> ## Documentation Index
> Fetch the complete documentation index at: https://internal.september.wtf/llms.txt
> Use this file to discover all available pages before exploring further.

# Asset Directory endpoints

> Manage MCP server connections — list, connect, disconnect, OAuth callbacks.

The Asset Directory holds the user's MCP connections and credentials. These
endpoints let you list available servers, initiate connections, complete
OAuth flows, and disconnect.

All endpoints require `X-Engine-Key`.

## GET /assets/servers

List MCP servers the Engine knows about.

```json theme={null}
[
  {
    "server_name": "slack",
    "display_name": "Slack",
    "transport": "sse",
    "auth_method": "oauth",
    "status": "available"
  }
]
```

## GET /assets/connections

List the user's active connections.

```json theme={null}
[
  {
    "ref_id": "conn-...",
    "server_name": "slack",
    "status": "connected",
    "scopes": ["channels:read", "chat:write"],
    "expires_at": "2026-05-27T..."
  }
]
```

## POST /assets/connect

Initiate a connection to a server.

```http theme={null}
POST /assets/connect
Content-Type: application/json

{
  "server_name": "slack",
  "server_config": null
}
```

For OAuth servers, the response includes a redirect URL the user must
visit to grant access:

```json theme={null}
{
  "ref_id": "conn-...",
  "status": "pending_oauth",
  "auth_url": "https://slack.com/oauth/..."
}
```

For non-OAuth servers (static API key), the connection is established
immediately:

```json theme={null}
{
  "ref_id": "conn-...",
  "status": "connected"
}
```

## POST /assets/callback

Internal endpoint used by the OAuth completion flow. Application code
typically doesn't call this directly — the user's browser is redirected
to `/assets/oauth/callback`, which posts to this endpoint.

## GET /assets/oauth/callback

OAuth redirect target. The OAuth provider redirects the user's browser
here after consent. The Engine validates the `state`, completes the
token exchange, and either redirects back to the application or returns
JSON.

| Query   | Purpose                                     |
| ------- | ------------------------------------------- |
| `code`  | OAuth authorization code from the provider. |
| `state` | CSRF-protection state token.                |

## DELETE /assets/connections/{ref_id}

Disconnect. Revokes the stored credentials and removes the connection.

```json theme={null}
{ "status": "disconnected", "ref_id": "conn-..." }
```

## See also

* [Built-in MCP tool](../../agents-and-tools/built-in-tools/mcp) for how
  connected servers show up to the agent.
* [Environment variables](../../../operations/config/env-vars) for
  `AD_ENCRYPTION_KEY` and `OAUTH_REDIRECT_BASE_URL`.