---
title: "FusionAuth MCP server for AI agents - actionlake"
description: "Give Claude 337 FusionAuth actions through one MCP server: users, identity providers, keys. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/fusionauth
updated: 2026-10-23
---

Connectors · Identity & security

# FusionAuth MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to FusionAuth and the rest of your systems. It gives your agent 337 FusionAuth actions (122 reads, 174 writes and 41 that wait for a confirmation) and holds the FusionAuth credential itself, so the agent never does. It paces FusionAuth's limits and records every call.

[Connect FusionAuth free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "fusionauth.groups.list",
  intent: "check which FusionAuth account is connected"
}
# List — groups · read · 1 upstream call
```

- 337 actions in one signed file
- 122 read look, never change
- 174 write create and update
- 41 wait for a yes destructive, confirmed first

Set up

## Connect FusionAuth in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect FusionAuth.
   API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `api_key` FusionAuth API key (Settings > API Keys)
   - `host` Where your FusionAuth lives: your host
   ```
   account { op: "connections.requirements", service: "fusionauth" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "fusionauth.groups.list" }
   # list — groups · read · 1 upstream call
   check { action: "fusionauth.users.create", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

FusionAuth at a glance

**Sign-in**

API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.

**You provide**

`api_key`

**Setup fields**

`host`

**Limits we pace to**

20 calls a second, per connection

**API covered**

FusionAuth API 1.69.0 (OpenAPI 3.0.3), at your FusionAuth instance's API base URL, which you enter when connecting

**Built from**

FusionAuth's documentation, read 23 October 2026[OpenAPI spec (GitHub)](https://raw.githubusercontent.com/FusionAuth/fusionauth-openapi/main/openapi.yaml) [fusionauth.io](https://fusionauth.io/docs/apis/authentication)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

82 of 122 reads, for up to 5 minutes; a write clears what it affects

**Shared entities**

3, so ask can line FusionAuth up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in FusionAuth.

337 actions in 56 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **122** read look, never change
- **174** write create and update
- **41** destructive wait for a confirmation

1. ### Users
   20
   7 read · 11 write · 2 destructive
   Create — users · Search — users · Get — users · Update — users
2. ### Identity providers
   14
   6 read · 7 write · 1 destructive
   List — identity providers · Create — identity providers · Get — identity providers · Update — identity providers
3. ### Keys
   10
   4 read · 5 write · 1 destructive
   List — keys · Get — keys · Delete — keys · Update — keys
4. ### Tenants
   10
   5 read · 4 write · 1 destructive
   List — tenants · Create — tenants · Get — tenants · Update — tenants
5. ### Applications
   9
   4 read · 4 write · 1 destructive
   List — applications · Create — applications · Get — applications · Update — applications
6. ### Consents
   9
   4 read · 4 write · 1 destructive
   Create — consents · Create with id — consents · List — consents · Search — consents
7. ### Email templates
   9
   4 read · 4 write · 1 destructive
   List — email templates · Create — email templates · Get — email templates · Update — email templates
8. ### Entities
   9
   3 read · 5 write · 1 destructive
   Create — entities · Create with id — entities · Get many — entities · Search — entities

**48 more areas · 247 actions**

- Entity types **9**
- Webhooks **9**
- Families **8**
- Groups **8**
- Ip access control lists **8**
- Lambdas **8**
- Message templates **8**
- Registrations **8**
- Themes **8**
- Connectors **7**
- Form fields **7**
- Forms **7**
- Messengers **7**
- User action reasons **7**
- User actions **7**
- User consents **7**
- API keys **6**
- Oauth scopes **6**
- Two factor **6**
- Application roles **5**
- Entity grants **5**
- Entity type permissions **5**
- Reactor **5**
- Refresh tokens **5**
- Reports **5**
- System **5**
- User actioning **5**
- User two factor **5**
- Webauthn **5**
- Webauthn credentials **5**
- Group members **4**
- Identity provider links **4**
- Identity verification **4**
- JWT **4**
- Login **4**
- Tenant manager identity providers **4**
- Audit logs **3**
- Integrations **3**
- Passwordless **3**
- System configuration **3**
- Tenant manager **3**
- User comments **3**
- Event logs **2**
- Oidc **2**
- Webhook event logs **2**
- Emails **1**
- Login records **1**
- Webhook attempt logs **1**

Top actions

## The FusionAuth API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 61 of FusionAuth's 61 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `fusionauth.groups.list` List — groups | List — groups. | read | `identity.group.list` 262 connectors |
| `fusionauth.users.create` Create — users | Create — users. | write | `identity.user.create` 262 connectors |
| `fusionauth.users.search` Search — users | Search — users. | read | `identity.user.search` 40 connectors |
| `fusionauth.applications.list` List — applications | List — applications. | read | `identity.application.list` 37 connectors |
| `fusionauth.groups.create` Create — groups | Create — groups. | write | `identity.group.create` 205 connectors |
| `fusionauth.applications.create` Create — applications | Create — applications. | write | `identity.application.create` 27 connectors |
| `fusionauth.application_roles.create` Create — application roles | Create — application roles. | write | `identity.role.create` 105 connectors |
| `fusionauth.api_keys.create` Create — api keys | Create — api keys. | write | `identity.api_key.create` 100 connectors |
| `fusionauth.group_members.add` Add — group members | Add — group members. | write | `identity.group_member.add` 72 connectors |
| `fusionauth.group_members.remove` Remove — group members | Remove — group members. | destructive | `identity.group_member.remove` 69 connectors |
| `fusionauth.application_roles.update` Update — application roles | Update — application roles. | write | `identity.role.update` 98 connectors |
| `fusionauth.api_keys.get` Get — api keys | Get — api keys. | read | `identity.api_key.get` 66 connectors |

Try it

## Prompts to paste into Claude.

Each one names the FusionAuth actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Who has access in FusionAuth? List every user and their role.
   calls `fusionauth.users.search`
2. Write write
   Create — users in FusionAuth. Show me exactly what you will send before you save it.
   calls `fusionauth.users.create`

Governance for FusionAuth

## Destructive actions wait for a yes.

41 FusionAuth actions are destructive. The first 10:

- Delete — users `fusionauth.users.delete`
- Delete — groups `fusionauth.groups.delete`
- Delete — applications `fusionauth.applications.delete`
- Remove — group members `fusionauth.group_members.remove`
- Delete — application roles `fusionauth.application_roles.delete`
- Delete — api keys `fusionauth.api_keys.delete`
- Delete — identity providers `fusionauth.identity_providers.delete`
- Delete — webhooks `fusionauth.webhooks.delete`
- Delete — keys `fusionauth.keys.delete`
- Delete — email templates `fusionauth.email_templates.delete`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do fusionauth.users.delete confirm_policy: **human**

Delete — users?

**intent:** the user asked me to delete — users

run suspended · waiting for a named person · key _fusionauth-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "fusionauth-agent",
  allowed_actions: ["fusionauth.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "fusionauth.users.delete", approver: "lead@example.com" },
    { match: "fusionauth.groups.delete", approver: "lead@example.com" },
    { match: "fusionauth.applications.delete", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to FusionAuth only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What FusionAuth costs on actionlake.

Every FusionAuth action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call FusionAuth refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 337 FusionAuth actions
- 337 actions page each page of a long list is one call
- 82 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every FusionAuth action.

337 actions by area: the id your agent calls, what it does, and its effect.

**Users 20**

- `fusionauth.users.bulk_delete` Bulk delete — users destructive
- `fusionauth.users.change_password` Change password — users write
- `fusionauth.users.change_password_by_identity` Change password by identity — users write
- `fusionauth.users.check_change_password_by_login_id` Check change password by login id — users read
- `fusionauth.users.check_change_password_id` Check change password id — users read
- `fusionauth.users.create` Create — users write
- `fusionauth.users.create_with_id` Create with id — users write
- `fusionauth.users.delete` Delete — users destructive
- `fusionauth.users.forgot_password` Forgot password — users write
- `fusionauth.users.get` Get — users read
- `fusionauth.users.get_many` Get many — users read
- `fusionauth.users.import` Import — users write
- `fusionauth.users.list_recent_logins` List recent logins — users read
- `fusionauth.users.lookup` Lookup — users read
- `fusionauth.users.patch` Patch — users write
- `fusionauth.users.refresh_search_index` Refresh search index — users write
- `fusionauth.users.search` Search — users read
- `fusionauth.users.start_verify_email` Start verify email — users write
- `fusionauth.users.update` Update — users write
- `fusionauth.users.verify_email` Verify email — users write

**Identity providers 14**

- `fusionauth.identity_providers.complete_login` Complete login — identity providers write
- `fusionauth.identity_providers.create` Create — identity providers write
- `fusionauth.identity_providers.create_with_id` Create with id — identity providers write
- `fusionauth.identity_providers.delete` Delete — identity providers destructive
- `fusionauth.identity_providers.get` Get — identity providers read
- `fusionauth.identity_providers.get_connection_test_result` Get connection test result — identity providers read
- `fusionauth.identity_providers.list` List — identity providers read
- `fusionauth.identity_providers.lookup` Lookup — identity providers read
- `fusionauth.identity_providers.patch` Patch — identity providers write
- `fusionauth.identity_providers.search` Search — identity providers read
- `fusionauth.identity_providers.search_by_params` Search by params — identity providers read
- `fusionauth.identity_providers.start_connection_test` Start connection test — identity providers write
- `fusionauth.identity_providers.start_login` Start login — identity providers write
- `fusionauth.identity_providers.update` Update — identity providers write

**Keys 10**

- `fusionauth.keys.delete` Delete — keys destructive
- `fusionauth.keys.generate` Generate — keys write
- `fusionauth.keys.generate_with_id` Generate with id — keys write
- `fusionauth.keys.get` Get — keys read
- `fusionauth.keys.import` Import — keys write
- `fusionauth.keys.import_with_id` Import with id — keys write
- `fusionauth.keys.list` List — keys read
- `fusionauth.keys.search` Search — keys read
- `fusionauth.keys.search_by_params` Search by params — keys read
- `fusionauth.keys.update` Update — keys write

**Tenants 10**

- `fusionauth.tenants.create` Create — tenants write
- `fusionauth.tenants.create_with_id` Create with id — tenants write
- `fusionauth.tenants.delete` Delete — tenants destructive
- `fusionauth.tenants.get` Get — tenants read
- `fusionauth.tenants.get_password_validation_rules` Get password validation rules — tenants read
- `fusionauth.tenants.get_password_validation_rules_for_tenant` Get password validation rules for tenant — tenants read
- `fusionauth.tenants.list` List — tenants read
- `fusionauth.tenants.patch` Patch — tenants write
- `fusionauth.tenants.search` Search — tenants read
- `fusionauth.tenants.update` Update — tenants write

**Applications 9**

- `fusionauth.applications.create` Create — applications write
- `fusionauth.applications.create_with_id` Create with id — applications write
- `fusionauth.applications.delete` Delete — applications destructive
- `fusionauth.applications.get` Get — applications read
- `fusionauth.applications.get_oauth_configuration` Get oauth configuration — applications read
- `fusionauth.applications.list` List — applications read
- `fusionauth.applications.patch` Patch — applications write
- `fusionauth.applications.search` Search — applications read
- `fusionauth.applications.update` Update — applications write

**Consents 9**

- `fusionauth.consents.create` Create — consents write
- `fusionauth.consents.create_with_id` Create with id — consents write
- `fusionauth.consents.delete` Delete — consents destructive
- `fusionauth.consents.get` Get — consents read
- `fusionauth.consents.list` List — consents read
- `fusionauth.consents.patch` Patch — consents write
- `fusionauth.consents.search` Search — consents read
- `fusionauth.consents.search_by_params` Search by params — consents read
- `fusionauth.consents.update` Update — consents write

**Email templates 9**

- `fusionauth.email_templates.create` Create — email templates write
- `fusionauth.email_templates.create_with_id` Create with id — email templates write
- `fusionauth.email_templates.delete` Delete — email templates destructive
- `fusionauth.email_templates.get` Get — email templates read
- `fusionauth.email_templates.list` List — email templates read
- `fusionauth.email_templates.patch` Patch — email templates write
- `fusionauth.email_templates.preview` Preview — email templates read
- `fusionauth.email_templates.search` Search — email templates read
- `fusionauth.email_templates.update` Update — email templates write

**Entities 9**

- `fusionauth.entities.create` Create — entities write
- `fusionauth.entities.create_with_id` Create with id — entities write
- `fusionauth.entities.delete` Delete — entities destructive
- `fusionauth.entities.get` Get — entities read
- `fusionauth.entities.get_many` Get many — entities read
- `fusionauth.entities.patch` Patch — entities write
- `fusionauth.entities.refresh_search_index` Refresh search index — entities write
- `fusionauth.entities.search` Search — entities read
- `fusionauth.entities.update` Update — entities write

**Entity types 9**

- `fusionauth.entity_types.create` Create — entity types write
- `fusionauth.entity_types.create_with_id` Create with id — entity types write
- `fusionauth.entity_types.delete` Delete — entity types destructive
- `fusionauth.entity_types.get` Get — entity types read
- `fusionauth.entity_types.list` List — entity types read
- `fusionauth.entity_types.patch` Patch — entity types write
- `fusionauth.entity_types.search` Search — entity types read
- `fusionauth.entity_types.search_by_params` Search by params — entity types read
- `fusionauth.entity_types.update` Update — entity types write

**Webhooks 9**

- `fusionauth.webhooks.create` Create — webhooks write
- `fusionauth.webhooks.create_with_id` Create with id — webhooks write
- `fusionauth.webhooks.delete` Delete — webhooks destructive
- `fusionauth.webhooks.get` Get — webhooks read
- `fusionauth.webhooks.list` List — webhooks read
- `fusionauth.webhooks.patch` Patch — webhooks write
- `fusionauth.webhooks.search` Search — webhooks read
- `fusionauth.webhooks.search_by_params` Search by params — webhooks read
- `fusionauth.webhooks.update` Update — webhooks write

**Families 8**

- `fusionauth.families.add_member` Add member — families write
- `fusionauth.families.create` Create — families write
- `fusionauth.families.list_for_user` List for user — families read
- `fusionauth.families.list_members` List members — families read
- `fusionauth.families.list_pending_children` List pending children — families read
- `fusionauth.families.remove_member` Remove member — families destructive
- `fusionauth.families.send_request_email` Send request email — families write
- `fusionauth.families.update_member` Update member — families write

**Groups 8**

- `fusionauth.groups.create` Create — groups write
- `fusionauth.groups.create_with_id` Create with id — groups write
- `fusionauth.groups.delete` Delete — groups destructive
- `fusionauth.groups.get` Get — groups read
- `fusionauth.groups.list` List — groups read
- `fusionauth.groups.patch` Patch — groups write
- `fusionauth.groups.search` Search — groups read
- `fusionauth.groups.update` Update — groups write

**Ip access control lists 8**

- `fusionauth.ip_access_control_lists.create` Create — ip access control lists write
- `fusionauth.ip_access_control_lists.create_with_id` Create with id — ip access control lists write
- `fusionauth.ip_access_control_lists.delete` Delete — ip access control lists destructive
- `fusionauth.ip_access_control_lists.get` Get — ip access control lists read
- `fusionauth.ip_access_control_lists.patch` Patch — ip access control lists write
- `fusionauth.ip_access_control_lists.search` Search — ip access control lists read
- `fusionauth.ip_access_control_lists.search_by_params` Search by params — ip access control lists read
- `fusionauth.ip_access_control_lists.update` Update — ip access control lists write

**Lambdas 8**

- `fusionauth.lambdas.create` Create — lambdas write
- `fusionauth.lambdas.create_with_id` Create with id — lambdas write
- `fusionauth.lambdas.delete` Delete — lambdas destructive
- `fusionauth.lambdas.get` Get — lambdas read
- `fusionauth.lambdas.list` List — lambdas read
- `fusionauth.lambdas.patch` Patch — lambdas write
- `fusionauth.lambdas.search` Search — lambdas read
- `fusionauth.lambdas.update` Update — lambdas write

**Message templates 8**

- `fusionauth.message_templates.create` Create — message templates write
- `fusionauth.message_templates.create_with_id` Create with id — message templates write
- `fusionauth.message_templates.delete` Delete — message templates destructive
- `fusionauth.message_templates.get` Get — message templates read
- `fusionauth.message_templates.list` List — message templates read
- `fusionauth.message_templates.patch` Patch — message templates write
- `fusionauth.message_templates.preview` Preview — message templates read
- `fusionauth.message_templates.update` Update — message templates write

**Registrations 8**

- `fusionauth.registrations.create` Create — registrations write
- `fusionauth.registrations.create_with_user` Create with user — registrations write
- `fusionauth.registrations.delete` Delete — registrations destructive
- `fusionauth.registrations.get` Get — registrations read
- `fusionauth.registrations.patch` Patch — registrations write
- `fusionauth.registrations.start_verify` Start verify — registrations write
- `fusionauth.registrations.update` Update — registrations write
- `fusionauth.registrations.verify` Verify — registrations write

**Themes 8**

- `fusionauth.themes.create` Create — themes write
- `fusionauth.themes.create_with_id` Create with id — themes write
- `fusionauth.themes.delete` Delete — themes destructive
- `fusionauth.themes.get` Get — themes read
- `fusionauth.themes.list` List — themes read
- `fusionauth.themes.patch` Patch — themes write
- `fusionauth.themes.search` Search — themes read
- `fusionauth.themes.update` Update — themes write

**Connectors 7**

- `fusionauth.connectors.create` Create — connectors write
- `fusionauth.connectors.create_with_id` Create with id — connectors write
- `fusionauth.connectors.delete` Delete — connectors destructive
- `fusionauth.connectors.get` Get — connectors read
- `fusionauth.connectors.list` List — connectors read
- `fusionauth.connectors.patch` Patch — connectors write
- `fusionauth.connectors.update` Update — connectors write

**Form fields 7**

- `fusionauth.form_fields.create` Create — form fields write
- `fusionauth.form_fields.create_with_id` Create with id — form fields write
- `fusionauth.form_fields.delete` Delete — form fields destructive
- `fusionauth.form_fields.get` Get — form fields read
- `fusionauth.form_fields.list` List — form fields read
- `fusionauth.form_fields.patch` Patch — form fields write
- `fusionauth.form_fields.update` Update — form fields write

**Forms 7**

- `fusionauth.forms.create` Create — forms write
- `fusionauth.forms.create_with_id` Create with id — forms write
- `fusionauth.forms.delete` Delete — forms destructive
- `fusionauth.forms.get` Get — forms read
- `fusionauth.forms.list` List — forms read
- `fusionauth.forms.patch` Patch — forms write
- `fusionauth.forms.update` Update — forms write

**Messengers 7**

- `fusionauth.messengers.create` Create — messengers write
- `fusionauth.messengers.create_with_id` Create with id — messengers write
- `fusionauth.messengers.delete` Delete — messengers destructive
- `fusionauth.messengers.get` Get — messengers read
- `fusionauth.messengers.list` List — messengers read
- `fusionauth.messengers.patch` Patch — messengers write
- `fusionauth.messengers.update` Update — messengers write

**User action reasons 7**

- `fusionauth.user_action_reasons.create` Create — user action reasons write
- `fusionauth.user_action_reasons.create_with_id` Create with id — user action reasons write
- `fusionauth.user_action_reasons.delete` Delete — user action reasons destructive
- `fusionauth.user_action_reasons.get` Get — user action reasons read
- `fusionauth.user_action_reasons.list` List — user action reasons read
- `fusionauth.user_action_reasons.patch` Patch — user action reasons write
- `fusionauth.user_action_reasons.update` Update — user action reasons write

**User actions 7**

- `fusionauth.user_actions.create` Create — user actions write
- `fusionauth.user_actions.create_with_id` Create with id — user actions write
- `fusionauth.user_actions.delete` Delete — user actions destructive
- `fusionauth.user_actions.get` Get — user actions read
- `fusionauth.user_actions.list` List — user actions read
- `fusionauth.user_actions.patch` Patch — user actions write
- `fusionauth.user_actions.update` Update — user actions write

**User consents 7**

- `fusionauth.user_consents.create` Create — user consents write
- `fusionauth.user_consents.create_with_id` Create with id — user consents write
- `fusionauth.user_consents.get` Get — user consents read
- `fusionauth.user_consents.list` List — user consents read
- `fusionauth.user_consents.patch` Patch — user consents write
- `fusionauth.user_consents.revoke` Revoke — user consents destructive
- `fusionauth.user_consents.update` Update — user consents write

**API keys 6**

- `fusionauth.api_keys.create` Create — api keys write
- `fusionauth.api_keys.create_with_id` Create with id — api keys write
- `fusionauth.api_keys.delete` Delete — api keys destructive
- `fusionauth.api_keys.get` Get — api keys read
- `fusionauth.api_keys.patch` Patch — api keys write
- `fusionauth.api_keys.update` Update — api keys write

**Oauth scopes 6**

- `fusionauth.oauth_scopes.create` Create — oauth scopes write
- `fusionauth.oauth_scopes.create_with_id` Create with id — oauth scopes write
- `fusionauth.oauth_scopes.delete` Delete — oauth scopes destructive
- `fusionauth.oauth_scopes.get` Get — oauth scopes read
- `fusionauth.oauth_scopes.patch` Patch — oauth scopes write
- `fusionauth.oauth_scopes.update` Update — oauth scopes write

**Two factor 6**

- `fusionauth.two_factor.check_status` Check status — two factor read
- `fusionauth.two_factor.get_status` Get status — two factor read
- `fusionauth.two_factor.login` Login — two factor write
- `fusionauth.two_factor.send_code_for_enable_disable` Send code for enable disable — two factor write
- `fusionauth.two_factor.send_code_for_login` Send code for login — two factor write
- `fusionauth.two_factor.start_login` Start login — two factor write

**Application roles 5**

- `fusionauth.application_roles.create` Create — application roles write
- `fusionauth.application_roles.create_with_id` Create with id — application roles write
- `fusionauth.application_roles.delete` Delete — application roles destructive
- `fusionauth.application_roles.patch` Patch — application roles write
- `fusionauth.application_roles.update` Update — application roles write

**Entity grants 5**

- `fusionauth.entity_grants.delete` Delete — entity grants destructive
- `fusionauth.entity_grants.get` Get — entity grants read
- `fusionauth.entity_grants.search` Search — entity grants read
- `fusionauth.entity_grants.search_by_params` Search by params — entity grants read
- `fusionauth.entity_grants.upsert` Upsert — entity grants write

**Entity type permissions 5**

- `fusionauth.entity_type_permissions.create` Create — entity type permissions write
- `fusionauth.entity_type_permissions.create_with_id` Create with id — entity type permissions write
- `fusionauth.entity_type_permissions.delete` Delete — entity type permissions destructive
- `fusionauth.entity_type_permissions.patch` Patch — entity type permissions write
- `fusionauth.entity_type_permissions.update` Update — entity type permissions write

**Reactor 5**

- `fusionauth.reactor.activate` Activate — reactor write
- `fusionauth.reactor.deactivate` Deactivate — reactor destructive
- `fusionauth.reactor.get_metrics` Get metrics — reactor read
- `fusionauth.reactor.get_status` Get status — reactor read
- `fusionauth.reactor.regenerate_keys` Regenerate keys — reactor write

**Refresh tokens 5**

- `fusionauth.refresh_tokens.get` Get — refresh tokens read
- `fusionauth.refresh_tokens.import` Import — refresh tokens write
- `fusionauth.refresh_tokens.list` List — refresh tokens read
- `fusionauth.refresh_tokens.revoke` Revoke — refresh tokens destructive
- `fusionauth.refresh_tokens.revoke_by_id` Revoke by id — refresh tokens destructive

**Reports 5**

- `fusionauth.reports.daily_active_users` Daily active users — reports read
- `fusionauth.reports.logins` Logins — reports read
- `fusionauth.reports.monthly_active_users` Monthly active users — reports read
- `fusionauth.reports.registrations` Registrations — reports read
- `fusionauth.reports.totals` Totals — reports read

**System 5**

- `fusionauth.system.get_reindex_status` Get reindex status — system read
- `fusionauth.system.health` Health — system read
- `fusionauth.system.reindex` Reindex — system write
- `fusionauth.system.status` Status — system read
- `fusionauth.system.version` Version — system read

**User actioning 5**

- `fusionauth.user_actioning.cancel` Cancel — user actioning destructive
- `fusionauth.user_actioning.get` Get — user actioning read
- `fusionauth.user_actioning.list` List — user actioning read
- `fusionauth.user_actioning.modify` Modify — user actioning write
- `fusionauth.user_actioning.take` Take — user actioning write

**User two factor 5**

- `fusionauth.user_two_factor.disable` Disable — user two factor destructive
- `fusionauth.user_two_factor.enable` Enable — user two factor write
- `fusionauth.user_two_factor.generate_recovery_codes` Generate recovery codes — user two factor write
- `fusionauth.user_two_factor.list_recovery_codes` List recovery codes — user two factor read
- `fusionauth.user_two_factor.update_method` Update method — user two factor write

**Webauthn 5**

- `fusionauth.webauthn.complete_assertion` Complete assertion — webauthn write
- `fusionauth.webauthn.complete_login` Complete login — webauthn write
- `fusionauth.webauthn.complete_registration` Complete registration — webauthn write
- `fusionauth.webauthn.start_login` Start login — webauthn write
- `fusionauth.webauthn.start_registration` Start registration — webauthn write

**Webauthn credentials 5**

- `fusionauth.webauthn_credentials.delete` Delete — webauthn credentials destructive
- `fusionauth.webauthn_credentials.delete_for_user` Delete for user — webauthn credentials destructive
- `fusionauth.webauthn_credentials.get` Get — webauthn credentials read
- `fusionauth.webauthn_credentials.import` Import — webauthn credentials write
- `fusionauth.webauthn_credentials.list_for_user` List for user — webauthn credentials read

**Group members 4**

- `fusionauth.group_members.add` Add — group members write
- `fusionauth.group_members.remove` Remove — group members destructive
- `fusionauth.group_members.replace` Replace — group members write
- `fusionauth.group_members.search` Search — group members read

**Identity provider links 4**

- `fusionauth.identity_provider_links.create` Create — identity provider links write
- `fusionauth.identity_provider_links.delete` Delete — identity provider links destructive
- `fusionauth.identity_provider_links.get_pending` Get pending — identity provider links read
- `fusionauth.identity_provider_links.list` List — identity provider links read

**Identity verification 4**

- `fusionauth.identity_verification.complete` Complete — identity verification write
- `fusionauth.identity_verification.send` Send — identity verification write
- `fusionauth.identity_verification.start` Start — identity verification write
- `fusionauth.identity_verification.verify` Verify — identity verification write

**JWT 4**

- `fusionauth.jwt.get_public_key` Get public key — jwt read
- `fusionauth.jwt.reconcile` Reconcile — jwt write
- `fusionauth.jwt.refresh` Refresh — jwt write
- `fusionauth.jwt.vend` Vend — jwt write

**Login 4**

- `fusionauth.login.login` Login — login write
- `fusionauth.login.logout` Logout — login destructive
- `fusionauth.login.ping` Ping — login write
- `fusionauth.login.ping_with_request` Ping with request — login write

**Tenant manager identity providers 4**

- `fusionauth.tenant_manager_identity_providers.create` Create — tenant manager identity providers write
- `fusionauth.tenant_manager_identity_providers.delete` Delete — tenant manager identity providers destructive
- `fusionauth.tenant_manager_identity_providers.patch` Patch — tenant manager identity providers write
- `fusionauth.tenant_manager_identity_providers.update` Update — tenant manager identity providers write

**Audit logs 3**

- `fusionauth.audit_logs.create` Create — audit logs write
- `fusionauth.audit_logs.get` Get — audit logs read
- `fusionauth.audit_logs.search` Search — audit logs read

**Integrations 3**

- `fusionauth.integrations.get` Get — integrations read
- `fusionauth.integrations.patch` Patch — integrations write
- `fusionauth.integrations.update` Update — integrations write

**Passwordless 3**

- `fusionauth.passwordless.login` Login — passwordless write
- `fusionauth.passwordless.send_code` Send code — passwordless write
- `fusionauth.passwordless.start` Start — passwordless write

**System configuration 3**

- `fusionauth.system_configuration.get` Get — system configuration read
- `fusionauth.system_configuration.patch` Patch — system configuration write
- `fusionauth.system_configuration.update` Update — system configuration write

**Tenant manager 3**

- `fusionauth.tenant_manager.get` Get — tenant manager read
- `fusionauth.tenant_manager.patch` Patch — tenant manager write
- `fusionauth.tenant_manager.update` Update — tenant manager write

**User comments 3**

- `fusionauth.user_comments.create` Create — user comments write
- `fusionauth.user_comments.list_for_user` List for user — user comments read
- `fusionauth.user_comments.search` Search — user comments read

**Event logs 2**

- `fusionauth.event_logs.get` Get — event logs read
- `fusionauth.event_logs.search` Search — event logs read

**Oidc 2**

- `fusionauth.oidc.get_jwks` Get jwks — oidc read
- `fusionauth.oidc.get_openid_configuration` Get openid configuration — oidc read

**Webhook event logs 2**

- `fusionauth.webhook_event_logs.get` Get — webhook event logs read
- `fusionauth.webhook_event_logs.search` Search — webhook event logs read

**Emails 1**

- `fusionauth.emails.send` Send — emails write

**Login records 1**

- `fusionauth.login_records.search` Search — login records read

**Webhook attempt logs 1**

- `fusionauth.webhook_attempt_logs.get` Get — webhook attempt logs read

Questions

## The FusionAuth MCP server, answered.

**Is there a FusionAuth MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 337 FusionAuth actions across users, identity providers, keys and tenants, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by FusionAuth.

**What do I need to connect FusionAuth?**

FusionAuth API key (Settings > API Keys). Plus your host. The free call account { op: "connections.requirements", service: "fusionauth" } lists exactly what to paste.

**Can an AI agent delete or change things in FusionAuth?**

Only if its key allows it, and only with an explicit confirmation. 41 FusionAuth actions are destructive, including delete — users, delete — groups and delete — applications. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my FusionAuth API limit?**

actionlake paces every call to the limits in the FusionAuth service file: 20 calls a second per connection. Repeated reads are answered from cache (82 FusionAuth actions can be), which never reaches FusionAuth.

**What does a FusionAuth action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (337 FusionAuth actions page). Cache hits, searches, dry runs and calls FusionAuth refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which FusionAuth API does it cover?**

The FusionAuth API 1.69.0 (OpenAPI 3.0.3) at your FusionAuth instance's API base URL, which you enter when connecting. It is built from FusionAuth's documentation as read on 23 October 2026. 337 actions in 56 areas, each one in the signed service file (version 1.0.0).

**Does actionlake keep my FusionAuth data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your FusionAuth credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like FusionAuth

Shares the most action names with

- [PingOne Platform API 31](https://actionlake.com/connectors/pingone-platform-api)
- [Clerk 28](https://actionlake.com/connectors/clerk)
- [OneLogin 23](https://actionlake.com/connectors/onelogin)
- [WorkOS 23](https://actionlake.com/connectors/workos)
- [Keycloak Admin REST API 22](https://actionlake.com/connectors/keycloak-admin-rest-api)
- [Auth0 Management API 21](https://actionlake.com/connectors/auth0-management-api)

Joins with, on shared entities

- [authentik 3](https://actionlake.com/connectors/authentik)
- [Material Security 3](https://actionlake.com/connectors/material-security)
- [HaloPSA 2](https://actionlake.com/connectors/halopsa)
- [Slack 2](https://actionlake.com/connectors/slack)
- [ServiceNow 2](https://actionlake.com/connectors/servicenow)
- [Fortinet FortiGate 2](https://actionlake.com/connectors/fortinet-fortigate)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by FusionAuth; the name is the vendor's own. Counts are from the FusionAuth service file, version 1.0.0.

## Give your agent FusionAuth today.

[Connect FusionAuth free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/fusionauth
More: https://actionlake.com/llms.txt