# Organization API

The Organization area publishes 84 REST endpoints. Paths are relative to `https://api.lessly.com`; see [Authentication](/reference/openapi#authentication) for the required header.

### `GET` `/governance/api/v1/auth/me`

Returns the current identity: identity ID, email, and identity type (e.g. "service" for a service token, which has no email)

MCP tool: `organization_auth_me`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| email | string | • | — |
| identityId | string | • | — |
| displayName | string | • | — |
| identityType | string | • | — |

### `GET` `/governance/api/v1/billing/budgets`

Reads the active product's billing budget: the per-product caps of the organization and the current consumption against them.

MCP tool: `organization_billing_budgets_get`

**Parameters**

No parameters.

**Response**

Returns `object`.

### `DELETE` `/governance/api/v1/billing/budgets/cap`

Clears the spending cap of one product in the caller’s organization, leaving that product with no cap. The product must belong to the same organization as the active product.

MCP tool: `organization_billing_caps_clear`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | body | string (uuid) | • | — |

**Response**

Returns `object`.

### `PUT` `/governance/api/v1/billing/budgets/cap`

Sets the spending cap of one product in the caller’s organization, in integer minor units. The product must belong to the same organization as the active product; any other is refused.

MCP tool: `organization_billing_caps_set`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | body | string (uuid) | • | — |
| cap_minor | body | integer | • | — |

**Response**

Returns `object`.

### `DELETE` `/governance/api/v1/connectors/:id`

Detaches the current product from a connector

MCP tool: `organization_connectors_remove`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `GET` `/governance/api/v1/connectors/:id/attachments`

Lists the products a connector is attached to (org owner/admin)

MCP tool: `organization_connectors_list-attachments`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| attachments | object[] | • | — |
| connectorId | string | • | — |

### `POST` `/governance/api/v1/connectors/:id/attachments`

Attaches products to a connector (batch, idempotent; org owner/admin)

MCP tool: `organization_connectors_attach`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| productIds | body | string[] | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| attachments | object[] | • | — |
| connectorId | string | • | — |

### `DELETE` `/governance/api/v1/connectors/:id/attachments/:productId`

Detaches one product from a connector (org owner/admin). Last detach → dormant.

MCP tool: `organization_connectors_detach`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| productId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `DELETE` `/governance/api/v1/connectors/:id/org`

Deletes a connector org-wide: soft-delete, remove all attachments, tear down routing (org owner/admin)

MCP tool: `organization_connectors_delete`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `POST` `/governance/api/v1/connectors/:id/requests`

Requests access to an org connector for a product (any product member)

MCP tool: `organization_connectors_request`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | query | string | • | — |
| id | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| status | string | • | — |

### `POST` `/governance/api/v1/connectors/:id/requests/:requestId/approve`

Approves a connector access request, attaching the product (org owner/admin)

MCP tool: `organization_connectors_approve-request`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| requestId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `POST` `/governance/api/v1/connectors/:id/requests/:requestId/deny`

Denies a connector access request (org owner/admin)

MCP tool: `organization_connectors_deny-request`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| requestId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `GET` `/governance/api/v1/connectors/available`

Lists org connectors not yet attached to a product, with this product's request status

MCP tool: `organization_connectors_list-available`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | query | string | • | — |

**Response**

Returns `object[]`.

| Item field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| status | string | • | — |
| provider | string | • | — |
| reauthAt | string | null | • | — |
| externalId | string | • | — |
| displayName | string | • | — |
| needsReauth | boolean | • | — |
| reauthReason | string | null | • | — |
| requestStatus | string | null one of: pending, denied | • | — |
| organizationId | string | • | — |

### `GET` `/governance/api/v1/connectors/clickup/install`

Starts the ClickUp OAuth connect flow for a product and returns the install URL

MCP tool: `organization_clickup_install`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/clickup/installations`

Lists the ClickUp installations connected to a product

MCP tool: `organization_clickup_list-installations`

**Parameters**

No parameters.

**Response**

Returns `object[]`.

| Item field | Type | Always | Description |
| --- | --- | --- | --- |
| status | string | • | — |
| teamId | string | • | — |
| teamName | string | • | — |

### `GET` `/governance/api/v1/connectors/cloudflare/install`

Starts the Cloudflare OAuth connect flow for a product and returns the consent URL

MCP tool: `organization_cloudflare_install`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/gdrive/install`

Starts the Google Drive OAuth connect flow for a product and returns the consent URL

MCP tool: `organization_gdrive_install`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/github/install`

Starts the GitHub app installation flow for a product. When the product's organization already has GitHub connections, returns them so one can be reused (attached) instead of dead-ending on GitHub's already-installed settings page. `url` is always returned — connecting an additional, different GitHub org stays possible.

MCP tool: `organization_github_install`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |
| status | string one of: install_required, already_connected | • | — |
| canAttach | boolean | • | — |
| connectors | object[] | • | — |

### `GET` `/governance/api/v1/connectors/github/installations`

Lists the GitHub app installations connected to a product

MCP tool: `organization_github_list-installations`

**Parameters**

No parameters.

**Response**

Returns `object[]`.

| Item field | Type | Always | Description |
| --- | --- | --- | --- |
| status | string | • | — |
| accountType | string | • | — |
| accountLogin | string | • | — |
| installationId | number | • | — |

### `GET` `/governance/api/v1/connectors/googleads/install`

Starts the Google Ads OAuth connect flow for an organization and returns the consent URL

MCP tool: `organization_googleads_install`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | query | string (uuid) | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/linkedin-member/install`

Starts the LinkedIn member (personal profile) OAuth connect flow for a product and returns the consent URL

MCP tool: `organization_linkedin_member_install`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/list`

Lists active connectors in a product

MCP tool: `organization_connectors_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | query | string | • | — |

**Response**

Returns `object[]`.

| Item field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| config | object | • | — |
| origin | string one of: product, org | • | — |
| status | string | • | — |
| provider | string | • | — |
| reauthAt | string | null | • | — |
| createdAt | string | • | — |
| customerId | string | null | • | — |
| externalId | string | • | — |
| displayName | string | • | — |
| needsReauth | boolean | • | — |
| reauthReason | string | null | • | — |

### `GET` `/governance/api/v1/connectors/reddit/install`

Starts the Reddit OAuth connect flow for a product and returns the consent URL

MCP tool: `organization_reddit_install`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/x/install`

Starts the X (Twitter) OAuth connect flow for a product and returns the consent URL

MCP tool: `organization_x_install`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/youtube/install`

Starts the YouTube OAuth connect flow for a product and returns the consent URL

MCP tool: `organization_youtube_install`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `POST` `/governance/api/v1/feedback`

Submit product feedback — opens a GitHub issue in the Lessly feedback repo. Use when the user wants to report a bug, request a feature, or leave feedback about the platform.

MCP tool: `organization_feedback_submit`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| title | body | string | • | — |
| details | body | string | • | — |
| page | body | string | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | null | • | — |
| number | number | null | • | — |
| supportThreadId | string | — | — |

### `GET` `/governance/api/v1/organizations`

Lists the organizations the current user belongs to (owned or via membership).

MCP tool: `organization_list`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| organizations | object[] | • | — |

### `POST` `/governance/api/v1/organizations`

Creates a new organization owned by the current user and sets it as the active organization for the session.

MCP tool: `organization_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| name | body | string | • | — |
| legalName | body | string | • | — |
| ownerName | body | string | • | — |
| countryOfIncorporation | body | string | • | — |
| residencyCountry | body | string | • | — |
| beneficialOwners | body | object[] | — | — |
| ownershipConfirmed | body | boolean | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |

### `GET` `/governance/api/v1/organizations/:organizationId/connectors`

Lists an organization's connectors with their product attachments (org owner/admin)

MCP tool: `organization_connectors_list-org`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |

**Response**

Returns `object[]`.

| Item field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| config | object | • | — |
| status | string | • | — |
| provider | string | • | — |
| reauthAt | string | null | • | — |
| createdAt | string | • | — |
| externalId | string | • | — |
| displayName | string | • | — |
| needsReauth | boolean | • | — |
| reauthReason | string | null | • | — |
| organizationId | string | • | — |
| attachedProducts | object[] | • | — |

### `GET` `/governance/api/v1/organizations/:organizationId/connectors/requests`

Lists connector access requests for an organization (org owner/admin)

MCP tool: `organization_connectors_list-requests`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |
| status | query | string one of: pending, approved, denied | — | — |

**Response**

Returns `object[]`.

| Item field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| status | string | • | — |
| provider | string | • | — |
| createdAt | string | • | — |
| productId | string | • | — |
| connectorId | string | • | — |
| productName | string | • | — |
| requestedBy | string | • | — |
| connectorDisplayName | string | • | — |

### `GET` `/governance/api/v1/organizations/:organizationId/invitations`

Lists invitations for an organization

MCP tool: `organization_member_list-invitations`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| invitations | object[] | • | — |

### `POST` `/governance/api/v1/organizations/:organizationId/invitations`

Invites a user to an organization by email, optionally sharing products

MCP tool: `organization_member_invite`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |
| email | body | string (email) | • | — |
| role | body | string one of: owner, admin, member | • | — |
| productShares | body | object[] | — | — |

**Response**

Returns `object`.

### `DELETE` `/governance/api/v1/organizations/:organizationId/invitations/:invitationId`

Revokes a pending organization invitation

MCP tool: `organization_member_revoke-invitation`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |
| invitationId | path | string (uuid) | • | — |

### `GET` `/governance/api/v1/organizations/:organizationId/members`

Lists the stored members of an organization with their roles and product grants

MCP tool: `organization_member_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| members | object[] | • | — |

### `DELETE` `/governance/api/v1/organizations/:organizationId/members/:userId`

Removes a member from an organization

MCP tool: `organization_member_remove`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |
| userId | path | string (uuid) | • | — |

### `GET` `/governance/api/v1/organizations/:organizationId/members/:userId/products`

Lists the products in an organization a member can access, with role, grant source, and expiry (management view; expired grants are shown with expiresAt).

MCP tool: `organization_member_list-product-access`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |
| userId | path | string (uuid) | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| products | object[] | • | — |

### `POST` `/governance/api/v1/organizations/:organizationId/members/:userId/products`

Grants an organization member explicit access to a product

MCP tool: `organization_member_share-product`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |
| userId | path | string (uuid) | • | — |
| productId | body | string (uuid) | • | — |
| role | body | string | — | — |
| expiresAt | body | string (date-time) | null | — | — |
| permissions | body | object | — | — |
| roleId | body | string (uuid) | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| role | string | • | — |
| userId | string | • | — |
| expiresAt | string | null | • | — |
| productId | string | • | — |

### `DELETE` `/governance/api/v1/organizations/:organizationId/members/:userId/products/:productId`

Revokes an explicit product share from an organization member

MCP tool: `organization_member_unshare-product`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |
| userId | path | string (uuid) | • | — |
| productId | path | string (uuid) | • | — |

### `PATCH` `/governance/api/v1/organizations/:organizationId/members/:userId/role`

Changes an organization member's role (owner only)

MCP tool: `organization_member_set-role`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |
| userId | path | string (uuid) | • | — |
| role | body | string one of: admin, member | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| role | string | • | — |
| userId | string | • | — |

### `POST` `/governance/api/v1/organizations/:organizationId/security/mfa/enable`

Turns ON organization-wide multi-factor authentication (2FA) enforcement for an organization. Owner-only: only the owner of the organization may call it. This is deliberately one-way — disabling MFA enforcement is not available over MCP; use the organization security settings in the Product App instead. The policy is strictest-wins across all of a member’s organizations, so enabling it here forces MFA enrollment for every member of this organization at their next sign-in or token refresh.

MCP tool: `organization_security_mfa_enable`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string (uuid) | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| mfaRequired | boolean one of: true | • | — |
| trustedDeviceAllowed | boolean | • | — |

### `GET` `/governance/api/v1/organizations/:orgId/groups`

Lists the groups of an organization with their members and product grants

MCP tool: `organization_groups_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| groups | object[] | • | — |

### `POST` `/governance/api/v1/organizations/:orgId/groups`

Creates an organization group (owner/admin)

MCP tool: `organization_groups_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| name | body | string | • | — |
| description | body | string | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| grants | object[] | • | — |
| members | object[] | • | — |
| createdAt | string | • | — |
| updatedAt | string | • | — |
| description | string | null | • | — |
| organizationId | string | • | — |

### `DELETE` `/governance/api/v1/organizations/:orgId/groups/:groupId`

Deletes an organization group; the access it carried is withdrawn (owner/admin)

MCP tool: `organization_groups_delete`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| groupId | path | string (uuid) | • | — |

### `GET` `/governance/api/v1/organizations/:orgId/groups/:groupId`

Gets a single organization group with its members and product grants

MCP tool: `organization_groups_get`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| groupId | path | string (uuid) | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| grants | object[] | • | — |
| members | object[] | • | — |
| createdAt | string | • | — |
| updatedAt | string | • | — |
| description | string | null | • | — |
| organizationId | string | • | — |

### `PATCH` `/governance/api/v1/organizations/:orgId/groups/:groupId`

Renames an organization group or changes its description (owner/admin)

MCP tool: `organization_groups_update`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| groupId | path | string (uuid) | • | — |
| name | body | string | — | — |
| description | body | string | null | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| grants | object[] | • | — |
| members | object[] | • | — |
| createdAt | string | • | — |
| updatedAt | string | • | — |
| description | string | null | • | — |
| organizationId | string | • | — |

### `DELETE` `/governance/api/v1/organizations/:orgId/groups/:groupId/grants/:productId`

Removes a group's grant on a product (owner/admin)

MCP tool: `organization_groups_grant-remove`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| groupId | path | string (uuid) | • | — |
| productId | path | string (uuid) | • | — |

### `PUT` `/governance/api/v1/organizations/:orgId/groups/:groupId/grants/:productId`

Grants a product to every member of a group at an organization role (owner/admin)

MCP tool: `organization_groups_grant-set`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| groupId | path | string (uuid) | • | — |
| productId | path | string (uuid) | • | — |
| roleId | body | string (uuid) | • | — |

### `POST` `/governance/api/v1/organizations/:orgId/groups/:groupId/members`

Adds an organization member to a group (owner/admin)

MCP tool: `organization_groups_member-add`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| groupId | path | string (uuid) | • | — |
| userId | body | string (uuid) | • | — |

### `DELETE` `/governance/api/v1/organizations/:orgId/groups/:groupId/members/:userId`

Removes a member from a group; the access the group carried is withdrawn (owner/admin)

MCP tool: `organization_groups_member-remove`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| groupId | path | string (uuid) | • | — |
| userId | path | string (uuid) | • | — |

### `GET` `/governance/api/v1/organizations/:orgId/roles`

Lists the reusable custom roles defined in an organization

MCP tool: `organization_roles_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| roles | object[] | • | — |

### `POST` `/governance/api/v1/organizations/:orgId/roles`

Creates a reusable organization role with allow/deny permission patterns (owner/admin)

MCP tool: `organization_roles_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| name | body | string | • | — |
| allow | body | string[] | — | — |
| deny | body | string[] | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| deny | string[] | • | — |
| name | string | • | — |
| type | string one of: system, custom | • | — |
| allow | string[] | • | — |
| createdAt | string | • | — |
| updatedAt | string | • | — |
| organizationId | string | • | — |

### `DELETE` `/governance/api/v1/organizations/:orgId/roles/:roleId`

Deletes an organization role (owner/admin). Already-materialized product grants are unaffected.

MCP tool: `organization_roles_delete`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| roleId | path | string (uuid) | • | — |

### `GET` `/governance/api/v1/organizations/:orgId/roles/:roleId`

Gets a single organization role by id

MCP tool: `organization_roles_get`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| roleId | path | string (uuid) | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| deny | string[] | • | — |
| name | string | • | — |
| type | string one of: system, custom | • | — |
| allow | string[] | • | — |
| createdAt | string | • | — |
| updatedAt | string | • | — |
| organizationId | string | • | — |

### `PATCH` `/governance/api/v1/organizations/:orgId/roles/:roleId`

Updates an organization role's name or allow/deny patterns (owner/admin)

MCP tool: `organization_roles_update`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string (uuid) | • | — |
| roleId | path | string (uuid) | • | — |
| name | body | string | — | — |
| allow | body | string[] | — | — |
| deny | body | string[] | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| deny | string[] | • | — |
| name | string | • | — |
| type | string one of: system, custom | • | — |
| allow | string[] | • | — |
| createdAt | string | • | — |
| updatedAt | string | • | — |
| organizationId | string | • | — |

### `POST` `/governance/api/v1/organizations/invitations/accept`

Accepts an organization invitation using the invitation token

MCP tool: `organization_member_accept-invite`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| token | body | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| name | string | • | — |
| role | string | • | — |
| products | object[] | • | — |
| organizationId | string | • | — |

### `GET` `/governance/api/v1/organizations/permission-catalog`

Lists the full permission catalog (key, display_name, group, level, scope) derived from @McpTool handlers. Only scope="product" entries are grantable in role/point-rights pickers; scope="user" entries are informational.

MCP tool: `organization_permission_catalog`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| catalog | object[] | • | — |

### `POST` `/governance/api/v1/organizations/select`

Sets the active organization for the current session and returns the resolved active product. Session state: the switch also rewrites the session product selection — the current product survives only when it belongs to the new organization, otherwise the caller's first product in that organization is selected, or the selection is cleared when there is none.

MCP tool: `organization_select`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | body | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| organization | object | • | — |
| activeProductId | string | null | • | — |

### `GET` `/governance/api/v1/products`

Lists all products the current user has access to

MCP tool: `organization_product_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | query | string | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| products | object[] | • | — |

### `POST` `/governance/api/v1/products`

Creates a new product with the given name

MCP tool: `organization_product_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| name | body | string | • | — |
| organizationId | body | string (uuid) | — | — |
| region | body | string one of: eu | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| role | string | • | — |
| slug | string | • | — |
| demoAt | string | null | • | — |
| region | string | • | — |
| status | string | • | — |
| logoUrl | string | null | • | — |
| blockedAt | string | null | • | — |
| createdAt | string | • | — |
| archivedAt | string | null | • | — |
| description | string | null | • | — |
| organizationId | string | • | — |

### `PATCH` `/governance/api/v1/products/:productId`

Updates an existing product's name and/or description

MCP tool: `organization_product_update`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| name | body | string | — | — |
| description | body | string | null | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| role | string | • | — |
| slug | string | • | — |
| demoAt | string | null | • | — |
| region | string | • | — |
| status | string | • | — |
| logoUrl | string | null | • | — |
| blockedAt | string | null | • | — |
| createdAt | string | • | — |
| archivedAt | string | null | • | — |
| description | string | null | • | — |
| organizationId | string | • | — |

### `GET` `/governance/api/v1/products/:productId/access`

Lists who can work in a product: the explicit grants and their roles, the organization owners and admins who inherit full access (read-only here), the organization members holding no access yet, and the organization's named roles a grant can be handed at. `canManage` states whether the caller may change any of it.

MCP tool: `organization_product_list-access`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| members | object[] | • | — |
| orgRoles | object[] | • | — |
| canManage | boolean | • | — |
| inherited | object[] | • | — |
| candidates | object[] | • | — |

### `DELETE` `/governance/api/v1/products/:productId/access/:userId`

Revokes a product grant from an organization member. Access inherited from an organization role is lifted in the organization, and the product owner is removed by transferring ownership.

MCP tool: `organization_product_revoke-access`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| userId | path | string | • | — |

### `PUT` `/governance/api/v1/products/:productId/access/:userId`

Grants an organization member access to a product, or changes the role they already hold, at a standard role (admin, member, viewer) or one of the organization's named roles. The target must already be an active member of the product's organization; owner is transfer-only, and access inherited from an organization role is changed in the organization.

MCP tool: `organization_product_set-access`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| userId | path | string | • | — |
| role | body | string one of: admin, member, viewer | — | — |
| roleId | body | string (uuid) | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| role | string | • | — |
| userId | string | • | — |
| productId | string | • | — |

### `GET` `/governance/api/v1/products/:productId/domains`

Lists the custom domains configured in a product

MCP tool: `organization_domains_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| domains | object[] | • | — |

### `POST` `/governance/api/v1/products/:productId/domains`

Adds a custom domain to a product. The domain always starts in external (self-managed DNS) mode; when the product has an active Cloudflare connector that can write DNS, the response carries a managedDns hint naming the connector and the tool that switches the domain to managed mode.

MCP tool: `organization_domains_add`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domain | body | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| mode | string one of: external, managed | • | — |
| domain | string | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| productId | string | • | — |
| managedDns | object | null | • | — |
| providerConnectorId | string | null | • | — |

### `DELETE` `/governance/api/v1/products/:productId/domains/:domainId`

Removes a custom domain from a product

MCP tool: `organization_domains_remove`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domainId | path | string | • | — |

### `GET` `/governance/api/v1/products/:productId/domains/:domainId`

Gets a single custom domain in a product by id

MCP tool: `organization_domains_get`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domainId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| mode | string one of: external, managed | • | — |
| domain | string | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| productId | string | • | — |
| providerConnectorId | string | null | • | — |

### `GET` `/governance/api/v1/products/:productId/domains/:domainId/bindings`

Lists the extension bindings attached to a domain in a product

MCP tool: `organization_bindings_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domainId | path | string | • | — |

**Response**

Returns `object[]`.

| Item field | Type | Always | Description |
| --- | --- | --- | --- |
| host | string | • | — |
| status | string one of: pending, active, failed | • | — |
| records | object[] | • | — |
| domainId | string | • | — |
| bindingId | string | • | — |
| instruction | string | null | • | — |
| statusDetail | string | null | • | — |
| ownerExtension | string | • | — |

### `PUT` `/governance/api/v1/products/:productId/domains/:domainId/mode`

Switches a custom domain between external (self-managed DNS) and managed mode. Managed mode requires providerConnectorId — the id of an active Cloudflare connector attached to the product — and hands the domain's records to the platform reconciler.

MCP tool: `organization_domains_set-mode`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domainId | path | string | • | — |
| mode | body | string one of: managed, external | • | — |
| providerConnectorId | body | string | — | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| mode | string one of: external, managed | • | — |
| domain | string | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| productId | string | • | — |
| providerConnectorId | string | null | • | — |

### `GET` `/governance/api/v1/products/:productId/extensions`

Lists extensions available to the current product

MCP tool: `organization_extensions_list-installed`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| extensions | object[] | • | — |

### `GET` `/governance/api/v1/products/:productId/me`

Returns the caller's own role on a product and the allow/deny grants it carries

MCP tool: `organization_product_me`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| deny | string[] | • | — |
| role | string | • | — |
| allow | string[] | • | — |
| roleId | string | null | • | — |
| roleName | string | null | • | — |
| roleType | string | null one of: system, custom | • | — |

### `GET` `/governance/api/v1/products/:productId/members`

Lists all active members of a product with their roles

MCP tool: `organization_product_list-members`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| members | object[] | • | — |

### `PUT` `/governance/api/v1/products/:productId/members/:memberId/role`

Assigns a role to a member of a product

MCP tool: `organization_members_assign-role`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| memberId | path | string | • | — |
| roleId | body | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| role | string | • | — |
| roleId | string | null | • | — |
| status | string | • | — |
| userId | string | null | • | — |
| agentId | string | null | • | — |
| joinedAt | string | null | • | — |
| expiresAt | string | null | • | — |
| invitedAt | string | • | — |
| invitedBy | string | null | • | — |
| productId | string | • | — |
| grantSource | string | • | — |
| permissions | object | • | — |

### `GET` `/governance/api/v1/products/:productId/public-keys`

Lists a product's public keys. Never returns key material.

MCP tool: `organization_public-keys_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| keys | object[] | • | — |

### `POST` `/governance/api/v1/products/:productId/public-keys`

Creates a public key for a product. The plaintext key is returned only in this response and cannot be retrieved again.

MCP tool: `organization_public-keys_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| name | body | string | • | — |
| scope | body | string | object[] one of: * | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| key | string | • | — |
| name | string | • | — |
| scope | string | object[] one of: * | • | — |
| imported | boolean | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| keyPrefix | string | • | — |
| revokedAt | string | null | • | — |

### `POST` `/governance/api/v1/products/:productId/public-keys/:id/revoke`

Revokes a public key. Idempotent; revocation is permanent.

MCP tool: `organization_public-keys_revoke`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| id | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| scope | string | object[] one of: * | • | — |
| imported | boolean | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| keyPrefix | string | • | — |
| revokedAt | string | null | • | — |

### `PUT` `/governance/api/v1/products/:productId/public-keys/:id/scope`

Replaces the scope of an active public key.

MCP tool: `organization_public-keys_update-scope`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| id | path | string | • | — |
| scope | body | string | object[] one of: * | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| scope | string | object[] one of: * | • | — |
| imported | boolean | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| keyPrefix | string | • | — |
| revokedAt | string | null | • | — |

### `GET` `/governance/api/v1/products/:productId/public-routes`

Lists the public routes declared by the product's toolkits, with each route's access mode and public URL.

MCP tool: `organization_public-routes_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| routes | object[] | • | — |

### `GET` `/governance/api/v1/products/:productId/roles`

Lists the roles assignable to a product member (system templates + product custom roles)

MCP tool: `organization_product_list-roles`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| roles | object[] | • | — |

### `POST` `/governance/api/v1/products/select`

Sets the active product for the current session and reconciles the active organization to that product's organization. Session state: the selection persists for the whole MCP session and every product-scoped tool call resolves against it until changed. Without an explicit selection the session resolves an active product implicitly, so results can belong to a product other than the intended one.

MCP tool: `organization_product_select`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | body | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| slug | string | • | — |

### `GET` `/governance/api/v1/support/threads`

List the support threads of the caller's organization, most recently updated first — every member sees every one of them. Threads the caller opened personally before support became organization-wide are included and flagged `legacy`. Use when the user asks about their organization's support requests or tickets.

MCP tool: `organization_support_threads_list`

**Parameters**

No parameters.

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| threads | object[] | • | — |

### `POST` `/governance/api/v1/support/threads`

Open a support thread owned by the caller's organization — the body becomes the first message, authored by the caller. Every colleague can then read and answer it. Use when the user wants to contact Lessly support.

MCP tool: `organization_support_thread_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| title | body | string | • | — |
| body | body | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| title | string | • | — |
| legacy | boolean | • | — |
| status | string | • | — |
| category | string one of: open, pending, resolved, closed | • | — |
| messages | object[] | • | — |
| createdAt | string | • | — |
| openedByName | string | • | — |
| lastMessageAt | string | • | — |
| lastMessagePreview | string | null | • | — |

### `GET` `/governance/api/v1/support/threads/:id`

Read one support thread of the caller's organization with its full conversation, each message named after its own author. A thread of another organization — or another person's legacy personal thread — is reported as not found.

MCP tool: `organization_support_thread_get`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| title | string | • | — |
| legacy | boolean | • | — |
| status | string | • | — |
| category | string one of: open, pending, resolved, closed | • | — |
| messages | object[] | • | — |
| createdAt | string | • | — |
| openedByName | string | • | — |
| lastMessageAt | string | • | — |
| lastMessagePreview | string | null | • | — |

### `POST` `/governance/api/v1/support/threads/:id/messages`

Reply in any support thread of the caller's organization, as the caller. A thread of another organization is reported as not found.

MCP tool: `organization_support_thread_reply`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| body | body | string | • | — |

**Response**

Returns `object`.

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| title | string | • | — |
| legacy | boolean | • | — |
| status | string | • | — |
| category | string one of: open, pending, resolved, closed | • | — |
| messages | object[] | • | — |
| createdAt | string | • | — |
| openedByName | string | • | — |
| lastMessageAt | string | • | — |
| lastMessagePreview | string | null | • | — |