MCP
Unavailable operations
Operations FloPay MCP deliberately does not serve, with the reason recorded for each in the reviewed API contract, including high-risk actions.
Unavailable operations
FloPay MCP never lists or runs these operations. Each exclusion and its reason come from the FloPay MCP contract version 1, revision 764b41d5c7205d6df7eeaeac832fafe882247f5526b1d4d6bc6f98e3eaca7784. An exclusion here does not change how the REST API behaves, and an operation that has not been reviewed for MCP is unavailable too, even though it is not listed.
| Operation | Reason |
|---|---|
PATCH /v1/settings/chargebacks/{id} | Chargeback settings require the state-bound MCP confirmation contract. |
POST /v1/settings/chargebacks/{id}/descriptors | Chargeback settings require the state-bound MCP confirmation contract. |
GET /v1/checkouts/sessions/{id} | Checkout-session-token operations are outside the merchant MCP surface. |
POST /v1/checkouts/sessions/{id}/3ds/complete | Checkout-session-token operations are outside the merchant MCP surface. |
PATCH /v1/checkouts/sessions/{id}/account | Checkout-session-token operations are outside the merchant MCP surface. |
PATCH /v1/checkouts/sessions/{id}/claim | Checkout-session-token operations are outside the merchant MCP surface. |
POST /v1/checkouts/sessions/{id}/process | Checkout-session-token operations are outside the merchant MCP surface. |
GET /v1/checkouts/sessions/{id}/products | Checkout-session-token operations are outside the merchant MCP surface. |
GET /v1/checkouts/sessions/{id}/status | Checkout-session-token operations are outside the merchant MCP surface. |
POST /v1/checkouts/sessions/{id}/vault/capture | Checkout-session-token operations are outside the merchant MCP surface. |
POST /v1/api-tokens | Credential operations require the state-bound MCP confirmation contract. |
DELETE /v1/api-tokens/{id} | Credential operations require the state-bound MCP confirmation contract. |
DELETE /v1/collections/{uuid} | Destructive catalog operations are reviewed and implemented separately. |
DELETE /v1/coupons/{uuid} | Destructive catalog operations are reviewed and implemented separately. |
DELETE /v1/products/brands/{uuid} | Destructive catalog operations are reviewed and implemented separately. |
POST /v1/products/brands/{uuid}/lifecycle/delete | Destructive catalog operations are reviewed and implemented separately. |
DELETE /v1/products/categories/{uuid} | Destructive catalog operations are reviewed and implemented separately. |
POST /v1/products/categories/{uuid}/lifecycle/delete | Destructive catalog operations are reviewed and implemented separately. |
DELETE /v1/products/{productUuid}/media/{uuid} | Destructive catalog operations are reviewed and implemented separately. |
POST /v1/products/{productUuid}/media/{uuid}/lifecycle/delete | Destructive catalog operations are reviewed and implemented separately. |
DELETE /v1/products/{productUuid}/prices/{uuid} | Destructive catalog operations are reviewed and implemented separately. |
POST /v1/products/{productUuid}/prices/{uuid}/lifecycle/delete | Destructive catalog operations are reviewed and implemented separately. |
DELETE /v1/products/{productUuid}/variants/{uuid} | Destructive catalog operations are reviewed and implemented separately. |
POST /v1/products/{productUuid}/variants/{uuid}/lifecycle/delete | Destructive catalog operations are reviewed and implemented separately. |
DELETE /v1/products/{uuid} | Destructive catalog operations are reviewed and implemented separately. |
DELETE /v1/settings/dunning-policy | Dunning-policy mutations require the state-bound MCP confirmation contract. |
PATCH /v1/settings/dunning-policy | Dunning-policy mutations require the state-bound MCP confirmation contract. |
GET /v1/exports/status | Export kill-switch status is a Dashboard preflight, not an MCP merchant operation. |
DELETE /v1/branding | High- and critical-risk merchant operations are reviewed and implemented separately. |
DELETE /v1/checkout-links/{uuid} | High- and critical-risk merchant operations are reviewed and implemented separately. |
PATCH /v1/checkout-links/{uuid} | High- and critical-risk merchant operations are reviewed and implemented separately. |
POST /v1/checkouts/sessions | High- and critical-risk merchant operations are reviewed and implemented separately. |
POST /v1/payments | High- and critical-risk merchant operations are reviewed and implemented separately. |
POST /v1/settings/gateways | High- and critical-risk merchant operations are reviewed and implemented separately. |
PATCH /v1/settings/gateways/{id} | High- and critical-risk merchant operations are reviewed and implemented separately. |
POST /v1/settings/gateways/{id}/activate | High- and critical-risk merchant operations are reviewed and implemented separately. |
POST /v1/settings/gateways/{id}/deactivate | High- and critical-risk merchant operations are reviewed and implemented separately. |
POST /v1/webhooks | High- and critical-risk merchant operations are reviewed and implemented separately. |
DELETE /v1/webhooks/{id} | High- and critical-risk merchant operations are reviewed and implemented separately. |
PATCH /v1/webhooks/{id} | High- and critical-risk merchant operations are reviewed and implemented separately. |
POST /v1/mcp/token-exchange | MCP adapter infrastructure: the credential exchange is not a merchant tool. |
PUT /v1/payments/{id}/cancel | Payment mutations require the state-bound MCP confirmation contract. |
PUT /v1/payments/{id}/capture | Payment mutations require the state-bound MCP confirmation contract. |
POST /v1/payments/{id}/refund | Payment mutations require the state-bound MCP confirmation contract. |
DELETE /v1/payment-methods/{id} | Payment-method deletion requires the state-bound MCP confirmation contract. |
PATCH /v1/settings/pre-dispute-alerts/{id} | Pre-dispute settings require the state-bound MCP confirmation contract. |
POST /v1/settings/pre-dispute-alerts/{id}/descriptors | Pre-dispute settings require the state-bound MCP confirmation contract. |
POST /v1/subscriptions/{id}/change | Subscription changes require the state-bound MCP confirmation contract. |
PUT /v1/subscriptions/{id}/cancel | Subscription control requires the state-bound MCP confirmation contract. |
PUT /v1/subscriptions/{id}/extend | Subscription control requires the state-bound MCP confirmation contract. |
PUT /v1/subscriptions/{id}/pause | Subscription control requires the state-bound MCP confirmation contract. |
PUT /v1/subscriptions/{id}/reactivate | Subscription control requires the state-bound MCP confirmation contract. |
PUT /v1/subscriptions/{id}/resume | Subscription control requires the state-bound MCP confirmation contract. |
POST /v1/subscriptions | Subscription creation requires the state-bound MCP confirmation contract. |
POST /v1/client-users | Team and role changes require the state-bound MCP confirmation contract. |
POST /v1/client-users/ownership/transfer | Team and role changes require the state-bound MCP confirmation contract. |
DELETE /v1/client-users/{id} | Team and role changes require the state-bound MCP confirmation contract. |
PATCH /v1/client-users/{id} | Team and role changes require the state-bound MCP confirmation contract. |
GET /v1/subscriptions/active | This is a deprecated compatibility route: it stays operational for existing direct API and SDK callers but is excluded from MCP parity. |
GET /v1/products/{productUuid}/media | This legacy collection returns a bare array for backward compatibility. |
GET /v1/products/{productUuid}/variants | This legacy collection returns a bare array for backward compatibility. |
GET /v1/products/{productUuid}/prices | This legacy collection returns a bare array; MCP clients use GET /v1/product-prices. |
GET /v1/settings/chargebacks | This legacy collection returns a bare array; MCP clients use GET /v1/settings/pre-dispute-alerts. |
GET /v1/settings/chargebacks/{id}/descriptors | This legacy collection returns a bare array; MCP clients use GET /v1/settings/pre-dispute-alerts/{id}/descriptors. |
POST /v1/auth/password-reset/confirm | Unauthenticated identity recovery is outside the merchant MCP surface. |
POST /v1/auth/password-reset/request | Unauthenticated identity recovery is outside the merchant MCP surface. |
POST /v1/auth/password-reset/validate | Unauthenticated identity recovery is outside the merchant MCP surface. |
GET /v1/webhooks/{id} | Webhook configuration requires the state-bound MCP confirmation contract. |
POST /v1/webhooks/events/resend | Webhook replay actions require the state-bound MCP confirmation contract. |
PUT /v1/webhooks/events/{id}/resend | Webhook replay actions require the state-bound MCP confirmation contract. |