Set Team Entitlements

PUT /teams/{team_id}/entitlements

Interactive request editor loads with JavaScript.

Authorization

BearerAdminToken

AuthorizationBearer <token>

Organization-scoped admin token. Read operations require a valid token, and write operations require a token with write permission.

In: header

Path Parameters

team_id*string

Team ID within the organization.

Formatuuid

Request Body

application/json

Body for setting or clearing a team's entitlements.

mcp*

The team's MCP ACL layer. Send a policy body to create or replace it, or null to remove it so member keys are left with the environment layer and their own block.

Response Body

`application/json`

curl -X PUT "$AISIX_CP/teams/$TEAM_ID/entitlements" \  -H "Authorization: Bearer $AISIX_TOKEN" \  -H "Content-Type: application/json" \  -d '{    "mcp": {      "allow": [        "string"      ]    }  }'

{
  "entitlements": {
    "mcp": {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "scope": "env",
      "env_id": "3f917d0d-4dff-42f3-97c4-6a5455dfe8c2",
      "team_id": "810007d0-bec5-486c-b5d1-28fcd8a079ba",
      "allow": [
        "string"
      ],
      "deny": [
        "string"
      ],
      "enabled": true,
      "created_at": "2019-08-24T14:15:22Z",
      "updated_at": "2019-08-24T14:15:22Z"
    }
  }
}

Request body or parameters failed validation.

{
  "error": {
    "code": "string",
    "message": "string"
  }
}

Missing or invalid bearer.

{
  "error": {
    "code": "UNAUTHENTICATED",
    "message": "no org context"
  }
}

Authenticated request is not permitted.

{
  "error": {
    "code": "CUSTOM_KEY_DISABLED",
    "message": "custom API key values are disabled for this organization"
  }
}

Resource not found.

{
  "error": {
    "code": "NOT_FOUND",
    "message": "provider key not found"
  }
}

Complete operation details and schema variants

PUT /teams/{team_id}/entitlements

Set Team Entitlements

Create, replace, or clear the team's entitlements. Setting the mcp block applies it to the team's caller API keys in every environment of the organization — identity-provider group changes synced to the team propagate automatically, with no per-key edits. Sending "mcp": null removes the team's layer, so member keys are left with the environment layer and their own block. Deny patterns configured on an environment layer keep applying to member keys however wide the team layer is.

Parameters

team_id (path, string, required): Team ID within the organization.

Request body

Content type: application/json

mcp (object, required): The team's MCP ACL layer. Send a policy body to create or replace it, or null to remove it so member keys are left with the environment layer and their own block.
allOf variant 1
mcp.allow (array, required): Namespaced server__tool patterns this layer allows (*, server__*, or an exact server__tool). Each entry may use letters, digits, ., _, -, and *; other characters are rejected. Send [] to leave the covered keys no MCP tool access, or ["*"] for a layer that only subtracts through deny.
mcp.deny (array, optional): Namespaced server__tool patterns removed from the effective grant of every caller API key the policy covers, matched the same way as allow. Deny always wins.
mcp.enabled (boolean, optional): Whether the policy is applied. Send false to keep the policy configured but inactive.

Responses

200: OK
entitlements (object, required): Entitlement categories configured directly on the team.
entitlements.mcp (object, required): The team's MCP ACL layer, applied to its caller API keys in every environment of the organization and intersected with the environment layer. null when the team adds no layer of its own.
allOf variant 1
entitlements.mcp.id (string, required): Policy ID.
entitlements.mcp.scope (string, required): Whether this policy is the environment layer or a team layer.
entitlements.mcp.env_id (string, optional): Environment the layer applies to. Present only for scope: env.
entitlements.mcp.team_id (string, optional): Team the layer applies to. Present only for scope: team.
entitlements.mcp.allow (array, required): Namespaced server__tool patterns this layer allows (*, server__*, or an exact server__tool). An empty list leaves the covered keys no MCP tool access; ["*"] narrows nothing, which is what a layer that only means to subtract tools sends alongside deny.
entitlements.mcp.deny (array, required): Namespaced server__tool patterns removed from the effective grant of every caller API key this layer covers. Deny always wins, on any layer.
entitlements.mcp.enabled (boolean, required): Whether the policy is applied. A disabled policy is kept but ignored.
entitlements.mcp.created_at (string, required): Time when the policy was created.
entitlements.mcp.updated_at (string, required): Time when the policy was last updated.
400: Request body or parameters failed validation.
error (object, required): Error details.
error.code (string, required): Machine-readable identifier. Examples: UNAUTHENTICATED, INVALID_REQUEST, MASTER_KEY_UNSET, INTERNAL.
error.message (string, required): Human-readable explanation; safe to surface to operators.
401: Missing or invalid bearer. Response fields (application/json): identical to PUT /teams/{team_id}/entitlements, response 400 above.
403: Authenticated request is not permitted. Response fields (application/json): identical to PUT /teams/{team_id}/entitlements, response 400 above.
404: Resource not found. Response fields (application/json): identical to PUT /teams/{team_id}/entitlements, response 400 above.

cURL

curl -X PUT '$AISIX_CP/teams/{team_id}/entitlements' -H 'Authorization: Bearer $AISIX_TOKEN'

Set Team Entitlements

200application/json

400application/json

401application/json

403application/json

404application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`