{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}MCP token object
The fields that decide what it reaches
| Field | |
|---|---|
use_created_by_permissions | true makes it a full access token: it follows the permissions of the person who created the API key, as those change. false makes it scoped — it carries its own selection, described below. |
tool_scope | Which MCP tools the token may call. Omit for all of them. Names come from the tools reference; a name your MCP server version does not ship is stored and grants nothing. |
table_scopes, volume_scopes | Catalog links, as {"layers": [], "folders": [], "tables": []}. Linking a layer or folder means everything inside it, now and in the future. |
secret_scopes | Ids of secrets the token may reference. |
semantic_layer_scopes | {"folders": [], "documents": []}. A folder covers its whole subtree. |
live_connection_scopes | One entry per live connection, each with an optional tools subset. |
all_tables, all_volumes, all_secrets, all_semantic_layer, all_live_connections | Take a whole axis instead of selecting within it. On Starter and Free this is the only form of scoping available — see Permissions. |
bearer_token is never returned to an API key, on any of these endpoints. The secret is
handed over through a one-time reveal_url that only opens in its creator’s browser session.Related
- Create an MCP token · Update · Rotate
- Permissions — full access vs scoped, and how each reacts to permission changes.
- Tools — the names
tool_scopeaccepts.
80MCP Configuration (Field only visible on expanded view. Expandable)
Created by (Expandable)
When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Show child attributes
Show child attributes
Ids of the secrets this restricted token may reference. Omit to inherit the creator's; [] for none.
Semantic Layer surface of this restricted token: {"folders": [...], "documents": [...]}. A folder covers its whole subtree, resolved at read time. Omit to inherit the creator's.
Show child attributes
Show child attributes
Catalog links for the TABLES axis: {"layers": [...], "folders": [...], "tables": [...]}. A layer or folder link means everything inside it, now and in the future — tables only.
Show child attributes
Show child attributes
Catalog links for the VOLUMES axis: {"layers": [...], "folders": [...], "volumes": [...]}. The same layer linked here brings volumes only, never tables.
Show child attributes
Show child attributes
Tables (Expandable)
Was this page helpful?