Skip to main content
PUT
Deny or restore enterprise-managed MCP client access
The organization bot token must have the following scopes:
  • mcp-client-connection:write-high-impact
Set access to denied to block future connections and revoke the member’s current tokens. Set it to allowed to remove the block. The operation is idempotent. Repeating a deny keeps access blocked and cleans up any current tokens; repeating a restore keeps access allowed. Restoring access requires enterprise-managed connections to be available for the workspace. The workspace and member must belong to the organization that owns the token. Invalid and out-of-organization targets return the same not-found response.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

Notion-Version
enum<string>
required

The Admin API version to use for this request.

Available options:
2026-06-01

Body

application/json
access
enum<string>
required

'denied' blocks access; 'allowed' restores access.

Available options:
allowed,
denied
user_id
string<uuid>
required
workspace_id
string<uuid>
required

Response

access
enum<string>
required

Access state applied to the member.

Available options:
allowed,
denied
revoked_token_count
number
required

Number of active tokens revoked. Always zero when restoring access.