# MCP operation reference

> Named tools, request bodies, permissions and asynchronous results.

_Reference · Updated 2026-10-27 · Describes release 0.1.164_

Open **Settings · Data in → Connect your agent** and use the **Use your own agent** card. The generated configuration binds your client to the current workspace. Start with `get_workspace_context`; it returns the workspace, your role permissions, the current token scope, the setup guide link and the documentation links (the `/help/llms.txt` index and the three Quick start pages). Token scope can restrict what your account role normally allows.

A read token is enough for ordinary exploration and the permitted chat, lake-query and IdP-test operations. Tenant writes, connection tests and execution previews need write or admin scope and the relevant workspace permission. Personal, webhook and private-agent token management, and every change that gives another person a login to the workspace — member invites (an activation link is a new login), adding, re-roling or removing a member, the workspace identity provider and an organization administrator's workspace staffing — require admin scope. Every platform-admin tool requires admin scope and a superadmin account; tools backed by tenant routes also retain those routes' tenant permission checks. Approval, change-window, quorum and review requirements apply exactly as in the portal.

The MCP `readOnlyHint` is operation metadata, not a token-scope grant. Report exports that save an artifact (`export_change_stats`, `export_benchmark_model_report`, `export_rca` and the like) are POST operations and need write scope; some GET downloads available to a read PAT still record an audit row, so a read PAT does not guarantee that no record is persisted. Conversely, an execution preview can be read-only but still require write scope under the current REST policy.

## Calling a tool

All known product features are included for enabled tenants and workspaces. Feature grants and terms acceptance are no longer required. The legacy grant, revoke and accept tools are deprecated compatibility no-ops: they do not change availability or create agreement records. Workspace membership, role permissions, token scope and actual connection/runtime setup still apply.

Connection `role` accepts `read`, `write` or `read_write`. New connections default to `allow_approved_execution=false`; set it explicitly for a write-capable connection intended for reviewed plans. Changing role clears consent unless explicitly renewed. `read_write` allows read tools to use the credential, but does not permit investigation tools to write. A plan still requires its exact review and approval.

Prepared incident and standalone Change plans use supported `execution_steps` with `selected_connections` when a connection choice is needed. No route creation is required. Route-management tools remain legacy compatibility operations. An invalid or empty structured plan never falls back to a legacy route; clients must follow the returned readiness reason and current review digest. A revert operation (`aws.security_group.authorize_ingress`, `azure.nsg_rule.put` or a `restore_*` operation) is never authored: the platform compiles it from the change ledger's recorded pre-state (Roll back, Draft revert), and a plan that names one is refused as unsupported.

Both servers speak only the Streamable HTTP transport, at the same URL, and accept every MCP revision from 2024-11-05 to 2026-07-28: a client on 2025-11-25 or earlier starts with `initialize` as before, and a 2026-07-28 client sends stateless requests (`server/discover`, no session). Every call is an HTTP POST answered with JSON. The older HTTP+SSE transport, where the client opens a GET stream and waits for an `endpoint` event, is not served: a client set to `sse` waits for that event until its connect timeout. Set the client's transport to Streamable HTTP (`http`), as the generated configuration does. `serverInfo.version` is the platform build.

The server advertises a separate named, typed tool for each operation below. Structured request bodies are normally nested under `body`; path and query arguments stay outside it. Follow each tool's advertised schema, including its upload argument names. For example:

```json
{
  "name": "patch_datasource",
  "arguments": {
    "ds_id": "CONNECTION_ID",
    "body": {"description": "Production metrics"}
  }
}
```

A workspace-bound URL supplies `tenant` automatically. On an unbound connection, supply `tenant` with the workspace ID or slug when you have more than one workspace. As in the REST API, `tenant` also reaches the Test Lab workspace of a workspace you belong to and, on the organization (`group_*`) tools, every workspace of an organization you administer. The bound connection rejects another workspace. Organization-wide and some account-management operations, including password changes and token revocation, require an unbound connection.

Omit a PATCH field to keep it unchanged. `null` clears a value only where the API permits it. Older tool names listed as aliases use the current advertised schema, including the nested body.

Results contain the HTTP `status`, canonical result in `data`, and relevant pagination/download metadata in `headers`. Errors retain the API's status and explanation. A response with `ok: false` is also marked as an MCP error, even when its HTTP status is 200. A started job is not a completed job: use `get_investigation`, `get_chat_session`, `get_xray_scan`, `get_benchmark` or `factory_run_detail` to read durable progress. Live SSE streams remain on their REST endpoints.

For uploads, pass `file: {"filename": "cases.json", "content_base64": "..."}`. The transport accepts up to 16 MiB of decoded file content; individual API limits still apply, including the 5 MiB document/Discovery attachment limit. Local file paths are never accepted. Download operations return the saved content and content type.

For a remediation, call `preview_remediation` with a write or admin token, show the exact payload in `data` to the user, then pass `data.digest` as `body.review_digest` to `remediate_incident`. Typed incident plans select a scoped execution-capable connection with explicit approved-plan consent, without a pre-created route. Include the same `body.selected_connections` in preview and release when choosing among matching connections. Use `body.request_only=true` to request human approval without executing; that is all an operator (`incidents.act` without `approvals.decide`) can do. Releasing needs `approvals.decide`, which the builtin approver, executive and owner roles hold; an L3 release needs two different people. If the plan, target, connection or policy changes, review again. A second approval or closed change window still prevents execution; opening a GitOps pull request is not evidence that the fix has landed.

For a Change action, use `preview_change_execution`, then include `data.digest` as `body.review_digest` when approving or executing. Prepared incident changes and standalone Changes with structured `execution_steps` need no route ID. Include the same `body.selected_connections` in preview and release when making a per-step connection choice. Historical route-based API clients retain `body.route_id`; a conceptual approval cannot approve an action selected later. A changed action needs fresh approvals. If execution is uncertain, inspect the target and reconcile the recorded outcome; reconciliation never authorizes automatic replay or proves recovery.

To suppress resources a compliance control flagged (EST-01 to EST-06), call `accept_control_exception` (the operation keeps its risk-acceptance name) with `body.resource_keys` taken from the control's latest evidence (`get_compliance_control` or the incident's `control`), a `body.risk_statement` — the reason — of at least 10 characters and an optional `body.expires_at` (default 90 days, at most 365). A suppression is a request: each resource lands in the risk register as `requested` and nothing changes until an approver other than the requester calls `approve_risk_decision` with its decision `id` (the requester may approve only when nobody else in the workspace holds `approvals.decide`) or `reject_risk_decision` with a `body.note`. `decide_finding` sends a scanner finding's risk decision the same way. Suppressing fixes nothing on the resource and is never a pass. When other resources stay flagged after an approval, a non-empty `exception.reanalysis_id` in that approval's response is the fresh analysis it started so the fix plan leaves the suppressed resources out; a plan drafted before the suppression can no longer be released. Revoke an approved decision through `revoke_decision`. **Removed in 0.1.95:** `suppress_finding` (`POST /api/aiops/{tenant_id}/incidents/{incident_id}/suppress-rule`) — clients that called it must move to `accept_control_exception`. Existing muted entries stop muting 90 days after they were set.

## Common tasks

- **What is waiting on me:** `needs_you` lists every decision waiting on a person, most urgent first: incidents awaiting approval, escalated incidents, change approvals, merge proposals, risk requests, post-implementation reviews and routes a rollback or a deviated fix demoted, with a count per `type`; pass `type` to page through one kind. `list_pending_approvals` holds only the tool-call approvals of paused analyses.
- **Ticket systems:** `discover_ticket_system` checks a Jira, ServiceNow or Azure DevOps connection without writing to it. `send_test_ticket` files a real ticket through the route and closes it again. `retry_incident_ticket` retries a failed filing or write-back, or writes back to a customer's own ticket that was left to a person.
- **Several connections into one account:** an AWS or Azure read connection runs four jobs unless its `config` switches one off with `false`: `harvest_inventory`, `platform_checks`, `sync_findings` and `harvest_changes`; an AWS one also runs `service_map`, and `builtin_detection` while the workspace has built-in detection on. A `patch_datasource` `config` replaces the whole config: read the connection's current `config` from `list_datasources`, change only the switch and send all of it back. A config holding only the switches drops every other key, such as the role ARN, region or subscription, and the jobs left on then fail.
- **Workspace toggles without their own tool:** send them in `patch_tenant` `body.settings`, for example `aiops_prompt_cache` and `aiops_prompt_diet` (`true`, `false`, or `null` for the platform default); `get_tenant` reads them back. The benchmark run tools take `prompt_diet` the same way to measure both arms on one build, and `compare_benchmark` names each run's arm.
- **Fix some resources now:** `reinvestigate_incident` with `body.defer` = the open resources of a scanner incident (resource ARN, else the resource) to leave out of THIS analysis — a maintenance window, downtime. Not a decision: they stay open and nothing expires; the change request lists them as *Not in this run* and a certified runbook never releases that change on its own.
- **Retention:** `preview_retention_sweep` shows what the next sweep would remove and writes nothing; `run_retention_sweep` with `body.dry_run=false` seals the affected months' usage statements and deletes the closed records past the window.

## Workspace operations

| Tool | REST operation | Additional names |
| --- | --- | --- |
| `me` | `GET /me` | — |
| `change_my_password` | `POST /me/password` | — |
| `list_tokens` | `GET /me/tokens` | — |
| `create_token` | `POST /me/tokens` | — |
| `revoke_token` | `DELETE /me/tokens/{token_id}` | — |
| `list_datasource_types` | `GET /api/aiops/datasource-types` | — |
| `list_datasource_categories` | `GET /api/aiops/datasource-categories` | — |
| `console_me` | `GET /api/aiops/me` | — |
| `my_groups` | `GET /api/aiops/groups/mine` | — |
| `group_detail` | `GET /api/aiops/groups/{group_id}` | — |
| `group_billing` | `GET /api/aiops/groups/{group_id}/billing` | — |
| `group_billing_csv` | `GET /api/aiops/groups/{group_id}/billing.csv` | — |
| `group_set_workspace_scope` | `PATCH /api/aiops/groups/{group_id}/tenants/{tenant_id}/scope` | — |
| `create_group` | `POST /api/aiops/groups` | — |
| `group_create_workspace` | `POST /api/aiops/groups/{group_id}/tenants` | — |
| `group_rename_workspace` | `PATCH /api/aiops/groups/{group_id}/tenants/{tenant_id}` | — |
| `group_list_workspace_members` | `GET /api/aiops/groups/{group_id}/tenants/{tenant_id}/members` | — |
| `group_set_workspace_member` | `PUT /api/aiops/groups/{group_id}/tenants/{tenant_id}/members` | — |
| `group_remove_workspace_member` | `DELETE /api/aiops/groups/{group_id}/tenants/{tenant_id}/members/{user_id}` | — |
| `list_tenants` | `GET /api/aiops` | — |
| `get_tenant` | `GET /api/aiops/{tenant_id}` | — |
| `patch_tenant` | `PATCH /api/aiops/{tenant_id}` | `patch_tenant_settings` |
| `get_guardrails` | `GET /api/aiops/{tenant_id}/guardrails` | — |
| `patch_guardrails` | `PATCH /api/aiops/{tenant_id}/guardrails` | — |
| `preview_retention_sweep` | `GET /api/aiops/{tenant_id}/retention/preview` | — |
| `run_retention_sweep` | `POST /api/aiops/{tenant_id}/retention/sweep` | — |
| `list_archived_records` | `GET /api/aiops/{tenant_id}/archive` | — |
| `list_archive_batches` | `GET /api/aiops/{tenant_id}/archive/batches` | — |
| `get_archived_record` | `GET /api/aiops/{tenant_id}/archive/{kind}/{record_id}` | — |
| `export_training_data` | `GET /api/aiops/{tenant_id}/archive/batches/{batch_id}/training.jsonl.gz` | — |
| `archive_backtest_cases` | `POST /api/aiops/{tenant_id}/archive/batches/{batch_id}/cases` | — |
| `get_builtin_detection` | `GET /api/aiops/{tenant_id}/detection` | — |
| `patch_builtin_detection` | `PATCH /api/aiops/{tenant_id}/detection` | — |
| `list_monitors` | `GET /api/aiops/{tenant_id}/monitors` | — |
| `create_monitor` | `POST /api/aiops/{tenant_id}/monitors` | — |
| `update_monitor` | `PATCH /api/aiops/{tenant_id}/monitors/{check_id}` | — |
| `delete_monitor` | `DELETE /api/aiops/{tenant_id}/monitors/{check_id}` | — |
| `run_monitor` | `POST /api/aiops/{tenant_id}/monitors/{check_id}/run` | — |
| `derive_monitors` | `POST /api/aiops/{tenant_id}/monitors/derive` | — |
| `get_web_allowlist` | `GET /api/aiops/{tenant_id}/web-allowlist` | — |
| `put_web_allowlist` | `PUT /api/aiops/{tenant_id}/web-allowlist` | `set_web_allowlist` |
| `get_model_tiers` | `GET /api/aiops/{tenant_id}/model-tiers` | — |
| `patch_model_tiers` | `PATCH /api/aiops/{tenant_id}/model-tiers` | — |
| `get_llm_endpoint` | `GET /api/aiops/{tenant_id}/llm-endpoint` | — |
| `put_llm_endpoint` | `PUT /api/aiops/{tenant_id}/llm-endpoint` | — |
| `delete_llm_endpoint` | `DELETE /api/aiops/{tenant_id}/llm-endpoint` | — |
| `suggest_model_tiers` | `GET /api/aiops/{tenant_id}/model-tiers/suggest` | — |
| `list_gateway_models` | `GET /api/aiops/{tenant_id}/models` | — |
| `list_members` | `GET /api/aiops/{tenant_id}/members` | — |
| `add_member` | `POST /api/aiops/{tenant_id}/members` | — |
| `set_member_role` | `PATCH /api/aiops/{tenant_id}/members/{member_user_id}` | — |
| `remove_member` | `DELETE /api/aiops/{tenant_id}/members/{member_user_id}` | — |
| `invite_member` | `POST /api/aiops/{tenant_id}/invites` | — |
| `reissue_invite` | `POST /api/aiops/{tenant_id}/invites/{user_id}/reissue` | — |
| `revoke_invite` | `DELETE /api/aiops/{tenant_id}/invites/{user_id}` | — |
| `list_roles` | `GET /api/aiops/{tenant_id}/roles` | — |
| `create_role` | `POST /api/aiops/{tenant_id}/roles` | — |
| `patch_role` | `PATCH /api/aiops/{tenant_id}/roles/{role_id}` | — |
| `delete_role` | `DELETE /api/aiops/{tenant_id}/roles/{role_id}` | — |
| `get_tenant_idp` | `GET /api/aiops/{tenant_id}/idp` | — |
| `put_tenant_idp` | `PUT /api/aiops/{tenant_id}/idp` | `set_idp` |
| `delete_tenant_idp` | `DELETE /api/aiops/{tenant_id}/idp` | `delete_idp` |
| `test_tenant_idp` | `POST /api/aiops/{tenant_id}/idp/test` | `test_idp` |
| `revoke_support_access` | `DELETE /api/aiops/{tenant_id}/support-access/{member_user_id}` | — |
| `mint_webhook_token` | `POST /api/aiops/{tenant_id}/webhook-token` | `admin: mint_webhook_token` |
| `mint_itsm_webhook_token` | `POST /api/aiops/{tenant_id}/itsm-webhook-token` | — |
| `mint_k8s_audit_token` | `POST /api/aiops/{tenant_id}/k8s-audit-token/{cluster}` | — |
| `list_features` | `GET /api/aiops/{tenant_id}/features` | — |
| `accept_feature_terms` | `POST /api/aiops/{tenant_id}/features/{feature}/accept` | — |
| `lake_overview` | `GET /api/aiops/{tenant_id}/lake` | `lake_stats` |
| `list_lake_specs` | `GET /api/aiops/{tenant_id}/lake/specs` | — |
| `create_lake_spec` | `POST /api/aiops/{tenant_id}/lake/specs` | — |
| `patch_lake_spec` | `PATCH /api/aiops/{tenant_id}/lake/specs/{spec_id}` | — |
| `delete_lake_spec` | `DELETE /api/aiops/{tenant_id}/lake/specs/{spec_id}` | — |
| `seed_lake_specs` | `POST /api/aiops/{tenant_id}/lake/specs/seed-defaults` | — |
| `query_lake` | `POST /api/aiops/{tenant_id}/lake/query` | `lake_query` |
| `erase_lake` | `POST /api/aiops/{tenant_id}/lake/erase` | — |
| `drop_lake` | `DELETE /api/aiops/{tenant_id}/lake` | — |
| `upload_text_file` | `POST /api/aiops/{tenant_id}/uploads/text` | — |
| `upload_xray_attachment` | `POST /api/aiops/{tenant_id}/xray/attachments` | — |
| `delete_xray_attachment` | `DELETE /api/aiops/{tenant_id}/xray/attachments/{attachment_id}` | — |
| `launch_xray` | `POST /api/aiops/{tenant_id}/xray` | — |
| `harvest_estate` | `POST /api/aiops/{tenant_id}/xray/harvest` | — |
| `list_xray_scans` | `GET /api/aiops/{tenant_id}/xray` | — |
| `get_xray_scan` | `GET /api/aiops/{tenant_id}/xray/{scan_id}` | — |
| `export_xray_ontology` | `GET /api/aiops/{tenant_id}/xray/{scan_id}/ontology.ttl` | — |
| `adopt_xray_context` | `POST /api/aiops/{tenant_id}/xray/{scan_id}/adopt-context` | — |
| `apply_xray_recommendation` | `POST /api/aiops/{tenant_id}/xray/{scan_id}/apply` | `apply_xray` |
| `delete_xray_scan` | `DELETE /api/aiops/{tenant_id}/xray/{scan_id}` | `delete_xray` |
| `cancel_xray_scan` | `POST /api/aiops/{tenant_id}/xray/{scan_id}/cancel` | `cancel_xray` |
| `list_pillars` | `GET /api/aiops/{tenant_id}/pillars` | — |
| `patch_pillar` | `PATCH /api/aiops/{tenant_id}/pillars/{pillar}` | — |
| `list_datasources` | `GET /api/aiops/{tenant_id}/datasources` | — |
| `create_datasource` | `POST /api/aiops/{tenant_id}/datasources` | `add_datasource` |
| `patch_datasource` | `PATCH /api/aiops/{tenant_id}/datasources/{ds_id}` | — |
| `delete_datasource` | `DELETE /api/aiops/{tenant_id}/datasources/{ds_id}` | — |
| `test_datasource` | `POST /api/aiops/{tenant_id}/datasources/{ds_id}/test` | — |
| `audit_datasource_permissions` | `POST /api/aiops/{tenant_id}/datasources/{ds_id}/audit-permissions` | — |
| `discover_ticket_system` | `POST /api/aiops/{tenant_id}/datasources/{ds_id}/ticket-discovery` | — |
| `discover_datasource_operations` | `POST /api/aiops/{tenant_id}/datasources/{ds_id}/discover-operations` | — |
| `adopt_read_paths` | `POST /api/aiops/{tenant_id}/datasources/{ds_id}/adopt-read-paths` | — |
| `list_routes` | `GET /api/aiops/{tenant_id}/routes` | — |
| `create_route` | `POST /api/aiops/{tenant_id}/routes` | — |
| `patch_route` | `PATCH /api/aiops/{tenant_id}/routes/{route_id}` | — |
| `certify_route` | `POST /api/aiops/{tenant_id}/routes/{route_id}/certification` | — |
| `preview_runbook` | `POST /api/aiops/{tenant_id}/routes/runbook-preview` | — |
| `list_runbook_templates` | `GET /api/aiops/{tenant_id}/runbook-templates` | — |
| `check_route_permissions` | `POST /api/aiops/{tenant_id}/routes/{route_id}/permissions-check` | — |
| `send_test_ticket` | `POST /api/aiops/{tenant_id}/routes/{route_id}/test-ticket` | — |
| `delete_route` | `DELETE /api/aiops/{tenant_id}/routes/{route_id}` | — |
| `export_knowledge` | `GET /api/aiops/{tenant_id}/knowledge/export` | — |
| `preview_knowledge_import` | `POST /api/aiops/{tenant_id}/knowledge/import/preview` | — |
| `import_knowledge` | `POST /api/aiops/{tenant_id}/knowledge/import` | — |
| `list_knowledge` | `GET /api/aiops/{tenant_id}/knowledge` | — |
| `create_knowledge` | `POST /api/aiops/{tenant_id}/knowledge` | `upsert_knowledge` |
| `activate_knowledge` | `POST /api/aiops/{tenant_id}/knowledge/{item_id}/activate` | — |
| `deactivate_knowledge` | `POST /api/aiops/{tenant_id}/knowledge/{item_id}/deactivate` | — |
| `delete_knowledge` | `DELETE /api/aiops/{tenant_id}/knowledge/{item_id}` | — |
| `list_skills` | `GET /api/aiops/{tenant_id}/skills` | — |
| `get_skill_default` | `GET /api/aiops/{tenant_id}/skills/{name}/default` | — |
| `restore_skill_default` | `POST /api/aiops/{tenant_id}/skills/{name}/restore-default` | — |
| `list_alerts` | `GET /api/aiops/{tenant_id}/alerts` | — |
| `list_incidents` | `GET /api/aiops/{tenant_id}/incidents` | — |
| `incident_summary` | `GET /api/aiops/{tenant_id}/incidents/summary` | — |
| `list_muted_findings` | `GET /api/aiops/{tenant_id}/incidents/muted-rules` | — |
| `unmute_finding` | `POST /api/aiops/{tenant_id}/incidents/muted-rules/unmute` | — |
| `get_incident` | `GET /api/aiops/{tenant_id}/incidents/{incident_id}` | — |
| `incident_last_known_good` | `GET /api/aiops/{tenant_id}/incidents/{incident_id}/lkg` | — |
| `draft_revert_plan` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/lkg/draft` | — |
| `keep_unauthorized_change` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/keep-change` | — |
| `verify_incident` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/verify` | — |
| `escalate_incident` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/escalate` | — |
| `reinvestigate_incident` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/reinvestigate` | `trigger_investigation` |
| `map_incident_source` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/map-source` | — |
| `bulk_resolve_incidents` | `POST /api/aiops/{tenant_id}/incidents/bulk-resolve` | — |
| `resolve_incident` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/resolve` | — |
| `retry_incident_ticket` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/ticket/retry` | — |
| `raise_concern` | `POST /api/aiops/{tenant_id}/concerns` | — |
| `preview_remediation` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/remediation-preview` | — |
| `remediate_incident` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/remediate` | — |
| `preapprove_incident_fix` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/preapprove` | — |
| `list_merge_proposals` | `GET /api/aiops/{tenant_id}/merge-proposals` | — |
| `decide_merge_proposal` | `POST /api/aiops/{tenant_id}/merge-proposals/{proposal_id}/decide` | — |
| `grant_incident_budget` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/budget-grant` | — |
| `export_rca` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/rca-export` | — |
| `needs_you` | `GET /api/aiops/{tenant_id}/needs-you` | — |
| `list_changes` | `GET /api/aiops/{tenant_id}/changes` | — |
| `change_summary` | `GET /api/aiops/{tenant_id}/changes/summary` | — |
| `change_stats` | `GET /api/aiops/{tenant_id}/changes/stats` | — |
| `export_change_stats` | `POST /api/aiops/{tenant_id}/changes/stats` | — |
| `list_harvest_reports` | `GET /api/aiops/{tenant_id}/changes/harvest` | — |
| `watched_repositories` | `GET /api/aiops/{tenant_id}/changes/watched-repos` | — |
| `get_change` | `GET /api/aiops/{tenant_id}/changes/{change_id}` | — |
| `get_change_request_document` | `GET /api/aiops/{tenant_id}/changes/{change_id}/document` | — |
| `draft_change_request_document` | `POST /api/aiops/{tenant_id}/changes/{change_id}/document/draft` | — |
| `create_change` | `POST /api/aiops/{tenant_id}/changes` | — |
| `plan_change` | `POST /api/aiops/{tenant_id}/changes/{change_id}/plan` | — |
| `approve_change` | `POST /api/aiops/{tenant_id}/changes/{change_id}/approve` | — |
| `reject_change` | `POST /api/aiops/{tenant_id}/changes/{change_id}/reject` | — |
| `close_change_without_verdict` | `POST /api/aiops/{tenant_id}/changes/{change_id}/close-without-verdict` | — |
| `reclassify_change` | `POST /api/aiops/{tenant_id}/changes/{change_id}/class` | — |
| `execute_change` | `POST /api/aiops/{tenant_id}/changes/{change_id}/execute` | — |
| `schedule_change` | `POST /api/aiops/{tenant_id}/changes/{change_id}/schedule` | — |
| `cancel_change_schedule` | `POST /api/aiops/{tenant_id}/changes/{change_id}/schedule/cancel` | — |
| `verify_change` | `POST /api/aiops/{tenant_id}/changes/{change_id}/verify` | — |
| `record_external_execution` | `POST /api/aiops/{tenant_id}/changes/{change_id}/external-executions` | — |
| `rollback_change` | `POST /api/aiops/{tenant_id}/changes/{change_id}/rollback` | — |
| `close_change_review` | `POST /api/aiops/{tenant_id}/changes/{change_id}/pir/close` | — |
| `request_change_window_exception` | `POST /api/aiops/{tenant_id}/changes/{change_id}/window-exception` | — |
| `decide_change_window_exception` | `POST /api/aiops/{tenant_id}/changes/{change_id}/window-exception/decide` | — |
| `harvest_changes` | `POST /api/aiops/{tenant_id}/changes/harvest` | — |
| `list_problems` | `GET /api/aiops/{tenant_id}/problems` | — |
| `get_problem` | `GET /api/aiops/{tenant_id}/problems/{problem_id}` | — |
| `confirm_problem` | `POST /api/aiops/{tenant_id}/problems/{problem_id}/confirm` | — |
| `close_problem` | `POST /api/aiops/{tenant_id}/problems/{problem_id}/close` | — |
| `compliance_posture` | `GET /api/aiops/{tenant_id}/compliance/posture` | — |
| `compliance_reports_view` | `GET /api/aiops/{tenant_id}/compliance/reports` | — |
| `refresh_compliance_reports` | `POST /api/aiops/{tenant_id}/compliance/reports/refresh` | — |
| `compliance_catalog_view` | `GET /api/aiops/{tenant_id}/compliance/catalog` | — |
| `compliance_discovery_findings` | `GET /api/aiops/{tenant_id}/compliance/discovery-findings` | — |
| `start_compliance_scan` | `POST /api/aiops/{tenant_id}/compliance/scan` | — |
| `list_compliance_scans` | `GET /api/aiops/{tenant_id}/compliance/scans` | — |
| `get_compliance_scan` | `GET /api/aiops/{tenant_id}/compliance/scans/{scan_id}` | — |
| `get_compliance_control` | `GET /api/aiops/{tenant_id}/compliance/controls/{control_id}` | — |
| `override_compliance_control` | `PATCH /api/aiops/{tenant_id}/compliance/controls/{control_id}` | — |
| `attest_requirement` | `POST /api/aiops/{tenant_id}/compliance/requirements/{ref}/attest` | — |
| `request_compliance_change` | `POST /api/aiops/{tenant_id}/compliance/controls/{control_id}/request-change` | — |
| `accept_control_exception` | `POST /api/aiops/{tenant_id}/compliance/controls/{control_id}/exceptions` | — |
| `request_discovery_change` | `POST /api/aiops/{tenant_id}/compliance/discovery-findings/{index}/request-change` | — |
| `export_interpretation_sheet` | `POST /api/aiops/{tenant_id}/compliance/interpretation-export` | — |
| `compliance_agreed_table` | `GET /api/aiops/{tenant_id}/compliance/agreed-table` | — |
| `accept_compliance_table` | `POST /api/aiops/{tenant_id}/compliance/agreed-table/accept` | — |
| `put_custom_requirement` | `PUT /api/aiops/{tenant_id}/compliance/custom-requirements/{ref}` | — |
| `delete_custom_requirement` | `DELETE /api/aiops/{tenant_id}/compliance/custom-requirements/{ref}` | — |
| `list_findings` | `GET /api/aiops/{tenant_id}/findings` | — |
| `list_finding_accounts` | `GET /api/aiops/{tenant_id}/findings/accounts` | — |
| `findings_score` | `GET /api/aiops/{tenant_id}/findings/score` | — |
| `findings_coverage` | `GET /api/aiops/{tenant_id}/findings/coverage` | — |
| `list_scanner_sync_reports` | `GET /api/aiops/{tenant_id}/findings/sync` | — |
| `sync_scanner_findings` | `POST /api/aiops/{tenant_id}/findings/sync` | — |
| `export_posture_period` | `POST /api/aiops/{tenant_id}/findings/posture-export` | — |
| `get_finding` | `GET /api/aiops/{tenant_id}/findings/{finding_id}` | — |
| `decide_finding` | `POST /api/aiops/{tenant_id}/findings/{finding_id}/decision` | — |
| `approve_risk_decision` | `POST /api/aiops/{tenant_id}/risk-decisions/{decision_id}/approve` | — |
| `reject_risk_decision` | `POST /api/aiops/{tenant_id}/risk-decisions/{decision_id}/reject` | — |
| `revoke_decision` | `POST /api/aiops/{tenant_id}/risk-decisions/{decision_id}/revoke` | — |
| `risk_register` | `GET /api/aiops/{tenant_id}/risk-register` | — |
| `export_risk_register` | `POST /api/aiops/{tenant_id}/risk-register/export` | — |
| `list_artifacts` | `GET /api/aiops/{tenant_id}/artifacts` | — |
| `get_artifact` | `GET /api/aiops/{tenant_id}/artifacts/{artifact_id}` | — |
| `spend_rollup` | `GET /api/aiops/{tenant_id}/spend` | — |
| `get_billing` | `GET /api/aiops/{tenant_id}/billing` | — |
| `get_billing_csv` | `GET /api/aiops/{tenant_id}/billing.csv` | — |
| `list_investigations` | `GET /api/aiops/{tenant_id}/investigations` | — |
| `get_investigation` | `GET /api/aiops/{tenant_id}/investigations/{inv_id}` | — |
| `decide_approvals` | `POST /api/aiops/{tenant_id}/investigations/{inv_id}/decisions` | `decide_approval` |
| `cancel_investigation` | `POST /api/aiops/{tenant_id}/investigations/{inv_id}/cancel` | — |
| `chat_ask` | `POST /api/aiops/{tenant_id}/chat` | — |
| `list_chat_sessions` | `GET /api/aiops/{tenant_id}/chat` | — |
| `get_chat_session` | `GET /api/aiops/{tenant_id}/chat/{sid}` | — |
| `cancel_chat_turn` | `POST /api/aiops/{tenant_id}/chat/{sid}/turns/{turn_id}/cancel` | — |
| `delete_chat_session` | `DELETE /api/aiops/{tenant_id}/chat/{sid}` | — |
| `get_proposal` | `GET /api/aiops/{tenant_id}/proposals/{proposal_id}` | — |
| `edit_proposal` | `PATCH /api/aiops/{tenant_id}/proposals/{proposal_id}` | — |
| `draft_incident_runbook` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/runbook-draft` | — |
| `create_feedback` | `POST /api/aiops/{tenant_id}/investigations/{inv_id}/feedback` | — |
| `list_feedback` | `GET /api/aiops/{tenant_id}/feedback` | — |
| `list_proposals` | `GET /api/aiops/{tenant_id}/proposals` | — |
| `approve_proposal` | `POST /api/aiops/{tenant_id}/proposals/{proposal_id}/approve` | — |
| `reject_proposal` | `POST /api/aiops/{tenant_id}/proposals/{proposal_id}/reject` | — |
| `retire_proposal` | `POST /api/aiops/{tenant_id}/proposals/{proposal_id}/retire` | — |
| `list_benchmarks` | `GET /api/aiops/{tenant_id}/benchmarks` | `get_benchmark_summary` |
| `list_datasets` | `GET /api/aiops/{tenant_id}/benchmarks/datasets` | — |
| `upload_dataset` | `POST /api/aiops/{tenant_id}/benchmarks/datasets` | — |
| `upload_dataset_version` | `POST /api/aiops/{tenant_id}/benchmarks/datasets/{dataset_id}/versions` | — |
| `get_dataset` | `GET /api/aiops/{tenant_id}/benchmarks/datasets/{dataset_id}` | — |
| `export_dataset` | `GET /api/aiops/{tenant_id}/benchmarks/datasets/{dataset_id}/export` | — |
| `run_dataset` | `POST /api/aiops/{tenant_id}/benchmarks/datasets/{dataset_id}/run` | — |
| `patch_dataset` | `PATCH /api/aiops/{tenant_id}/benchmarks/datasets/{dataset_id}` | — |
| `trash_dataset` | `DELETE /api/aiops/{tenant_id}/benchmarks/datasets/{dataset_id}` | — |
| `restore_dataset` | `POST /api/aiops/{tenant_id}/benchmarks/datasets/{dataset_id}/restore` | — |
| `export_history_golden_set` | `GET /api/aiops/{tenant_id}/benchmarks/history-export` | — |
| `benchmark_model_report` | `GET /api/aiops/{tenant_id}/benchmarks/model-report` | — |
| `export_benchmark_model_report` | `POST /api/aiops/{tenant_id}/benchmarks/model-report` | — |
| `get_benchmark` | `GET /api/aiops/{tenant_id}/benchmarks/{run_id}` | — |
| `run_builtin_benchmark` | `POST /api/aiops/{tenant_id}/benchmarks/builtin` | `run_benchmark_builtin` |
| `upload_golden_set` | `POST /api/aiops/{tenant_id}/benchmarks/golden` | `run_benchmark_golden` |
| `rerun_benchmark` | `POST /api/aiops/{tenant_id}/benchmarks/{run_id}/rerun` | — |
| `resume_benchmark` | `POST /api/aiops/{tenant_id}/benchmarks/{run_id}/resume` | — |
| `compare_benchmark` | `GET /api/aiops/{tenant_id}/benchmarks/{run_id}/compare` | — |
| `override_benchmark_result` | `PATCH /api/aiops/{tenant_id}/benchmarks/{run_id}/results/{scenario_id}` | — |
| `run_history_backtest` | `POST /api/aiops/{tenant_id}/benchmarks/from-history` | — |
| `harvest_factory_run` | `POST /api/aiops/{tenant_id}/test-factory/runs/{run_id}/harvest` | — |
| `delete_benchmark_run` | `DELETE /api/aiops/{tenant_id}/benchmarks/{run_id}` | — |
| `export_benchmark_report` | `POST /api/aiops/{tenant_id}/benchmarks/{run_id}/report` | — |
| `certify_benchmark` | `POST /api/aiops/{tenant_id}/benchmarks/{run_id}/certify` | — |
| `certification_bundle` | `GET /api/aiops/{tenant_id}/benchmarks/{run_id}/certification.json` | — |
| `import_benchmark` | `POST /api/aiops/{tenant_id}/benchmarks/import` | — |
| `factory_status` | `GET /api/aiops/{tenant_id}/test-factory` | — |
| `factory_trend` | `GET /api/aiops/{tenant_id}/test-factory/trend` | — |
| `factory_validate` | `POST /api/aiops/{tenant_id}/test-factory/validate` | — |
| `factory_provision` | `POST /api/aiops/{tenant_id}/test-factory/provision` | — |
| `factory_run_catalogue` | `POST /api/aiops/{tenant_id}/test-factory/runs` | — |
| `factory_set_guards` | `PATCH /api/aiops/{tenant_id}/test-factory/guards` | — |
| `factory_run_dashboard` | `GET /api/aiops/{tenant_id}/test-factory/runs/{run_id}/dashboard` | — |
| `factory_run_detail` | `GET /api/aiops/{tenant_id}/test-factory/runs/{run_id}` | — |
| `factory_run_cancel` | `POST /api/aiops/{tenant_id}/test-factory/runs/{run_id}/cancel` | — |
| `factory_teardown` | `POST /api/aiops/{tenant_id}/test-factory/teardown` | — |
| `factory_reset_incidents` | `POST /api/aiops/{tenant_id}/test-factory/reset-incidents` | — |
| `tenant_audit` | `GET /api/aiops/{tenant_id}/audit` | — |
| `tenant_audit_actions` | `GET /api/aiops/{tenant_id}/audit/actions` | — |
| `tenant_audit_verify` | `GET /api/aiops/{tenant_id}/audit/verify` | — |
| `tenant_audit_export` | `GET /api/aiops/{tenant_id}/audit/export` | — |
| `create_lab_workspace` | `POST /api/aiops/{tenant_id}/lab` | — |
| `provision_plan` | `GET /api/aiops/{tenant_id}/test-factory/provision-plan` | — |
| `alert_coverage` | `GET /api/aiops/{tenant_id}/alert-coverage` | — |
| `platform_identity` | `GET /api/aiops/{tenant_id}/platform-identity` | — |
| `preview_cloud_setup` | `POST /api/aiops/{tenant_id}/cloud-setup/preview` | — |
| `mint_agent_token` | `POST /api/aiops/{tenant_id}/agent-tokens` | — |
| `list_agent_tokens` | `GET /api/aiops/{tenant_id}/agent-tokens` | — |
| `revoke_agent_token` | `DELETE /api/aiops/{tenant_id}/agent-tokens/{token_id}` | — |
| `onboarding_status` | `GET /api/aiops/{tenant_id}/onboarding-status` | — |
| `create_validation` | `POST /api/aiops/{tenant_id}/intake/validations` | — |
| `list_validations` | `GET /api/aiops/{tenant_id}/intake/validations` | — |
| `get_validation` | `GET /api/aiops/{tenant_id}/intake/validations/{vid}` | — |
| `mcp_status` | `GET /api/aiops/{tenant_id}/mcp/status` | — |
| `get_workspace_context` | `GET /api/aiops/{tenant_id}/mcp/context` | — |
| `list_topology` | `GET /api/aiops/{tenant_id}/topology` | — |
| `add_topology_edges` | `POST /api/aiops/{tenant_id}/topology` | — |
| `delete_topology_edge` | `DELETE /api/aiops/{tenant_id}/topology/{edge_id}` | — |
| `infer_topology` | `POST /api/aiops/{tenant_id}/topology/infer` | — |
| `sync_trace_topology` | `POST /api/aiops/{tenant_id}/topology/sync-traces` | — |
| `get_estate_graph` | `GET /api/aiops/{tenant_id}/estate/graph` | — |
| `list_estate_history` | `GET /api/aiops/{tenant_id}/estate/history` | — |
| `get_service_group` | `GET /api/aiops/{tenant_id}/estate/service-group` | — |
| `acknowledge_no_firewall` | `POST /api/aiops/{tenant_id}/estate/no-firewall` | — |
| `list_pending_approvals` | `GET /api/aiops/{tenant_id}/pending-approvals` | — |
| `get_exec_report` | `GET /api/aiops/{tenant_id}/executive-report` | — |
| `test_llm_endpoint` | `POST /api/aiops/{tenant_id}/llm-endpoint/test` | — |
| `reconcile_execution` | `POST /api/aiops/{tenant_id}/incidents/{incident_id}/reconcile-execution` | — |
| `preview_change_execution` | `POST /api/aiops/{tenant_id}/changes/{change_id}/execution-preview` | — |
| `reconcile_change_execution` | `POST /api/aiops/{tenant_id}/changes/{change_id}/reconcile-execution` | — |
| `record_change_deployment` | `POST /api/aiops/{tenant_id}/changes/{change_id}/application` | — |
| `verify_change_restoration` | `POST /api/aiops/{tenant_id}/changes/{change_id}/rollback-verify` | — |
| `dashboard_summary` | `GET /api/aiops/{tenant_id}/dashboard/summary` | — |

## Platform operations

These tools are available at `/mcp/admin` and require a superadmin with an admin-scope PAT or SSO identity.

| Tool | REST operation | Additional names |
| --- | --- | --- |
| `list_users` | `GET /users` | — |
| `create_user` | `POST /users` | — |
| `patch_user` | `PATCH /users/{user_id}` | — |
| `send_user_reset_link` | `POST /users/{user_id}/reset-link` | — |
| `delete_user` | `DELETE /users/{user_id}` | — |
| `create_datasource_type` | `POST /api/aiops/datasource-types` | — |
| `patch_datasource_type` | `PATCH /api/aiops/datasource-types/{key}` | — |
| `delete_datasource_type` | `DELETE /api/aiops/datasource-types/{key}` | — |
| `admin_gateway_models` | `GET /api/aiops/admin/models` | — |
| `get_platform_model_tiers` | `GET /api/aiops/admin/model-tiers-default` | — |
| `patch_platform_model_tiers` | `PATCH /api/aiops/admin/model-tiers-default` | — |
| `get_auto_investigate_defaults` | `GET /api/aiops/admin/auto-investigate-defaults` | — |
| `patch_auto_investigate_defaults` | `PATCH /api/aiops/admin/auto-investigate-defaults` | — |
| `get_retention_defaults` | `GET /api/aiops/admin/retention-defaults` | — |
| `patch_retention_defaults` | `PATCH /api/aiops/admin/retention-defaults` | — |
| `get_builtin_detection_platform` | `GET /api/aiops/admin/builtin-detection` | — |
| `patch_builtin_detection_platform` | `PATCH /api/aiops/admin/builtin-detection` | — |
| `get_platform_model_prices` | `GET /api/aiops/admin/model-prices` | — |
| `put_platform_model_prices` | `PUT /api/aiops/admin/model-prices` | — |
| `record_model_mappings` | `POST /api/aiops/admin/model-prices/mappings` | — |
| `sync_platform_model_prices` | `POST /api/aiops/admin/model-prices/sync` | — |
| `get_platform_smtp` | `GET /api/aiops/admin/smtp` | — |
| `put_platform_smtp` | `PUT /api/aiops/admin/smtp` | — |
| `admin_audit` | `GET /api/aiops/admin/audit` | `audit_query` |
| `admin_audit_verify` | `GET /api/aiops/admin/audit/verify` | — |
| `admin_audit_export` | `GET /api/aiops/admin/audit/export` | — |
| `admin_overview_stats` | `GET /api/aiops/admin/overview` | `list_tenants` |
| `admin_runner_status` | `GET /api/aiops/admin/runners` | — |
| `admin_billing` | `GET /api/aiops/admin/billing` | — |
| `admin_billing_csv` | `GET /api/aiops/admin/billing.csv` | — |
| `admin_rebook_costs` | `POST /api/aiops/admin/rebook-costs` | — |
| `admin_patch_tenant` | `PATCH /api/aiops/admin/tenants/{tenant_id}` | — |
| `admin_tenant_config` | `GET /api/aiops/admin/tenants/{tenant_id}` | `get_tenant` |
| `admin_patch_pillar` | `PATCH /api/aiops/admin/tenants/{tenant_id}/pillars/{pillar}` | `set_pillar` |
| `admin_create_group` | `POST /api/aiops/admin/groups` | — |
| `admin_list_groups` | `GET /api/aiops/admin/groups` | — |
| `admin_group_detail` | `GET /api/aiops/admin/groups/{group_id}` | — |
| `admin_group_assign` | `PUT /api/aiops/admin/groups/{group_id}/tenants/{tenant_id}` | — |
| `admin_group_set_member` | `PUT /api/aiops/admin/groups/{group_id}/members/{user_id}` | — |
| `admin_group_remove_member` | `DELETE /api/aiops/admin/groups/{group_id}/members/{user_id}` | — |
| `admin_group_unassign` | `DELETE /api/aiops/admin/groups/{group_id}/tenants/{tenant_id}` | — |
| `create_tenant` | `POST /api/aiops` | — |
| `provision_keycloak_sso` | `POST /api/aiops/{tenant_id}/idp/provision-keycloak` | `provision_keycloak`, `tenant: provision_keycloak` |
| `grant_support_access` | `POST /api/aiops/{tenant_id}/support-access` | — |
| `grant_feature` | `POST /api/aiops/{tenant_id}/features/{feature}` | — |
| `revoke_feature` | `DELETE /api/aiops/{tenant_id}/features/{feature}` | — |
| `create_lab` | `POST /api/aiops/admin/tenants/{tenant_id}/lab` | — |
| `get_connection_setup` | `GET /api/aiops/admin/connection-setup` | — |
| `put_connection_setup` | `PUT /api/aiops/admin/connection-setup` | — |
| `get_cloud_runtime` | `GET /api/aiops/admin/tenants/{tenant_id}/cloud-runtime` | — |
| `put_cloud_runtime` | `PUT /api/aiops/admin/tenants/{tenant_id}/cloud-runtime` | — |
| `mint_runner_token` | `POST /api/aiops/admin/tenants/{tenant_id}/runner-tokens` | — |
| `list_runner_tokens` | `GET /api/aiops/admin/tenants/{tenant_id}/runner-tokens` | — |
| `revoke_runner_token` | `DELETE /api/aiops/admin/tenants/{tenant_id}/runner-tokens/{token_id}` | — |

## Separate protocols

Browser login/OIDC redirects, incoming webhooks, internal private-agent claims/checkpoints/secrets, the OpenAI-compatible agent facade, and live SSE streams keep their own protocols. They are not generic MCP tools. MCP cannot choose an arbitrary URL, HTTP method or Authorization header for an operation.

The source catalogue is `app/mcp_operations.json`. Regenerate both copies of this reference with `python scripts/render-mcp-reference.py` from the repository root. A coverage check fails if a new management route has no reviewed binding or an existing binding loses its REST route.


## Next steps

- Next: [Admin MCP server](/help/ops-admin-mcp.md)
- [All Reference pages](/help/reference/llms.txt)
- [Documentation home](/help/)