MCP server (Streamable HTTP transport)
package main
import ( "fmt" "strings" "net/http" "io")
func main() {
url := "https://api.ai.wpengine.com/v1/mcp"
payload := strings.NewReader("{}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>") req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close() body, _ := io.ReadAll(res.Body)
fmt.Println(res) fmt.Println(string(body))
}const url = 'https://api.ai.wpengine.com/v1/mcp';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}<?php
$client = new \GuzzleHttp\Client();
$response = $client->request('POST', 'https://api.ai.wpengine.com/v1/mcp', [ 'body' => '{}', 'headers' => [ 'Authorization' => 'Bearer <token>', 'Content-Type' => 'application/json', ],]);
echo $response->getBody();curl --request POST \ --url https://api.ai.wpengine.com/v1/mcp \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{}'Exposes the gateway as a remote MCP server over the Streamable HTTP transport (JSON-RPC 2.0 over HTTP, optionally upgrading to Server-Sent Events for streamed responses). Accepts either a WP Engine API key (prefixed “wpe_”) carrying the mcp scope, scoped to the key’s project, or an Okta JWT with WPEngine-Account and WPEngine-Project headers (Console Coworker). Interactive OAuth sign-in for external MCP clients (e.g. Claude Desktop) is planned. The gateway does not preserve MCP session state between requests; clients should not rely on server-side session continuity across calls. The list_site_abilities, search_abilities, and run_site_ability tools additionally require a personal API key when using API-key auth; a project-scoped key resolves no acting user and these tools return an unauthorized error. Okta JWT callers use the verified subject instead.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Header Parameters
Section titled “Header Parameters”WP Engine account context. For API keys the account acted on is derived from the key and this header is informational only. For Okta JWT (Console Coworker) this header is required and must match the token’s account claim.
WP Engine project context. Required for Okta JWT callers (Console Coworker). For API keys the project is derived from the key.
Optional. The agent session a knowledge-base tool call is being performed for, when the call answers a tool request from that session. Used only to group the call with the rest of the session’s activity in observability data. It is ignored unless it names a session in the same project as the caller, and it never changes the response.
Request Bodyrequired
Section titled “Request Bodyrequired”A JSON-RPC 2.0 request or notification per the MCP spec.
object
JSON-RPC 2.0 batch of up to 10 messages. POST bodies with more than 10 messages are rejected with HTTP 400 and a JSON-RPC Invalid Request error before any message is dispatched.
A JSON-RPC 2.0 request or notification per the MCP spec.
object
Examplegenerated
{}Responses
Section titled “Responses”One application/json JSON-RPC response for a single request, or an array of responses when the POST body was a JSON-RPC batch.
JSON-RPC 2.0 response for a single request.
object
JSON-RPC 2.0 responses for a batch request.
object
Examplegenerated
{}Accepted with no body for JSON-RPC notifications (such as notifications/initialized) that do not expect a response.
Invalid MCP request — for example, a missing or invalid Accept header, an empty POST body, a JSON-RPC batch exceeding 10 messages, or malformed JSON-RPC payload. Oversized batches return HTTP 400 with a JSON-RPC Invalid Request error (code: -32600, message: batch exceeds maximum of 10 calls) before any message is dispatched. Most other validation failures return plain text; MCP standard header mismatches return a JSON-RPC error object instead.
JSON-RPC 2.0 error returned when a POST body is a batch exceeding 10 messages.
object
object
object
Example
{ "jsonrpc": "2.0", "error": { "code": -32600, "message": "batch exceeds maximum of 10 calls" }}Missing or invalid bearer token
object
object
Correlation ID for this request, matching the X-Request-ID response header — a 32-character trace ID behind the load balancer, otherwise a UUID. Quote it in support reports.
Example
{ "error": { "type": "invalid_request_error", "request_id": "80f1e2c3a4b5c6d7e8f9a0b1c2d3e4f5" }}Headers
Section titled “Headers”Example
Bearer realm="ai-services"The token is valid, but the caller is not permitted to perform this action — either its scope/permission is insufficient or the authenticated user is not authorized for the target account (error type “permission_error”). On /v1/chat/completions specifically, a 403 with error type “content_policy_violation” instead means the request content was blocked by content moderation policy; that response never identifies which filter or category matched.
object
object
Correlation ID for this request, matching the X-Request-ID response header — a 32-character trace ID behind the load balancer, otherwise a UUID. Quote it in support reports.
Example
{ "error": { "type": "invalid_request_error", "request_id": "80f1e2c3a4b5c6d7e8f9a0b1c2d3e4f5" }}Request Content-Type is not application/json.
A required dependency is temporarily unavailable. Retry after a short delay with exponential back-off.
object
object
Correlation ID for this request, matching the X-Request-ID response header — a 32-character trace ID behind the load balancer, otherwise a UUID. Quote it in support reports.
Example
{ "error": { "type": "invalid_request_error", "request_id": "80f1e2c3a4b5c6d7e8f9a0b1c2d3e4f5" }}