curl --request PUT \
--url https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"access": {
"orgWide": false,
"memberIds": [],
"teamIds": []
}
}
'import requests
url = "https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access"
payload = { "access": {
"orgWide": False,
"memberIds": [],
"teamIds": []
} }
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({access: {orgWide: false, memberIds: [], teamIds: []}})
};
fetch('https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'access' => [
'orgWide' => false,
'memberIds' => [
],
'teamIds' => [
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access"
payload := strings.NewReader("{\n \"access\": {\n \"orgWide\": false,\n \"memberIds\": [],\n \"teamIds\": []\n }\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"access\": {\n \"orgWide\": false,\n \"memberIds\": [],\n \"teamIds\": []\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"access\": {\n \"orgWide\": false,\n \"memberIds\": [],\n \"teamIds\": []\n }\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"name": "<string>",
"externalKey": "<string>",
"url": "<string>",
"authType": "oauth",
"credentialMode": "shared",
"apiKeyAuthScheme": "bearer",
"exposeDirectly": true,
"connected": true,
"connectedAt": "2023-11-07T05:31:56Z",
"connectedForMe": true,
"requiredBy": [
{
"pluginId": "<string>",
"name": "<string>"
}
],
"access": {
"orgWide": true,
"memberIds": [
"<string>"
],
"teamIds": [
"<string>"
]
},
"readiness": {
"status": "ready",
"checkedAt": "2023-11-07T05:31:56Z",
"lastSuccessfulAt": "2023-11-07T05:31:56Z",
"reason": "<string>",
"failure": "sign_in_required"
},
"organizationReadiness": {
"status": "ready",
"checkedAt": "2023-11-07T05:31:56Z",
"lastSuccessfulAt": "2023-11-07T05:31:56Z",
"reason": "<string>",
"failure": "sign_in_required"
},
"mcpUrl": "<string>",
"createdByName": "<string>",
"createdByYou": true,
"canRemove": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"needsReconnect": true,
"credentialHealth": "unknown",
"credentialHealthReason": "authorization_rejected",
"credentialHealthCheckedAt": "2023-11-07T05:31:56Z",
"issuerReviewRequired": true,
"reconnectActionOwner": "member",
"missingFeatures": [
"<string>"
],
"externalAccountId": "<string>",
"grantedScopes": [
"<string>"
],
"tenantId": "<string>",
"identityManagedBy": [
{
"pluginId": "<string>",
"name": "<string>"
}
],
"requiredAuthType": "oauth",
"authPolicyConfirmed": true,
"authTypeMismatch": true,
"oauthClientConfigured": true,
"oauthClientRequired": true,
"setupRequired": true,
"oauthClientId": "<string>",
"oauthClientHasSecret": true,
"manualOAuthEndpoints": {
"authorizationEndpoint": "<string>",
"tokenEndpoint": "<string>"
},
"oauthCallbackUrl": "<string>",
"oauthSharedCallbackUrl": "<string>",
"oauthClientMetadataUrl": "<string>",
"oauthCallbackMode": "shared-v1",
"oauthRegistrationSource": "pre-registered",
"authorizationServerIssuer": "<string>",
"requestedScopes": [
"<string>"
]
}{
"error": "invalid_request",
"details": [
{
"message": "<string>",
"path": [
"<string>"
]
}
],
"message": "<string>",
"capability": "<string>"
}{
"error": "unauthorized"
}{
"error": "forbidden",
"reason": "<string>",
"message": "<string>"
}{
"error": "connection_not_found",
"message": "<string>"
}Replace who can use an External MCP Connection
Owners, admins, and the member who added the connection. Full-replace semantics: send the complete desired access set (orgWide, or memberIds + teamIds). Team and member ids come from GET /v1/org. A non-admin creator cannot grant org-wide access and always keeps their own access.
curl --request PUT \
--url https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"access": {
"orgWide": false,
"memberIds": [],
"teamIds": []
}
}
'import requests
url = "https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access"
payload = { "access": {
"orgWide": False,
"memberIds": [],
"teamIds": []
} }
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({access: {orgWide: false, memberIds: [], teamIds: []}})
};
fetch('https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'access' => [
'orgWide' => false,
'memberIds' => [
],
'teamIds' => [
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access"
payload := strings.NewReader("{\n \"access\": {\n \"orgWide\": false,\n \"memberIds\": [],\n \"teamIds\": []\n }\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"access\": {\n \"orgWide\": false,\n \"memberIds\": [],\n \"teamIds\": []\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openworklabs.com/v1/mcp-connections/{connectionId}/access")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"access\": {\n \"orgWide\": false,\n \"memberIds\": [],\n \"teamIds\": []\n }\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"name": "<string>",
"externalKey": "<string>",
"url": "<string>",
"authType": "oauth",
"credentialMode": "shared",
"apiKeyAuthScheme": "bearer",
"exposeDirectly": true,
"connected": true,
"connectedAt": "2023-11-07T05:31:56Z",
"connectedForMe": true,
"requiredBy": [
{
"pluginId": "<string>",
"name": "<string>"
}
],
"access": {
"orgWide": true,
"memberIds": [
"<string>"
],
"teamIds": [
"<string>"
]
},
"readiness": {
"status": "ready",
"checkedAt": "2023-11-07T05:31:56Z",
"lastSuccessfulAt": "2023-11-07T05:31:56Z",
"reason": "<string>",
"failure": "sign_in_required"
},
"organizationReadiness": {
"status": "ready",
"checkedAt": "2023-11-07T05:31:56Z",
"lastSuccessfulAt": "2023-11-07T05:31:56Z",
"reason": "<string>",
"failure": "sign_in_required"
},
"mcpUrl": "<string>",
"createdByName": "<string>",
"createdByYou": true,
"canRemove": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"needsReconnect": true,
"credentialHealth": "unknown",
"credentialHealthReason": "authorization_rejected",
"credentialHealthCheckedAt": "2023-11-07T05:31:56Z",
"issuerReviewRequired": true,
"reconnectActionOwner": "member",
"missingFeatures": [
"<string>"
],
"externalAccountId": "<string>",
"grantedScopes": [
"<string>"
],
"tenantId": "<string>",
"identityManagedBy": [
{
"pluginId": "<string>",
"name": "<string>"
}
],
"requiredAuthType": "oauth",
"authPolicyConfirmed": true,
"authTypeMismatch": true,
"oauthClientConfigured": true,
"oauthClientRequired": true,
"setupRequired": true,
"oauthClientId": "<string>",
"oauthClientHasSecret": true,
"manualOAuthEndpoints": {
"authorizationEndpoint": "<string>",
"tokenEndpoint": "<string>"
},
"oauthCallbackUrl": "<string>",
"oauthSharedCallbackUrl": "<string>",
"oauthClientMetadataUrl": "<string>",
"oauthCallbackMode": "shared-v1",
"oauthRegistrationSource": "pre-registered",
"authorizationServerIssuer": "<string>",
"requestedScopes": [
"<string>"
]
}{
"error": "invalid_request",
"details": [
{
"message": "<string>",
"path": [
"<string>"
]
}
],
"message": "<string>",
"capability": "<string>"
}{
"error": "unauthorized"
}{
"error": "forbidden",
"reason": "<string>",
"message": "<string>"
}{
"error": "connection_not_found",
"message": "<string>"
}Authorizations
Organization API key passed as the x-api-key header. The raw key is the header value; do not prefix it with Bearer.
Path Parameters
Den TypeID with 'emc_' prefix and a 26-character base32 suffix.
30Body
Show child attributes
Show child attributes
Response
Access updated.
oauth, apikey, none shared, per_member bearer, token ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$Show child attributes
Show child attributes
Show child attributes
Show child attributes
The calling member's own last check. Null means never checked for them (or the settings or their sign-in changed since).
Show child attributes
Show child attributes
scope=manageable only. Whether the connector itself works: for shared connections the shared credential's check; for per-member connections the latest Ready check any member recorded for the current settings, otherwise the caller's own check. Null means nobody has checked it yet.
Show child attributes
Show child attributes
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$unknown, ready, reconnect_required authorization_rejected, credential_expired, post_authorization_validation_failed ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$member, organization_admin Show child attributes
Show child attributes
oauth, apikey, none Whether a client secret is configured. Only returned with explicit connection-settings view permission; never the secret itself.
Only returned with explicit connection-settings view permission; omitted from usable member listings, including for the connection creator.
Show child attributes
Show child attributes
shared-v1, isolated-v1, legacy-v1 pre-registered, client-metadata, dynamic Was this page helpful?