---
title: "Set customer AI connector permissions for one workspace"
description: "Platform admins only. Creates or updates the workspace's mcp_workspace_access row with the\nfields sent (others keep their stored value or column default). AI Connectors are available\nautomatically; availability switches are refused. allowed_roles must be a subset of owner, admin, manager,\nagent. Quotas are whole numbers within quota_limits. `writes_enabled` lets the workspace's\neligible members confirm changes proposed by the AI (Phase 5): turning it ON is platform-owner\nonly (403 OWNER_ROLE_REQUIRED for an admin); any platform admin may turn it off. 503\nMCP_WRITES_NOT_SET_UP when it is sent before migration 20261005f. Workspace owners can never\nset it. Written with the service-role client; the admin log records the server-built\nbefore/after values.\n"
---

> Documentation Index
> Fetch the complete documentation index at: https://developer.channelautomations.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Channel Automation API › Platform Admin

`PUT /api/admin/mcp-access/{workspaceId}`

Platform admins only. Creates or updates the workspace's mcp_workspace_access row with the
fields sent (others keep their stored value or column default). AI Connectors are available
automatically; availability switches are refused. allowed_roles must be a subset of owner, admin, manager,
agent. Quotas are whole numbers within quota_limits. `writes_enabled` lets the workspace's
eligible members confirm changes proposed by the AI (Phase 5): turning it ON is platform-owner
only (403 OWNER_ROLE_REQUIRED for an admin); any platform admin may turn it off. 503
MCP_WRITES_NOT_SET_UP when it is sent before migration 20261005f. Workspace owners can never
set it. Written with the service-role client; the admin log records the server-built
before/after values.

## Authentication

- `BearerAuth`, http, header `Authorization`, format `JWT`

## Path parameters

- `workspaceId` (`put/api/admin/mcp-access/workspaceId.path.workspaceId`; string, required)

## Request body

_Required._

- `allowed_roles` (`put/api/admin/mcp-access/workspaceId.allowed_roles`; array<string>, optional)
  - one of `"owner"`, `"admin"`, `"manager"`, `"agent"`
- `daily_call_quota` (`put/api/admin/mcp-access/workspaceId.daily_call_quota`; integer, optional)
  - min 0
- `daily_row_quota` (`put/api/admin/mcp-access/workspaceId.daily_row_quota`; integer, optional)
  - min 0
- `daily_llm_token_quota` (`put/api/admin/mcp-access/workspaceId.daily_llm_token_quota`; integer, optional)
  - min 0
- `no_ai_synthesis` (`put/api/admin/mcp-access/workspaceId.no_ai_synthesis`; boolean, optional)
- `writes_enabled` (`put/api/admin/mcp-access/workspaceId.writes_enabled`; boolean, optional) — Allow confirmed changes (platform owner only to turn on)

## Example request

```json
{
  "allowed_roles": [
    "owner"
  ],
  "daily_call_quota": 0,
  "daily_row_quota": 0,
  "daily_llm_token_quota": 0,
  "no_ai_synthesis": true,
  "writes_enabled": true
}
```

## Code samples

### cURL

```bash
curl --request PUT \
  --url 'https://api.channelautomation.com/api/admin/mcp-access/<workspaceId>' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "allowed_roles": [
    "owner"
  ],
  "daily_call_quota": 0,
  "daily_row_quota": 0,
  "daily_llm_token_quota": 0,
  "no_ai_synthesis": true,
  "writes_enabled": true
}
'
```

### TypeScript

```typescript
const url = 'https://api.channelautomation.com/api/admin/mcp-access/<workspaceId>';
const options = {
  method: 'PUT',
  headers: {'Content-Type': 'application/json', Authorization: 'Bearer <token>'},
  body: JSON.stringify({
    allowed_roles: ['owner'],
    daily_call_quota: 0,
    daily_row_quota: 0,
    daily_llm_token_quota: 0,
    no_ai_synthesis: true,
    writes_enabled: true
  })
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://api.channelautomation.com/api/admin/mcp-access/<workspaceId>"

payload = {
    "allowed_roles": ["owner"],
    "daily_call_quota": 0,
    "daily_row_quota": 0,
    "daily_llm_token_quota": 0,
    "no_ai_synthesis": True,
    "writes_enabled": True
}
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer <token>"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)
```

## Responses

### 200

{ success, data: row with workspace_name and writes_supported }

### 400

No fields, or an invalid value

### 403

OWNER_ROLE_REQUIRED (turning writes_enabled on as a platform admin)

### 404

Workspace not found

### 500

Internal server error

#### Example

```json
{
  "error": "Internal server error",
  "details": "string",
  "success": false
}
```

- `error` (`put/api/admin/mcp-access/workspaceId.response.500.error`; string, optional)
  - example `"Internal server error"`
- `details` (`put/api/admin/mcp-access/workspaceId.response.500.details`; string, optional)
- `success` (`put/api/admin/mcp-access/workspaceId.response.500.success`; boolean, optional)
  - example `false`

### 503

MCP_ACCESS_NOT_SET_UP, or MCP_WRITES_NOT_SET_UP


Source: https://developer.channelautomations.com/api/put-api-admin-mcp-access-workspace-id/index.md