> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-muhammad-kumail-native-mcp-tabs-batch.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Test Connection > TestConnection probes an MCP server with the supplied URL + transport + plaintext credentials and reports whether a real MCP initialize + tools/list succeeded. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/mcp_servers/test_connection openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/mcp_servers/test_connection: post: tags: - MCP Servers summary: Test Connection description: |- TestConnection probes an MCP server with the supplied URL + transport + plaintext credentials and reports whether a real MCP initialize + tools/list succeeded. operationId: c1.api.ai_governance.v1.MCPServerService.TestConnection requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerServiceTestConnectionRequest responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerServiceTestConnectionResponse description: Successful response x-codeSamples: - lang: go label: TestConnection source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.MCPServer.TestConnection(ctx, nil)\n if err != nil {\n log.Fatal(err)\n }\n if res.MCPServerServiceTestConnectionResponse != nil {\n // handle response\n }\n}" components: schemas: c1.api.ai_governance.v1.MCPServerServiceTestConnectionRequest: description: |- MCPServerServiceTestConnectionRequest exercises an MCPServerExternalConfig against the upstream server and reports whether the supplied URL + transport + credentials accept a real MCP initialize + tools/list. properties: appId: description: |- App ID of an existing external MCP connector. When set together with connector_id, the request runs in edit mode (see above). type: string connectorId: description: >- Connector ID of an existing external MCP connector. When set together with app_id, the request runs in edit mode (see above). type: string externalConfig: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerExternalConfig - type: 'null' updateMask: type: - string - 'null' title: Mcp Server Service Test Connection Request type: object x-speakeasy-name-override: MCPServerServiceTestConnectionRequest c1.api.ai_governance.v1.MCPServerServiceTestConnectionResponse: description: The MCPServerServiceTestConnectionResponse message. properties: failureReason: description: |- Sanitized, human-readable explanation of why the probe failed, set only when reachable=false (e.g. "MCP server unreachable or rejected the credentials (HTTP 401 Unauthorized)"). Empty when reachable=true. Never contains raw upstream response bytes. type: string reachable: description: |- True when the MCP initialize handshake AND a tools/list call both succeeded against the upstream with the supplied credentials. False when the probe ran but the upstream was unreachable or rejected the request — see failure_reason. Malformed requests (missing/invalid config, bad permissions) are returned as a gRPC error, not reachable=false. type: boolean toolCount: description: |- Number of tools advertised by the upstream's tools/list response. Zero when reachable=false; can also legitimately be zero when the server is reachable but exposes no tools. int64 to match MCPServerSearchWithToolCountResult.tool_count. format: int64 type: string title: Mcp Server Service Test Connection Response type: object x-speakeasy-name-override: MCPServerServiceTestConnectionResponse c1.api.ai_governance.v1.MCPServerExternalConfig: description: > MCPServerExternalConfig configures an external MCP server accessed via HTTP transport. The server is routed through the MCP gateway for credential decryption. This message contains a oneof named auth_config. Only a single field of the following list may be set at a time: - none - bearerToken - oauth2 - customHeader - basicAuth properties: basicAuth: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthBasicAuth - type: 'null' bearerToken: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthBearerToken - type: 'null' customHeader: oneOf: - $ref: >- #/components/schemas/c1.api.ai_governance.v1.MCPServerAuthCustomHeader - type: 'null' none: oneOf: - $ref: '#/components/schemas/c1.api.ai_governance.v1.MCPServerAuthNone' - type: 'null' oauth2: oneOf: - $ref: '#/components/schemas/c1.api.ai_governance.v1.MCPServerAuthOAuth2' - type: 'null' requireToolApproval: description: |- Optional per-server override for tool auto-approval. See MCPServerView.require_tool_approval for semantics. enum: - OPTIONAL_BOOL_UNSPECIFIED - OPTIONAL_BOOL_TRUE - OPTIONAL_BOOL_FALSE type: string x-speakeasy-unknown-values: allow tokenSharing: description: >- Token sharing model. SHARED = admin authorizes once; PER_USER = each user authenticates independently. PER_USER is supported for OAuth2 authorization_code, bearer_token, custom_header, and basic_auth. Defaults to SHARED at runtime. enum: - MCP_SERVER_TOKEN_SHARING_UNSPECIFIED - MCP_SERVER_TOKEN_SHARING_SHARED - MCP_SERVER_TOKEN_SHARING_PER_USER type: string x-speakeasy-unknown-values: allow transportType: description: Transport type for the MCP connection. enum: - MCP_SERVER_TRANSPORT_TYPE_UNSPECIFIED - MCP_SERVER_TRANSPORT_TYPE_STREAMABLE_HTTP - MCP_SERVER_TRANSPORT_TYPE_SSE type: string x-speakeasy-unknown-values: allow url: description: The HTTP endpoint URL of the external MCP server (HTTPS required). type: string title: Mcp Server External Config type: object x-speakeasy-name-override: MCPServerExternalConfig c1.api.ai_governance.v1.MCPServerAuthBasicAuth: description: |- MCPServerAuthBasicAuth provides HTTP Basic authentication (RFC 7617). The gateway encodes `username:password` as base64 and sends it as `Authorization: Basic ` on every outbound request. properties: password: description: |- Password. Sealed before storage; never returned on read. ignore_empty for the same PER_USER reason as username above. type: string username: description: |- Username. Sent in plaintext over TLS; stored unsealed on the connector config (mirrors how MCPAuthOAuth2.client_id is plaintext). ignore_empty mirrors MCPServerAuthBearerToken.token — PER_USER admin submits don't carry a username; the handler enforces non-empty for SHARED. type: string title: Mcp Server Auth Basic Auth type: object x-speakeasy-name-override: MCPServerAuthBasicAuth c1.api.ai_governance.v1.MCPServerAuthBearerToken: description: MCPServerAuthBearerToken provides bearer token authentication. properties: token: description: The bearer token value. type: string title: Mcp Server Auth Bearer Token type: object x-speakeasy-name-override: MCPServerAuthBearerToken c1.api.ai_governance.v1.MCPServerAuthCustomHeader: description: MCPServerAuthCustomHeader provides custom header authentication. properties: headerName: description: HTTP header name. type: string headerValue: description: HTTP header value. type: string title: Mcp Server Auth Custom Header type: object x-speakeasy-name-override: MCPServerAuthCustomHeader c1.api.ai_governance.v1.MCPServerAuthNone: description: MCPServerAuthNone indicates no authentication is required. title: Mcp Server Auth None type: object x-speakeasy-name-override: MCPServerAuthNone c1.api.ai_governance.v1.MCPServerAuthOAuth2: description: >- MCPServerAuthOAuth2 provides OAuth2 client credentials or JWT Bearer authentication. properties: authorizeUrl: description: >- OAuth2 authorization endpoint URL (for service and passthrough modes). type: string clientId: description: >- OAuth2 client identifier. Required for CLIENT_CREDENTIALS mode; not used for JWT_BEARER mode. type: string clientIdMode: description: >- How the client_id is acquired for authorization_code mode. When DCR (or CIMD), client_id / client_secret are not required on input — the gateway registers itself with the authorization server during Register and injects the result. UNSPECIFIED means manual (admin-entered client_id). enum: - MCP_SERVER_AUTH_OAUTH2_CLIENT_ID_MODE_UNSPECIFIED - MCP_SERVER_AUTH_OAUTH2_CLIENT_ID_MODE_DCR - MCP_SERVER_AUTH_OAUTH2_CLIENT_ID_MODE_CIMD type: string x-speakeasy-unknown-values: allow clientSecret: description: >- OAuth2 client secret. Required for CLIENT_CREDENTIALS mode; not used for JWT_BEARER mode. type: string codeChallengeMethodsSupported: description: >- PKCE code challenge methods supported by the authorization server, as returned by DiscoverOIDCEndpoints. Optional registration-time shortcut that lets the gateway skip the per-flow xjwks.Cache lookup. Capped at 8 entries because RFC 7636 / RFC 8414 only define a tiny enumerated set ("plain", "S256") and we don't want to be a dumping ground for arbitrary strings the IdP might emit. items: type: string type: - array - 'null' extraAuthorizeParams: additionalProperties: type: string description: >- Static query params appended to the authorize URL on top of the standard OAuth2 fields (e.g. Notion "owner=user"). Applies to authorization_code mode only. Inherited from MCPServerCatalogAuthMode.extra_authorize_params at registration time. type: object extraTokenParams: additionalProperties: type: string description: >- Extra body params POSTed to the token endpoint on top of the standard OAuth2 fields. Provider-specific (e.g. Auth0/Wiz "audience"). Applies to client_credentials mode only; other modes ignore it. Inherited from MCPServerCatalogAuthMode.extra_token_params at registration time; admins can add, edit, or remove entries on the edit form. type: object issuerUrl: description: |- OIDC issuer URL (no trailing path). Used as the cache key for live PKCE-methods discovery via xjwks.Cache on the gateway. Populated by the Discover button or hand-entered alongside authorize_url/token_url. Required for SERVICE / PASSTHROUGH modes. type: string jwtAudience: description: >- Audience claim for the JWT. When empty, token_url is used as the audience. type: string jwtIssuer: description: The service account email / issuer claim. type: string jwtPrivateKey: description: >- PEM-encoded RSA private key (plaintext in API; sealed before storage). type: string jwtSubject: description: Optional subject for domain-wide delegation. type: string mode: description: OAuth2 mode. enum: - MCP_SERVER_AUTH_OAUTH2_MODE_UNSPECIFIED - MCP_SERVER_AUTH_OAUTH2_MODE_SERVICE - MCP_SERVER_AUTH_OAUTH2_MODE_PASSTHROUGH - MCP_SERVER_AUTH_OAUTH2_MODE_CLIENT_CREDENTIALS - MCP_SERVER_AUTH_OAUTH2_MODE_JWT_BEARER - MCP_SERVER_AUTH_OAUTH2_MODE_GOOGLE_SERVICE_ACCOUNT - MCP_SERVER_AUTH_OAUTH2_MODE_AUTHORIZATION_CODE type: string x-speakeasy-unknown-values: allow pkce: description: |- PKCE behavior for authorization_code mode: "discover" (or empty), "s256", or "disabled". Inherited from MCPServerCatalogAuthMode.pkce. type: string scopes: description: OAuth2 scopes to request. items: type: string type: - array - 'null' scopesSupported: description: |- Full list of OAuth scopes the IdP advertises in its discovery doc (`scopes_supported`). Distinct from the `scopes` field above, which is the curated subset the admin wants requested on the authorize URL. Captured at registration time so the edit form can offer autocomplete suggestions on the Scopes input without forcing the admin to re-run Discover. Capped at 256 because providers like Salesforce return ~36; 256 leaves headroom without inviting abuse. items: type: string type: - array - 'null' tokenEndpointAuthMethod: description: >- RFC 7591 token_endpoint_auth_method the authorization server assigned. Read-only / ignored on write: server-set from the DCR result, never copied from the API request into the stored model. Surfaced for display only. type: string tokenUrl: description: |- OAuth2 token endpoint URL. Required for all modes when creating or rotating; uses ignore_empty so partial UpdateCredentials calls that omit this path pass protovalidate. The handler enforces required-on-create. type: string title: Mcp Server Auth O Auth 2 type: object x-speakeasy-name-override: MCPServerAuthOAuth2 securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````