Platform endpoint

Use this endpoint to provision a workspace or operate the native identity directory. The caller needs a verified MCP identity and an active platform operator grant. The packaged ingress path is /api/platform/mcp. The platform listener accepts MCP internally at /mcp on port 5193.

Discover before acting

1. Initialize the endpoint and call list_v2_platform_functions with {}. Check listener.scope is platform and find the function and mode you need.
2. For a native user or group lookup, use read_v2_platform_program with the typed program. Directory calls require the native directory integration to be configured.
3. For a write, execute_v2_platform_program requires program and idempotency_key. Follow the function's own approval and replay contract.

Workspace provisioning example

The Create a workspace example submits platform.workspace.create, records the returned workspaceId and checks status is Active. The operation creates the workspace and its first Administrator grant atomically. Exact replay returns the original result. PLATFORM_OPERATOR_REQUIRED calls for checking the caller's enrollment and operator grant. Continue on the bound workspace endpoint to create the first application, or see Native identities for directory work.