> ## Documentation Index
> Fetch the complete documentation index at: https://developers.notion.com/llms.txt
> Use this file to discover all available pages before exploring further.

> Deny or restore a member's enterprise-managed MCP client access.

# Deny or restore enterprise-managed MCP client access

The organization bot token must have the following scopes:

* `mcp-client-connection:write-high-impact`

Set `access` to `denied` to block future connections and revoke the member's current tokens. Set it to `allowed` to remove the block.

The operation is idempotent. Repeating a deny keeps access blocked and cleans up any current tokens; repeating a restore keeps access allowed. Restoring access requires enterprise-managed connections to be available for the workspace.

The workspace and member must belong to the organization that owns the token. Invalid and out-of-organization targets return the same not-found response.


## OpenAPI

````yaml openapi-adminApi.json PUT /v1/mcp_client_connections/enterprise_managed_access
openapi: 3.1.0
info:
  title: Notion Admin API
  version: 1.0.0
  termsOfService: >-
    https://notion.notion.site/Terms-and-Privacy-28ffdd083dc3473e9c2da6ec011b58ac
servers:
  - url: https://api.notion.com/admin
security:
  - bearerAuth: []
tags:
  - name: Exports
    description: Workspace export endpoints
  - name: Legal holds
    description: Legal hold endpoints
  - name: Managed users
    description: Managed user endpoints
paths:
  /v1/mcp_client_connections/enterprise_managed_access:
    put:
      tags:
        - Admin API
      summary: Deny or restore enterprise-managed MCP client access
      operationId: update-mcp-client-connection-enterprise-managed-access
      parameters:
        - $ref: '#/components/parameters/notionVersion'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                access:
                  description: '''denied'' blocks access; ''allowed'' restores access.'
                  type: string
                  enum:
                    - allowed
                    - denied
                user_id:
                  type: string
                  format: uuid
                workspace_id:
                  type: string
                  format: uuid
              required:
                - access
                - user_id
                - workspace_id
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  access:
                    description: Access state applied to the member.
                    type: string
                    enum:
                      - allowed
                      - denied
                  revoked_token_count:
                    description: >-
                      Number of active tokens revoked. Always zero when
                      restoring access.
                    type: number
                required:
                  - access
                  - revoked_token_count
        '400':
          description: The request body, path parameters, or query parameters are invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/adminApiError400'
              example:
                type: error
                code: validation_error
                status: 400
                message: The request body is invalid.
        '401':
          description: The request is missing a valid bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/adminApiError401'
              example:
                type: error
                code: unauthorized
                status: 401
                message: Unauthorized.
        '403':
          description: >-
            The authenticated bot does not have access to the requested resource
            or scope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/adminApiError403'
              example:
                type: error
                code: forbidden
                status: 403
                message: Forbidden.
        '404':
          description: The requested resource could not be found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/adminApiError404'
              example:
                type: error
                code: not_found
                status: 404
                message: Not found.
        '429':
          description: The request was rate limited.
          headers:
            retry-after:
              description: Seconds to wait before retrying the request.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/adminApiError429'
              example:
                type: error
                code: rate_limited
                status: 429
                message: Rate limited.
        '500':
          description: An unexpected server error occurred.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/adminApiError500'
              example:
                type: error
                code: internal_server_error
                status: 500
                message: An unexpected error occurred.
components:
  parameters:
    notionVersion:
      name: Notion-Version
      in: header
      required: true
      schema:
        enum:
          - '2026-06-01'
      description: The Admin API version to use for this request.
  schemas:
    adminApiError400:
      type: object
      properties:
        type:
          enum:
            - error
        code:
          enum:
            - validation_error
        status:
          enum:
            - 400
        message:
          type: string
      required:
        - type
        - code
        - status
        - message
      additionalProperties: false
    adminApiError401:
      type: object
      properties:
        type:
          enum:
            - error
        code:
          enum:
            - unauthorized
        status:
          enum:
            - 401
        message:
          type: string
      required:
        - type
        - code
        - status
        - message
      additionalProperties: false
    adminApiError403:
      type: object
      properties:
        type:
          enum:
            - error
        code:
          enum:
            - missing_scope
            - forbidden
        status:
          enum:
            - 403
        message:
          type: string
      required:
        - type
        - code
        - status
        - message
      additionalProperties: false
    adminApiError404:
      type: object
      properties:
        type:
          enum:
            - error
        code:
          enum:
            - not_found
        status:
          enum:
            - 404
        message:
          type: string
      required:
        - type
        - code
        - status
        - message
      additionalProperties: false
    adminApiError429:
      type: object
      properties:
        type:
          enum:
            - error
        code:
          enum:
            - rate_limited
        status:
          enum:
            - 429
        message:
          type: string
      required:
        - type
        - code
        - status
        - message
      additionalProperties: false
    adminApiError500:
      type: object
      properties:
        type:
          enum:
            - error
        code:
          enum:
            - internal_server_error
        status:
          enum:
            - 500
        message:
          type: string
      required:
        - type
        - code
        - status
        - message
      additionalProperties: false
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````