ConductorOne · socialyadept · Jul 24, 2026
diff --git a/product/admin/mcp-server/pagerduty.mdx b/product/admin/mcp-server/pagerduty.mdx
@@ -1,17 +1,170 @@
 ---
 title: Set up the PagerDuty MCP server
-description: Connect PagerDuty to C1 with per-user OAuth or a REST API key, then register the PagerDuty MCP server and govern its tools.
+description: Connect PagerDuty to C1 through the PagerDuty REST API or PagerDuty's own hosted MCP server, then register the server and govern its tools.
 og:title: Set up the PagerDuty MCP server
-og:description: Connect PagerDuty to C1 with per-user OAuth or a REST API key, then register the PagerDuty MCP server and govern its tools.
+og:description: Connect PagerDuty to C1 through the PagerDuty REST API or PagerDuty's own hosted MCP server, then register the server and govern its tools.
 sidebarTitle: PagerDuty
 ---
 
-{/* Editor Refresh: 2026-06-11 */}
+{/* Editor Refresh: 2026-07-24 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
+C1 can govern PagerDuty access two ways. Both let your AI clients read from and act on PagerDuty through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog:
+
+- **PagerDuty MCP** — listed as plain **PagerDuty** in your catalog. C1 registers PagerDuty's own hosted MCP server (`mcp.pagerduty.com`) as a downstream server C1 governs. Authenticate with per-user OAuth — using a Scoped OAuth application you register manually in PagerDuty, since PagerDuty's hosted MCP server doesn't support dynamic client registration (DCR) — or with a shared API key or user token. Tool calls run with whichever identity you authenticated.
+- **PagerDuty API** — C1 hosts its own MCP server that translates PagerDuty's REST API into tools. You choose between per-user OAuth or a shared REST API key, and access is scoped to the OAuth app's granted scopes or the REST API key's permissions.
+
+| | PagerDuty MCP | PagerDuty API |
+| :--- | :--- | :--- |
+| **Who hosts the MCP server** | PagerDuty | C1 |
+| **Authentication** | Per-user OAuth with a manually registered Scoped OAuth application (no DCR), or a shared API key / user token (bearer) | Per-user OAuth, or a shared REST API key (bearer token) |
+| **Access scoping** | The connected identity's own PagerDuty permissions, within whatever scopes the OAuth app was granted — not independently scoped by C1 | The scopes you grant the OAuth app, or the permissions of the REST API key you provide |
+| **Tool surface** | PagerDuty's own tool set: incidents, services, on-call schedules, escalation policies, teams, event orchestrations, status pages, and more | Incidents, services, schedules, escalation policies, and users, mapped to PagerDuty REST API endpoints |
+| **Setup effort** | Register a Scoped OAuth application in PagerDuty (or create an API key), then register it in C1 — no automatic registration | Register an OAuth app or create a REST API key in PagerDuty, then register it in C1 |
+
+Use the native **PagerDuty MCP** option (listed as plain **PagerDuty** in your catalog) if you want PagerDuty's own broader, agentic tool set and you're prepared to manually register a Scoped OAuth application (or use an API key). Use **PagerDuty API** if you'd rather scope access purely through PagerDuty's REST API scopes with either credential type.
+
+<Tabs>
+
+<Tab title="PagerDuty MCP">
+
+C1 registers as a client of PagerDuty's own hosted MCP server ([PagerDuty MCP Server](https://support.pagerduty.com/main/docs/pagerduty-mcp-server)) rather than translating PagerDuty's REST API itself. Your users' AI clients still only ever see C1-governed MCP tools, but C1 proxies each tool call straight through to `mcp.pagerduty.com/mcp` under the connected identity, then returns the result. The tools available are exactly the ones PagerDuty's own MCP server exposes — C1 doesn't reshape or add to them.
+
+## Before you begin
+
+- AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
+- For per-user OAuth, you need permission to register a Scoped OAuth application in PagerDuty — this requires an account admin or owner role. Regular users are limited to **Classic User OAuth**, which C1 doesn't use here, since it only supports coarse and unreliable access.
+- For an API key or user token, you need a PagerDuty account that can create a REST API key, or your own user account to create a personal token.
+- PagerDuty's hosted MCP server doesn't support OAuth dynamic client registration (DCR). Unlike some other native MCP integrations, per-user OAuth here always starts with an application you register yourself — there's no automatic client registration to skip.
+
+<Note>
+In your MCP server catalog, this option is listed as **PagerDuty** — distinct from the **PagerDuty API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
+</Note>
+
+## Option 1: Set up per-user OAuth
+
+With per-user OAuth, you register one Scoped OAuth application in PagerDuty and each user authorizes individually. This keeps every action attributable to the user who took it, within the scopes you granted.
+
+### Register a Scoped OAuth application
+
+<Steps>
+<Step>
+In PagerDuty, go to **Integrations** > **App Registration** and select **New App**. Give it a name that identifies C1 for your team, such as `C1`. See PagerDuty's [Register an App](https://developer.pagerduty.com/docs/register-an-app) documentation.
+</Step>
+<Step>
+Select **OAuth 2.0** as the app's functionality, then leave **Scoped OAuth** selected on the next screen — it's the default and the only mode with the granular, per-object scopes below. The other option, **Classic User OAuth**, only supports coarse read (and unreliable write) access, so C1 doesn't use it.
+</Step>
+<Step>
+Set the **Redirect URL** exactly to:
+
+```
+https://accounts.conductor.one/auth/callback
+```
+</Step>
+<Step>
+Select the scopes C1 needs. For full functionality, grant:
+
+- `incidents.read`, `incidents.write` — view, create, acknowledge, resolve, and update incidents
+- `services.read`, `services.write` — view, create, and update services
+- `teams.read`, `teams.write` — view, create, and update teams and their memberships
+- `users.read`, `users.write` — view, create, and update users
+- `schedules.read`, `schedules.write` — view, create, and update on-call schedules
+- `oncalls.read` — view who is currently on call
+- `escalation_policies.read` — view escalation policies
+- `event_orchestrations.read`, `event_orchestrations.write` — view, create, and update event orchestrations (the rules that route events to services)
+- `status_pages.read`, `status_pages.write` — view, create, and update status pages
+- `webhook_subscriptions.read`, `webhook_subscriptions.write` — view, create, and update webhook subscriptions
+- `change_events.read` — view change events (deployments and other changes correlated with incidents)
+- `incident_workflows.read`, `incident_workflows:instances.write` — view incident workflow definitions, and run workflow instances
+- `extension_schemas.read` — view extension schemas used by service extensions and integrations
+- `openid` — sign in with OpenID Connect; identifies the authorizing user
+
+You can narrow or widen this list later from the same screen.
+</Step>
+<Step>
+Select **Register App**, then copy the **Client ID** and **Client Secret** from the confirmation dialog. PagerDuty shows the secret only once.
+</Step>
+</Steps>
+
+### Register the server with OAuth
+
+With your Scoped OAuth application ready, register the server and provide your credentials:
+
+<Steps>
+<Step>
+Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty** from the catalog.
+</Step>
+<Step>
+When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enter your application's **client ID** and **client secret**. Leave **Use dynamic client registration** off — PagerDuty's hosted MCP server doesn't support it.
+</Step>
+<Step>
+Save your changes. The first time a user calls a PagerDuty tool from their AI client, they're redirected to PagerDuty to sign in (if they aren't already) and approve the connection, then returned to C1.
+</Step>
+</Steps>
+
+## Option 2: Use an API key or user token
+
+An API key or user token authenticates every user as one shared PagerDuty identity. Use this when per-user attribution in PagerDuty isn't required, or when you'd rather skip registering an OAuth application.
+
+<Steps>
+<Step>
+In PagerDuty, go to **Integrations** > **API Access Keys** and select **Create New API Key** — or, for a personal token, go to your user icon, then **My Profile** > **User Settings** > **API Access** > **Create API User Token**. See PagerDuty's [API Access Keys](https://support.pagerduty.com/main/docs/api-access-keys) documentation.
+</Step>
+<Step>
+Give the key a recognizable description such as `C1`, then copy it. PagerDuty shows it only once.
+</Step>
+<Step>
+Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty** from the catalog.
+</Step>
+<Step>
+When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your API key or user token.
+</Step>
+<Step>
+Save your changes. C1 starts a sync that discovers the tools the PagerDuty MCP server exposes.
+</Step>
+</Steps>
+
+<Note>
+PagerDuty doesn't use the standard `Bearer` prefix for this credential — it expects the `Authorization` header formatted as `Token token=<key>` ([source](https://community.pagerduty.com/ask-a-product-question-2/can-t-use-api-user-tokens-702)). C1 sends it in this format automatically; you don't need to enter the prefix yourself.
+</Note>
+
+## What access is granted
+
+Tool calls run with whichever identity you authenticated: for per-user OAuth, the connected user's own PagerDuty permissions within the scopes you granted; for an API key or user token, the permissions attached to that credential. Either way, access spans PagerDuty's own tool set — incidents, services, on-call schedules, escalation policies, teams, event orchestrations, status pages, and more.
+
+## How PagerDuty MCP credentials are shared
+
+How PagerDuty sees your users' activity depends on the method you chose:
+
+- **Per-user OAuth.** Each user authorizes with their own PagerDuty account, so tool calls run under that user's PagerDuty identity and inherit only the scopes you granted. PagerDuty attributes each action to the individual user.
+- **API key or user token.** Every user's tool calls use the one credential you provided, so PagerDuty sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage).
+
+## Discover and govern tools
+
+After you register the server, C1 runs tool discovery against PagerDuty's hosted MCP server. Discovered tools appear on the server's **Tools** tab.
+
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+
+Before anyone can call a PagerDuty tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
+
+<Note>
+Tool discovery runs even if authentication isn't complete yet, so seeing discovered tools doesn't confirm a user has authorized or that credentials are valid. You confirm access when an approved user successfully calls a PagerDuty tool from their AI client.
+</Note>
+
+## Manage access to PagerDuty MCP
+
+- **Rotate the OAuth client secret** in your PagerDuty app under **Integrations** > **App Registration**, then update the secret on the server's authentication settings in C1.
+- **Rotate an API key or user token** by creating a new one in PagerDuty and updating it in C1, then delete the old one.
+- **Revoke access** from the app's page in **App Registration** — revoke its tokens to invalidate every session at once, or delete the app entirely.
+- **Adjust scopes** by editing them on the OAuth application in PagerDuty, or by choosing a read-only versus full-access API key.
+
+</Tab>
+
+<Tab title="PagerDuty API">
+
 The PagerDuty MCP server lets you govern access to PagerDuty — incidents, services, schedules, escalation policies, and users exposed by the PagerDuty REST API — as tools your AI clients can call through C1.
 
 PagerDuty supports two ways to authenticate, and you choose one when you register the server:
@@ -34,7 +187,7 @@
 - For a REST API key, you need a PagerDuty account that can create a REST API key, and the email address of a valid PagerDuty user to record as the actor on write operations.
 
 <Note>
-If you don't see **PagerDuty** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
+In your MCP server catalog, this option is listed as **PagerDuty API** — distinct from the **PagerDuty** entry, which connects to PagerDuty's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
 </Note>
 
 ## Option 1: Set up per-user OAuth
@@ -67,7 +220,7 @@
 
 <Steps>
 <Step>
-Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty** from the catalog.
+Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty API** from the catalog.
 </Step>
 <Step>
 When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your OAuth app's **client ID**, **client secret**, and the **scopes** you granted.
@@ -105,7 +258,7 @@
 
 <Steps>
 <Step>
-Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty** from the catalog.
+Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty API** from the catalog.
 </Step>
 <Step>
 Enter the **actor email** — the email of a valid PagerDuty user to record as the actor on write operations such as acknowledging or resolving incidents.
@@ -133,7 +286,7 @@

 Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).

 Before anyone can call a PagerDuty tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.

 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your PagerDuty credentials when an approved user successfully calls a PagerDuty tool from their AI client.
@@ -144,3 +297,7 @@
 - **Rotate the OAuth client secret** in your PagerDuty app under **Integrations** > **Developer Tools** > **App Registration**, then update the secret on the server's authentication settings in C1.
 - **Rotate a REST API key** by creating a new key in PagerDuty and updating it in C1, then delete the old key.
 - **Adjust access** by editing the OAuth app's scopes or by choosing a read-only versus full-access REST API key in PagerDuty.
+
+</Tab>
+
+</Tabs>