Skip to content
Ask LucyAsk LucyAsk Lucy Docs

The organization's tool permissions

GET
/org/tool-permissions
curl --request GET \
  --url https://api.asklucy.eu/v1/org/tool-permissions \
  --header 'Authorization: Bearer <token>'

Every tool of every connector this Lucy offers, and local access’s tools, grouped by tool server, with the organization’s permission. A tool an admin hasn’t set has its default, from the tool’s MCP annotations: allow for a read-only tool, ask for one that writes, deletes, reaches the open world or other people. Listed whether or not the connector or local access is on, so admins can set them first. mine is null.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

OK

Media typeapplication/json
object
data
required
Array<object>
object
server
required
string
name
required
string
kind
required

custom: a connector an admin added by URL (McpServer).

string
Allowed values: connector local custom
shared

Everyone’s calls use one account the organization signed in with (“Shared by the organization”).

boolean
host

For custom, the host the calls go to.

string | null
enabled

The person’s own switch for the whole connector (setMyConnectorSwitch); always true in /org/tool-permissions.

boolean
tools
required
Array<object>
object
server
required

The tool server, a connector (m365) or local.

string
tool
required

The tool’s name on its server (the model sees <server>.<tool>).

string
title
required
string
description
required

One line on what the tool does, for settings pages.

string
app
required

The connector’s app the tool belongs to (ConnectorApp.id); null for local access.

string | null
access
required

For local access, whether the tool reads or changes files; null otherwise.

string | null
Allowed values: read write
hints
required

The tool’s MCP annotations the default is read from.

object
read_only
required
boolean
destructive
required
boolean
open_world
required

It reaches outside the person’s own data, such as other people (sending, inviting).

boolean
annotated

The server gave annotations (Lucy’s catalog always does). False for a custom server’s tool without any.

boolean
default
required

What Lucy may do with a tool. allow: it uses the tool without asking. ask: each call waits for the person’s yes on a card in the chat (Step.approval). deny: the tool is hidden from the model, which never sees it. Stricter is deny > ask > allow.

string
Allowed values: allow ask deny
organization
required

What Lucy may do with a tool. allow: it uses the tool without asking. ask: each call waits for the person’s yes on a card in the chat (Step.approval). deny: the tool is hidden from the model, which never sees it. Stricter is deny > ask > allow.

string
Allowed values: allow ask deny
organization_set
required

An admin set organization; false when it is the tool’s default.

boolean
mine
required
One of:

What Lucy may do with a tool. allow: it uses the tool without asking. ask: each call waits for the person’s yes on a card in the chat (Step.approval). deny: the tool is hidden from the model, which never sees it. Stricter is deny > ask > allow.

string
Allowed values: allow ask deny
effective
required

What Lucy may do with a tool. allow: it uses the tool without asking. ask: each call waits for the person’s yes on a card in the chat (Step.approval). deny: the tool is hidden from the model, which never sees it. Stricter is deny > ask > allow.

string
Allowed values: allow ask deny
changed

For a custom server’s tool, new or changed since an admin reviewed it; organization is then ask at most.

boolean
choices
required

The values the caller may set: an admin any of the three; a person organization and what is stricter (only deny when the organization asks, none when it denies).

Array<string>
Allowed values: allow ask deny
next_cursor
required
string | null

Example 

{
  "data": [
    {
      "server": "m365",
      "name": "Microsoft 365",
      "kind": "connector",
      "tools": [
        {
          "server": "m365",
          "tool": "mail_send",
          "title": "Send an email",
          "app": "send_mail",
          "access": "read",
          "default": "allow",
          "organization": "allow",
          "mine": "allow",
          "effective": "allow",
          "choices": [
            "allow"
          ]
        }
      ]
    }
  ]
}

401

Section titled “401”

Missing, expired or invalid token.

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required
string format: uri-reference
title
required
string
status
required
integer
detail
string
instance
string
request_id
string
quota

For quota-exceeded, the window that is used up.

object
window
required
string
Allowed values: five_hours week month
percent_used
required
number
<= 100
resets_at
required

Null for a rolling window that hasn’t started.

string | null format: date-time
limited_by
required

organization when the organization’s budget is closer to running out than the member’s own limit.

string
Allowed values: personal organization
request
One of:

A request as its member sees it, where they asked.

object
id
required
string
status
required
string
Allowed values: pending approved declined withdrawn
created_at
required
string format: date-time
decided_at
required
string | null format: date-time
note
required

What the admin who decided wrote back.

string | null
errors

Field-level problems (400 only).

Array<object>
object
field
required

JSON pointer into the request body.

string
message
required
string

Example 

{
  "type": "https://docs.asklucy.eu/errors/answer-in-progress",
  "quota": {
    "window": "five_hours",
    "limited_by": "personal",
    "request": {
      "status": "pending"
    }
  }
}

Headers

Section titled “Headers”
X-Request-Id
string

Unique per request; quote it to support.

403

Section titled “403”

The token is valid but lacks the role this needs.

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required
string format: uri-reference
title
required
string
status
required
integer
detail
string
instance
string
request_id
string
quota

For quota-exceeded, the window that is used up.

object
window
required
string
Allowed values: five_hours week month
percent_used
required
number
<= 100
resets_at
required

Null for a rolling window that hasn’t started.

string | null format: date-time
limited_by
required

organization when the organization’s budget is closer to running out than the member’s own limit.

string
Allowed values: personal organization
request
One of:

A request as its member sees it, where they asked.

object
id
required
string
status
required
string
Allowed values: pending approved declined withdrawn
created_at
required
string format: date-time
decided_at
required
string | null format: date-time
note
required

What the admin who decided wrote back.

string | null
errors

Field-level problems (400 only).

Array<object>
object
field
required

JSON pointer into the request body.

string
message
required
string

Example 

{
  "type": "https://docs.asklucy.eu/errors/answer-in-progress",
  "quota": {
    "window": "five_hours",
    "limited_by": "personal",
    "request": {
      "status": "pending"
    }
  }
}

Headers

Section titled “Headers”
X-Request-Id
string

Unique per request; quote it to support.