MongoDB package v1.0.0

An OAuth 2.0 service-account access token for the customer's own Atlas organization or project, held in the client's own secret manager. This registration defines one exact stored value: the complete Authorization header value 'Bearer ' followed by the access token, minted by an external deployment process that exchanges the service-account client id and client secret at the Atlas token endpoint (POST /api/oauth/token); the injector places the stored value verbatim into the Authorization header.

Atlas also accepts legacy HTTP Digest API keys, but a Digest public-key:private-key pair drives a challenge-response flow that cannot be represented as one injected header value, so Digest material must never be stored under this secret_ref_id — a deployment that needs Digest requires a separately declared, reviewed Digest-capable connector (see the pack notes). Service-account access tokens are valid for one hour, so the external custody job must refresh the stored value before expiry; an expired value fails closed.

Revocation handling: rotating or revoking a service-account client secret stops new tokens being issued; the reviewed documentation does not state that secret revocation invalidates already-issued access tokens, but Atlas documents a per-token revocation endpoint (POST /api/oauth/revoke, called with the service account's client id and secret) — so the external process should revoke any outstanding token explicitly and otherwise treat issued tokens as live until their one-hour expiry.

Least privilege: grant the credential only the roles these capabilities need (read-only project roles for the reads, project cluster manager for cluster lifecycle) — to terminate a cluster Atlas itself requires Project Owner or Organization Owner, which is far more than the rest of this pack needs, so a deployment not ready for that role should remove the delete capability.

IP access list: if the organization requires an Atlas Administration API IP access list, tokens can be created from any address but API calls must originate from a listed address — the deployment's egress must satisfy it.

Executor hygiene: the resolved material must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

The endpoint host 'mongodb-atlas.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the Atlas Administration API host the deployment actually uses (the documented base URL is https://cloud.mongodb.com/api/atlas/v2) before enabling, in every endpoint, in the resource locator and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step.

GROUP_ID and CLUSTER_NAME in the endpoint paths are placeholders the deployment binds to concrete values before enabling; groups and projects are synonymous in Atlas.

Stored credential format: this HTTP registration defines one exact stored value — an externally minted OAuth 2.0 service-account access token stored as the complete 'Bearer <token>' Authorization header value (see the credential note). The Atlas Administration API also accepts legacy HTTP Digest API keys, whose public-key:private-key challenge flow cannot be represented as a single injected header value; Digest is deliberately outside this pack unless a separately declared, reviewed Digest-capable connector represents that behavior.

Documented exclusions — this pack does not register: project or organization deletion (DELETE /api/atlas/v2/groups/{groupId} and organization-level endpoints), backup restore jobs (a restore overwrites current cluster data) and snapshot export or download, database user update and deletion (PATCH/DELETE .../databaseUsers/{databaseName}/{username} — the path carries the authentication database as well as the username) and password changes, access list entry deletion (DELETE .../accessList/{entryValue} — removing an entry is a network-boundary change that can lock out legitimate clients and deserves its own review), programmatic API key management endpoints (creating or deleting Atlas API keys themselves), invoice and billing endpoints, federation and identity-provider configuration, private endpoint and network peering management, live migration, and anything on the data plane — the Atlas Administration API does not read or write data stored in clusters, so no database-content capability exists here to register.

The Atlas API explorer pages are large client-side documents; the routes registered here follow the documented v2 shapes (groups, clusters, databaseUsers, accessList) and were verified on 2026-09-21 against the retrieved Atlas Administration API v2 reference (see the review record).

The reviewed sources establish: the operation-specific roles (pause/resume requires Project Cluster Manager or higher; termination requires Project Owner or Organization Owner) and the pause effects (backups stopped, all data deleted from separately deployed Search Nodes and rebuilt on resume) come from the fetched pause-terminate page, and the OAuth service-account flow and the negotiated media version (Accept: application/vnd.atlas.<date>+json) come from the fetched v2 API reference page — how the HTTP connector pins that Accept header is a deployment binding decision, not something this registration encodes.