Skip to content
Ask LucyAsk LucyAsk Lucy Docs

What Lucy's tools may do for you

GET
/me/tool-permissions
curl --request GET \
  --url https://api.asklucy.eu/v1/me/tool-permissions \
  --header 'Authorization: Bearer <token>'

The tools of your connectors and of local access, grouped by tool server, each with its permission: allow (Lucy uses it without asking), ask (you approve each call in the chat) or deny (Lucy never sees it). Your organization sets each tool’s permission (organization); you can make a tool stricter for yourself (mine), never looser. effective is the stricter of the two, and what Lucy does. These are yours, for every conversation: there is no per-conversation setting.

Listed: Microsoft 365’s tools for the apps your organization allows, while it is on; local access’s tools while the organization’s local_files isn’t off (the change tools only with read_write).

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

OK

Media typeapplication/json
object
data
required
Array<object>
object
server
required
string
name
required
string
kind
required

custom: a connector an admin added by URL (McpServer).

string
Allowed values: connector local custom
shared

Everyone’s calls use one account the organization signed in with (“Shared by the organization”).

boolean
host

For custom, the host the calls go to.

string | null
enabled

The person’s own switch for the whole connector (setMyConnectorSwitch); always true in /org/tool-permissions.

boolean
tools
required
Array<object>
object
server
required

The tool server, a connector (m365) or local.

string
tool
required

The tool’s name on its server (the model sees <server>.<tool>).

string
title
required
string
description
required

One line on what the tool does, for settings pages.

string
app
required

The connector’s app the tool belongs to (ConnectorApp.id); null for local access.

string | null
access
required

For local access, whether the tool reads or changes files; null otherwise.

string | null
Allowed values: read write
hints
required

The tool’s MCP annotations the default is read from.

object
read_only
required
boolean
destructive
required
boolean
open_world
required

It reaches outside the person’s own data, such as other people (sending, inviting).

boolean
annotated

The server gave annotations (Lucy’s catalog always does). False for a custom server’s tool without any.

boolean
default
required

What Lucy may do with a tool. allow: it uses the tool without asking. ask: each call waits for the person’s yes on a card in the chat (Step.approval). deny: the tool is hidden from the model, which never sees it. Stricter is deny > ask > allow.

string
Allowed values: allow ask deny
organization
required

What Lucy may do with a tool. allow: it uses the tool without asking. ask: each call waits for the person’s yes on a card in the chat (Step.approval). deny: the tool is hidden from the model, which never sees it. Stricter is deny > ask > allow.

string
Allowed values: allow ask deny
organization_set
required

An admin set organization; false when it is the tool’s default.

boolean
mine
required
One of:

What Lucy may do with a tool. allow: it uses the tool without asking. ask: each call waits for the person’s yes on a card in the chat (Step.approval). deny: the tool is hidden from the model, which never sees it. Stricter is deny > ask > allow.

string
Allowed values: allow ask deny
effective
required

What Lucy may do with a tool. allow: it uses the tool without asking. ask: each call waits for the person’s yes on a card in the chat (Step.approval). deny: the tool is hidden from the model, which never sees it. Stricter is deny > ask > allow.

string
Allowed values: allow ask deny
changed

For a custom server’s tool, new or changed since an admin reviewed it; organization is then ask at most.

boolean
choices
required

The values the caller may set: an admin any of the three; a person organization and what is stricter (only deny when the organization asks, none when it denies).

Array<string>
Allowed values: allow ask deny
next_cursor
required
string | null

Example 

{
  "data": [
    {
      "server": "m365",
      "name": "Microsoft 365",
      "kind": "connector",
      "tools": [
        {
          "server": "m365",
          "tool": "mail_send",
          "title": "Send an email",
          "app": "send_mail",
          "access": "read",
          "default": "allow",
          "organization": "allow",
          "mine": "allow",
          "effective": "allow",
          "choices": [
            "allow"
          ]
        }
      ]
    }
  ]
}

401

Section titled “401”

Missing, expired or invalid token.

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required
string format: uri-reference
title
required
string
status
required
integer
detail
string
instance
string
request_id
string
quota

For quota-exceeded, the window that is used up.

object
window
required
string
Allowed values: five_hours week month
percent_used
required
number
<= 100
resets_at
required

Null for a rolling window that hasn’t started.

string | null format: date-time
limited_by
required

organization when the organization’s budget is closer to running out than the member’s own limit.

string
Allowed values: personal organization
request
One of:

A request as its member sees it, where they asked.

object
id
required
string
status
required
string
Allowed values: pending approved declined withdrawn
created_at
required
string format: date-time
decided_at
required
string | null format: date-time
note
required

What the admin who decided wrote back.

string | null
errors

Field-level problems (400 only).

Array<object>
object
field
required

JSON pointer into the request body.

string
message
required
string

Example 

{
  "type": "https://docs.asklucy.eu/errors/answer-in-progress",
  "quota": {
    "window": "five_hours",
    "limited_by": "personal",
    "request": {
      "status": "pending"
    }
  }
}

Headers

Section titled “Headers”
X-Request-Id
string

Unique per request; quote it to support.

403

Section titled “403”

The token is valid but lacks the role this needs.

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required
string format: uri-reference
title
required
string
status
required
integer
detail
string
instance
string
request_id
string
quota

For quota-exceeded, the window that is used up.

object
window
required
string
Allowed values: five_hours week month
percent_used
required
number
<= 100
resets_at
required

Null for a rolling window that hasn’t started.

string | null format: date-time
limited_by
required

organization when the organization’s budget is closer to running out than the member’s own limit.

string
Allowed values: personal organization
request
One of:

A request as its member sees it, where they asked.

object
id
required
string
status
required
string
Allowed values: pending approved declined withdrawn
created_at
required
string format: date-time
decided_at
required
string | null format: date-time
note
required

What the admin who decided wrote back.

string | null
errors

Field-level problems (400 only).

Array<object>
object
field
required

JSON pointer into the request body.

string
message
required
string

Example 

{
  "type": "https://docs.asklucy.eu/errors/answer-in-progress",
  "quota": {
    "window": "five_hours",
    "limited_by": "personal",
    "request": {
      "status": "pending"
    }
  }
}

Headers

Section titled “Headers”
X-Request-Id
string

Unique per request; quote it to support.