> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.taktoria.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.taktoria.com/_mcp/server.

# List

GET https://api.taktoria.com/api/v1/mcp-connections

The workspace's MCP connections, newest first. A key, or a workspace
admin's session, sees every connection, as Settings → MCP connections lists
them; anybody else's session sees their own, as Account → Connected
apps does. Requires `mcpConnections:read`.

Reference: https://docs.taktoria.com/api-reference/mcp-connections/list

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Servers

- `https://api.taktoria.com/api/v1` (Production, default)
- `http://localhost:3000/api/v1` (Local)

## Request

### Query parameters

- `limit` (integer, optional) — 1 to 200; 50 by default.
- `cursor` (string, optional)

## Response

### 200

- `data` (list of McpConnection, required)
- `hasMore` (boolean, required)
- `nextCursor` (string, optional) — Pass as `cursor` for the next page; null on the last.

## Errors

### 401 Unauthorized Error

- `error` (ErrorDetail, required)

### 403 Forbidden Error

Refused, and `error.code` says why. On an app's write endpoints, a signed-in session is refused `viewer_only` when the person is a Viewer of the app (they read it, and change nothing in it), and `seat_required` without a seat on it; a key is never either. Beyond those: `admin_required` when the change is an admin's (an app admin's for an app's admin powers, a workspace admin's for the workspace's settings), `forbidden` when the person may not change this one thing, `read_only_session` for a change only a key makes, `person_required` for what only a signed-in person does through their own account elsewhere (exporting a LaunchCal artifact to their docs tool), which a key cannot, `insufficient_scope` for a key without the scope, and `google_sign_in_required` for a session the workspace's Google rule turns away. Nothing was done.

- `error` (ErrorDetail, required)

### 429 Too Many Requests Error

Rate limited (`rate_limited`): the key, the signed-in person, the workspace or an expensive endpoint's own budget is used up for now. `Retry-After` says how many seconds to wait, and `details` names the `policy`, its `limit`, `windowSeconds` and `retryAfter`. Every answer to an authenticated request carries the IETF `RateLimit-Policy` and `RateLimit` headers, so a client can slow down before it gets this. Nothing was done; wait and send it again. See "Rate limits".

- `error` (ErrorDetail, required)

## Types

### McpConnection

One person's connection of an AI assistant to the workspace through MCP, made on the consent page. It acts as that person, with their seats and rights. Its tokens are never shown.

- `id` (string, required)
- `person` (McpConnectionPerson, required) — The member who connected the assistant, and whom it acts as.
- `client` (McpConnectionClient, required) — The AI assistant, as it identified itself to Taktoria's OAuth server: registered (RFC 7591), or by a Client ID Metadata Document (MCP 2026-07-28).
- `scopes` (list of string, required) — What it may do, as MCP scopes: `<app>:read` and `<app>:write`, such as `launchcal:read` or `okrhub:write`. See [Scopes](/ai-assistants/mcp-servers#scopes).
- `createdAt` (datetime, required)
- `signInMethod` (string, optional) — How the person was signed in when they connected it: `google`, `sso` or `password`. A workspace that requires Google refuses a connection not made with Google.
- `lastUsedAt` (datetime, optional) — The last request it made, to the minute. Absent if it has made none.

### ErrorDetail

- `code` (string, required) — A stable machine-readable code such as `not_found`.
- `message` (string, required)
- `details` (any, optional)

### McpConnectionPerson

The member who connected the assistant, and whom it acts as.

- `id` (string, required)
- `name` (string, required)

### McpConnectionClient

The AI assistant, as it identified itself to Taktoria's OAuth server: registered (RFC 7591), or by a Client ID Metadata Document (MCP 2026-07-28).

- `id` (string, required) — Its OAuth client id. For a client identified by a Client ID Metadata Document, this is the document's HTTPS address.
- `name` (string, required) — The name it gave itself when it was connected, such as `Claude`.
- `host` (string, optional) — Who it is, as far as Taktoria can tell, as the consent page shows it: the host its Client ID Metadata Document was fetched from, when it has one (that host vouches for it); otherwise where it sends people back to after connecting, such as `claude.ai`, or a native app's scheme such as `cursor`.

## Examples

**Response**

```json
{
  "data": [
    {
      "id": "mcp_7f3a",
      "person": {
        "id": "usr_1",
        "name": "Ada Lovelace"
      },
      "client": {
        "id": "cl_claude",
        "name": "Claude",
        "host": "claude.ai"
      },
      "scopes": [
        "launchcal:read",
        "okrhub:read",
        "okrhub:write"
      ],
      "createdAt": "2026-10-01T09:00:00Z",
      "signInMethod": "google",
      "lastUsedAt": "2026-10-11T14:32:00Z"
    }
  ],
  "hasMore": false,
  "nextCursor": null
}
```

**SDK Code**

```python
import requests

url = "https://api.taktoria.com/api/v1/mcp-connections"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.taktoria.com/api/v1/mcp-connections';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.taktoria.com/api/v1/mcp-connections"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.taktoria.com/api/v1/mcp-connections")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.taktoria.com/api/v1/mcp-connections")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.taktoria.com/api/v1/mcp-connections', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.taktoria.com/api/v1/mcp-connections");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.taktoria.com/api/v1/mcp-connections")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```