---
title: OpenAPI MCP
description: An OpenAPI MCP application exposes APIs described by OpenAPI specifications to AI agents over MCP in Agent Privilege.
component: privilege
page_id: privilege:agent-privilege:configuration/agentic-apps/openapi-mcp
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/agentic-apps/openapi-mcp.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: September 10, 2026
section_ids:
  configure-an-openapi-mcp-integration: Configure an OpenAPI MCP integration
  before-you-begin: Before you begin
  step-1-create-an-openapi-mcp-application-in-pingone-privilege: "Step 1: Create an OpenAPI MCP application in PingOne Privilege"
  step-2-configure-policies-for-openapi-operations: "Step 2: Configure policies for OpenAPI operations"
  step-3-establish-connectivity-between-agent-and-gateway: "Step 3: Establish connectivity between agent and gateway"
  result: Result
---

# OpenAPI MCP

An OpenAPI MCP application exposes an [OpenAPI](https://spec.openapis.org/)-described REST API as MCP tools that AI agents can call, subject to PingOne Privilege policy. Each operation in the specification becomes an MCP tool, so you can control API access at the operation level without deploying your own MCP server. PingOne Privilege hosts the OpenAPI MCP application as a managed container on the [AI gateway](../ai-gateways.html).

This integration provides:

* Use of OpenAPI MCP when you have REST APIs documented by OpenAPI specifications.

* Tool, prompt, and resource-level PingOne Privilege policy.

* Full audit of agent tool calls in **Activity > Activity Logs**.

## Configure an OpenAPI MCP integration

Configuration involves creating an OpenAPI MCP application in PingOne Privilege, configuring policies for the application, and establishing connectivity between the agent and an Agent Privilege gateway.

### Before you begin

Ensure you have the following:

* An AI gateway configured in Directory > Gateways. Learn more in [AI gateways](../ai-gateways.html).

* An OpenAPI specification for the API you want to expose.

### Step 1: Create an OpenAPI MCP application in PingOne Privilege

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. Click the **Add Application** tab and select the **OpenAPI MCP** tile.

3. Configure the following fields:

   * **Application Name**: A name for the application, for example, `payments-api-mcp`.

   * **Mesh Cluster**: Leave this field empty for now. You'll select the mesh cluster after you create the application.

   * **REST API Endpoint**: The base URL of the API that the specification describes, for example, `https://api.example.com`.

   * **Tool Mode**: How operations from the specification are exposed as tools.

   * **OpenAPI Spec URL**: The location of the OpenAPI specification, for example, `https://example.com/openapi.yaml`.

   * **Auth Mode**: How PingOne Privilege authenticates to the backend API:

     * **Static Token**: A fixed token that PingOne Privilege sends on every request.

     * **User Token**: The authorization token is sourced automatically from the calling user's [User Vault](../../use-cases/user-vault.html) credential at request time.

     * **None**: No authentication is sent to the backend API. Use this only if the API is publicly accessible or secured at the network level.

   * **Headers**: Optional custom HTTP headers to send when calling the backend API.

4. Click **Create**.

### Step 2: Configure policies for OpenAPI operations

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. In the list, find the **OpenAPI MCP** application.

3. Click **(⋮)**, then click **Create Policy**.

4. Select which operations from the OpenAPI specification are available to agents.

5. Click **Update Configuration**.

6. Add the users or groups the policy will apply to.

7. Define the users or groups the policy will apply to.

8. Click **Continue**.

9. Configure the policy with the following fields:

   * **Policy Name**

   * **Select Timezone**

   * **Start Date** and **Start Time**

   * **End Date** in hours, days, weeks, months, or custom date.

10. Click **Submit** to save the policy.

### Step 3: Establish connectivity between agent and gateway

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. On the **Active Applications** tab, find the **OpenAPI MCP** application and click **More Info**.

3. On the **Overview** tab's **Resource Information** section, select a configured **AI Gateway** from the list.

4. Copy the **MCP Config** code.

5. Use the code you just copied to connect to the **OpenAPI MCP** app through your client. For example, you can paste the code into Claude Desktop.

   **Result:** The associated **OpenAPI MCP** app is now accessible through that client.

6. Validate that the OpenAPI MCP tools appear in the client and that restricted tools don't appear.

### Result

Users can now get the **MCP Config** for connecting their client to the **OpenAPI MCP** app under **Agentic Apps** in the PingOne Privilege user console.