{"openapi":"3.1.0","info":{"title":"FusionAuth (BYOK) API","version":"0.1.0","description":"FusionAuth (BYOK) lets an AI assistant read your own FusionAuth data through the FusionAuth API with a key you supply (FusionAuth API key). Read-only: 11 tools (get_system_version, list_applications, get_application, list_tenants, list_groups, list_lambdas, list_webhooks, list_themes, list_consents, list_email_templates, list_user_actions). The BYOK key travels with each request, is used for that...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-fusionauth.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-fusionauth/docs"},"termsOfService":"https://connectorbay.com/byok-fusionauth/terms"},"servers":[{"url":"https://byok-fusionauth.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-fusionauth/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/get_system_version":{"post":{"operationId":"get_system_version","summary":"Show which FusionAuth version the instance is running. Use for \"Which FusionAuth version is our instance running\".","description":"Show which FusionAuth version the instance is running. Use for \"Which FusionAuth version is our instance running\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"}},"required":["instance"],"title":"get_system_versionArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_applications":{"post":{"operationId":"list_applications","summary":"List applications with name, state, tenant, OAuth client ID, enabled grants and redirect URLs. Client secrets are not re","description":"List applications with name, state, tenant, OAuth client ID, enabled grants and redirect URLs. Client secrets are not returned by this tool. Use for \"Which applications are set up in our FusionAuth instance\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"},"inactive":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"description":"True to include inactive applications as well.","title":"Inactive"}},"required":["instance"],"title":"list_applicationsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_application":{"post":{"operationId":"get_application","summary":"Get one application by ID: name, state, OAuth client ID, grants, redirect URLs and the roles it defines. Use for \"What r","description":"Get one application by ID: name, state, OAuth client ID, grants, redirect URLs and the roles it defines. Use for \"What roles and redirect URLs does the FusionAuth application with a given ID have\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"},"application_id":{"description":"Application ID (a UUID) from list_applications.","maxLength":200,"title":"Application Id","type":"string"}},"required":["instance","application_id"],"title":"get_applicationArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_tenants":{"post":{"operationId":"list_tenants","summary":"List tenants with name, state, issuer, theme, base URL and last update. Detailed security settings are not returned by t","description":"List tenants with name, state, issuer, theme, base URL and last update. Detailed security settings are not returned by this tool. Use for \"Which tenants does our FusionAuth instance have\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"}},"required":["instance"],"title":"list_tenantsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_groups":{"post":{"operationId":"list_groups","summary":"List groups with name, tenant and the application roles they grant. Members are not listed. Use for \"What groups exist i","description":"List groups with name, tenant and the application roles they grant. Members are not listed. Use for \"What groups exist in FusionAuth and what roles do they carry\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"}},"required":["instance"],"title":"list_groupsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_lambdas":{"post":{"operationId":"list_lambdas","summary":"List lambdas (custom JWT, reconcile and validation functions) with name, type, engine and debug flag. The script body is","description":"List lambdas (custom JWT, reconcile and validation functions) with name, type, engine and debug flag. The script body is not returned by this tool. Use for \"Which lambdas are configured in FusionAuth\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"},"type":{"anyOf":[{"maxLength":60,"type":"string"},{"type":"null"}],"default":null,"description":"Only lambdas of this type, for example JWTPopulate, OpenIDReconcile or LoginValidation.","title":"Type"}},"required":["instance"],"title":"list_lambdasArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_webhooks":{"post":{"operationId":"list_webhooks","summary":"List webhooks with description, target URL, whether they are global, and the tenants they apply to. Credentials are not ","description":"List webhooks with description, target URL, whether they are global, and the tenants they apply to. Credentials are not returned by this tool. Use for \"Which webhooks does FusionAuth call and where\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"}},"required":["instance"],"title":"list_webhooksArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_themes":{"post":{"operationId":"list_themes","summary":"List themes with name, type (simple or advanced) and last update. Templates and stylesheets are not returned by this too","description":"List themes with name, type (simple or advanced) and last update. Templates and stylesheets are not returned by this tool. Use for \"Which login page themes exist in FusionAuth\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"}},"required":["instance"],"title":"list_themesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_consents":{"post":{"operationId":"list_consents","summary":"List consent definitions with name, allowed values, self-consent age and whether several values may be granted. Use for ","description":"List consent definitions with name, allowed values, self-consent age and whether several values may be granted. Use for \"What consents are defined in FusionAuth\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"}},"required":["instance"],"title":"list_consentsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_email_templates":{"post":{"operationId":"list_email_templates","summary":"List email templates with name, default subject and from address. Template bodies are not returned by this tool. Use for","description":"List email templates with name, default subject and from address. Template bodies are not returned by this tool. Use for \"Which email templates exist in FusionAuth\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"}},"required":["instance"],"title":"list_email_templatesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_user_actions":{"post":{"operationId":"list_user_actions","summary":"List user actions (such as warnings or timed suspensions) with name, whether they block login, and whether they are temp","description":"List user actions (such as warnings or timed suspensions) with name, whether they block login, and whether they are temporal. Use for \"Which user actions are defined in FusionAuth\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"instance":{"description":"Your FusionAuth Cloud hostname label: the part before .fusionauth.io, for example 'acme' for acme.fusionauth.io.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Instance","type":"string"},"inactive":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"description":"True to include inactive actions as well.","title":"Inactive"}},"required":["instance"],"title":"list_user_actionsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}