---
title: "Get per-user-headers submission flow"
method: GET
path: "/api/mcp/per-user-headers/flows/{id}"
tags: ["MCP"]
---

# Get per-user-headers submission flow

`GET /api/mcp/per-user-headers/flows/{id}`

Returns the pending submission flow row plus the live MCP client's schema
(required header names + optional admin header names). Used by the
`/workspace/mcp-sessions/auth?flow=<id>&kind=headers` landing page to
render the values form.

Requires management API authentication via `Authorization: Bearer <API key>`.

## Path parameters

- `id` string, required

## Response `200`

Flow detail

- MCPHeadersFlowDetail — Response for GET /api/mcp/per-user-headers/flows/{id}. Carries the schema the end-user needs to fill in plus identity binding info for display.
  - `id` string, required
  - `flow_mode` 'user' | 'vk' | 'session', required
  - `status` 'pending' | 'completed' | 'expired', required
  - `mcp_client` MCPClientSummary — Minimal MCP client view embedded in session rows.
    - `client_id` string
    - `name` string
  - `user_id` string, nullable
  - `user` MCPUserSummary — Minimal user view embedded on user-keyed session rows.
    - `id` string
    - `name` string
  - `virtual_key` MCPVirtualKeySummary — Minimal virtual-key view embedded in session rows.
    - `id` string
    - `name` string
  - `session_id` string, nullable
  - `expires_at` string, date-time, required
  - `created_at` string, date-time, required
  - `required_header_keys` string[], required — Header names the end-user must supply on this submission
  - `admin_header_keys` string[] — Names (not values) of static admin headers attached to every per-user request. Surfaced so the user understands what context will accompany their values.
  - `submitted_keys` string[] — Names of header keys already on the caller's existing credential. Populated whenever a credential exists for the binding (both `active` and `needs_update` states — `orphaned` credentials are filtered server-side). Values are never returned. `has_active_credential` only flips to true when the credential is in `active` state.
  - `has_active_credential` boolean, required — True when a credential already exists for the flow's (mode, identity, mcp_client) triple. The submission UI uses this to render an "edit" affordance instead of a fresh form.

## Other responses

- `401` — Unauthorized — missing or invalid credentials
- `404` — Resource not found
- `500` — Internal server error

---

[API](https://skmtc.net/getbifrost/apis/bifrost-api.md) · [All operations](https://skmtc.net/getbifrost/apis/bifrost-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/getbifrost/bifrost-api/versions/f8cab88f64ea/schema)