@nylorun/runtime 0.19.1-beta → 0.21.0-beta

package/dist/management-openapi.json

@@ -2,16 +2,17 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.19.1-beta",
+    "version": "0.21.0-beta",
     "x-nylorun-protocol": {
       "min": 4,
-      "max": 8,
+      "max": 10,
       "features": [
         "runtime-tenants",
         "admin-status",
         "studio-principal",
         "artifacts",
         "management-api",
+        "resource-server",
         "tenant-fixture-model",
         "transcript-events",
         "subject-headers",
@@ -70,6 +71,8 @@
             "type": "string",
             "enum": [
               "not_found",
+              "credential_required",
+              "credential_invalid",
               "protocol_unsupported",
               "host_rejected",
               "origin_rejected",
@@ -91,10 +94,9 @@
               "sandbox_lost",
               "sandbox_expired",
               "issuer_unavailable",
-              "oauth_client_required",
-              "oauth_state_invalid",
-              "oauth_failed",
               "definition_files_missing",
+              "credential_rejected",
+              "mcp_preview_failed",
               "internal_error"
             ]
           },
@@ -2111,7 +2113,7 @@
             "type": "string",
             "enum": [
               "bearer",
-              "oauth"
+              "headers"
             ]
           },
           "binding": {
@@ -2126,9 +2128,28 @@
             ],
             "additionalProperties": false
           },
-          "expiresAt": {
+          "headerNames": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "via": {
             "type": "string"
           },
+          "identity": {
+            "type": "object",
+            "properties": {
+              "header": {
+                "type": "string",
+                "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+              }
+            },
+            "required": [
+              "header"
+            ],
+            "additionalProperties": false
+          },
           "createdAt": {
             "type": "string"
           },
@@ -2180,6 +2201,22 @@
                   "token": {
                     "type": "string",
                     "minLength": 1
+                  },
+                  "via": {
+                    "type": "string"
+                  },
+                  "identity": {
+                    "type": "object",
+                    "properties": {
+                      "header": {
+                        "type": "string",
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                      }
+                    },
+                    "required": [
+                      "header"
+                    ],
+                    "additionalProperties": false
                   }
                 },
                 "required": [
@@ -2195,104 +2232,33 @@
                   "type": {
                     "type": "string",
                     "enum": [
-                      "oauth"
+                      "headers"
                     ]
                   },
                   "url": {
                     "type": "string",
                     "minLength": 1
                   },
-                  "accessToken": {
-                    "type": "string",
-                    "minLength": 1
+                  "headers": {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string",
+                      "minLength": 1
+                    }
                   },
-                  "expiresAt": {
-                    "type": [
-                      "string",
-                      "null"
-                    ],
-                    "minLength": 1
+                  "via": {
+                    "type": "string"
                   },
-                  "refresh": {
+                  "identity": {
                     "type": "object",
                     "properties": {
-                      "tokenEndpoint": {
+                      "header": {
                         "type": "string",
-                        "minLength": 1
-                      },
-                      "clientId": {
-                        "type": "string",
-                        "minLength": 1
-                      },
-                      "refreshToken": {
-                        "type": "string",
-                        "minLength": 1
-                      },
-                      "tokenEndpointAuth": {
-                        "oneOf": [
-                          {
-                            "type": "object",
-                            "properties": {
-                              "type": {
-                                "type": "string",
-                                "enum": [
-                                  "none"
-                                ]
-                              }
-                            },
-                            "required": [
-                              "type"
-                            ],
-                            "additionalProperties": false
-                          },
-                          {
-                            "type": "object",
-                            "properties": {
-                              "type": {
-                                "type": "string",
-                                "enum": [
-                                  "client_secret_basic"
-                                ]
-                              },
-                              "clientSecret": {
-                                "type": "string",
-                                "minLength": 1
-                              }
-                            },
-                            "required": [
-                              "type",
-                              "clientSecret"
-                            ],
-                            "additionalProperties": false
-                          },
-                          {
-                            "type": "object",
-                            "properties": {
-                              "type": {
-                                "type": "string",
-                                "enum": [
-                                  "client_secret_post"
-                                ]
-                              },
-                              "clientSecret": {
-                                "type": "string",
-                                "minLength": 1
-                              }
-                            },
-                            "required": [
-                              "type",
-                              "clientSecret"
-                            ],
-                            "additionalProperties": false
-                          }
-                        ]
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
                       }
                     },
                     "required": [
-                      "tokenEndpoint",
-                      "clientId",
-                      "refreshToken",
-                      "tokenEndpointAuth"
+                      "header"
                     ],
                     "additionalProperties": false
                   }
@@ -2300,7 +2266,7 @@
                 "required": [
                   "type",
                   "url",
-                  "accessToken"
+                  "headers"
                 ],
                 "additionalProperties": false
               }
@@ -2336,7 +2302,7 @@
                   "type": "string",
                   "enum": [
                     "bearer",
-                    "oauth"
+                    "headers"
                   ]
                 },
                 "binding": {
@@ -2351,9 +2317,28 @@
                   ],
                   "additionalProperties": false
                 },
-                "expiresAt": {
+                "headerNames": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "via": {
                   "type": "string"
                 },
+                "identity": {
+                  "type": "object",
+                  "properties": {
+                    "header": {
+                      "type": "string",
+                      "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                    }
+                  },
+                  "required": [
+                    "header"
+                  ],
+                  "additionalProperties": false
+                },
                 "createdAt": {
                   "type": "string"
                 },
@@ -2404,6 +2389,28 @@
                   "token": {
                     "type": "string",
                     "minLength": 1
+                  },
+                  "via": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "identity": {
+                    "type": [
+                      "object",
+                      "null"
+                    ],
+                    "properties": {
+                      "header": {
+                        "type": "string",
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                      }
+                    },
+                    "required": [
+                      "header"
+                    ],
+                    "additionalProperties": false
                   }
                 },
                 "required": [
@@ -2418,24 +2425,42 @@
                   "type": {
                     "type": "string",
                     "enum": [
-                      "oauth"
+                      "headers"
                     ]
                   },
-                  "accessToken": {
-                    "type": "string",
-                    "minLength": 1
+                  "headers": {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string",
+                      "minLength": 1
+                    }
                   },
-                  "expiresAt": {
+                  "via": {
                     "type": [
                       "string",
                       "null"
+                    ]
+                  },
+                  "identity": {
+                    "type": [
+                      "object",
+                      "null"
                     ],
-                    "minLength": 1
+                    "properties": {
+                      "header": {
+                        "type": "string",
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                      }
+                    },
+                    "required": [
+                      "header"
+                    ],
+                    "additionalProperties": false
                   }
                 },
                 "required": [
                   "type",
-                  "accessToken"
+                  "headers"
                 ],
                 "additionalProperties": false
               }
@@ -2449,44 +2474,134 @@
         ],
         "additionalProperties": false
       },
-      "StartOAuthResponse": {
+      "McpPreview": {
         "type": "object",
         "properties": {
-          "authorizeUrl": {
+          "name": {
             "type": "string"
           },
-          "expiresAt": {
+          "url": {
+            "type": "string"
+          },
+          "type": {
+            "type": "string",
+            "enum": [
+              "streamable-http",
+              "sse"
+            ]
+          },
+          "credentialSent": {
+            "type": "boolean"
+          },
+          "serverInfo": {
+            "type": "object",
+            "additionalProperties": {}
+          },
+          "instructions": {
             "type": "string"
+          },
+          "tools": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "serverToolName": {
+                  "type": "string"
+                },
+                "modelName": {
+                  "type": "string"
+                },
+                "description": {
+                  "type": "string"
+                },
+                "annotations": {
+                  "type": "object",
+                  "additionalProperties": {}
+                },
+                "schemaBytes": {
+                  "type": "integer",
+                  "minimum": 0
+                }
+              },
+              "required": [
+                "serverToolName",
+                "schemaBytes"
+              ],
+              "additionalProperties": false
+            }
+          },
+          "renamed": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "serverToolName": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "serverToolName",
+                "name"
+              ],
+              "additionalProperties": false
+            }
+          },
+          "authRequired": {
+            "type": "object",
+            "properties": {
+              "resourceMetadataUrl": {
+                "type": "string"
+              },
+              "resourceMetadata": {
+                "type": "object",
+                "additionalProperties": {}
+              }
+            },
+            "additionalProperties": false
           }
         },
         "required": [
-          "authorizeUrl",
-          "expiresAt"
+          "name",
+          "url",
+          "type",
+          "credentialSent",
+          "tools",
+          "renamed"
         ],
         "additionalProperties": false
       },
-      "StartOAuthRequest": {
+      "McpPreviewRequest": {
         "type": "object",
         "properties": {
+          "requestId": {
+            "type": "string",
+            "minLength": 1
+          },
           "url": {
             "type": "string",
-            "minLength": 1,
-            "maxLength": 2048
+            "minLength": 1
           },
-          "server": {
+          "type": {
             "type": "string",
-            "minLength": 1,
-            "maxLength": 128
+            "enum": [
+              "streamable-http",
+              "sse"
+            ]
           },
-          "clientId": {
+          "name": {
             "type": "string",
-            "minLength": 1,
-            "maxLength": 512
+            "pattern": "^[A-Za-z0-9_-]{1,64}$"
+          },
+          "vaultId": {
+            "type": "string",
+            "minLength": 1
           }
         },
         "required": [
-          "url",
-          "server"
+          "url"
         ],
         "additionalProperties": false
       },
@@ -2961,10 +3076,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -2990,6 +3105,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -3001,7 +3126,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3053,10 +3178,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3092,6 +3217,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -3103,7 +3238,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3155,10 +3290,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3194,6 +3329,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -3205,7 +3350,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3266,10 +3411,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -3316,7 +3461,7 @@
             }
           },
           "401": {
-            "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
+            "description": "No credential (`credential_required`), one the Tenant does not accept (`credential_invalid`), a token that expired (`token_expired`), or a token whose issuer's keys cannot be fetched now (`issuer_unavailable`). `WWW-Authenticate: Bearer` names the protected resource metadata (`resource_metadata`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3336,7 +3481,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3401,10 +3546,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3430,6 +3575,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -3441,7 +3596,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3503,10 +3658,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3525,6 +3680,16 @@
           "400": {
             "description": "Not a key name, a reserved name, or a management key's name"
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -3536,7 +3701,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3596,10 +3761,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3618,6 +3783,16 @@
           "400": {
             "description": "Not a key name, a reserved name, or a management key's name"
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -3629,7 +3804,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3680,10 +3855,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3709,8 +3884,8 @@
               }
             }
           },
-          "403": {
-            "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
             "content": {
               "application/json": {
                 "schema": {
@@ -3719,9 +3894,19 @@
               }
             }
           },
-          "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
-            "content": {
+          "403": {
+            "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found (`not_found`)",
+            "content": {
               "application/json": {
                 "schema": {
                   "$ref": "#/components/schemas/Rejected"
@@ -3771,10 +3956,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3800,6 +3985,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -3811,7 +4006,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3862,10 +4057,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3891,6 +4086,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -3902,7 +4107,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -3951,10 +4156,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3990,6 +4195,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4001,7 +4216,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4052,10 +4267,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4091,6 +4306,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4102,7 +4327,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4191,10 +4416,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4220,6 +4445,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4231,7 +4466,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4301,10 +4536,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4330,6 +4565,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4341,7 +4586,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4392,10 +4637,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4421,6 +4666,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4432,7 +4687,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4482,10 +4737,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4521,6 +4776,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4532,7 +4797,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4584,10 +4849,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4623,6 +4888,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4634,7 +4909,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4697,10 +4972,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4726,6 +5001,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4737,7 +5022,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4796,10 +5081,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4825,6 +5110,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4836,7 +5131,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4893,10 +5188,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4922,6 +5217,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -4933,7 +5238,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -4971,7 +5276,7 @@
           "Vaults"
         ],
         "summary": "Add a credential",
-        "description": "A bearer token or OAuth tokens, bound to the URLs a tool may send them to.",
+        "description": "A bearer token, bound to the URL a tool may send it to.",
         "security": [
           {
             "managementKey": []
@@ -4993,10 +5298,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5032,6 +5337,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -5043,7 +5358,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -5100,10 +5415,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5129,6 +5444,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -5140,7 +5465,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -5207,10 +5532,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5236,6 +5561,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -5247,7 +5582,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -5312,10 +5647,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5351,6 +5686,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -5362,7 +5707,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -5430,10 +5775,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5459,6 +5804,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -5470,7 +5825,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -5502,13 +5857,13 @@
         }
       }
     },
-    "/v1/tenant/vaults/{vaultId}/oauth/start": {
+    "/v1/tenant/mcp/preview": {
       "post": {
         "tags": [
-          "Vaults"
+          "MCP servers"
         ],
-        "summary": "Start an MCP OAuth connect",
-        "description": "Signs the installation in to the remote MCP server at `url` (declared as `server`) and stores its OAuth credential, bound to `url`, in this installation vault. The Runtime discovers the server's authorization server (RFC 9728, RFC 8414), registers itself (RFC 7591) unless `clientId` names a registered client, and answers the URL to open in a browser; the sign-in returns to `GET /v1/oauth/callback` within `expiresAt`. The callback URL is `NYLORUN_PUBLIC_URL` + `/v1/oauth/callback`, or this request's own origin when the Host has no public URL. Application keys acting for no one only. `oauth_client_required` when the server offers no registration and no `clientId` was given.",
+        "summary": "Preview an MCP server's tools",
+        "description": "Connects to the remote MCP server at `url` with the installation vault's credential for that URL (its headers and `via`; never an identity header), under the Host's address policy, lists its tools within 15 s and closes the connection. It never calls a tool. Each tool comes with the name the model would call it (`modelName`, made with `name`), its annotations and its input schema's size. A server that answers `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any: it needs a person's sign-in, so reach it through a gateway (`via`), or with a key. No credential value is in the answer.",
         "security": [
           {
             "managementKey": []
@@ -5519,21 +5874,13 @@
         ],
         "x-nylorun-scopes": "never",
         "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": true,
-            "name": "vaultId",
-            "in": "path"
-          },
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5543,18 +5890,18 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/StartOAuthRequest"
+                "$ref": "#/components/schemas/McpPreviewRequest"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Where to send the browser",
+            "description": "The server's tools, or that it needs a credential (`authRequired`)",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/StartOAuthResponse"
+                  "$ref": "#/components/schemas/McpPreview"
                 }
               }
             }
@@ -5569,18 +5916,8 @@
               }
             }
           },
-          "403": {
-            "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
             "content": {
               "application/json": {
                 "schema": {
@@ -5589,21 +5926,8 @@
               }
             }
           },
-          "426": {
-            "description": "`Nylorun-Protocol` missing or unsupported",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProtocolRejected"
-                }
-              }
-            }
-          },
-          "502": {
-            "description": "The authorization server, or its discovery, failed or refused (`oauth_failed`)"
-          },
-          "503": {
-            "description": "The Tenant's storage or streams are unavailable",
+          "403": {
+            "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
               "application/json": {
                 "schema": {
@@ -5611,101 +5935,9 @@
                 }
               }
             }
-          }
-        }
-      }
-    },
-    "/v1/oauth/callback": {
-      "get": {
-        "tags": [
-          "Vaults"
-        ],
-        "summary": "Finish an MCP OAuth connect",
-        "description": "Where the authorization server sends the browser back with `code` and `state` (or `error`). Exchanges the code once and stores the credential; answers a small HTML page. Needs no credential and no `Nylorun-Protocol`. A `state` is used once, for ten minutes (`oauth_state_invalid`).",
-        "security": [
-          {
-            "applicationKey": []
-          },
-          {
-            "issuerToken": []
-          },
-          {}
-        ],
-        "x-nylorun-credentials": [
-          "application",
-          "subject",
-          "token"
-        ],
-        "x-nylorun-scopes": "any",
-        "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": false,
-            "name": "code",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": false,
-            "name": "state",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": false,
-            "name": "error",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The protocol version, `8`"
-            },
-            "required": false,
-            "description": "The protocol version, `8`",
-            "name": "Nylorun-Protocol",
-            "in": "header"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The person an application key acts for"
-            },
-            "required": false,
-            "description": "The person an application key acts for",
-            "name": "Nylorun-Subject",
-            "in": "header"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The subject's space-separated scopes; required with a subject"
-            },
-            "required": false,
-            "description": "The subject's space-separated scopes; required with a subject",
-            "name": "Nylorun-Scopes",
-            "in": "header"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Connected",
-            "content": {
-              "text/html": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
           },
-          "400": {
-            "description": "Invalid headers, path, body or cursor",
+          "404": {
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -5714,8 +5946,8 @@
               }
             }
           },
-          "401": {
-            "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
+          "409": {
+            "description": "Several installation vaults hold a credential for the URL (name one with `vaultId`), or the one there cannot be used",
             "content": {
               "application/json": {
                 "schema": {
@@ -5724,18 +5956,18 @@
               }
             }
           },
-          "403": {
-            "description": "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
+          "426": {
+            "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Rejected"
+                  "$ref": "#/components/schemas/ProtocolRejected"
                 }
               }
             }
           },
-          "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+          "502": {
+            "description": "The server could not be listed (`mcp_preview_failed`): `details.failure` is the code a tool call would have failed with, such as `mcp.unreachable` for an address the Host refuses",
             "content": {
               "application/json": {
                 "schema": {
@@ -5744,19 +5976,6 @@
               }
             }
           },
-          "426": {
-            "description": "`Nylorun-Protocol` missing or unsupported",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProtocolRejected"
-                }
-              }
-            }
-          },
-          "502": {
-            "description": "The authorization server refused the code (`oauth_failed`)"
-          },
           "503": {
             "description": "The Tenant's storage or streams are unavailable",
             "content": {
@@ -5789,10 +6008,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5818,6 +6037,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -5829,7 +6058,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -5881,10 +6110,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5920,6 +6149,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -5931,7 +6170,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -5993,10 +6232,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6032,6 +6271,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -6043,7 +6292,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -6097,10 +6346,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6126,6 +6375,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -6137,7 +6396,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -6187,10 +6446,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6226,6 +6485,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -6237,7 +6506,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -6288,10 +6557,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6317,6 +6586,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -6328,7 +6607,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -6378,10 +6657,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `8`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6417,6 +6696,16 @@
               }
             }
           },
+          "401": {
+            "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
           "403": {
             "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
@@ -6428,7 +6717,7 @@
             }
           },
           "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "description": "Not found (`not_found`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -6477,7 +6766,11 @@
     },
     {
       "name": "Vaults",
-      "description": "The installation's credentials for agents' tools: API keys and MCP OAuth connections. Sessions attach a vault by id. `admin.vaults`."
+      "description": "The installation's and each person's credentials for agents' tools: API keys, bound to the URL they are sent to. Sessions attach a vault by id. `admin.vaults`."
+    },
+    {
+      "name": "MCP servers",
+      "description": "See a remote MCP server's tools before an agent names it, with the installation vault's credential for its URL: their model names, sizes and annotations, or that it needs a person's sign-in. `admin.mcp`."
     },
     {
       "name": "Signing keys",