold integrations:edit.
  • not_your_account: the caller is not the person who connected this private connection.
  • mcp_share_needs_reconnect: the MCP server's saved sign-in would stop its tools working once the server is shared, so the write refuses with the MCP_SHARE_NEEDS_RECONNECT error code. Reconnecting the server is the remedy.
make_private_unavailable_reason'already_private' | 'managed_account' | 'scope_sealed_at_connect' | 'missing_edit_permission' | 'owner_unknown' | 'oauth_owner_mismatch'

Why can_make_private is False for this caller. Null when it is True.

The value names the first term of that answer that fails, in the order account_capabilities states:

  • already_private: the connection is private already.
  • managed_account: Patricia manages the connection. The visibility write refuses a managed connection for every caller.
  • scope_sealed_at_connect: the connection's credential is sealed to the sharing it was connected with (core.scope_sealed_credentials), and both visibility writes refuse to move it in either direction. Its refusal message carries the remedy, core.scope_sealed_credentials.SCOPE_SEALED_REMEDY.
  • missing_edit_permission: the caller does not hold integrations:edit.
  • owner_unknown: the connection records nobody it could become private to. An MCP server needs a connected_by_user_id; another connection needs an email or actor.
  • oauth_owner_mismatch: the MCP server signs in with OAuth, and its saved sign-in is not the recorded connector's: there is none, it names another user or no membership, or its membership is not the one the connector's owner contract resolves. The narrowing's grant check refuses it with the MCP_OAUTH_OWNER_MISMATCH error code. Disconnecting the server and having that person connect it again as private is the remedy.

Changes

No recorded changes to this operation across all 1 revision of this API.