> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usepatchwork.co/llms.txt
> Use this file to discover all available pages before exploring further.

# List MCP grants

> Active grants in your workspace, newest first. A grant is one user's standing authorization for one MCP client on one published agent. Not gated on credits.




## OpenAPI

````yaml /openapi.yaml get /v1/mcp/grants
openapi: 3.1.0
info:
  title: Patchwork API
  version: 1.0.0
  description: >
    Public data-plane API. Two products today: Identify (bare account
    resolution) and Loom (threads, runs, and outcomes). Every response is a JSON
    envelope — `status: success` with `data`, or `status: error` with `error`.
  contact:
    url: https://usepatchwork.co
servers:
  - url: https://api.usepatchwork.co
security:
  - bearerAuth: []
tags:
  - name: Identify
    description: Resolve an account or wallet to the institution and rails behind it.
  - name: Extract
    description: >-
      Turn a document into structured data, and manage the schema types that
      shape it.
  - name: Loom
    description: Threads, messages, runs, and outcomes for an embedded agent.
  - name: Files
    description: Upload bytes once, get a durable handle, reference it from any product.
  - name: Voice
    description: Transcribe an utterance, speak a reply, list the available voices.
  - name: MCP
    description: >-
      The grants your users hold when they reach an agent from their own AI
      client.
paths:
  /v1/mcp/grants:
    get:
      tags:
        - MCP
      summary: List MCP grants
      description: >
        Active grants in your workspace, newest first. A grant is one user's
        standing authorization for one MCP client on one published agent. Not
        gated on credits.
      operationId: listMcpGrants
      parameters:
        - name: subject
          in: query
          required: false
          description: Narrow to one subject, exactly as your login bridge asserted it.
          schema:
            type: string
        - $ref: '#/components/parameters/Cursor'
        - $ref: '#/components/parameters/Limit'
      responses:
        '200':
          description: The workspace's active MCP grants.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnvelopeMcpGrantList'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  parameters:
    Cursor:
      name: cursor
      in: query
      required: false
      description: >
        Opaque pagination cursor. Pass back the `next_cursor` from the previous
        page verbatim; do not construct one.
      schema:
        type: string
    Limit:
      name: limit
      in: query
      required: false
      description: Page size. Clamped to 100.
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 25
  schemas:
    EnvelopeMcpGrantList:
      type: object
      required:
        - status
        - data
      properties:
        status:
          type: string
          const: success
        data:
          type: array
          items:
            $ref: '#/components/schemas/McpGrant'
        pagination:
          $ref: '#/components/schemas/Pagination'
    Error:
      type: object
      required:
        - status
        - error
      properties:
        status:
          type: string
          const: error
        error:
          type: object
          required:
            - message
            - code
          properties:
            message:
              type: string
              description: Human-readable explanation.
            code:
              type: string
              description: Stable machine-readable code.
            details:
              description: Optional extra context.
    McpGrant:
      type: object
      required:
        - id
        - subject_ref
        - scopes
        - agent
        - client
        - created_at
      properties:
        id:
          type: string
          format: uuid
          description: Pass to the revoke endpoint.
        subject_ref:
          type: string
          description: >
            The subject your login bridge asserted. Every run made under this
            grant carries it.
        scopes:
          type: array
          items:
            type: string
            enum:
              - read
              - write
          description: >
            What the client asked for and the user allowed. Recorded for audit;
            what the client can call is set by the agent's wiring.
        agent:
          type: object
          required:
            - public_id
            - name
          properties:
            public_id:
              type: string
              description: The exact published agent version this grant is for.
            name:
              type: string
        client:
          type: object
          required:
            - name
          properties:
            name:
              type: string
              description: The MCP client's registered name. A label, not an identity.
        created_at:
          type: string
          format: date-time
          description: When the user first consented.
        last_authorized_at:
          type: string
          format: date-time
          nullable: true
          description: >
            When an access token was most recently issued against the grant.
            Tracks re-authorization, not tool calls.
    Pagination:
      type: object
      required:
        - has_more
        - limit
      properties:
        next_cursor:
          type: string
          nullable: true
          description: Pass to `cursor` for the next page. Null on the last page.
        has_more:
          type: boolean
        limit:
          type: integer
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >
        Identify accepts a workspace API key (`sk_…`). Loom accepts either a
        short-lived session token (direct) or a workspace API key (relay).

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.