Documentation

Public API & MCP

Drive the runtime programmatically and from AI assistants.

BARRY can be driven programmatically — generate → execute → monitor — over a documented REST API and a Model Context Protocol (MCP) server. Client handling, settings, firewall / alert configuration and secret writes are out of scope of this surface.

Authenticating

Two token types work on every role-gated /api/* endpoint, in addition to the browser session:

Personal Access Token (PAT) — a BARRY-native token you mint yourself under Settings → API tokens (Admin only). It looks like barry_pat_…, is shown once at creation, carries a single role (Viewer / Operator / Admin) and can be revoked or given an expiry at any time.
Identity-provider token — a service-principal access token from your IdP (Entra ID / Keycloak), when the operator has enabled the API bearer path.

Present either as a standard bearer header:

Authorization: Bearer barry_pat_xxxxxxxx

Roles gate reads vs. writes: Viewer reads, Operator additionally runs transports, Admin has full write access. An Operator-scoped token can run any transport (the firewall, connector-enabled and serve-only guards still apply).

What you can do

Generate — create/update transports, connections, triggers, output formats, schedules and groups. The quickest path is the YAML config-as-code endpoint, which upserts objects by name.
Execute — run a transport now, cancel a run, read a transport's status.
Monitor — list runs and run detail, throughput/error/freshness trends, and the schema-registry dataset catalog.
Discover (read-only, so authoring is self-contained) — list the registered on-prem clients (to bind a client-placed connection), browse a source's tables, test a connection, and list connector kinds + vault-secret names.

OpenAPI reference

The full request/response contract is served as an OpenAPI document and a browsable reference UI:

/openapi/v1.json — the machine-readable spec (fetchable with a read token).
/scalar — the interactive reference (browser, Admin).

MCP server

An MCP server is hosted at /mcp (Streamable HTTP) with the same bearer authentication. Point an MCP-capable assistant (Claude Desktop, an IDE, or the MCP inspector) at https://<your-host>/mcp with an Authorization: Bearer barry_pat_… header. It exposes the same surface as tools:

Generate: author_config, validate_config, export_transport_yaml, create_transport
Execute: run_transport, cancel_run, get_transport_status
Monitor: list_transports, list_transport_runs, get_run, list_datasets, monitor_trends, monitor_errors, monitor_freshness, monitor_upcoming
Discovery: list_connections, list_output_formats, list_schedules, list_clients, browse_tables, get_table_schema, test_connection
Data inspection: query_preview — run a transport's custom SELECT for a small sample; query_source — run a read-only SELECT of the assistant's own making against a source connection. query_source is gated: it stays off until an operator enables it, because it lets an assistant read arbitrary source data.

Write and execute tools require the Operator role on the token; read tools require Viewer. Tools accept transports and connections by name or id — an assistant can resolve "server A" without knowing GUIDs.

Connect from VS Code / Claude Code

.vscode/mcp.json:

{
  "servers": {
    "barry": {
      "type": "http",
      "url": "https://<your-host>/mcp",
      "headers": { "Authorization": "Bearer barry_pat_…" }
    }
  }
}

Claude Code CLI:

claude mcp add --transport http barry https://<your-host>/mcp \
  --header "Authorization: Bearer barry_pat_…"

The Settings → API Tokens page renders both snippets with a freshly minted token filled in. A prompt like "load table Customer from connection server-a to storage-b as a full load" maps to list_connections → browse_tables → list_output_formats → create_transport → run_transport → get_transport_status.

← Git integration

SQL Server →