List Server Connections
List who in the organization holds a connection to this MCP server — the inverse of the caller-scoped connection endpoints, which only ever return your own connection.
Requires organization admin. The response discloses which members use which server, so it is not available to regular members.
This reads current connection state, so a member who has already migrated and disconnected is simply absent. Use it when retiring or replacing a connector and you need to know who to tell. Audit logs answer a different question — who used a connector inside the retention window — so they both miss people who connected but never used it and keep listing people who already moved on.
Owner classes
Every owner class is returned by default: people (user_id set), AI
agents (application_id set), and the tenant service account
(neither set). An agent still bound to a server you are retiring
blocks the migration just as much as a person does. Narrow with
owner=user when you specifically want a list of people to notify.
Resolving user_id
user_id is the external IdP subject. Resolve names and email
addresses by joining against the identity users API — but you must
include deactivated members. Deactivating a member does not
remove their connection row, so an active-only user list silently
drops people who still hold a connection to the server you are
retiring.
A user_id that resolves nowhere belongs to a member already deleted
from identity whose connection row outlived them. Surface those for
manual follow-up; do not drop them from the count.
Interpreting status
error is a positive dead-credential signal for OAuth connectors,
which a keepalive sweep refreshes on a few-hour cycle, flipping any
credential it cannot refresh to error.
connected is unverified for everything else — non-OAuth connectors
(api_key, basic_auth, bearer_token, plaid, generic), where
refresh is lazy and a row can sit in connected behind a token that
no longer works.
last_accessed_at tracks use, not credential health, and the sweep
never writes it. A connection that was never used can still hold a
live, actively-refreshed credential with last_accessed_at set to
null. Do not read null as “connected once and moved on” — those
members still need to be told.
Migrating between connectors
Connecting a replacement server does not remove the old connection; the member has to disconnect it. Pull the roster of both servers and compare: present in both means already migrated and merely untidy, present only in the old one means not yet migrated.
Authorizations
JWT token obtained through Barndoor's OAuth 2.0 authorization-code flow with PKCE.
The token should be included in the Authorization header:
Authorization: Bearer <your-jwt-token>
Use the Barndoor SDK's loginInteractive() function to obtain tokens automatically.
Path Parameters
The MCP server whose connections to list
Query Parameters
Comma-separated stored connection statuses to include: pending,
connected, error. Omit for all. Only stored values are accepted —
available is computed per-caller and never persisted, so passing it
returns 400 rather than silently matching nothing.
Comma-separated owner classes to include: user, agent,
service_account. Omit for all. Use owner=user for a notify list.
Page number (1-based)
x >= 1Number of items per page. The maximum is 100 — a larger value returns
422, so page through the results rather than raising it.
1 <= x <= 100