---
title: "Atomically replace a staff MCP key's workspace grants"
description: "Platform admins may assign read grants; write grants and any replacement on a global-write key require a platform owner. Replacement is transactional; failure preserves the previous grants and read overrides. Requires the atomic-grant migration; no non-atomic fallback."
---

> Documentation Index
> Fetch the complete documentation index at: https://developer.channelautomations.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Channel Automation API › Workspaces

`PUT /api/admin/mcp-permissions/keys/{keyId}/workspaces`

Platform admins may assign read grants; write grants and any replacement on a global-write key require a platform owner. Replacement is transactional; failure preserves the previous grants and read overrides. Requires the atomic-grant migration; no non-atomic fallback.

## Authentication

- `BearerAuth`, http, header `Authorization`, format `JWT`

## Path parameters

- `keyId` (`put/api/admin/mcp-permissions/keys/keyId/workspaces.path.keyId`; string, required)
  - format `uuid`

## Request body

_Required._

- `permissions` (`put/api/admin/mcp-permissions/keys/keyId/workspaces.permissions`; array<object>, required)
  - `workspaceId` (`put/api/admin/mcp-permissions/keys/keyId/workspaces.permissions.workspaceId`; string, required)
  - `role` (`put/api/admin/mcp-permissions/keys/keyId/workspaces.permissions.role`; string, required)
    - one of `"read"`, `"write"`

## Example request

```json
{
  "permissions": [
    {
      "workspaceId": "string",
      "role": "read"
    }
  ]
}
```

## Code samples

### cURL

```bash
curl --request PUT \
  --url 'https://api.channelautomation.com/api/admin/mcp-permissions/keys/<keyId>/workspaces' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "permissions": [
    {
      "workspaceId": "string",
      "role": "read"
    }
  ]
}
'
```

### TypeScript

```typescript
const url = 'https://api.channelautomation.com/api/admin/mcp-permissions/keys/<keyId>/workspaces';
const options = {
  method: 'PUT',
  headers: {'Content-Type': 'application/json', Authorization: 'Bearer <token>'},
  body: JSON.stringify({permissions: [{workspaceId: 'string', role: 'read'}]})
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://api.channelautomation.com/api/admin/mcp-permissions/keys/<keyId>/workspaces"

payload = { "permissions": [
        {
            "workspaceId": "string",
            "role": "read"
        }
    ] }
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer <token>"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)
```

## Responses

### 200

Entire grant set replaced

### 400

Invalid permission set

### 401

Invalid session

### 403

Insufficient platform role

### 404

Key not found

### 500

Replacement failed; previous grants retained


Source: https://developer.channelautomations.com/api/put-api-admin-mcp-permissions-keys-key-id-workspaces/index.md