MCP
Unavailable operations
Operations FloPay MCP deliberately does not serve, plus the default-deny boundary for privileged, internal, callback, and checkout surfaces.
Unavailable operations
FloPay MCP never lists or runs these operations. Each exclusion and its reason come from the FloPay MCP contract version 1, revision cc71a476426ea531d369de5441cde85ab81ab52c9764406e5f09501857d7ed32. An exclusion here does not change how the REST API behaves, and an operation that has not been reviewed for MCP is unavailable too, even though it is not listed.
FloPay MCP defaults to deny for superadmin, partner, internal-service, inbound webhook, OAuth callback, and checkout-session-token surfaces. They stay unavailable even when individual routes are not listed below.
| Operation | Reason |
|---|---|
PUT /v1/products/{productId}/metered-items/{priceId} | Attaching metered items to a plan is not an MCP action in usage billing slice 1. |
GET /v1/checkouts/sessions/{id} | Checkout-session-token operations are outside the merchant MCP surface. |
POST /v1/checkouts/sessions/{id}/3ds/complete | Checkout-session-token operations are outside the merchant MCP surface. |
PATCH /v1/checkouts/sessions/{id}/account | Checkout-session-token operations are outside the merchant MCP surface. |
PATCH /v1/checkouts/sessions/{id}/claim | Checkout-session-token operations are outside the merchant MCP surface. |
POST /v1/checkouts/sessions/{id}/process | Checkout-session-token operations are outside the merchant MCP surface. |
GET /v1/checkouts/sessions/{id}/products | Checkout-session-token operations are outside the merchant MCP surface. |
GET /v1/checkouts/sessions/{id}/status | Checkout-session-token operations are outside the merchant MCP surface. |
POST /v1/checkouts/sessions/{id}/vault/capture | Checkout-session-token operations are outside the merchant MCP surface. |
GET /v1/exports/status | Export kill-switch status is a Dashboard preflight, not an MCP merchant operation. |
POST /v1/mcp/token-exchange | MCP adapter infrastructure: the credential exchange is not a merchant tool. |
POST /v1/users/{id}/merge/preview | MCP callers preview a customer merge through the User_merge action preview, which mints the confirmation token; this REST preview is for direct API and dashboard callers. |
PUT /v1/subscriptions/{id}/metered-items/{itemId}/override | Metered unit price overrides are not an MCP action in usage billing slice 1. |
GET /v1/company/invoice-settings | Not available through FloPay MCP. |
PATCH /v1/company/invoice-settings | Not available through FloPay MCP. |
PATCH /v1/invoices/{id}/tax-note | Not available through FloPay MCP. |
GET /v1/products/{productId}/metered-items | Not available through FloPay MCP. |
PATCH /v1/users/{id}/business-details | Not available through FloPay MCP. |
PATCH /v1/users/{id}/profile | Not available through FloPay MCP. |
GET /v1/subscriptions/active | This is a deprecated compatibility route: it stays operational for existing direct API and SDK callers but is excluded from MCP parity. |
GET /v1/products/{productUuid}/media | This legacy collection returns a bare array for backward compatibility. |
GET /v1/products/{productUuid}/variants | This legacy collection returns a bare array for backward compatibility. |
GET /v1/products/{productUuid}/prices | This legacy collection returns a bare array; MCP clients use GET /v1/product-prices. |
GET /v1/settings/chargebacks | This legacy collection returns a bare array; MCP clients use GET /v1/settings/pre-dispute-alerts. |
GET /v1/settings/chargebacks/{id}/descriptors | This legacy collection returns a bare array; MCP clients use GET /v1/settings/pre-dispute-alerts/{id}/descriptors. |
POST /v1/auth/password-reset/confirm | Unauthenticated identity recovery is outside the merchant MCP surface. |
POST /v1/auth/password-reset/request | Unauthenticated identity recovery is outside the merchant MCP surface. |
POST /v1/auth/password-reset/validate | Unauthenticated identity recovery is outside the merchant MCP surface. |
GET /v1/branding/clients/{clientId} | Unauthenticated public brand read is outside the merchant MCP surface. |
POST /v1/subscriptions/{subscriptionId}/usage | Usage reporting is a merchant server integration, not an MCP action. |
GET /v1/webhooks/{id} | Webhook configuration requires the state-bound MCP confirmation contract. |