Organization API

Returns the current identity: identity ID, email, and identity type (e.g. "service" for a service token, which has no email)

MCP tool: organization_auth_me

Parameters

No parameters.

Response

Returns object.

Removes the monthly limit for extra charges of the organization that owns the product in product_id. An open pause stays until organization_billing_budget_resume; nothing restarts on its own. Returns: the budget view, as organization_billing_budgets_get. Fails when: the caller does not own the organization.

MCP tool: organization_billing_budget_clear

Parameters

No parameters.

Response

Returns object.

Reads the monthly limit for extra charges of the organization that owns the product in product_id, this UTC month's counted extra charges, the 50/80/100% thresholds reached, and any open budget pause. To change the limit use organization_billing_budget_set; to remove it, organization_billing_budget_clear; to end a pause, organization_billing_budget_resume. Returns: { currency, budget: { amount_minor, action, updated_at } | null, month: { period, start, end }, counted_minor, lines: { resource, amount_minor }[], thresholds: { percent, reached_at }[], pause: { paused_at, period, amount_minor, counted_minor, resumable, blocked_by } | null, suspension, projection } suspension.reason "unusual_charges" means extra charges this month are unusually high: report it in those words, never as a limit and never with an amount; the remedy is organization_billing_budget_set or contacting support. Any other unknown reason is a billing restriction. Fails when: the caller does not own the organization.

MCP tool: organization_billing_budgets_get

Parameters

No parameters.

Response

Returns object.

Sets the monthly limit for extra charges of the organization that owns the product in product_id, in integer minor units, and what happens at 100%. Replaces any existing limit. Does not end an open pause; organization_billing_budget_resume does. Returns: the budget view, as organization_billing_budgets_get. Typical sequence: organization_billing_budget_set → organization_billing_budget_resume. Fails when: the caller does not own the organization, or no currency is pinned for it yet (currency_not_pinned).

MCP tool: organization_billing_budget_set

Parameters

Response

Returns object.

Ends the open budget pause of the organization that owns the product in product_id, so paused services restart and new chargeable work is allowed again. Possible only when pause.resumable is true in organization_billing_budgets_get. Returns: the budget view, as organization_billing_budgets_get. Typical sequence: organization_billing_budgets_get → organization_billing_budget_set → organization_billing_budget_resume. Fails when: the caller does not own the organization, no pause is open (409 not_paused), or the pause is still blocked (409 resume_blocked, blocked_by: budget_reached | billing_paused | measure_unavailable).

MCP tool: organization_billing_budget_resume

Parameters

No parameters.

Response

Returns object.

Detaches the product in product_id from a connector. For a github-token connector this revokes it (product owner or admin): the stored token and webhook secret are deleted and the revocation is audited.

MCP tool: organization_connectors_remove

Parameters

Response

Returns object.

Lists the products a connector is attached to (org owner/admin)

MCP tool: organization_connectors_list-attachments

Parameters

Response

Returns object.

Attaches products to a connector (batch, idempotent; org owner/admin)

MCP tool: organization_connectors_attach

Parameters

Response

Returns object.

Detaches one product from a connector (org owner/admin). Last detach → dormant.

MCP tool: organization_connectors_detach

Parameters

Response

Returns object.

Deletes a connector org-wide: soft-delete, remove all attachments, tear down routing (org owner/admin)

MCP tool: organization_connectors_delete

Parameters

Response

Returns object.

Requests access to an org connector for a product (any product member)

MCP tool: organization_connectors_request

Parameters

Response

Returns object.

Approves a connector access request, attaching the product (org owner/admin)

MCP tool: organization_connectors_approve-request

Parameters

Response

Returns object.

Denies a connector access request (org owner/admin)

MCP tool: organization_connectors_deny-request

Parameters

Response

Returns object.

Lists org connectors not yet attached to a product, with this product's request status

MCP tool: organization_connectors_list-available

Parameters

Response

Returns object[].

Starts the ClickUp OAuth connect flow for a product and returns the install URL

MCP tool: organization_clickup_install

Parameters

Response

Returns object.

Lists the ClickUp installations connected to a product

MCP tool: organization_clickup_list-installations

Parameters

No parameters.

Response

Returns object[].

Starts the Cloudflare OAuth connect flow for a product and returns the consent URL

MCP tool: organization_cloudflare_install

Parameters

Response

Returns object.

Starts the Google Drive OAuth connect flow for a product and returns the consent URL

MCP tool: organization_gdrive_install

Parameters

Response

Returns object.

Starts the GitHub app installation flow for a product. When the product's organization already has GitHub connections, returns them so one can be reused (attached) instead of dead-ending on GitHub's already-installed settings page. `url` is always returned — connecting an additional, different GitHub org stays possible.

MCP tool: organization_github_install

Parameters

Response

Returns object.

Lists the GitHub app installations connected to a product

MCP tool: organization_github_list-installations

Parameters

No parameters.

Response

Returns object[].

Starts the Google Ads OAuth connect flow for an organization and returns the consent URL

MCP tool: organization_googleads_install

Parameters

Response

Returns object.

Starts the LinkedIn member (personal profile) OAuth connect flow for a product and returns the consent URL

MCP tool: organization_linkedin_member_install

Parameters

Response

Returns object.

Lists active connectors in a product. A github-token row is a fine-grained GitHub token the product connected in the console: config carries repos, tokenLast4, expiresAt, permissions and autoDeploy; lastUsedAt and reauthReason (expiring, expired, revoked) are on the row. The token itself is never returned, and it is added or replaced in the console only.

MCP tool: organization_connectors_list

Parameters

Response

Returns object[].

Starts the Reddit OAuth connect flow for a product and returns the consent URL

MCP tool: organization_reddit_install

Parameters

Response

Returns object.

Starts the X (Twitter) OAuth connect flow for a product and returns the consent URL

MCP tool: organization_x_install

Parameters

Response

Returns object.

Starts the YouTube OAuth connect flow for a product and returns the consent URL

MCP tool: organization_youtube_install

Parameters

Response

Returns object.

Submit product feedback — opens a GitHub issue in the Lessly feedback repo. Use when the user wants to report a bug, request a feature, or leave feedback about the platform.

MCP tool: organization_feedback_submit

Parameters

Response

Returns object.

Lists the organizations the current user belongs to (owned or via membership).

MCP tool: organization_list

Parameters

No parameters.

Response

Returns object.

Creates a new organization owned by the current user and sets it as the active organization for the session.

MCP tool: organization_create

Parameters

Response

Returns object.

Lists an organization's connectors with their product attachments (org owner/admin)

MCP tool: organization_connectors_list-org

Parameters

Response

Returns object[].

Lists connector access requests for an organization (org owner/admin)

MCP tool: organization_connectors_list-requests

Parameters

Response

Returns object[].

Lists invitations for an organization

MCP tool: organization_member_list-invitations

Parameters

Response

Returns object.

Invite a user to an organization by email. Share the products listed in productShares when supplied.

MCP tool: organization_member_invite

Parameters

Response

Returns object.

Revokes a pending organization invitation

MCP tool: organization_member_revoke-invitation

Parameters

Lists the stored members of an organization with their roles and product grants. email is filled for org owners and admins only; it is null for plain members and when Identity has none.

MCP tool: organization_member_list

Parameters

Response

Returns object.

Removes a member from an organization

MCP tool: organization_member_remove

Parameters

Lists the products in an organization a member can access, with role, grant source, and expiry (management view; expired grants are shown with expiresAt).

MCP tool: organization_member_list-product-access

Parameters

Response

Returns object.

Grants an organization member explicit access to a product

MCP tool: organization_member_share-product

Parameters

Response

Returns object.

Revokes an explicit product share from an organization member

MCP tool: organization_member_unshare-product

Parameters

Changes an organization member's role (owner only)

MCP tool: organization_member_set-role

Parameters

Response

Returns object.

Turns ON organization-wide multi-factor authentication (2FA) enforcement for an organization. Owner-only: only the owner of the organization may call it. This is deliberately one-way — disabling MFA enforcement is not available over MCP; use the organization security settings in the Product App instead. The policy is strictest-wins across all of a member’s organizations, so enabling it here forces MFA enrollment for every member of this organization at their next sign-in or token refresh.

MCP tool: organization_security_mfa_enable

Parameters

Response

Returns object.

Lists the groups of an organization with their members and product grants

MCP tool: organization_groups_list

Parameters

Response

Returns object.

Creates an organization group (owner/admin)

MCP tool: organization_groups_create

Parameters

Response

Returns object.

Deletes an organization group; the access it carried is withdrawn (owner/admin)

MCP tool: organization_groups_delete

Parameters

Gets a single organization group with its members and product grants

MCP tool: organization_groups_get

Parameters

Response

Returns object.

Renames an organization group or changes its description (owner/admin)

MCP tool: organization_groups_update

Parameters

Response

Returns object.

Removes a group's grant on a product (owner/admin)

MCP tool: organization_groups_grant-remove

Parameters

Grants a product to every member of a group at an organization role (owner/admin)

MCP tool: organization_groups_grant-set

Parameters

Adds an organization member to a group (owner/admin)

MCP tool: organization_groups_member-add

Parameters

Removes a member from a group; the access the group carried is withdrawn (owner/admin)

MCP tool: organization_groups_member-remove

Parameters

Lists the reusable custom roles defined in an organization

MCP tool: organization_roles_list

Parameters

Response

Returns object.

Creates a reusable organization role with allow/deny permission patterns (owner/admin)

MCP tool: organization_roles_create

Parameters

Response

Returns object.

Deletes an organization role (owner/admin). Already-materialized product grants are unaffected.

MCP tool: organization_roles_delete

Parameters

Gets a single organization role by id

MCP tool: organization_roles_get

Parameters

Response

Returns object.

Updates an organization role's name or allow/deny patterns (owner/admin)

MCP tool: organization_roles_update

Parameters

Response

Returns object.

Accepts an organization invitation using the invitation token

MCP tool: organization_member_accept-invite

Parameters

Response

Returns object.

Lists the full permission catalog (key, display_name, group, level, scope) derived from @McpTool handlers. Only scope="product" entries are grantable in role/point-rights pickers; scope="user" entries are informational.

MCP tool: organization_permission_catalog

Parameters

No parameters.

Response

Returns object.

Sets the active organization for the current session. Product-scoped tools are not affected: they take product_id; list products with organization_product_list. An archived organization cannot be selected: 409 organization_archived, and nothing changes.

MCP tool: organization_select

Parameters

Response

Returns object.

Lists all products the current user has access to

MCP tool: organization_product_list

Parameters

Response

Returns object.

Creates a new product with the given name. Returns the new product; pass its id as product_id to product-scoped tools.

MCP tool: organization_product_create

Parameters

Response

Returns object.

Updates an existing product's name and/or description

MCP tool: organization_product_update

Parameters

Response

Returns object.

Lists who can work in a product: the explicit grants and their roles, the organization owners and admins who inherit full access (read-only here), the organization members holding no access yet, and the organization's named roles a grant can be handed at. `canManage` states whether the caller may change any of it.

MCP tool: organization_product_list-access

Parameters

Response

Returns object.

Revokes a product grant from an organization member. Access inherited from an organization role is lifted in the organization, and the product owner is removed by transferring ownership.

MCP tool: organization_product_revoke-access

Parameters

Grants an organization member access to a product, or changes the role they already hold, at a standard role (admin, member, viewer) or one of the organization's named roles. The target must already be an active member of the product's organization; owner is transfer-only, and access inherited from an organization role is changed in the organization.

MCP tool: organization_product_set-access

Parameters

Response

Returns object.

Lists the custom domains configured in a product

MCP tool: organization_domains_list

Parameters

Response

Returns object.

Adds a custom domain to a product. The domain always starts in external (self-managed DNS) mode; when the product has an active Cloudflare connector that can write DNS, the response carries a managedDns hint naming the connector and the tool that switches the domain to managed mode.

MCP tool: organization_domains_add

Parameters

Response

Returns object.

Removes a custom domain from a product

MCP tool: organization_domains_remove

Parameters

Gets a single custom domain in a product by id

MCP tool: organization_domains_get

Parameters

Response

Returns object.

Lists the extension bindings attached to a domain in a product

MCP tool: organization_bindings_list

Parameters

Response

Returns object[].

Switches a custom domain between external (self-managed DNS) and managed mode. Managed mode requires providerConnectorId — the id of an active Cloudflare connector attached to the product — and hands the domain's records to the platform reconciler.

MCP tool: organization_domains_set-mode

Parameters

Response

Returns object.

List the erasure requests raised for this product's own end users, newest first. `organization_product_erasure_get` reads one by id. Returns: { requests: [{ id, subjectId, status, requestedAt, dueAt, acks }], next }. Page with `after` set to the previous answer's `next`; `next` is null on the last page. Requests raised by another product are never listed. Fails when: the caller is not a member of the product.

MCP tool: organization_product_erasure_list

Parameters

Response

Returns object.

Erase one end user of this product, named by email address, phone number, your own user id and display name. Identifiers are hashed on arrival and no tool on this surface returns one. `organization_product_erasure_list` reads the requests back. Returns: { id, subjectType, subjectId, controller, productId, subjectRefs, requestedBy, requestedAt, dueAt, status, acks }. Typical sequence: organization_product_erasure_request → organization_product_erasure_get. Fails when: no email, phone and external id is given, or the caller does not hold owner or admin on the product. Irreversible.

MCP tool: organization_product_erasure_request

Parameters

Response

Returns object.

Read one erasure request raised for this product's own end users, with the acknowledgement each participating service has filed. `organization_product_erasure_list` enumerates them. Returns: { id, subjectType, subjectId, controller, productId, subjectRefs, requestedBy, requestedAt, dueAt, status, startedAt, finishedAt, acks }. Fails when: the request id is unknown or belongs to another product — both answer 404.

MCP tool: organization_product_erasure_get

Parameters

Response

Returns object.

Lists extensions available to the given product

MCP tool: organization_extensions_list-installed

Parameters

Response

Returns object.

Returns the caller's own role on a product and the allow/deny grants it carries

MCP tool: organization_product_me

Parameters

Response

Returns object.

Lists all active members of a product with their roles

MCP tool: organization_product_list-members

Parameters

Response

Returns object.

Assigns a role to a member of a product

MCP tool: organization_members_assign-role

Parameters

Response

Returns object.

Lists the delegated principals of a product with the tools they hold, are waiting on, and have lost a sponsor for (product owner/admin)

MCP tool: organization_principal-grants_list

Parameters

Response

Returns object.

Sponsors tools for a delegated principal; the approver becomes the sponsor and may only approve what their own role covers, the rest come back in notSponsorable (product owner/admin)

MCP tool: organization_principal-grants_approve

Parameters

Response

Returns object.

Takes tools away from a delegated principal; omit tools to take away everything it holds (product owner/admin)

MCP tool: organization_principal-grants_revoke

Parameters

Response

Returns object.

Lists a product's public keys. Never returns key material.

MCP tool: organization_public-keys_list

Parameters

Response

Returns object.

Creates a public key for a product. The plaintext key is returned only in this response and cannot be retrieved again.

MCP tool: organization_public-keys_create

Parameters

Response

Returns object.

Revokes a public key. Idempotent; revocation is permanent.

MCP tool: organization_public-keys_revoke

Parameters

Response

Returns object.

Replaces the scope of an active public key.

MCP tool: organization_public-keys_update-scope

Parameters

Response

Returns object.

Lists the public routes declared by the product's toolkits, with each route's access mode and public URL.

MCP tool: organization_public-routes_list

Parameters

Response

Returns object.

Lists the roles assignable to a product member (system templates + product custom roles)

MCP tool: organization_product_list-roles

Parameters

Response

Returns object.

Sets the active product of the Workspace console session and reconciles the active organization to that product's organization. Console only: agents do not need it. Product-scoped tools take product_id; list products with organization_product_list.

MCP tool: organization_product_select

Parameters

Response

Returns object.

List the support threads of the caller's organization, most recently updated first — every member sees every one of them. Threads the caller opened personally before support became organization-wide are included and flagged `legacy`. Use when the user asks about their organization's support requests or tickets.

MCP tool: organization_support_threads_list

Parameters

No parameters.

Response

Returns object.

Open a support thread owned by the caller's organization — the body becomes the first message, authored by the caller. Every colleague can then read and answer it. Use when the user wants to contact Lessly support. Attach screenshots or logs by passing them in `attachments` as base64 — up to 10 files, each up to 25 MiB decoded; they travel in this same call and need no upload step of their own. If any file is refused the thread is opened but the message is not written, and the error names the file. A first message of files and no text is legal — omit `body` entirely; the title is always required.

MCP tool: organization_support_thread_create

Parameters

Response

Returns object.

Read one support thread of the caller's organization with its full conversation, each message named after its own author. A thread of another organization — or another person's legacy personal thread — is reported as not found.

MCP tool: organization_support_thread_get

Parameters

Response

Returns object.

Reply in any support thread of the caller's organization, as the caller. A thread of another organization is reported as not found. Attach screenshots or logs by passing them in `attachments` as base64 — up to 10 files, each up to 25 MiB decoded; they travel in this same call and need no upload step of their own. If any file is refused the reply is not posted at all, and the error names the file and what went wrong with it. A reply of files and no text is legal — omit `body` entirely.

MCP tool: organization_support_thread_reply

Parameters

Response

Returns object.