Build with AI

Available Tools (early access)

Use the PingOne Remote Model Context Protocol (MCP) Server to connect your artificial intelligence (AI) client to PingOne through a PingOne-hosted remote endpoint. After you configure a supported client and sign on with PingOne OAuth 2.0, you can use MCP tools to work on PingOne administrative tasks directly from your AI client.

You don’t need to install or maintain a local MCP server. PingOne hosts and manages the service, giving you a single entry point for headless administration and centrally managed updates.

The PingOne Remote MCP Server exposes available tools organized into functional categories.

You don’t need to know the individual tool names. Describe what you want in natural language and your AI agent automatically selects the right tool.

Category What you can do

Environments

List, create, update environments, and manage their enabled services.

Populations

Create and manage user populations.

Applications

Full CRUD for OpenID Connect (OIDC), SAML, and worker applications, plus grants, policies, attribute mappings, secrets, push credentials, and role assignments.

Resources

Create and manage OAuth 2.0 protected resources and their scopes.

Users

Create, update, and manage users, including passwords, MFA, and account lockout.

DaVinci

Work with DaVinci flows, applications, connectors, variables, forms, and execution history.

Environments

List accessible environments or manage their configuration and enabled services.

The following table describes the environment tools:

Tool Description

listEnvironments

List PingOne environments accessible to the authenticated user.

getEnvironment

Retrieve an environment’s complete configuration, including its enabled services (Bill of Materials).

createEnvironment

Create a new sandbox PingOne environment for development or testing.

Production environments cannot be created here. They must be created via the admin console.

updateEnvironment

Update an environment’s configuration. You can:

  • Rename an environment

  • Promote a sandbox to production

  • Change the license

  • Change enabled services (Bill of Materials)

The region cannot be changed.

Example prompts

  • "List all my PingOne environments"

  • "Create a sandbox environment called Dev Testing in the NA geography"

  • "What services are enabled in my environment?"

  • "Enable PingOne MFA in my sandbox environment"

Populations

Create and manage populations to organize users within an environment.

The following table describes the population tools:

Tool Description

listPopulations

List populations in an environment.

createPopulation

Create a new population to organize users.

getPopulation

Retrieve a population’s full configuration.

updatePopulation

Update a population’s configuration and assign its default identity provider.

deletePopulation

Permanently delete a population.

Non-empty and default populations cannot be deleted.

Example prompts

  • "List all populations in my environment"

  • "Create a new population called External Users"

  • "Update the description of the Employees population"

Applications

Register and configure OIDC, SAML, worker, and catalog template applications. Manage their grants, authentication policies, attribute mappings, push credentials, client secrets, and role assignments.

Core application management

The following table describes the core application tools:

Tool Description

listApplications

List applications in the environment.

getApplication

Retrieve the full configuration of a single application along with its sub-resources:

  • Metadata

  • Masked secret and rotation state

  • Attribute mappings

  • Flow policy assignments

  • Grants

  • Push credentials

  • Role assignments

  • Sign-on policy assignments

createApplication

Create a new application. Automatically inject grant-type defaults. Available subtypes include:

  • oidc_web_app

  • oidc_native

  • oidc_single_page

  • oidc_worker

  • oidc_device_authorization

  • saml

  • template_app

updateApplication

Update an existing application’s base configuration or its sub-resources:

  • Attribute mappings

  • Flow-policy assignments

  • Sign-on-policy assignments

  • Grants

  • Push credentials

  • Role assignments

  • Secret rotation

  • Metadata

Type and protocol cannot be changed.

deleteApplication

Permanently delete an application.

System-managed applications (Admin Console, Portal, Self-Service) cannot be deleted.

listApplicationCatalog

Browse the PingOne application catalog of prebuilt integration templates, or inspect a specific template to review its requirements.

Example prompts

  • "List all applications in my environment"

  • "Create a single-page app called My SPA with redirect URI http://localhost:3000/callback"

  • "Create a worker application from the Salesforce template in the catalog"

  • "What grants does the My API app have?"

  • "Add the openid and email scopes to the My App grant for the PingOne API resource"

  • "Rotate the client secret for My Worker App and keep the old one valid for 24 hours"

  • "Assign the Identity Data Admin role to My Worker App for environment xyz"

Resources

Create and manage OAuth 2.0 protected resources representing APIs that applications request access to.

The following table describes the resource tools:

Tool Description

listResources

List all resources in an environment to view the protected APIs that applications request access to.

getResource

Retrieve a single resource, including its scopes, attributes, and masked client secret.

createResource

Create a new custom resource representing a protected API.

updateResource

Update a custom resource, including its scopes, attributes, and client secret.

Built-in system resources cannot be changed.

deleteResource

Permanently delete a custom resource and its scopes.

Built-in OpenID Connect and PingOne API resources cannot be deleted.

Example prompts

  • "List all resources in my environment"

  • "Create a new resource called My API with audience https://api.example.com"

  • "Add read and write scopes to My API resource"

  • "What scopes does the PingOne API resource have?"

Users

Create, read, update, and manage users in an environment, including their passwords, MFA enrollment, and account status.

The following table describes the user tools:

Tool Description

listUsers

Search for users in an environment.

getUser

Retrieve a specific user’s profile and related state:

  • MFA

  • Password

  • Roles

  • Groups

  • Consents

  • Linked accounts

  • Sessions

createUser

Create a new user in an environment, with optional email verification.

updateUser

Update a user’s profile or relationships:

  • Enable or disable account

  • Account lock

  • Identity provider

  • Population

  • Admin and application roles

  • Groups

  • Agreement consents

  • Linked external accounts

  • Sessions

deleteUser

Permanently delete a user, along with their MFA devices, sessions, and role assignments.

updateUserMfa

Manage a user’s MFA configuration:

  • Enablement

  • Temporary bypass

  • Enrolled devices

  • Device pairing keys

updateUserPassword

Manage a user’s password:

  • Force a password change at next sign-on

  • Unlock a locked-out password

  • Send the user a recovery code

Example prompts

  • "Find all users with @example.com email addresses"

  • "Create a test user with username testuser1 in the Employees population"

  • "Force a password reset for user abc@example.com"

  • "Disable MFA for user xyz@example.com for 30 minutes"

  • "Unlock the account for user abc123"

  • "List users who have been locked out"

Provisioning

The following table describes the provisioning tools:

Tool Description

listProvisioningConnections

List provisioning connections (stores) in an environment to view their status and advanced action settings.

getProvisioningConnection

Retrieve the full configuration of a single provisioning connection, including advanced action settings:

  • User create, update, or disable

  • Group sync

  • Membership sync

updateProvisioningConnection

Enable or disable a provisioning connection.

Before enabling non-internal connections, a connectivity test is run. The enable is rejected if the connection is unreachable.

listProvisioningRules

List provisioning rules in an environment to view their direction and active state.

getProvisioningRule

Retrieve the full configuration of a single provisioning rule, including all attribute mappings.

createProvisioningRule

Create a new provisioning rule or clone an existing one.

updateProvisioningRule

Update a provisioning rule’s configuration or active state.

deleteProvisioningRule

Permanently and irreversibly delete a provisioning rule and all its attribute mappings.

If another rule references this one as a parent, it cannot be deleted. Workday writeback rules must be deleted before their parent inbound rule.

syncProvisioningRule

Trigger a sync on a provisioning rule. Available modes:

  • Full: Replicates all users from source to target.

  • Partial: Applies only changes since the last poll.

Audit activity

The following table describes the audit activity tools:

Tool Description

searchAuditActivities

Search audit events for a PingOne environment to:

  • Investigate activity history

  • Trace actor actions

  • Identify what changed on a resource

  • Review compliance events

Without a time range, it returns only the last 24 hours.

getAuditActivity

Retrieve the complete detail of a single audit event by ID.

Roles

The following table describes the role tools:

Tool Description

listRoles

List the predefined (built-in) admin roles available for assignment.

getRole

Review the privileges granted by a specific predefined (built-in) admin role.

Groups

The following table describes the group tools:

Tool Description

listGroups

List groups in an environment by name, population, or external ID.

getGroup

Retrieve a group’s full configuration, including:

  • Members

  • Total member count

  • Role assignments

createGroup

Create a new group in an environment, optionally scoped to a population.

updateGroup

Update a group’s settings, including:

  • Direct memberships

  • Nested-group relationships

  • Role assignments

deleteGroup

Permanently delete a group.

DaVinci

Manage DaVinci flows, applications, connectors, variables, forms, and execution history.

DaVinci tools are only available when your environment has the DaVinci capability enabled.

Flows

The following table describes the DaVinci flow tools:

Tool Description

createDavinciFlow

Create, clone, or import a DaVinci flow.

listDavinciFlows

List available DaVinci flows.

getDavinciFlow

Retrieve the complete definition of a DaVinci flow, including its full node graph and settings. Run the DVLinter engine to view errors and warnings, list saved versions, or export specific historical versions.

listDavinciFlowExecutions

List past executions of a DaVinci flow.

getDavinciFlowExecution

Retrieve the event log of a single flow execution to debug failures, verify data transformations, or investigate user-specific issues.

updateDavinciFlow

Manage a DaVinci flow to:

  • Replace the flow definition

  • Enable or disable the flow

  • Deploy the flow to production

  • Assign an alias to a flow version

  • Revert the flow to a specific saved version

deleteDavinciFlow

Permanently delete a DaVinci flow or a specific flow version.

Applications

The following table describes the DaVinci application tools:

Tool Description

listDavinciApplications

List DaVinci applications.

getDavinciApplication

Retrieve the full configuration of a single DaVinci application or flow policy.

createDavinciApplication

Create a new DaVinci application.

updateDavinciApplication

Update an existing DaVinci application to:

  • Modify OAuth and API-key configurations

  • Rotate its API key or secret

  • Add or update a flow policy

deleteDavinciApplication

Permanently delete a DaVinci application or detach a specific flow policy from it.

Connectors

The following table describes the DaVinci connector tools:

Tool Description

listDavinciConnectors

Discover available DaVinci connector types and deployed instances.

getDavinciConnector

Retrieve full details for a specific DaVinci connector type or instance.

createDavinciConnector

Create a new DaVinci connector instance, either from scratch or by cloning an existing instance.

updateDavinciConnector

Update the mutable fields of an existing DaVinci connector instance.

deleteDavinciConnector

Permanently delete a DaVinci connector instance.

Deletion is blocked if any flow references the connector instance.

getDavinciConnectorCapabilityOptions

View the available option values for a connector instance’s capability fields.

Variables

The following table describes the DaVinci variable tools:

Tool Description

listDavinciVariables

List DaVinci variables with their data types and context.

getDavinciVariable

Retrieve the full configuration of a single DaVinci variable, including its context, type, and default value.

createDavinciVariable

Create a new DaVinci variable.

updateDavinciVariable

Update the mutable fields of an existing DaVinci variable.

deleteDavinciVariable

Permanently delete a DaVinci variable.

Deletion is blocked if any flow references the variable.

Forms

The following table describes the DaVinci form tools:

Tool Description

listDavinciForms

List DaVinci forms.

getDavinciForm

Retrieve the full configuration of a single DaVinci form, including all fields and layout.

createDavinciForm

Create a new DaVinci form for sign-on, registration, password reset, or other identity forms.

updateDavinciForm

Update an existing DaVinci form’s fields and layout.

deleteDavinciForm

Permanently delete a DaVinci form.

UI templates

The following table describes the DaVinci UI template tools:

Tool Description

listDavinciUiTemplates

List DaVinci UI templates for the environment.

getDavinciUiTemplate

Retrieve the full configuration of a DaVinci UI template.

createDavinciUiTemplate

Create a new DaVinci UI template for login, registration, or other identity experiences.

updateDavinciUiTemplate

Update an existing DaVinci UI template.

deleteDavinciUiTemplate

Permanently delete a DaVinci UI template.

Unless forced, deletion is blocked if the template is referenced by flows.

Example prompts

  • "List all DaVinci flows"

  • "Show me the last 10 executions of the Registration flow"

  • "What happened during execution xyz-456?"

  • "List all DaVinci connector instances in my environment"

  • "Create a new DaVinci variable called sessionTimeout with value 3600"

  • "Show me all DaVinci forms"