Post
/api/mcp-manager/audit/events
Accepts a batch of mutating or security-relevant audit events observed by the gateway (tool invocations, logins, tool publishing) and forwards each into the tenant's audit stream. Pool-token accessible -- called by the gateway itself, not by end users.
Security
HTTP
Type bearer
Body parameters
object
schemaVersion
string Required
gateway
object (McpAuditGatewayInfo) Required
instanceId
string
version
string
events
Array of object (McpAuditEvent) Required
object
id
string Required
Gateway-generated UUIDv4 -- idempotency key.
timestamp
string (date-time) Required
eventType
string Required
Free-form -- not restricted to a fixed set. Common values today are tool.invoke, user.login, admin.login and tools.publish, but the gateway may report other event types mcp-manager does not yet know about; those are still forwarded into the audit stream rather than rejected.
username
string Required
server
string | null
tool
string | null
decision
string | null
Valid values[
"allow",
"deny",
"bypass"
]
success
boolean
message
string
requestId
string | null
endpoint
string | null
details
object
Responses
202
Batch accepted; individual malformed events may be dropped (accepted < total).
object
accepted
integer
400
Malformed envelope