Organization API

The Organization area publishes 84 REST endpoints. Paths are relative to https://api.lessly.com; see Authentication for the required header.

GET/governance/api/v1/auth/me

Returns the current identity: identity ID, email, and identity type (e.g. "service" for a service token, which has no email)

MCP tool: organization_auth_me

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`email`	`string`	•	—
`identityId`	`string`	•	—
`displayName`	`string`	•	—
`identityType`	`string`	•	—

GET/governance/api/v1/billing/budgets

Reads the active product's billing budget: the per-product caps of the organization and the current consumption against them.

MCP tool: organization_billing_budgets_get

Parameters

No parameters.

Response

Returns object.

DELETE/governance/api/v1/billing/budgets/cap

Clears the spending cap of one product in the caller’s organization, leaving that product with no cap. The product must belong to the same organization as the active product.

MCP tool: organization_billing_caps_clear

Parameters

Name	In	Type	Required	Description
`productId`	body	`string (uuid)`	•	—

Response

Returns object.

PUT/governance/api/v1/billing/budgets/cap

Sets the spending cap of one product in the caller’s organization, in integer minor units. The product must belong to the same organization as the active product; any other is refused.

MCP tool: organization_billing_caps_set

Parameters

Name	In	Type	Required	Description
`productId`	body	`string (uuid)`	•	—
`cap_minor`	body	`integer`	•	—

Response

Returns object.

DELETE/governance/api/v1/connectors/:id

Detaches the current product from a connector

MCP tool: organization_connectors_remove

Parameters

Name	In	Type	Required	Description
`id`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`success`	`boolean`	•	—

GET/governance/api/v1/connectors/:id/attachments

Lists the products a connector is attached to (org owner/admin)

MCP tool: organization_connectors_list-attachments

Parameters

Name	In	Type	Required	Description
`id`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`attachments`	`object[]`	•	—
`connectorId`	`string`	•	—

POST/governance/api/v1/connectors/:id/attachments

Attaches products to a connector (batch, idempotent; org owner/admin)

MCP tool: organization_connectors_attach

Parameters

Name	In	Type	Required	Description
`id`	path	`string`	•	—
`productIds`	body	`string[]`	•	—

Response

Returns object.

Field	Type	Always	Description
`attachments`	`object[]`	•	—
`connectorId`	`string`	•	—

DELETE/governance/api/v1/connectors/:id/attachments/:productId

Detaches one product from a connector (org owner/admin). Last detach → dormant.

MCP tool: organization_connectors_detach

Parameters

Name	In	Type	Required	Description
`id`	path	`string`	•	—
`productId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`success`	`boolean`	•	—

DELETE/governance/api/v1/connectors/:id/org

Deletes a connector org-wide: soft-delete, remove all attachments, tear down routing (org owner/admin)

MCP tool: organization_connectors_delete

Parameters

Name	In	Type	Required	Description
`id`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`success`	`boolean`	•	—

POST/governance/api/v1/connectors/:id/requests

Requests access to an org connector for a product (any product member)

MCP tool: organization_connectors_request

Parameters

Name	In	Type	Required	Description
`productId`	query	`string`	•	—
`id`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`status`	`string`	•	—

POST/governance/api/v1/connectors/:id/requests/:requestId/approve

Approves a connector access request, attaching the product (org owner/admin)

MCP tool: organization_connectors_approve-request

Parameters

Name	In	Type	Required	Description
`id`	path	`string`	•	—
`requestId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`success`	`boolean`	•	—

POST/governance/api/v1/connectors/:id/requests/:requestId/deny

Denies a connector access request (org owner/admin)

MCP tool: organization_connectors_deny-request

Parameters

Name	In	Type	Required	Description
`id`	path	`string`	•	—
`requestId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`success`	`boolean`	•	—

GET/governance/api/v1/connectors/available

Lists org connectors not yet attached to a product, with this product's request status

MCP tool: organization_connectors_list-available

Parameters

Name	In	Type	Required	Description
`productId`	query	`string`	•	—

Response

Returns object[].

Item field	Type	Always	Description
`id`	`string`	•	—
`status`	`string`	•	—
`provider`	`string`	•	—
`reauthAt`	`string \| null`	•	—
`externalId`	`string`	•	—
`displayName`	`string`	•	—
`needsReauth`	`boolean`	•	—
`reauthReason`	`string \| null`	•	—
`requestStatus`	`string \| null`one of: pending, denied	•	—
`organizationId`	`string`	•	—

GET/governance/api/v1/connectors/clickup/install

Starts the ClickUp OAuth connect flow for a product and returns the install URL

MCP tool: organization_clickup_install

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`url`	`string`	•	—

GET/governance/api/v1/connectors/clickup/installations

Lists the ClickUp installations connected to a product

MCP tool: organization_clickup_list-installations

Parameters

No parameters.

Response

Returns object[].

Item field	Type	Always	Description
`status`	`string`	•	—
`teamId`	`string`	•	—
`teamName`	`string`	•	—

GET/governance/api/v1/connectors/cloudflare/install

Starts the Cloudflare OAuth connect flow for a product and returns the consent URL

MCP tool: organization_cloudflare_install

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`url`	`string`	•	—

GET/governance/api/v1/connectors/gdrive/install

Starts the Google Drive OAuth connect flow for a product and returns the consent URL

MCP tool: organization_gdrive_install

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`url`	`string`	•	—

GET/governance/api/v1/connectors/github/install

Starts the GitHub app installation flow for a product. When the product's organization already has GitHub connections, returns them so one can be reused (attached) instead of dead-ending on GitHub's already-installed settings page. `url` is always returned — connecting an additional, different GitHub org stays possible.

MCP tool: organization_github_install

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`url`	`string`	•	—
`status`	`string`one of: install_required, already_connected	•	—
`canAttach`	`boolean`	•	—
`connectors`	`object[]`	•	—

GET/governance/api/v1/connectors/github/installations

Lists the GitHub app installations connected to a product

MCP tool: organization_github_list-installations

Parameters

No parameters.

Response

Returns object[].

Item field	Type	Always	Description
`status`	`string`	•	—
`accountType`	`string`	•	—
`accountLogin`	`string`	•	—
`installationId`	`number`	•	—

GET/governance/api/v1/connectors/googleads/install

Starts the Google Ads OAuth connect flow for an organization and returns the consent URL

MCP tool: organization_googleads_install

Parameters

Name	In	Type	Required	Description
`organizationId`	query	`string (uuid)`	•	—

Response

Returns object.

Field	Type	Always	Description
`url`	`string`	•	—

GET/governance/api/v1/connectors/linkedin-member/install

Starts the LinkedIn member (personal profile) OAuth connect flow for a product and returns the consent URL

MCP tool: organization_linkedin_member_install

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`url`	`string`	•	—

GET/governance/api/v1/connectors/list

Lists active connectors in a product

MCP tool: organization_connectors_list

Parameters

Name	In	Type	Required	Description
`productId`	query	`string`	•	—

Response

Returns object[].

Item field	Type	Always	Description
`id`	`string`	•	—
`config`	`object`	•	—
`origin`	`string`one of: product, org	•	—
`status`	`string`	•	—
`provider`	`string`	•	—
`reauthAt`	`string \| null`	•	—
`createdAt`	`string`	•	—
`customerId`	`string \| null`	•	—
`externalId`	`string`	•	—
`displayName`	`string`	•	—
`needsReauth`	`boolean`	•	—
`reauthReason`	`string \| null`	•	—

GET/governance/api/v1/connectors/reddit/install

Starts the Reddit OAuth connect flow for a product and returns the consent URL

MCP tool: organization_reddit_install

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`url`	`string`	•	—

GET/governance/api/v1/connectors/x/install

Starts the X (Twitter) OAuth connect flow for a product and returns the consent URL

MCP tool: organization_x_install

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`url`	`string`	•	—

GET/governance/api/v1/connectors/youtube/install

Starts the YouTube OAuth connect flow for a product and returns the consent URL

MCP tool: organization_youtube_install

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`url`	`string`	•	—

POST/governance/api/v1/feedback

Submit product feedback — opens a GitHub issue in the Lessly feedback repo. Use when the user wants to report a bug, request a feature, or leave feedback about the platform.

MCP tool: organization_feedback_submit

Parameters

Name	In	Type	Required	Description
`title`	body	`string`	•	—
`details`	body	`string`	•	—
`page`	body	`string`	—	—

Response

Returns object.

Field	Type	Always	Description
`url`	`string \| null`	•	—
`number`	`number \| null`	•	—
`supportThreadId`	`string`	—	—

GET/governance/api/v1/organizations

Lists the organizations the current user belongs to (owned or via membership).

MCP tool: organization_list

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`organizations`	`object[]`	•	—

POST/governance/api/v1/organizations

Creates a new organization owned by the current user and sets it as the active organization for the session.

MCP tool: organization_create

Parameters

Name	In	Type	Required	Description
`name`	body	`string`	•	—
`legalName`	body	`string`	•	—
`ownerName`	body	`string`	•	—
`countryOfIncorporation`	body	`string`	•	—
`residencyCountry`	body	`string`	•	—
`beneficialOwners`	body	`object[]`	—	—
`ownershipConfirmed`	body	`boolean`	—	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`name`	`string`	•	—

GET/governance/api/v1/organizations/:organizationId/connectors

Lists an organization's connectors with their product attachments (org owner/admin)

MCP tool: organization_connectors_list-org

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string`	•	—

Response

Returns object[].

Item field	Type	Always	Description
`id`	`string`	•	—
`config`	`object`	•	—
`status`	`string`	•	—
`provider`	`string`	•	—
`reauthAt`	`string \| null`	•	—
`createdAt`	`string`	•	—
`externalId`	`string`	•	—
`displayName`	`string`	•	—
`needsReauth`	`boolean`	•	—
`reauthReason`	`string \| null`	•	—
`organizationId`	`string`	•	—
`attachedProducts`	`object[]`	•	—

GET/governance/api/v1/organizations/:organizationId/connectors/requests

Lists connector access requests for an organization (org owner/admin)

MCP tool: organization_connectors_list-requests

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string`	•	—
`status`	query	`string`one of: pending, approved, denied	—	—

Response

Returns object[].

Item field	Type	Always	Description
`id`	`string`	•	—
`status`	`string`	•	—
`provider`	`string`	•	—
`createdAt`	`string`	•	—
`productId`	`string`	•	—
`connectorId`	`string`	•	—
`productName`	`string`	•	—
`requestedBy`	`string`	•	—
`connectorDisplayName`	`string`	•	—

GET/governance/api/v1/organizations/:organizationId/invitations

Lists invitations for an organization

MCP tool: organization_member_list-invitations

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—

Response

Returns object.

Field	Type	Always	Description
`invitations`	`object[]`	•	—

POST/governance/api/v1/organizations/:organizationId/invitations

Invites a user to an organization by email, optionally sharing products

MCP tool: organization_member_invite

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—
`email`	body	`string (email)`	•	—
`role`	body	`string`one of: owner, admin, member	•	—
`productShares`	body	`object[]`	—	—

Response

Returns object.

DELETE/governance/api/v1/organizations/:organizationId/invitations/:invitationId

Revokes a pending organization invitation

MCP tool: organization_member_revoke-invitation

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—
`invitationId`	path	`string (uuid)`	•	—

GET/governance/api/v1/organizations/:organizationId/members

Lists the stored members of an organization with their roles and product grants

MCP tool: organization_member_list

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—

Response

Returns object.

Field	Type	Always	Description
`members`	`object[]`	•	—

DELETE/governance/api/v1/organizations/:organizationId/members/:userId

Removes a member from an organization

MCP tool: organization_member_remove

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—
`userId`	path	`string (uuid)`	•	—

GET/governance/api/v1/organizations/:organizationId/members/:userId/products

Lists the products in an organization a member can access, with role, grant source, and expiry (management view; expired grants are shown with expiresAt).

MCP tool: organization_member_list-product-access

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—
`userId`	path	`string (uuid)`	•	—

Response

Returns object.

Field	Type	Always	Description
`products`	`object[]`	•	—

POST/governance/api/v1/organizations/:organizationId/members/:userId/products

Grants an organization member explicit access to a product

MCP tool: organization_member_share-product

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—
`userId`	path	`string (uuid)`	•	—
`productId`	body	`string (uuid)`	•	—
`role`	body	`string`	—	—
`expiresAt`	body	`string (date-time) \| null`	—	—
`permissions`	body	`object`	—	—
`roleId`	body	`string (uuid)`	—	—

Response

Returns object.

Field	Type	Always	Description
`role`	`string`	•	—
`userId`	`string`	•	—
`expiresAt`	`string \| null`	•	—
`productId`	`string`	•	—

DELETE/governance/api/v1/organizations/:organizationId/members/:userId/products/:productId

Revokes an explicit product share from an organization member

MCP tool: organization_member_unshare-product

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—
`userId`	path	`string (uuid)`	•	—
`productId`	path	`string (uuid)`	•	—

PATCH/governance/api/v1/organizations/:organizationId/members/:userId/role

Changes an organization member's role (owner only)

MCP tool: organization_member_set-role

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—
`userId`	path	`string (uuid)`	•	—
`role`	body	`string`one of: admin, member	•	—

Response

Returns object.

Field	Type	Always	Description
`role`	`string`	•	—
`userId`	`string`	•	—

POST/governance/api/v1/organizations/:organizationId/security/mfa/enable

Turns ON organization-wide multi-factor authentication (2FA) enforcement for an organization. Owner-only: only the owner of the organization may call it. This is deliberately one-way — disabling MFA enforcement is not available over MCP; use the organization security settings in the Product App instead. The policy is strictest-wins across all of a member’s organizations, so enabling it here forces MFA enrollment for every member of this organization at their next sign-in or token refresh.

MCP tool: organization_security_mfa_enable

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	•	—

Response

Returns object.

Field	Type	Always	Description
`mfaRequired`	`boolean`one of: true	•	—
`trustedDeviceAllowed`	`boolean`	•	—

GET/governance/api/v1/organizations/:orgId/groups

Lists the groups of an organization with their members and product grants

MCP tool: organization_groups_list

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—

Response

Returns object.

Field	Type	Always	Description
`groups`	`object[]`	•	—

POST/governance/api/v1/organizations/:orgId/groups

Creates an organization group (owner/admin)

MCP tool: organization_groups_create

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`name`	body	`string`	•	—
`description`	body	`string`	—	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`name`	`string`	•	—
`grants`	`object[]`	•	—
`members`	`object[]`	•	—
`createdAt`	`string`	•	—
`updatedAt`	`string`	•	—
`description`	`string \| null`	•	—
`organizationId`	`string`	•	—

DELETE/governance/api/v1/organizations/:orgId/groups/:groupId

Deletes an organization group; the access it carried is withdrawn (owner/admin)

MCP tool: organization_groups_delete

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`groupId`	path	`string (uuid)`	•	—

GET/governance/api/v1/organizations/:orgId/groups/:groupId

Gets a single organization group with its members and product grants

MCP tool: organization_groups_get

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`groupId`	path	`string (uuid)`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`name`	`string`	•	—
`grants`	`object[]`	•	—
`members`	`object[]`	•	—
`createdAt`	`string`	•	—
`updatedAt`	`string`	•	—
`description`	`string \| null`	•	—
`organizationId`	`string`	•	—

PATCH/governance/api/v1/organizations/:orgId/groups/:groupId

Renames an organization group or changes its description (owner/admin)

MCP tool: organization_groups_update

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`groupId`	path	`string (uuid)`	•	—
`name`	body	`string`	—	—
`description`	body	`string \| null`	—	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`name`	`string`	•	—
`grants`	`object[]`	•	—
`members`	`object[]`	•	—
`createdAt`	`string`	•	—
`updatedAt`	`string`	•	—
`description`	`string \| null`	•	—
`organizationId`	`string`	•	—

DELETE/governance/api/v1/organizations/:orgId/groups/:groupId/grants/:productId

Removes a group's grant on a product (owner/admin)

MCP tool: organization_groups_grant-remove

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`groupId`	path	`string (uuid)`	•	—
`productId`	path	`string (uuid)`	•	—

PUT/governance/api/v1/organizations/:orgId/groups/:groupId/grants/:productId

Grants a product to every member of a group at an organization role (owner/admin)

MCP tool: organization_groups_grant-set

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`groupId`	path	`string (uuid)`	•	—
`productId`	path	`string (uuid)`	•	—
`roleId`	body	`string (uuid)`	•	—

POST/governance/api/v1/organizations/:orgId/groups/:groupId/members

Adds an organization member to a group (owner/admin)

MCP tool: organization_groups_member-add

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`groupId`	path	`string (uuid)`	•	—
`userId`	body	`string (uuid)`	•	—

DELETE/governance/api/v1/organizations/:orgId/groups/:groupId/members/:userId

Removes a member from a group; the access the group carried is withdrawn (owner/admin)

MCP tool: organization_groups_member-remove

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`groupId`	path	`string (uuid)`	•	—
`userId`	path	`string (uuid)`	•	—

GET/governance/api/v1/organizations/:orgId/roles

Lists the reusable custom roles defined in an organization

MCP tool: organization_roles_list

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—

Response

Returns object.

Field	Type	Always	Description
`roles`	`object[]`	•	—

POST/governance/api/v1/organizations/:orgId/roles

Creates a reusable organization role with allow/deny permission patterns (owner/admin)

MCP tool: organization_roles_create

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`name`	body	`string`	•	—
`allow`	body	`string[]`	—	—
`deny`	body	`string[]`	—	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`deny`	`string[]`	•	—
`name`	`string`	•	—
`type`	`string`one of: system, custom	•	—
`allow`	`string[]`	•	—
`createdAt`	`string`	•	—
`updatedAt`	`string`	•	—
`organizationId`	`string`	•	—

DELETE/governance/api/v1/organizations/:orgId/roles/:roleId

Deletes an organization role (owner/admin). Already-materialized product grants are unaffected.

MCP tool: organization_roles_delete

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`roleId`	path	`string (uuid)`	•	—

GET/governance/api/v1/organizations/:orgId/roles/:roleId

Gets a single organization role by id

MCP tool: organization_roles_get

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`roleId`	path	`string (uuid)`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`deny`	`string[]`	•	—
`name`	`string`	•	—
`type`	`string`one of: system, custom	•	—
`allow`	`string[]`	•	—
`createdAt`	`string`	•	—
`updatedAt`	`string`	•	—
`organizationId`	`string`	•	—

PATCH/governance/api/v1/organizations/:orgId/roles/:roleId

Updates an organization role's name or allow/deny patterns (owner/admin)

MCP tool: organization_roles_update

Parameters

Name	In	Type	Required	Description
`orgId`	path	`string (uuid)`	•	—
`roleId`	path	`string (uuid)`	•	—
`name`	body	`string`	—	—
`allow`	body	`string[]`	—	—
`deny`	body	`string[]`	—	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`deny`	`string[]`	•	—
`name`	`string`	•	—
`type`	`string`one of: system, custom	•	—
`allow`	`string[]`	•	—
`createdAt`	`string`	•	—
`updatedAt`	`string`	•	—
`organizationId`	`string`	•	—

POST/governance/api/v1/organizations/invitations/accept

Accepts an organization invitation using the invitation token

MCP tool: organization_member_accept-invite

Parameters

Name	In	Type	Required	Description
`token`	body	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`name`	`string`	•	—
`role`	`string`	•	—
`products`	`object[]`	•	—
`organizationId`	`string`	•	—

GET/governance/api/v1/organizations/permission-catalog

Lists the full permission catalog (key, display_name, group, level, scope) derived from @McpTool handlers. Only scope="product" entries are grantable in role/point-rights pickers; scope="user" entries are informational.

MCP tool: organization_permission_catalog

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`catalog`	`object[]`	•	—

POST/governance/api/v1/organizations/select

Sets the active organization for the current session and returns the resolved active product. Session state: the switch also rewrites the session product selection — the current product survives only when it belongs to the new organization, otherwise the caller's first product in that organization is selected, or the selection is cleared when there is none.

MCP tool: organization_select

Parameters

Name	In	Type	Required	Description
`organizationId`	body	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`organization`	`object`	•	—
`activeProductId`	`string \| null`	•	—

GET/governance/api/v1/products

Lists all products the current user has access to

MCP tool: organization_product_list

Parameters

Name	In	Type	Required	Description
`organizationId`	query	`string`	—	—

Response

Returns object.

Field	Type	Always	Description
`products`	`object[]`	•	—

POST/governance/api/v1/products

Creates a new product with the given name

MCP tool: organization_product_create

Parameters

Name	In	Type	Required	Description
`name`	body	`string`	•	—
`organizationId`	body	`string (uuid)`	—	—
`region`	body	`string`one of: eu	—	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`name`	`string`	•	—
`role`	`string`	•	—
`slug`	`string`	•	—
`demoAt`	`string \| null`	•	—
`region`	`string`	•	—
`status`	`string`	•	—
`logoUrl`	`string \| null`	•	—
`blockedAt`	`string \| null`	•	—
`createdAt`	`string`	•	—
`archivedAt`	`string \| null`	•	—
`description`	`string \| null`	•	—
`organizationId`	`string`	•	—

PATCH/governance/api/v1/products/:productId

Updates an existing product's name and/or description

MCP tool: organization_product_update

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`name`	body	`string`	—	—
`description`	body	`string \| null`	—	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`name`	`string`	•	—
`role`	`string`	•	—
`slug`	`string`	•	—
`demoAt`	`string \| null`	•	—
`region`	`string`	•	—
`status`	`string`	•	—
`logoUrl`	`string \| null`	•	—
`blockedAt`	`string \| null`	•	—
`createdAt`	`string`	•	—
`archivedAt`	`string \| null`	•	—
`description`	`string \| null`	•	—
`organizationId`	`string`	•	—

GET/governance/api/v1/products/:productId/access

Lists who can work in a product: the explicit grants and their roles, the organization owners and admins who inherit full access (read-only here), the organization members holding no access yet, and the organization's named roles a grant can be handed at. `canManage` states whether the caller may change any of it.

MCP tool: organization_product_list-access

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`members`	`object[]`	•	—
`orgRoles`	`object[]`	•	—
`canManage`	`boolean`	•	—
`inherited`	`object[]`	•	—
`candidates`	`object[]`	•	—

DELETE/governance/api/v1/products/:productId/access/:userId

Revokes a product grant from an organization member. Access inherited from an organization role is lifted in the organization, and the product owner is removed by transferring ownership.

MCP tool: organization_product_revoke-access

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`userId`	path	`string`	•	—

PUT/governance/api/v1/products/:productId/access/:userId

Grants an organization member access to a product, or changes the role they already hold, at a standard role (admin, member, viewer) or one of the organization's named roles. The target must already be an active member of the product's organization; owner is transfer-only, and access inherited from an organization role is changed in the organization.

MCP tool: organization_product_set-access

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`userId`	path	`string`	•	—
`role`	body	`string`one of: admin, member, viewer	—	—
`roleId`	body	`string (uuid)`	—	—

Response

Returns object.

Field	Type	Always	Description
`role`	`string`	•	—
`userId`	`string`	•	—
`productId`	`string`	•	—

GET/governance/api/v1/products/:productId/domains

Lists the custom domains configured in a product

MCP tool: organization_domains_list

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`domains`	`object[]`	•	—

POST/governance/api/v1/products/:productId/domains

Adds a custom domain to a product. The domain always starts in external (self-managed DNS) mode; when the product has an active Cloudflare connector that can write DNS, the response carries a managedDns hint naming the connector and the tool that switches the domain to managed mode.

MCP tool: organization_domains_add

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`domain`	body	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`mode`	`string`one of: external, managed	•	—
`domain`	`string`	•	—
`createdAt`	`string`	•	—
`createdBy`	`string`	•	—
`productId`	`string`	•	—
`managedDns`	`object \| null`	•	—
`providerConnectorId`	`string \| null`	•	—

DELETE/governance/api/v1/products/:productId/domains/:domainId

Removes a custom domain from a product

MCP tool: organization_domains_remove

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`domainId`	path	`string`	•	—

GET/governance/api/v1/products/:productId/domains/:domainId

Gets a single custom domain in a product by id

MCP tool: organization_domains_get

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`domainId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`mode`	`string`one of: external, managed	•	—
`domain`	`string`	•	—
`createdAt`	`string`	•	—
`createdBy`	`string`	•	—
`productId`	`string`	•	—
`providerConnectorId`	`string \| null`	•	—

GET/governance/api/v1/products/:productId/domains/:domainId/bindings

Lists the extension bindings attached to a domain in a product

MCP tool: organization_bindings_list

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`domainId`	path	`string`	•	—

Response

Returns object[].

Item field	Type	Always	Description
`host`	`string`	•	—
`status`	`string`one of: pending, active, failed	•	—
`records`	`object[]`	•	—
`domainId`	`string`	•	—
`bindingId`	`string`	•	—
`instruction`	`string \| null`	•	—
`statusDetail`	`string \| null`	•	—
`ownerExtension`	`string`	•	—

PUT/governance/api/v1/products/:productId/domains/:domainId/mode

Switches a custom domain between external (self-managed DNS) and managed mode. Managed mode requires providerConnectorId — the id of an active Cloudflare connector attached to the product — and hands the domain's records to the platform reconciler.

MCP tool: organization_domains_set-mode

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`domainId`	path	`string`	•	—
`mode`	body	`string`one of: managed, external	•	—
`providerConnectorId`	body	`string`	—	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`mode`	`string`one of: external, managed	•	—
`domain`	`string`	•	—
`createdAt`	`string`	•	—
`createdBy`	`string`	•	—
`productId`	`string`	•	—
`providerConnectorId`	`string \| null`	•	—

GET/governance/api/v1/products/:productId/extensions

Lists extensions available to the current product

MCP tool: organization_extensions_list-installed

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`extensions`	`object[]`	•	—

GET/governance/api/v1/products/:productId/me

Returns the caller's own role on a product and the allow/deny grants it carries

MCP tool: organization_product_me

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`deny`	`string[]`	•	—
`role`	`string`	•	—
`allow`	`string[]`	•	—
`roleId`	`string \| null`	•	—
`roleName`	`string \| null`	•	—
`roleType`	`string \| null`one of: system, custom	•	—

GET/governance/api/v1/products/:productId/members

Lists all active members of a product with their roles

MCP tool: organization_product_list-members

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`members`	`object[]`	•	—

PUT/governance/api/v1/products/:productId/members/:memberId/role

Assigns a role to a member of a product

MCP tool: organization_members_assign-role

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`memberId`	path	`string`	•	—
`roleId`	body	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`role`	`string`	•	—
`roleId`	`string \| null`	•	—
`status`	`string`	•	—
`userId`	`string \| null`	•	—
`agentId`	`string \| null`	•	—
`joinedAt`	`string \| null`	•	—
`expiresAt`	`string \| null`	•	—
`invitedAt`	`string`	•	—
`invitedBy`	`string \| null`	•	—
`productId`	`string`	•	—
`grantSource`	`string`	•	—
`permissions`	`object`	•	—

GET/governance/api/v1/products/:productId/public-keys

Lists a product's public keys. Never returns key material.

MCP tool: organization_public-keys_list

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`keys`	`object[]`	•	—

POST/governance/api/v1/products/:productId/public-keys

Creates a public key for a product. The plaintext key is returned only in this response and cannot be retrieved again.

MCP tool: organization_public-keys_create

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`name`	body	`string`	•	—
`scope`	body	`string \| object[]`one of: *	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`key`	`string`	•	—
`name`	`string`	•	—
`scope`	`string \| object[]`one of: *	•	—
`imported`	`boolean`	•	—
`createdAt`	`string`	•	—
`createdBy`	`string`	•	—
`keyPrefix`	`string`	•	—
`revokedAt`	`string \| null`	•	—

POST/governance/api/v1/products/:productId/public-keys/:id/revoke

Revokes a public key. Idempotent; revocation is permanent.

MCP tool: organization_public-keys_revoke

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`id`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`name`	`string`	•	—
`scope`	`string \| object[]`one of: *	•	—
`imported`	`boolean`	•	—
`createdAt`	`string`	•	—
`createdBy`	`string`	•	—
`keyPrefix`	`string`	•	—
`revokedAt`	`string \| null`	•	—

PUT/governance/api/v1/products/:productId/public-keys/:id/scope

Replaces the scope of an active public key.

MCP tool: organization_public-keys_update-scope

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—
`id`	path	`string`	•	—
`scope`	body	`string \| object[]`one of: *	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`name`	`string`	•	—
`scope`	`string \| object[]`one of: *	•	—
`imported`	`boolean`	•	—
`createdAt`	`string`	•	—
`createdBy`	`string`	•	—
`keyPrefix`	`string`	•	—
`revokedAt`	`string \| null`	•	—

GET/governance/api/v1/products/:productId/public-routes

Lists the public routes declared by the product's toolkits, with each route's access mode and public URL.

MCP tool: organization_public-routes_list

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`routes`	`object[]`	•	—

GET/governance/api/v1/products/:productId/roles

Lists the roles assignable to a product member (system templates + product custom roles)

MCP tool: organization_product_list-roles

Parameters

Name	In	Type	Required	Description
`productId`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`roles`	`object[]`	•	—

POST/governance/api/v1/products/select

Sets the active product for the current session and reconciles the active organization to that product's organization. Session state: the selection persists for the whole MCP session and every product-scoped tool call resolves against it until changed. Without an explicit selection the session resolves an active product implicitly, so results can belong to a product other than the intended one.

MCP tool: organization_product_select

Parameters

Name	In	Type	Required	Description
`productId`	body	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`name`	`string`	•	—
`slug`	`string`	•	—

GET/governance/api/v1/support/threads

List the support threads of the caller's organization, most recently updated first — every member sees every one of them. Threads the caller opened personally before support became organization-wide are included and flagged `legacy`. Use when the user asks about their organization's support requests or tickets.

MCP tool: organization_support_threads_list

Parameters

No parameters.

Response

Returns object.

Field	Type	Always	Description
`threads`	`object[]`	•	—

POST/governance/api/v1/support/threads

Open a support thread owned by the caller's organization — the body becomes the first message, authored by the caller. Every colleague can then read and answer it. Use when the user wants to contact Lessly support.

MCP tool: organization_support_thread_create

Parameters

Name	In	Type	Required	Description
`title`	body	`string`	•	—
`body`	body	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`title`	`string`	•	—
`legacy`	`boolean`	•	—
`status`	`string`	•	—
`category`	`string`one of: open, pending, resolved, closed	•	—
`messages`	`object[]`	•	—
`createdAt`	`string`	•	—
`openedByName`	`string`	•	—
`lastMessageAt`	`string`	•	—
`lastMessagePreview`	`string \| null`	•	—

GET/governance/api/v1/support/threads/:id

Read one support thread of the caller's organization with its full conversation, each message named after its own author. A thread of another organization — or another person's legacy personal thread — is reported as not found.

MCP tool: organization_support_thread_get

Parameters

Name	In	Type	Required	Description
`id`	path	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`title`	`string`	•	—
`legacy`	`boolean`	•	—
`status`	`string`	•	—
`category`	`string`one of: open, pending, resolved, closed	•	—
`messages`	`object[]`	•	—
`createdAt`	`string`	•	—
`openedByName`	`string`	•	—
`lastMessageAt`	`string`	•	—
`lastMessagePreview`	`string \| null`	•	—

POST/governance/api/v1/support/threads/:id/messages

Reply in any support thread of the caller's organization, as the caller. A thread of another organization is reported as not found.

MCP tool: organization_support_thread_reply

Parameters

Name	In	Type	Required	Description
`id`	path	`string`	•	—
`body`	body	`string`	•	—

Response

Returns object.

Field	Type	Always	Description
`id`	`string`	•	—
`title`	`string`	•	—
`legacy`	`boolean`	•	—
`status`	`string`	•	—
`category`	`string`one of: open, pending, resolved, closed	•	—
`messages`	`object[]`	•	—
`createdAt`	`string`	•	—
`openedByName`	`string`	•	—
`lastMessageAt`	`string`	•	—
`lastMessagePreview`	`string \| null`	•	—

Was this page helpful?