IAM
iam: 75 operations.
Also for this capability: API · CLI · MCP · SDKs
iam: 75 operations. Name one in "op" and pass that operation's own arguments in "input". describe returns an operation's input schema.
| Tool | iam |
| Address | https://api.hanzo.ai/v1/mcp |
| Method | tools/call (JSON-RPC 2.0) |
| Arguments | 2, 1 required |
| Operation | POST /v1/iam/providers · POST /v1/iam/organizations · DELETE /v1/iam/organizations/{owner}/{name} · DELETE /v1/iam/providers/{owner}/{name} · GET /v1/iam/organizations/{owner}/{name} · GET /v1/iam/providers/{owner}/{name} · GET /v1/iam/account · GET /v1/iam/auth/application · GET /v1/iam/consent · GET /v1/iam/oauth/authorize · GET /v1/iam/oauth/callback · GET /v1/iam/oauth/userinfo · GET /v1/iam/scim/v2/ServiceProviderConfig · GET /v1/iam/web3/nonce · GET /v1/iam/whoami · GET /v1/iam/organizations · GET /v1/iam/providers · POST /v1/iam/organizations/avatar · PUT /v1/iam/organizations/{owner}/{name} · PUT /v1/iam/providers/{owner}/{name} · POST /v1/iam/admin/applications/upsert |
| Product | iam |
Arguments
| Field | Type | Required | Default | Values | Description |
|---|---|---|---|---|---|
input | object | — | — | — | arguments for the chosen op |
op | string | yes | — | — | — |
tools/list declares a type, a description, which fields are required and an enumerated value set for each field and nothing further, and every column above is MCP's own. This tool takes an operation name and that operation's arguments, so what the document constrains is what goes inside input, field by field, on the operation you name — ask describe for that. A — means MCP does not constrain the field.
Call it
A tools/call carries every argument in one flat object — nothing binds to a path or a query string. This call carries exactly the arguments the operation requires, so it is the smallest one that can run.
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "iam",
"arguments": {
"op": "list__well_known_jwks"
}
}
}'Values are the operation's own defaults and enumerated values where it declares them, and a <placeholder> where neither source declares one. tools/list needs no credential; tools/call does — called without one MCP answers HTTP 200 with a JSON-RPC result whose isError is set and whose text says what was missing. How to get a key →
The operation behind it
iam dispatches to 75 operations. 21 of them MCP names exactly as the document ids them, and those are below; for the rest MCP has its own verb, which describe resolves.
| Operation | Route | Product | Summary |
|---|---|---|---|
addProvider | POST /v1/iam/providers | iam | Adds an identity provider your people can sign in with, or a service your applications… |
createOrganization | POST /v1/iam/organizations | iam | Makes a new organization — the account your users, applications, roles, projects and… |
deleteOrganization | DELETE /v1/iam/organizations/{owner}/{name} | iam | Removes an organization and everything named inside it. |
deleteProvider | DELETE /v1/iam/providers/{owner}/{name} | iam | Removes a provider. |
getOrganization | GET /v1/iam/organizations/{owner}/{name} | iam | Returns one organization: its display, its defaults and the sign-in rules everyone in it… |
getProvider | GET /v1/iam/providers/{owner}/{name} | iam | Returns one provider: what it connects to and how it is configured. |
get_iam_account | GET /v1/iam/account | iam | Returns the signed-in person's own account and the organization they belong to — what a… |
get_iam_auth_application | GET /v1/iam/auth/application | iam | Returns everything a login screen needs to draw itself for one application: its branding,… |
get_iam_consent | GET /v1/iam/consent | iam | Returns the calling person's own privacy and communication choices. |
get_iam_oauth_authorize | GET /v1/iam/oauth/authorize | iam | Starts a sign-in — the address you send a browser to, and the beginning of every OAuth… |
get_iam_oauth_callback | GET /v1/iam/oauth/callback | iam | Completes the round-trip: it resolves and burns the single-use transaction (checking… |
get_iam_oauth_userinfo | GET /v1/iam/oauth/userinfo | iam | Returns the profile claims for whoever the access token belongs to — the standard OpenID… |
get_iam_scim_v2_serviceproviderconfig | GET /v1/iam/scim/v2/ServiceProviderConfig | iam | Tells your identity provider which parts of SCIM this directory supports, so it… |
get_iam_web3_nonce | GET /v1/iam/web3/nonce | iam | Starts a wallet sign-in: it returns a one-time challenge for the wallet to sign. |
get_iam_whoami | GET /v1/iam/whoami | iam | Tells you who the current caller is — the lightweight check a page makes on load to… |
listOrganizations | GET /v1/iam/organizations | iam | Returns the organizations you can act in, the ones you belong to first and the rest… |
listProviders | GET /v1/iam/providers | iam | Returns your organization's providers, newest first — the identity providers your people… |
setOrganizationAvatar | POST /v1/iam/organizations/avatar | iam | Changes how an organization appears across Hanzo: the square mark beside its name, as an… |
updateOrganization | PUT /v1/iam/organizations/{owner}/{name} | iam | Changes an organization's display, its defaults and the sign-in rules everyone in it… |
updateProvider | PUT /v1/iam/providers/{owner}/{name} | iam | Changes a provider's settings or rotates the credentials it holds. |
upsertApplication | POST /v1/iam/admin/applications/upsert | iam | Creates an application or updates it in place, so a deployment can declare the… |
The same capability over plain HTTP is in the iam API reference, on https://api.hanzo.ai.
Generated from tools/list on https://api.hanzo.ai/v1/mcp — 121 tools captured 2026-08-16.
How is this guide?