> ## Documentation Index > Fetch the complete documentation index at: https://docs.clarifeye.ai/llms.txt > Use this file to discover all available pages before exploring further. # Set the current user's API key for an api_key MCP server > Stores the user's own API key for an enabled api_key server in one of their knowledge stores (encrypted at rest) and pushes it to their vault. Credentials are per-user; there is no shared store-level key. ## OpenAPI ````yaml /api-reference/openapi-full.yaml post /users/me/mcp-connections/set-api-key/ openapi: 3.0.3 info: title: Clarifeye Platform API — Full API Documentation description: > Complete REST API reference for the Clarifeye Platform. Documents every endpoint exposed by the platform — the public surface plus the advanced surface: pipeline customization (extraction flows, pipeline runs, warehouse tables, document tag/metadata configuration), the pre-MCP AI surface (agent settings, playground conversations, conversation-scoped feedback views, notifications), and the impersonation header. New AI integrations should consume knowledge via MCP rather than the conversation/agent-settings endpoints documented here. ## Authentication All endpoints require authentication. Include the Authorization header in every request using either format: - `Authorization: Token ` - `Authorization: Bearer ` ## Organization API Key Authentication The user-provisioning endpoints authenticate with an **org-scoped API key** instead of a user token: - `Authorization: Api-Key ` The key is minted internally by Clarifeye (not self-service) and is scoped to a single organization — it can only act on the organization whose UUID matches the `{id}` in the request path. The email domains a key may pre-create accounts for are configured by Clarifeye on the organization (`allowed_provisioning_domains`). Once you have a key and your domains are set, call `POST /organizations/{id}/provision-user/` to pre-create users and `POST /organizations/{id}/deprovision-user/` to remove them. ## Impersonation Certain endpoints support user impersonation for creating or listing data on behalf of other users. This is useful for integrating external systems that need to attribute actions to specific users. **Header:** `X-Impersonate-Email` **Required Permission:** `CAN_IMPERSONATE_OTHER_USERS` (contact Clarifeye to enable this permission) **Behavior:** - If the header is provided and the impersonator has the required permission, the action is performed as the target user - If the target user is not found, the request proceeds as the original authenticated user - If the target user does not have access to the project, the request proceeds as the original authenticated user - If the impersonator lacks the `CAN_IMPERSONATE_OTHER_USERS` permission, the header is ignored version: 1.0.0 contact: name: Clarifeye Support servers: - url: https://eu.app.clarifeye.ai/api/v1 description: EU - url: https://us.app.clarifeye.ai/api/v1 description: US security: - BearerAuth: [] - TokenAuth: [] tags: - name: Users description: Manage users within a project - name: Invitations description: Manage project invitations - name: Documents description: Manage documents within a project - name: Agent Settings description: Manage AI agent configurations - name: Conversations description: Create and interact with AI-powered conversations - name: Interviews description: Assign and review structured interview conversations - name: Feedback description: >- Submit and review feedback — standalone (content-only), agent-submitted (MCP), or linked to a conversation message - name: Tools description: Execute configured AI tools with custom parameters - name: Tables description: Perform CRUD operations on warehouse tables - name: Notifications description: Manage project-scoped notifications for users - name: Extraction Flows description: >- Manage extraction flows (auto-sync DAGs) — list, run, inspect statistics, update, and publish - name: Object Extractors description: | Extract structured data (instances of a Pydantic model) from chunks or blocks of documents. Update auto-creates a new `ObjectExtractorVersion` when version-bearing fields change. - name: Tag Extractors description: | Apply hierarchical metadata tags to chunks or documents using an LLM. Update auto-creates a new `TagExtractorVersion` when version-bearing fields change. - name: Chunks Extractors description: | Segment parsed documents into chunks for downstream processing. Update auto-creates a new `ChunksExtractorVersion` when version-bearing fields change. - name: Parsing Extractors description: | Convert source documents to text blocks via the parsing pipeline. Update auto-creates a new `ParsingExtractorVersion` when version-bearing fields change. - name: Document Filter Extractors description: | Restrict a downstream pipeline branch to documents matching a filter. Update auto-creates a new version when the filter changes. - name: Chunk Tag Filter Extractors description: | Restrict a downstream pipeline branch to chunks carrying specific tags. Update auto-creates a new version when the filter changes. - name: Document Tag Extractors description: | Apply a flat set of metadata tags to each document. Update auto-creates a new version when version-bearing fields change. - name: Tag Alerts Extractors description: | Run LLM-based alerts over already-extracted tag rows. Update auto-creates a new version when version-bearing fields change. - name: Object Alerts Extractors description: > Run LLM-based alerts over already-extracted object rows. Update auto-creates a new version when version-bearing fields change. - name: Imported Object Extractors description: | Hold objects imported from an external system (rather than extracted by an LLM). Useful for hydrating the warehouse with data produced outside the platform. - name: Pipeline Runs description: >- Inspect pipeline runs queued by extraction flows or other pipeline triggers — list runs and fetch the details/status of a single run - name: User Provisioning description: > Pre-create and de-provision org users via an org-scoped API key (`Authorization: Api-Key `). The organization is resolved from the key. - name: Organization API Keys description: > Superuser management of org-scoped provisioning API keys. Minting and revoking are superuser-only; org admins can list/retrieve/reveal their own org's keys. - name: Design System Templates description: Reference/example files attached to a design template. paths: /users/me/mcp-connections/set-api-key/: post: tags: - External MCP summary: Set the current user's API key for an api_key MCP server description: >- Stores the user's own API key for an enabled api_key server in one of their knowledge stores (encrypted at rest) and pushes it to their vault. Credentials are per-user; there is no shared store-level key. operationId: setUserMcpApiKey requestBody: required: true content: application/json: schema: type: object required: - url - api_key properties: url: type: string api_key: type: string writeOnly: true responses: '200': description: The updated connection content: application/json: schema: $ref: '#/components/schemas/UserMCPConnection' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' components: schemas: UserMCPConnection: type: object description: >- A user's credential for one external MCP server URL (account-scoped, no secrets exposed). All non-`none` modes are per-user. A synthesized row (a server the user could connect but hasn't) has a null `id` and status `not_connected`. properties: id: type: string format: uuid nullable: true normalized_url: type: string status: type: string enum: - connected - expired - revoked - error - not_connected auth_mode: type: string enum: - oauth - api_key - none nullable: true description: >- Auth mode of the servers using this URL; null for an orphaned connection. has_api_key: type: boolean description: True when this is an api_key connection with a key stored. server_names: type: array items: type: string description: >- Names of the enabled servers (across the user's stores) that use this URL. store_names: type: array items: type: string in_use: type: boolean description: >- False when no enabled server in any of the user's stores still references this URL. connected_at: type: string format: date-time nullable: true last_refreshed_at: type: string format: date-time nullable: true token_expires_at: type: string format: date-time nullable: true Error: type: object properties: error: type: string description: Error message example: error: User not found ValidationError: type: object additionalProperties: type: array items: type: string example: email: - This field is required. responses: BadRequest: description: Bad request - invalid parameters or request body content: application/json: schema: oneOf: - $ref: '#/components/schemas/Error' - $ref: '#/components/schemas/ValidationError' Unauthorized: description: Unauthorized - missing or invalid authentication content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Authentication credentials were not provided. securitySchemes: BearerAuth: type: http scheme: bearer description: 'Use Authorization: Bearer ' TokenAuth: type: apiKey in: header name: Authorization description: 'Use Authorization: Token ' ````