{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}MCP token object
The fields that decide what it reaches
| Field | |
|---|---|
use_created_by_permissions | Derived, not chosen. A token that declares any scope field below is scoped: it carries its own selection. A token that declares none is full access: it follows the permissions of the person who created the API key, as those change. Sending true together with a scope field returns 400. |
tool_scope | Which MCP tools the token may call. Omit for all of them. Names come from the tools reference; a name that is unknown or not available to the key’s creator returns 400. |
table_scopes, volume_scopes | Catalog links, as {"layers": [], "folders": [], "tables": []}. Linking a layer or folder means everything inside it, now and in the future. |
secret_scopes | Ids of secrets the token may reference. Stored and validated, but no tool a scoped token can reach uses secrets yet, so today this field has no effect. |
semantic_layer_scopes | {"folders": [], "documents": []}. A folder covers its whole subtree. |
live_connection_scopes | One entry per live connection, each with an optional tools subset. |
all_tables, all_volumes, all_secrets, all_semantic_layer, all_live_connections | Take a whole axis instead of selecting within it. On Starter and Free this is the only form of scoping available; see Permissions. |
Other fields
| Field | |
|---|---|
expires_at | When the token stops working. One year after creation by default, and never more than a year. It cannot be changed after creation. |
last_used_at | When the token last made a request, taken from the token access log. For a token idle for longer than the log keeps, or on the Free plan, where the log does not record, it falls back to the last value recorded before the log existed, or null if there is none. |
bearer_token is never returned to an API key, on any of these endpoints. The secret is
handed over through a one-time reveal_url that only opens in its creator’s browser session.Related
- Create an MCP token · Update · Rotate
- Permissions: full access vs scoped, and how each reacts to permission changes.
- Tools: the names
tool_scopeaccepts.
80When the token was last used to call the API, or null if it never was.
MCP Configuration (Field only visible on expanded view. Expandable)
Created by (Expandable)
When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Show child attributes
Show child attributes
Ids of the secrets this restricted token may reference. Omit to inherit the creator's; [] for none.
Semantic Layer surface of this restricted token: {"folders": [...], "documents": [...]}. A folder covers its whole subtree, resolved at read time. Omit to inherit the creator's.
Show child attributes
Show child attributes
Catalog links for the TABLES axis: {"layers": [...], "folders": [...], "tables": [...]}. A layer or folder link means everything inside it, now and in the future — tables only.
Show child attributes
Show child attributes
Catalog links for the VOLUMES axis: {"layers": [...], "folders": [...], "volumes": [...]}. The same layer linked here brings volumes only, never tables.
Show child attributes
Show child attributes
Tables (Expandable)
Was this page helpful?