Skip to main content
These operations manage the people in your workspace and the roles and teams that scope what they can do. User and role operations each require their own management capability.
Closed beta. The MCP Manager Admin API and MCP server are available now to a limited set of workspaces through the MCP Manager Admin API entitlement (ff-mcpm-admin), ahead of general availability. If you don’t see Settings → MCP & API in your workspace, it isn’t enabled for you yet — ask your MCP Manager contact to join the beta.

​
List Teams

Read-only List the workspace’s teams. Returns each accessible team as { guid, name, enabled }, scoped to what the caller may see, like the people → teams page. MCP tool: list_teams · REST: GET /api/v1/mcpm-admin/teams · Capability: none — available to any authenticated caller Parameters: none. Example

​
Create Team

Create a workspace team. Creates an enabled team owned by the caller (a creator edge), wired to the organization. Returns { guid, name, enabled }. Add members with set_user_teams and provision gateways with assign_team_to_gateway. MCP tool: create_team · REST: POST /api/v1/mcpm-admin/teams · Capability: Manage teams (manageTeams) Parameters
​
string
required
A human-readable name for the team (e.g. “Engineering”).
Example

​
Rename Team

Rename a team. Renames the team. Saved only when the name actually changes. Returns { guid, name, enabled }. MCP tool: rename_team · REST: PATCH /api/v1/mcpm-admin/teams/:teamGuid/name · Capability: Manage teams (manageTeams) Parameters
​
string
required
The guid of the team to rename (from list_teams).
​
string
required
The new name for the team.
Example

​
Delete Team

Destructive Delete a team. Hard-deletes the team; its membership and gateway-provisioning edges are removed. Returns { deleted: true, teamGuid }. MCP tool: delete_team · REST: DELETE /api/v1/mcpm-admin/teams/:teamGuid · Capability: Manage teams (manageTeams) Parameters
​
string
required
The guid of the team to delete (from list_teams).
Example

​
List Roles

Read-only List the workspace’s roles. Returns each role as { guid, name, grantedCapabilities }, where grantedCapabilities are the capability keys the role grants (value true) — the same keys whoami reports for a user. MCP tool: list_roles · REST: GET /api/v1/mcpm-admin/roles · Capability: Manage roles (manageRoles) Parameters: none. Example

​
Create Role

Create a workspace role. Creates a role owned by the caller, wired to the organization, with the given capability grants (empty by default). Returns { guid, name, grantedCapabilities }. MCP tool: create_role · REST: POST /api/v1/mcpm-admin/roles · Capability: Manage roles (manageRoles) Parameters
​
string
required
A human-readable name for the role (e.g. “Gateway Operator”).
​
object
Initial capability grants as a map of capability key → “true”/“false” (e.g. { "basicGatewayManagement": "true" }). Omit to create a role with no capabilities (set them later with modify_role). Any value other than “true” is treated as false. (a string → string map)
Example

​
Modify Role

Rename a role and/or change its capability grants. Updates the role’s name and/or merges the supplied capability grants into its existing grants (provided keys are set; others unchanged). Saved only when something actually changes. Returns { guid, name, grantedCapabilities }. MCP tool: modify_role · REST: PATCH /api/v1/mcpm-admin/roles/:roleGuid · Capability: Manage roles (manageRoles) Parameters
​
string
required
The guid of the role to modify (from list_roles).
​
string
A new name for the role.
​
object
Capability grants to set, as a map of capability key → “true”/“false”. MERGED into the existing grants — only the provided keys change; others are left as-is. Any value other than “true” is treated as false. (a string → string map)
Example

​
Delete Role

Destructive Delete a role, reassigning its users to a replacement role. Before deleting, every user currently on the role is moved to reassignToRoleGuid (so no user is ever left without a role), then the role is deleted. Returns { deleted: true, reassignedUsers }. MCP tool: delete_role · REST: DELETE /api/v1/mcpm-admin/roles/:roleGuid · Capability: Manage roles (manageRoles) Parameters
​
string
required
The guid of the role to delete (from list_roles).
​
string
required
The guid of the role to move every affected user onto. Required — a user must always have exactly one role.
Example

​
List Users

Read-only List the workspace’s users with their role and teams. Returns each user as { guid, emailAddress, displayName, isActive, roleGuid, roleName, teamGuids }, scoped to what the caller may see, like the people → users page. MCP tool: list_users · REST: GET /api/v1/mcpm-admin/users · Capability: none — available to any authenticated caller Parameters: none. Example

​
Set User Role

Set a user’s role. Assigns the role to the user, replacing their current one (a user has exactly one role). Returns the updated user { guid, emailAddress, displayName, isActive, roleGuid, roleName, teamGuids }. MCP tool: set_user_role · REST: PUT /api/v1/mcpm-admin/users/:userGuid/role · Capability: Manage user role assignments (manageUserRoles) Parameters
​
string
required
The guid of the user (from list_users).
​
string
required
The guid of the role to assign (from list_roles).
Example

​
Set User Teams

Replace a user’s team memberships. Sets the user’s teams to exactly the provided list: missing memberships are added, ones not listed are removed. Returns the updated user { guid, emailAddress, displayName, isActive, roleGuid, roleName, teamGuids }. MCP tool: set_user_teams · REST: PUT /api/v1/mcpm-admin/users/:userGuid/teams · Capability: Manage user team assignments (manageUserTeams) Parameters
​
string
required
The guid of the user (from list_users).
​
string
required
The full set of team guids the user should belong to, comma-separated (e.g. “WST-a,WST-b”). This REPLACES the user’s team memberships — teams not listed are removed. Pass an empty string to clear all.
Example

​
Invite User

Invite a new user to the workspace. Sends a workspace invitation, optionally assigning a role and teams. The invite is processed through the BFF so role/team edges and notification wiring are created correctly. Returns { email, userGuid } (userGuid is the created user once available). The caller is recorded as the referrer. MCP tool: invite_user · REST: POST /api/v1/mcpm-admin/users/invite · Capability: Invite users (inviteUsers) Parameters
​
string
required
The email address to invite.
​
string
The invitee’s first name (optional).
​
string
The invitee’s last name (optional).
​
string
The guid of the role to assign the invitee (from list_roles).
​
string
Comma-separated team guids to add the invitee to (from list_teams), e.g. “WST-a,WST-b”.
​
string
An optional custom message included in the invitation email.
Example

​
Deactivate User

Destructive Deactivate a workspace user. Deactivates the user (removes their workspace membership and license) via the BFF. Authorization is enforced by the removeUsers capability. Returns { deactivated: <userGuid> }. MCP tool: deactivate_user · REST: POST /api/v1/mcpm-admin/users/:userGuid/deactivate · Capability: Remove users (removeUsers) Parameters
​
string
required
The guid of the user to deactivate (from list_users).
Example

​
Further reading

Hosts

Where to go next in this section.

Authentication & access

Tokens, the entitlement, capability gating, and error codes for every operation here.

Tool & endpoint reference

The full reference index across every domain.

Capabilities

What each capability named on this page actually allows.