PingOne Privilege

OpenAPI MCP

An OpenAPI MCP application exposes an OpenAPI-described REST API as MCP tools that AI agents can call, subject to PingOne Privilege policy. Each operation in the specification becomes an MCP tool, so you can control API access at the operation level without deploying your own MCP server. PingOne Privilege hosts the OpenAPI MCP application as a managed container on the AI gateway.

This integration provides:

  • Use of OpenAPI MCP when you have REST APIs documented by OpenAPI specifications.

  • Tool, prompt, and resource-level PingOne Privilege policy.

  • Full audit of agent tool calls in Activity > Activity Logs.

Configure an OpenAPI MCP integration

Configuration involves creating an OpenAPI MCP application in PingOne Privilege, configuring policies for the application, and establishing connectivity between the agent and an Agent Privilege gateway.

Before you begin

Ensure you have the following:

  • An AI gateway configured in Directory > Gateways. Learn more in AI gateways.

  • An OpenAPI specification for the API you want to expose.

Step 1: Create an OpenAPI MCP application in PingOne Privilege

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. Click the Add Application tab and select the OpenAPI MCP tile.

  3. Configure the following fields:

    • Application Name: A name for the application, for example, payments-api-mcp.

    • Mesh Cluster: Leave this field empty for now. You’ll select the mesh cluster after you create the application.

    • REST API Endpoint: The base URL of the API that the specification describes, for example, https://api.example.com.

    • Tool Mode: How operations from the specification are exposed as tools.

    • OpenAPI Spec URL: The location of the OpenAPI specification, for example, https://example.com/openapi.yaml.

    • Auth Mode: How PingOne Privilege authenticates to the backend API:

      • Static Token: A fixed token that PingOne Privilege sends on every request.

      • User Token: The authorization token is sourced automatically from the calling user’s User Vault credential at request time.

      • None: No authentication is sent to the backend API. Use this only if the API is publicly accessible or secured at the network level.

    • Headers: Optional custom HTTP headers to send when calling the backend API.

  4. Click Create.

Step 2: Configure policies for OpenAPI operations

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. In the list, find the OpenAPI MCP application.

  3. Click (⋮), then click Create Policy.

  4. Select which operations from the OpenAPI specification are available to agents.

  5. Click Update Configuration.

  6. Add the users or groups the policy will apply to.

  7. Define the users or groups the policy will apply to.

  8. Click Continue.

  9. Configure the policy with the following fields:

    • Policy Name

    • Select Timezone

    • Start Date and Start Time

    • End Date in hours, days, weeks, months, or custom date.

  10. Click Submit to save the policy.

Step 3: Establish connectivity between agent and gateway

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. On the Active Applications tab, find the OpenAPI MCP application and click More Info.

  3. On the Overview tab’s Resource Information section, select a configured AI Gateway from the list.

  4. Copy the MCP Config code.

  5. Use the code you just copied to connect to the OpenAPI MCP app through your client. For example, you can paste the code into Claude Desktop.

    Result: The associated OpenAPI MCP app is now accessible through that client.

  6. Validate that the OpenAPI MCP tools appear in the client and that restricted tools don’t appear.

Result

Users can now get the MCP Config for connecting their client to the OpenAPI MCP app under Agentic Apps in the PingOne Privilege user console.