> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # List Server Connections > List who in the organization holds a connection to this MCP server — the inverse of the caller-scoped connection endpoints, which only ever return your own connection. Requires organization **admin**. The response discloses which members use which server, so it is not available to regular members. This reads *current* connection state, so a member who has already migrated and disconnected is simply absent. Use it when retiring or replacing a connector and you need to know who to tell. Audit logs answer a different question — who *used* a connector inside the retention window — so they both miss people who connected but never used it and keep listing people who already moved on. ### Owner classes Every owner class is returned by default: people (`user_id` set), AI agents (`application_id` set), and the tenant service account (neither set). An agent still bound to a server you are retiring blocks the migration just as much as a person does. Narrow with `owner=user` when you specifically want a list of people to notify. ### Resolving `user_id` `user_id` is the external IdP subject. Resolve names and email addresses by joining against the identity users API — but you must **include deactivated members**. Deactivating a member does not remove their connection row, so an active-only user list silently drops people who still hold a connection to the server you are retiring. A `user_id` that resolves nowhere belongs to a member already deleted from identity whose connection row outlived them. Surface those for manual follow-up; do not drop them from the count. ### Interpreting `status` `error` is a positive dead-credential signal for OAuth connectors, which a keepalive sweep refreshes on a few-hour cycle, flipping any credential it cannot refresh to `error`. `connected` is unverified for everything else — non-OAuth connectors (`api_key`, `basic_auth`, `bearer_token`, `plaid`, `generic`), where refresh is lazy and a row can sit in `connected` behind a token that no longer works. `last_accessed_at` tracks *use*, not credential health, and the sweep never writes it. A connection that was never used can still hold a live, actively-refreshed credential with `last_accessed_at` set to `null`. Do not read `null` as "connected once and moved on" — those members still need to be told. ### Migrating between connectors Connecting a replacement server does not remove the old connection; the member has to disconnect it. Pull the roster of both servers and compare: present in both means already migrated and merely untidy, present only in the old one means not yet migrated. ## OpenAPI ````yaml GET /api/registry/v1/servers/{server_id}/connections openapi: 3.1.0 info: title: Barndoor Platform API version: 1.0.0 description: > REST API for the Barndoor Platform - manage MCP servers, OAuth connections, and proxy MCP requests. ## Authentication All endpoints require a JWT Bearer token obtained through Barndoor's OAuth 2.0 authorization-code flow with PKCE. The SDK handles the OAuth flow automatically using interactive login. ## MCP Integration The `/mcp/{mcp_server_name}` endpoints provide streaming proxy access to third-party MCP servers (Salesforce, Notion, Slack, etc.) with automatic authentication and session management. contact: name: Barndoor Support url: https://barndoor.ai servers: - url: https://{organization_id}.platform.barndoor.ai description: Production (Trial and Enterprise) variables: organization_id: description: Your organization identifier default: your-org security: - BearerAuth: [] tags: - name: Servers description: Manage MCP server instances - name: Connections description: Manage OAuth connections to MCP servers - name: Policies description: Manage access control policies for agents and servers - name: Agents description: Manage AI agent registrations - name: MCP Proxy description: Proxy requests to MCP servers paths: /api/registry/v1/servers/{server_id}/connections: get: tags: - Connections summary: List connections to a server description: | List who in the organization holds a connection to this MCP server — the inverse of the caller-scoped connection endpoints, which only ever return your own connection. Requires organization **admin**. The response discloses which members use which server, so it is not available to regular members. This reads *current* connection state, so a member who has already migrated and disconnected is simply absent. Use it when retiring or replacing a connector and you need to know who to tell. Audit logs answer a different question — who *used* a connector inside the retention window — so they both miss people who connected but never used it and keep listing people who already moved on. ### Owner classes Every owner class is returned by default: people (`user_id` set), AI agents (`application_id` set), and the tenant service account (neither set). An agent still bound to a server you are retiring blocks the migration just as much as a person does. Narrow with `owner=user` when you specifically want a list of people to notify. ### Resolving `user_id` `user_id` is the external IdP subject. Resolve names and email addresses by joining against the identity users API — but you must **include deactivated members**. Deactivating a member does not remove their connection row, so an active-only user list silently drops people who still hold a connection to the server you are retiring. A `user_id` that resolves nowhere belongs to a member already deleted from identity whose connection row outlived them. Surface those for manual follow-up; do not drop them from the count. ### Interpreting `status` `error` is a positive dead-credential signal for OAuth connectors, which a keepalive sweep refreshes on a few-hour cycle, flipping any credential it cannot refresh to `error`. `connected` is unverified for everything else — non-OAuth connectors (`api_key`, `basic_auth`, `bearer_token`, `plaid`, `generic`), where refresh is lazy and a row can sit in `connected` behind a token that no longer works. `last_accessed_at` tracks *use*, not credential health, and the sweep never writes it. A connection that was never used can still hold a live, actively-refreshed credential with `last_accessed_at` set to `null`. Do not read `null` as "connected once and moved on" — those members still need to be told. ### Migrating between connectors Connecting a replacement server does not remove the old connection; the member has to disconnect it. Pull the roster of both servers and compare: present in both means already migrated and merely untidy, present only in the old one means not yet migrated. operationId: listServerConnections parameters: - name: server_id in: path required: true schema: type: string format: uuid description: The MCP server whose connections to list - name: status in: query required: false schema: type: string description: > Comma-separated stored connection statuses to include: `pending`, `connected`, `error`. Omit for all. Only stored values are accepted — `available` is computed per-caller and never persisted, so passing it returns `400` rather than silently matching nothing. example: connected,error - name: owner in: query required: false schema: type: string description: | Comma-separated owner classes to include: `user`, `agent`, `service_account`. Omit for all. Use `owner=user` for a notify list. example: user - name: page in: query required: false schema: type: integer minimum: 1 default: 1 description: Page number (1-based) - name: limit in: query required: false schema: type: integer minimum: 1 maximum: 100 default: 10 description: > Number of items per page. The maximum is 100 — a larger value returns `422`, so page through the results rather than raising it. responses: '200': description: | Paginated roster of connections to this server. `pagination.total` is the headcount. content: application/json: schema: $ref: >- #/components/schemas/PaginationResponse_ServerConnectionSummary_ '400': description: Invalid `status` or `owner` filter value content: application/json: schema: $ref: '#/components/schemas/DetailError' '401': description: Unauthorized - invalid or missing JWT token '403': description: Caller is not an organization admin content: application/json: schema: $ref: '#/components/schemas/DetailError' '404': description: | MCP server not found in the caller's organization. A server belonging to another organization also returns `404`, not `403`. content: application/json: schema: $ref: '#/components/schemas/DetailError' '422': description: Query parameter failed validation (for example `limit` above 100) components: schemas: PaginationResponse_ServerConnectionSummary_: type: object properties: data: type: array items: $ref: '#/components/schemas/ServerConnectionSummary' description: Connections for the current page pagination: $ref: '#/components/schemas/PaginationMeta' description: Pagination metadata required: - data - pagination DetailError: type: object required: - detail properties: detail: type: string description: Human-readable error message example: >- Invalid status filter: available. Valid values: connected, error, pending ServerConnectionSummary: type: object required: - connection_id - status - created_at properties: connection_id: type: string format: uuid description: Identifier of the connection row user_id: type: - string - 'null' description: | External IdP subject of the person who owns this connection. `null` when the connection is owned by an AI agent or by the tenant service account. example: 8a415438-1af6-43ff-917c-a84d54167526 application_id: type: - string - 'null' format: uuid description: | Set when an AI agent owns this connection instead of a person. `null` otherwise. status: type: string enum: - pending - connected - error description: Stored connection status example: connected created_at: type: string format: date-time description: When the connection row was created connected_at: type: - string - 'null' format: date-time description: When the connection was established; `null` if it never was last_accessed_at: type: - string - 'null' format: date-time description: | When the connection was last used. `null` means never used — which does not imply the credential is dead. PaginationMeta: properties: page: type: integer title: Page description: Current page number limit: type: integer title: Limit description: Items per page total: type: integer title: Total description: Total number of items pages: type: integer title: Pages description: Total number of pages previous_page: anyOf: - type: integer - type: 'null' title: Previous Page description: Previous page number (null if first page) next_page: anyOf: - type: integer - type: 'null' title: Next Page description: Next page number (null if last page) type: object required: - page - limit - total - pages - previous_page - next_page title: PaginationMeta description: Pagination metadata. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: > JWT token obtained through Barndoor's OAuth 2.0 authorization-code flow with PKCE. The token should be included in the Authorization header: `Authorization: Bearer ` Use the Barndoor SDK's `loginInteractive()` function to obtain tokens automatically. ````