Revoke a member's MCP access in this workspace
Stop this member reaching this workspace over MCP.
/v1/workspace/members/{user_id}/mcp-access/revokeAdmin- Operation id
- revoke_mcp_access
- Access
- An editor or a viewer is refused.
/v1/workspace/members/{user_id}/mcp-access/revokeStop this member reaching this workspace over MCP.
Per workspace, not per person. Revoking here says nothing about their access to any other workspace they belong to, and it does not touch their ordinary access to this one: they keep using the product normally.
It takes effect on their very next MCP call. There is no cache to expire and no token lifetime to wait out.
Revoking twice is a success, with already: true, so this is safe to
retry. An unknown member is 404.
There is no screen for this today, so it is done through the API.
Tenancy: the request is scoped to one workspace, and the credential presented is what selects it. A caller with no membership in that workspace is refused with 404, which is indistinguishable from a workspace that does not exist.
Authorisation: admin or owner. An editor or viewer receives 403 insufficient_role.
Access: Authorization: Bearer carrying either a realm access token or an API key. A key must hold the workspace-admin:write scope, and the workspace role of the person who owns it must meet the floor above.
A realm-issued access token, presented as Authorization: Bearer <token>. It acts as the person who signed in, and every operation resolves their workspace role live from the membership record.
In: header
Path Parameters
uuidResponse Body
application/json
application/json
curl -X POST "https://example.com/v1/workspace/members/497f6eca-6276-4993-bfeb-53cbbbba6f08/mcp-access/revoke"{}