> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These docs cover three products: TrustGate (AI agent gateway), TrustGuard (runtime security), and TrustTest (AI red teaming). Start from each product overview for the definition and How it works. Prefer the .md URL next to a page in /llms.txt when you need the full article. Use /llms-full.txt for a single-file dump of the site.

# Read an MCP application's upstream accounts

> For an MCP consumer that acts as the application itself: per bound MCP server, its upstream auth mode, whether that server needs an account linked for the application, and — when it does — whether one is linked, for which account, and whether it needs reconnecting. The accounts belong to the consumer, so the answer does not depend on which credential the application authenticates with. Credential material is never returned.



## OpenAPI

````yaml /trustgate/api/openapi.json get /v1/gateways/{gateway_id}/consumers/{id}/upstream-accounts
openapi: 3.0.0
info:
  description: >-
    Administrative API for managing gateways and their registries, policies,
    consumers and auth credentials.
  title: TrustGate Admin API
  contact:
    name: NeuralTrust
    url: https://neuraltrust.ai/contact
    email: support@neuraltrust.ai
  version: '1.0'
servers:
  - url: /
security: []
paths:
  /v1/gateways/{gateway_id}/consumers/{id}/upstream-accounts:
    get:
      tags:
        - consumers
      summary: Read an MCP application's upstream accounts
      description: >-
        For an MCP consumer that acts as the application itself: per bound MCP
        server, its upstream auth mode, whether that server needs an account
        linked for the application, and — when it does — whether one is linked,
        for which account, and whether it needs reconnecting. The accounts
        belong to the consumer, so the answer does not depend on which
        credential the application authenticates with. Credential material is
        never returned.
      parameters:
        - description: Gateway id
          name: gateway_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - description: Consumer id
          name: id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_consumer_response.ConsumerUpstreamAccounts
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody
        '409':
          description: The consumer acts for users, so it holds no account of its own
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody
      security:
        - BearerAuth: []
components:
  schemas:
    github_com_NeuralTrust_TrustGate_pkg_api_handler_http_consumer_response.ConsumerUpstreamAccounts:
      type: object
      properties:
        accounts:
          type: array
          items:
            $ref: >-
              #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_consumer_response.ConsumerUpstreamAccount
        consumer_id:
          type: string
        needs_linking:
          type: boolean
        principal_sub:
          description: |-
            PrincipalSub is the identity the upstream accounts hang off:
            app:<consumer_id>, the application itself.
          type: string
        slug:
          type: string
    github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody:
      type: object
      properties:
        error:
          type: string
        message:
          type: string
    github_com_NeuralTrust_TrustGate_pkg_api_handler_http_consumer_response.ConsumerUpstreamAccount:
      type: object
      properties:
        account_ref:
          type: string
        code:
          type: string
        expires_at:
          type: string
        linked:
          type: boolean
        mode:
          description: >-
            Mode is the server's upstream auth mode: none, static,
            client_credentials,

            forwarded, passthrough or exchange.
          type: string
        needs_linked_account:
          description: |-
            NeedsLinkedAccount is true only for a server that forwards a stored
            credential; the rest carry their own or need none.
          type: boolean
        needs_reconnect:
          type: boolean
        provider:
          type: string
        registry:
          type: string
        registry_id:
          type: string
        scopes:
          type: array
          items:
            type: string
  securitySchemes:
    BearerAuth:
      type: apiKey
      name: Authorization
      in: header

````