API Reference

Zero Trust

Access

AI Controls

Mcp

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Portals

List MCP Portals

client.zeroTrust.access.aiControls.mcp.portals.list(PortalListParams { account_id, page, per_page, search } params, RequestOptionsoptions?): V4PagePaginationArray<PortalListResponse { id, hostname, name, 8 more } >

GET/accounts/{account_id}/access/ai-controls/mcp/portals

Create a new MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.create(PortalCreateParams { account_id, id, hostname, 5 more } params, RequestOptionsoptions?): PortalCreateResponse { id, hostname, name, 8 more }

POST/accounts/{account_id}/access/ai-controls/mcp/portals

Read details of an MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.read(stringid, PortalReadParams { account_id } params, RequestOptionsoptions?): PortalReadResponse { id, hostname, name, 8 more }

GET/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

Update a MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.update(stringid, PortalUpdateParams { account_id, allow_code_mode, description, 4 more } params, RequestOptionsoptions?): PortalUpdateResponse { id, hostname, name, 8 more }

PUT/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

Delete a MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.delete(stringid, PortalDeleteParams { account_id } params, RequestOptionsoptions?): PortalDeleteResponse { id, hostname, name, 7 more }

DELETE/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

ModelsExpand Collapse

PortalListResponse { id, hostname, name, 8 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

servers: Array<Server>

id: string

server id

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status?: string

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

allow_code_mode?: boolean

Allow remote code execution in Dynamic Workers (beta)

created_at?: string

formatdate-time

created_by?: string

description?: string

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway

PortalCreateResponse { id, hostname, name, 8 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

servers: Array<Server>

id: string

server id

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status?: string

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

allow_code_mode?: boolean

Allow remote code execution in Dynamic Workers (beta)

created_at?: string

formatdate-time

created_by?: string

description?: string

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway

PortalReadResponse { id, hostname, name, 8 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

servers: Array<Server>

id: string

server id

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status?: string

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

allow_code_mode?: boolean

Allow remote code execution in Dynamic Workers (beta)

created_at?: string

formatdate-time

created_by?: string

description?: string

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway

PortalUpdateResponse { id, hostname, name, 8 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

servers: Array<Server>

id: string

server id

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status?: string

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

allow_code_mode?: boolean

Allow remote code execution in Dynamic Workers (beta)

created_at?: string

formatdate-time

created_by?: string

description?: string

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway

PortalDeleteResponse { id, hostname, name, 7 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

allow_code_mode?: boolean

Allow remote code execution in Dynamic Workers (beta)

created_at?: string

formatdate-time

created_by?: string

description?: string

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway