# Get an MCP server access policy `GET /apis/cra.diagrid.io/v1beta1/projects/{ProjectId}/mcpserveraccesspolicies/{ProjectSubresourceId}` Get the details of an MCP server access policy. ## Request ### Path parameters | Name | Type | Required | Description | | --- | --- | --- | --- | | `ProjectId` | string | Yes | Unique identifier of the project. | | `ProjectSubresourceId` | string | Yes | Unique identifier of the project subresource. | ## Responses ### 200 — The requested MCP server access policy. `application/json` - `apiVersion` (string) - `kind` (string) - `metadata` (object) - `name` (string) - `uid` (string) - `resourceVersion` (integer) - `createdAt` (string) - `updatedAt` (string) - `deletedAt` (string) - `labels` (object) - `annotations` (object) - `spec` (object) — Required. - `projectId` (string) — Required. Read-only. Immutable. ProjectID is server-derived from the request path; the client-supplied value is ignored. - `mcpServerRef` (string) — Required. Immutable. - `rules` (object[]) — nil/empty ⇒ deny everything. - `callers` (object[]) — Required. Min items: 1. - `appID` (string) — Required. - `grants` (object[]) — Required. Min items: 1. - `capability` (string) — Required. One of: `tools`, `resources`, `prompts`. - `names` (string[]) — Required. globs; "*" = all. Min items: 1. - `verbs` (string[]) — empty ⇒ all verbs for the capability. - `scopes` (string[]) - `auth` (object) — AuthPolicy is keyed by auth mode so identity knobs stay scoped to the mode that carries user identity (SPIFFE JWT exchange today). - `spiffeJWT` (object) — SpiffeJWTPolicy is the fail-closed enforcement policy for the SPIFFE JWT exchange (OBO) auth mode, enforced on the caller-side sidecar before mint. - `requireUser` (boolean) — RequireUser rejects calls with no X-Diagrid-User-Token (401 oauth.missing_token). - `requiredScopes` (string[]) — RequiredScopes rejects calls whose user token lacks any listed scope (403 oauth.missing_scope). Presence implies RequireUser. - `status` (object) - `status` (string) — Status is the current processing status of the resource. - `updatedAt` (string) — UpdatedAt is the time of the last status update. - `messages` (object[]) — Messages contains any status messages, such as error details. - `message` (string) - `instances` (object[]) — Instances includes the status for each instance of the resource. - `cluster` (string) — Cluster is the name of the cluster hosting this instance. - `region` (string) — Region is the region where the instance is located (e.g. "us-east-1"). - `placementId` (string) — PlacementID is the project placement this instance belongs to (e.g. "1"). - `status` (string) — Status is the current processing status of the resource. - `updatedAt` (string) — UpdatedAt is the time of the last status update. - `messages` (object[]) — Messages contains any status messages, such as error details. - `message` (string) Example: ```json { "apiVersion": "cra.diagrid.io/v1beta1", "kind": "MCPServerAccessPolicy", "metadata": { "name": "github" }, "spec": { "projectId": "my-project", "mcpServerRef": "github", "rules": [ { "callers": [ { "appID": "support-agent" } ], "grants": [ { "capability": "tools", "names": [ "search_*", "get_issue" ] } ] } ] } } ``` `application/vnd.api+json` - `data` (object) - `apiVersion` (string) - `kind` (string) - `metadata` (object) - `name` (string) - `uid` (string) - `resourceVersion` (integer) - `createdAt` (string) - `updatedAt` (string) - `deletedAt` (string) - `labels` (object) - `annotations` (object) - `spec` (object) — Required. - `projectId` (string) — Required. Read-only. Immutable. ProjectID is server-derived from the request path; the client-supplied value is ignored. - `mcpServerRef` (string) — Required. Immutable. - `rules` (object[]) — nil/empty ⇒ deny everything. - `callers` (object[]) — Required. Min items: 1. - `appID` (string) — Required. - `grants` (object[]) — Required. Min items: 1. - `capability` (string) — Required. One of: `tools`, `resources`, `prompts`. - `names` (string[]) — Required. globs; "*" = all. Min items: 1. - `verbs` (string[]) — empty ⇒ all verbs for the capability. - `scopes` (string[]) - `auth` (object) — AuthPolicy is keyed by auth mode so identity knobs stay scoped to the mode that carries user identity (SPIFFE JWT exchange today). - `spiffeJWT` (object) — SpiffeJWTPolicy is the fail-closed enforcement policy for the SPIFFE JWT exchange (OBO) auth mode, enforced on the caller-side sidecar before mint. - `requireUser` (boolean) — RequireUser rejects calls with no X-Diagrid-User-Token (401 oauth.missing_token). - `requiredScopes` (string[]) — RequiredScopes rejects calls whose user token lacks any listed scope (403 oauth.missing_scope). Presence implies RequireUser. - `status` (object) - `status` (string) — Status is the current processing status of the resource. - `updatedAt` (string) — UpdatedAt is the time of the last status update. - `messages` (object[]) — Messages contains any status messages, such as error details. - `message` (string) - `instances` (object[]) — Instances includes the status for each instance of the resource. - `cluster` (string) — Cluster is the name of the cluster hosting this instance. - `region` (string) — Region is the region where the instance is located (e.g. "us-east-1"). - `placementId` (string) — PlacementID is the project placement this instance belongs to (e.g. "1"). - `status` (string) — Status is the current processing status of the resource. - `updatedAt` (string) — UpdatedAt is the time of the last status update. - `messages` (object[]) — Messages contains any status messages, such as error details. - `message` (string) ### 404 — The MCP server access policy was not found. `application/json` In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object. - `code` (string) — Required. This is the same as the HTTP status of the response. - `message` (string) — Required. A short description of the error. - `status` (object) — Required. A status code that indicates the error type. - `details` (object) — Additional details about the errors. - `@type` (string) — The type of error. - `reason` (string) — A reason for the error. - `domain` (string) — The domain in which the error occurred. - `metadata` (object) — Additional metadata about the error. `application/vnd.api+json` JSONAPI.org specification error response wrapper for UI. - `error` (object) — In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object. - `code` (string) — Required. This is the same as the HTTP status of the response. - `message` (string) — Required. A short description of the error. - `status` (object) — Required. A status code that indicates the error type. - `details` (object) — Additional details about the errors. - `@type` (string) — The type of error. - `reason` (string) — A reason for the error. - `domain` (string) — The domain in which the error occurred. - `metadata` (object) — Additional metadata about the error. - `meta` (object) — Link members related to the primary data. - One of: - **string (uri-reference)** — A string containing the link's URL. - **object** - `href` (string (uri-reference)) — Required. A string containing the link's URL. - `meta` (object) — Non-standard meta-information that can not be represented as an attribute or relationship. - `links` (object) — Non-standard meta-information that can not be represented as an attribute or relationship. ### default — Unexpected error. `application/json` In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object. - `code` (string) — Required. This is the same as the HTTP status of the response. - `message` (string) — Required. A short description of the error. - `status` (object) — Required. A status code that indicates the error type. - `details` (object) — Additional details about the errors. - `@type` (string) — The type of error. - `reason` (string) — A reason for the error. - `domain` (string) — The domain in which the error occurred. - `metadata` (object) — Additional metadata about the error. `application/vnd.api+json` JSONAPI.org specification error response wrapper for UI. - `error` (object) — In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object. - `code` (string) — Required. This is the same as the HTTP status of the response. - `message` (string) — Required. A short description of the error. - `status` (object) — Required. A status code that indicates the error type. - `details` (object) — Additional details about the errors. - `@type` (string) — The type of error. - `reason` (string) — A reason for the error. - `domain` (string) — The domain in which the error occurred. - `metadata` (object) — Additional metadata about the error. - `meta` (object) — Link members related to the primary data. - One of: - **string (uri-reference)** — A string containing the link's URL. - **object** - `href` (string (uri-reference)) — Required. A string containing the link's URL. - `meta` (object) — Non-standard meta-information that can not be represented as an attribute or relationship. - `links` (object) — Non-standard meta-information that can not be represented as an attribute or relationship.