Update an MCP server's request policy

PUT/v1/mcp-servers/{slug}/policy

Update an MCP server's request policy.

A partial update: absent fields are left unchanged; clear_sampling_max_tokens and clear_sampling_budget remove those caps. When sampling is on, the server needs sampling_virtual_key (a virtual key of the server's workspace, not disabled or expired) and sampling_model (allowed by that key); sampling completions are billed to that key.

Requires an organization admin key, or a workspace admin key for the server's workspace. Returns 400 when sampling is on without a usable key and model, or for an invalid root URI. Returns 402 when the organization's plan does not include the MCP Gateway. Returns 404 when the server does not exist in the organization.

Authorization

AuthorizationBearer va_
A platform API key (va_...), created under Settings > API keys. Scoped to an organization or one workspace, with an admin or member role. Used by the management API.

Path parameters

slugstringrequired
The MCP server's slug (mcps-...).

Query parameters

organizationstringrequired
The organization's identifier (slug).

Request body application/json

the fields to change

sampling_enabledboolean
Whether the upstream may ask for LLM completions. Default false. Turning it on needs sampling_virtual_key and sampling_model.
sampling_virtual_keystring
The slug of a virtual key in the server's workspace; sampling completions run, and are billed, on it. It must not be disabled or expired, and must allow sampling_model. Empty clears it.
At least 0 characters · At most 64 characters
sampling_modelstring
The model every sampling request runs on, up to 255 characters; the upstream's model preferences are ignored. Empty clears it.
At least 0 characters · At most 255 characters
sampling_max_tokensinteger<int32>
Most tokens one sampling completion may produce, 1 to 32000. Absent: the gateway default (1024).
Minimum 1 · Maximum 32000
clear_sampling_max_tokensboolean
true in an update removes the server's token cap, back to the gateway default.
sampling_budget_usdnumber
Sampling spend allowed per calendar month (UTC), in USD. Absent: no cap. 0 stops all sampling.
Minimum 0
clear_sampling_budgetboolean
true in an update removes the budget.
sampling_spent_usdnumber
Read-only: what sampling has cost this calendar month (UTC), in USD.
elicitation_enabledboolean
Whether the upstream may ask the person for input. Default true. Requests that ask for a credential are always refused, and guardrails scan each request.
elicitation_url_modeboolean
Whether the upstream may send the person to a web page (an https URL) instead of a form. Default false.
roots_enabledboolean
Whether the upstream may ask which roots the client works in; it is answered with allowed_roots. Default false.
allowed_rootsstring[]
The root URIs the upstream may learn, for example file:///home/agent/project, at most 20. Absolute URIs with no user info or fragment. Replaces the list when sent.
At most 20 items
max_nesting_depthinteger<int32>
How many rounds of sampling, elicitation or roots requests one call may take, 1 to 10. Default 3.
Minimum 1 · Maximum 10

Responses

200application/json

sampling_enabledboolean
Whether the upstream may ask for LLM completions. Default false. Turning it on needs sampling_virtual_key and sampling_model.
sampling_virtual_keystring
The slug of a virtual key in the server's workspace; sampling completions run, and are billed, on it. It must not be disabled or expired, and must allow sampling_model. Empty clears it.
At least 0 characters · At most 64 characters
sampling_modelstring
The model every sampling request runs on, up to 255 characters; the upstream's model preferences are ignored. Empty clears it.
At least 0 characters · At most 255 characters
sampling_max_tokensinteger<int32>
Most tokens one sampling completion may produce, 1 to 32000. Absent: the gateway default (1024).
Minimum 1 · Maximum 32000
clear_sampling_max_tokensboolean
true in an update removes the server's token cap, back to the gateway default.
sampling_budget_usdnumber
Sampling spend allowed per calendar month (UTC), in USD. Absent: no cap. 0 stops all sampling.
Minimum 0
clear_sampling_budgetboolean
true in an update removes the budget.
sampling_spent_usdnumber
Read-only: what sampling has cost this calendar month (UTC), in USD.
elicitation_enabledboolean
Whether the upstream may ask the person for input. Default true. Requests that ask for a credential are always refused, and guardrails scan each request.
elicitation_url_modeboolean
Whether the upstream may send the person to a web page (an https URL) instead of a form. Default false.
roots_enabledboolean
Whether the upstream may ask which roots the client works in; it is answered with allowed_roots. Default false.
allowed_rootsstring[]
The root URIs the upstream may learn, for example file:///home/agent/project, at most 20. Absolute URIs with no user info or fragment. Replaces the list when sent.
At most 20 items
max_nesting_depthinteger<int32>
How many rounds of sampling, elicitation or roots requests one call may take, 1 to 10. Default 3.
Minimum 1 · Maximum 10

Request

curl -X PUT "https://api.vectoraxis.ai/v1/mcp-servers/{slug}/policy?organization=string" \
  -H "Authorization: Bearer $VECTORAXIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "sampling_enabled": true,
  "sampling_virtual_key": "string",
  "sampling_model": "string",
  "sampling_max_tokens": 1,
  "clear_sampling_max_tokens": true,
  "sampling_budget_usd": 0,
  "clear_sampling_budget": true,
  "sampling_spent_usd": 0,
  "elicitation_enabled": true,
  "elicitation_url_mode": true,
  "roots_enabled": true,
  "allowed_roots": [
    "string"
  ],
  "max_nesting_depth": 1
}'

VectorAxis is built by GK Labs, a member of NVIDIA Inception.