Get Team Entitlements
GET /teams/{team_id}/entitlements
GET /teams/{team_id}/entitlementsInteractive request editor loads with JavaScript.
Authorization
BearerAdminToken Organization-scoped admin token. Read operations require a valid token, and write operations require a token with write permission.
In: header
Path Parameters
Team ID within the organization.
uuidResponse Body
application/json
application/json
application/json
curl -X GET "$AISIX_CP/teams/$TEAM_ID/entitlements" \ -H "Authorization: Bearer $AISIX_TOKEN"OK
{
"entitlements": {
"mcp": {
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"scope": "env",
"env_id": "3f917d0d-4dff-42f3-97c4-6a5455dfe8c2",
"team_id": "810007d0-bec5-486c-b5d1-28fcd8a079ba",
"allow": [
"string"
],
"deny": [
"string"
],
"enabled": true,
"created_at": "2019-08-24T14:15:22Z",
"updated_at": "2019-08-24T14:15:22Z"
}
}
}Missing or invalid bearer.
{
"error": {
"code": "UNAUTHENTICATED",
"message": "no org context"
}
}Resource not found.
{
"error": {
"code": "NOT_FOUND",
"message": "provider key not found"
}
}Complete operation details and schema variants
GET /teams/{team_id}/entitlements
Get Team Entitlements
Fetch the team's entitlements. The mcp block, when present, is
the MCP ACL layer caller API keys bound to this team carry in
every environment of the organization; it is intersected with the
environment layer for those keys and can only narrow it. Absent
means the team adds no layer of its own.
Parameters
team_id(path, string, required): Team ID within the organization.
Responses
-
200: OK -
entitlements(object, required): Entitlement categories configured directly on the team. -
entitlements.mcp(object, required): The team's MCP ACL layer, applied to its caller API keys in every environment of the organization and intersected with the environment layer.nullwhen the team adds no layer of its own. -
allOf variant 1
-
entitlements.mcp.id(string, required): Policy ID. -
entitlements.mcp.scope(string, required): Whether this policy is the environment layer or a team layer. -
entitlements.mcp.env_id(string, optional): Environment the layer applies to. Present only forscope: env. -
entitlements.mcp.team_id(string, optional): Team the layer applies to. Present only forscope: team. -
entitlements.mcp.allow(array, required): Namespacedserver__toolpatterns this layer allows (*,server__*, or an exactserver__tool). An empty list leaves the covered keys no MCP tool access;["*"]narrows nothing, which is what a layer that only means to subtract tools sends alongsidedeny. -
entitlements.mcp.deny(array, required): Namespacedserver__toolpatterns removed from the effective grant of every caller API key this layer covers. Deny always wins, on any layer. -
entitlements.mcp.enabled(boolean, required): Whether the policy is applied. A disabled policy is kept but ignored. -
entitlements.mcp.created_at(string, required): Time when the policy was created. -
entitlements.mcp.updated_at(string, required): Time when the policy was last updated. -
401: Missing or invalid bearer. -
error(object, required): Error details. -
error.code(string, required): Machine-readable identifier. Examples:UNAUTHENTICATED,INVALID_REQUEST,MASTER_KEY_UNSET,INTERNAL. -
error.message(string, required): Human-readable explanation; safe to surface to operators. -
404: Resource not found. Response fields (application/json): identical toGET /teams/{team_id}/entitlements, response 401 above.
cURL
curl -X GET '$AISIX_CP/teams/{team_id}/entitlements' -H 'Authorization: Bearer $AISIX_TOKEN'