post_v1_cloud_provider_accounts

Links one of the caller org's cloud accounts and folds the Kubernetes clusters it finds there into the ONE Hanzo fleet, so they appear at /v1/clusters and can run work like any managed or bring-your-own cluster. Answers 201.

The credential is verified LIVE against the provider BEFORE anything is stored, so a bad one is refused and nothing is written; it is then sealed in the org's own KMS namespace and never appears in a response, the account index, or a log line. Discovery follows, and a cluster that fails to fold is reported as DATA in the clusters list rather than failing the link.

Re-linking a label that already exists re-seals its credential and re-folds it, so this is how a rotated token is replaced. Requires org admin.

Arguments

tools/list declares a type and a description for each field and nothing further. A — means neither the door nor that operation constrains the field.

Call it

A tools/call carries every argument in one flat object — nothing binds to a path or a query string. Nothing above is required, so every declared argument is shown rather than a guess at which matter.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "post_v1_cloud_provider_accounts",
         "arguments": {
           "clientId": "<clientId>",
           "clientSecret": "<clientSecret>",
           "credentialJson": "<credentialJson>",
           "externalId": "<externalId>",
           "label": "<label>",
           "projectIds": [
             "<projectIds>"
           ],
           "provider": "<provider>",
           "regions": [
             "<regions>"
           ],
           "roleArn": "<roleArn>",
           "subscriptionIds": [
             "<subscriptionIds>"
           ],
           "tenantId": "<tenantId>",
           "token": "<token>"
         }
       }
     }'

Values are the operation's own defaults and enumerated values where it declares them, and a <placeholder> where neither source declares one. tools/list needs no credential; tools/call does — called without one the door answers HTTP 200 with a JSON-RPC result whose isError is set and whose text says what was missing. How to get a key →

The operation behind it

The same capability over plain HTTP is in the cloud API reference, on https://api.hanzo.ai.

All 833 tools · The door · API reference

Generated from tools/list on https://api.hanzo.ai/v1/mcp — 833 tools captured 2026-08-01 (this build read the vendored copy; the door was unreachable).