> ## Documentation Index > Fetch the complete documentation index at: https://openworklabs.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Manually run a tool from an External MCP Connection > Workspace owner/admin diagnostic runner. Executes one named MCP tool with caller-supplied JSON arguments using the Den-managed shared credential or the calling admin's connected credential. Returns an ephemeral inspection of the actual tools/call HTTP request and response with credential and session headers redacted. The caller must already be granted access to the connection. Credentials, arguments, results, and inspection payloads are never written to logs. ## OpenAPI ````yaml /openapi.json post /v1/mcp-connections/{connectionId}/tools/call openapi: 3.1.0 info: title: Den API description: >- OpenAPI spec for the Den control plane API. Authentication: - Use `Authorization: Bearer ` for user-authenticated routes that require a Den session. - Use `x-api-key: ` for API-key-authenticated routes that accept organization API keys. - Public routes like health and documentation do not require authentication. Swagger tip: use the security schemes in the Authorize dialog to set either `bearerAuth` or `denApiKey` before trying protected endpoints. version: dev servers: [] security: [] tags: - name: System description: Service health and operational routes. - name: Organizations description: Top-level organization creation and context routes. - name: Invitations description: Invitation preview, acceptance, creation, and cancellation routes. - name: API Keys description: Organization API key management routes. - name: SCIM description: Organization SCIM connector management routes. - name: SSO description: Organization single sign-on connector management routes. - name: Members description: Organization member management routes. - name: Roles description: Organization custom role management routes. - name: Teams description: Organization team management routes. - name: Templates description: Organization shared template routes. - name: LLM Providers description: Organization LLM provider catalog, configuration, and access routes. - name: Workers description: Worker lifecycle, billing, and runtime routes. - name: Worker Runtime description: Worker runtime inspection and upgrade routes. - name: Worker Activity description: Worker heartbeat and activity reporting routes. - name: Telemetry description: Telemetry event ingestion and adoption analytics. - name: Admin description: Administrative reporting routes. - name: Users description: Current user and membership routes. - name: Bootstrap description: Agent-first provisional workspace setup routes. paths: /v1/mcp-connections/{connectionId}/tools/call: post: tags: - Authentication summary: Manually run a tool from an External MCP Connection description: >- Workspace owner/admin diagnostic runner. Executes one named MCP tool with caller-supplied JSON arguments using the Den-managed shared credential or the calling admin's connected credential. Returns an ephemeral inspection of the actual tools/call HTTP request and response with credential and session headers redacted. The caller must already be granted access to the connection. Credentials, arguments, results, and inspection payloads are never written to logs. operationId: postV1McpConnectionsByConnectionIdToolsCall parameters: - in: path name: connectionId schema: format: typeid type: string minLength: 30 maxLength: 30 pattern: ^emc_.* required: true description: Den TypeID with 'emc_' prefix and a 26-character base32 suffix. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ExternalMcpConnectionToolRunInput' responses: '200': description: The MCP tool completed. content: application/json: schema: $ref: '#/components/schemas/ExternalMcpConnectionToolRunResponse' '400': description: Invalid tool name or arguments. content: application/json: schema: $ref: '#/components/schemas/InvalidRequestError' '401': description: The caller must be signed in. content: application/json: schema: $ref: '#/components/schemas/UnauthorizedError' '403': description: >- The caller must be a workspace owner/admin and have access to this connection. content: application/json: schema: $ref: '#/components/schemas/ForbiddenError' '404': description: Unknown connection. content: application/json: schema: $ref: '#/components/schemas/ExternalMcpConnectionNotFoundError' '409': description: The connection has no usable credential for this member. content: application/json: schema: $ref: '#/components/schemas/ExternalMcpConnectionNotReadyError' '413': description: The tool arguments exceeded the request size limit. content: application/json: schema: $ref: >- #/components/schemas/ExternalMcpConnectionToolRequestTooLargeError '502': description: The upstream MCP tool call failed. content: application/json: schema: $ref: '#/components/schemas/ExternalMcpConnectionToolRunFailedError' components: schemas: ExternalMcpConnectionToolRunInput: type: object properties: toolName: type: string minLength: 1 maxLength: 255 arguments: type: object propertyNames: type: string additionalProperties: {} required: - toolName - arguments ExternalMcpConnectionToolRunResponse: type: object properties: referenceId: type: string durationMs: type: number minimum: 0 result: {} inspection: $ref: '#/components/schemas/ExternalMcpConnectionToolInspection' required: - referenceId - durationMs - result - inspection InvalidRequestError: type: object properties: error: type: string const: invalid_request details: type: array items: type: object properties: message: type: string path: type: array items: anyOf: - type: string - type: number required: - message additionalProperties: {} required: - error - details UnauthorizedError: type: object properties: error: type: string const: unauthorized required: - error ForbiddenError: type: object properties: error: type: string enum: - forbidden - reauth reason: type: string message: type: string required: - error ExternalMcpConnectionNotFoundError: type: object properties: error: type: string const: connection_not_found message: type: string required: - error - message ExternalMcpConnectionNotReadyError: type: object properties: error: type: string const: connection_not_ready message: type: string required: - error - message ExternalMcpConnectionToolRequestTooLargeError: type: object properties: error: type: string const: payload_too_large message: type: string required: - error - message ExternalMcpConnectionToolRunFailedError: type: object properties: error: type: string const: tool_execution_failed message: type: string diagnostic: $ref: '#/components/schemas/ExternalMcpDiagnostic' inspection: $ref: '#/components/schemas/ExternalMcpConnectionToolInspection' required: - error - message - diagnostic - inspection ExternalMcpConnectionToolInspection: type: object properties: request: $ref: '#/components/schemas/ExternalMcpConnectionToolInspectionRequest' response: $ref: '#/components/schemas/ExternalMcpConnectionToolInspectionResponse' diagnosis: $ref: '#/components/schemas/ExternalMcpConnectionToolInspectionDiagnosis' required: - diagnosis ExternalMcpDiagnostic: type: object properties: referenceId: type: string phase: type: string enum: - CONFIGURATION - NETWORK_DNS - NETWORK_TCP - NETWORK_TLS - HTTP_ROUTING - AUTH_RESOURCE_DISCOVERY - AUTH_ISSUER_DISCOVERY - AUTH_CLIENT_REGISTRATION - AUTH_USER_OR_WORKLOAD - AUTH_TOKEN_ACQUISITION - AUTH_RESOURCE_VALIDATION - MCP_TRANSPORT - MCP_VERSION - MCP_INITIALIZE - MCP_INITIALIZED - MCP_TOOL_DISCOVERY - MCP_TOOL_EXECUTION - PROVIDER_AUTHORIZATION - PROVIDER_EXECUTION - CONTINUITY_REFRESH - CONTINUITY_SESSION - SHUTDOWN category: type: string code: type: string highestPassed: type: string enum: - configured - reachable - authorized - protocol_ready - catalog_ready - operation_ready retryable: type: boolean actionOwner: type: string enum: - openwork - network_admin - provider_admin - organization_admin - member operatorAction: type: string message: type: string httpStatus: type: integer minimum: 100 maximum: 599 operationPhase: type: string enum: - CONFIGURATION - NETWORK_DNS - NETWORK_TCP - NETWORK_TLS - HTTP_ROUTING - AUTH_RESOURCE_DISCOVERY - AUTH_ISSUER_DISCOVERY - AUTH_CLIENT_REGISTRATION - AUTH_USER_OR_WORKLOAD - AUTH_TOKEN_ACQUISITION - AUTH_RESOURCE_VALIDATION - MCP_TRANSPORT - MCP_VERSION - MCP_INITIALIZE - MCP_INITIALIZED - MCP_TOOL_DISCOVERY - MCP_TOOL_EXECUTION - PROVIDER_AUTHORIZATION - PROVIDER_EXECUTION - CONTINUITY_REFRESH - CONTINUITY_SESSION - SHUTDOWN outbound: type: object properties: origin: type: string pathHash: type: string required: - origin - pathHash providerRequestId: type: string providerStatus: type: integer minimum: -9007199254740991 maximum: 9007199254740991 providerCode: type: string payloadBytes: type: integer minimum: -9007199254740991 maximum: 9007199254740991 jsonRpcCode: type: integer minimum: -9007199254740991 maximum: 9007199254740991 connectUrl: type: string format: uri required: - referenceId - phase - category - code - highestPassed - retryable - actionOwner - operatorAction - message ExternalMcpConnectionToolInspectionRequest: type: object properties: method: type: string url: type: string startedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ headers: type: array items: $ref: '#/components/schemas/ExternalMcpConnectionToolInspectionHeader' body: $ref: '#/components/schemas/ExternalMcpConnectionToolInspectionBody' required: - method - url - startedAt - headers - body ExternalMcpConnectionToolInspectionResponse: type: object properties: status: type: integer minimum: 100 maximum: 599 statusText: type: string durationMs: type: number minimum: 0 headers: type: array items: $ref: '#/components/schemas/ExternalMcpConnectionToolInspectionHeader' body: $ref: '#/components/schemas/ExternalMcpConnectionToolInspectionBody' required: - status - statusText - durationMs - headers - body ExternalMcpConnectionToolInspectionDiagnosis: type: object properties: status: type: string enum: - succeeded - failed layer: type: string enum: - openwork - network - mcp_connection - remote_http - mcp_tool summary: type: string required: - status - layer - summary ExternalMcpConnectionToolInspectionHeader: type: object properties: name: type: string value: type: string redacted: type: boolean required: - name - value - redacted ExternalMcpConnectionToolInspectionBody: type: object properties: text: type: string bytes: type: integer minimum: 0 maximum: 9007199254740991 truncated: type: boolean unavailable: type: boolean required: - text - bytes - truncated ````