---
title: "What the caller may do here"
method: GET
path: "/projects/{projectId}/capabilities"
tags: ["Projects"]
---

# What the caller may do here

`GET /projects/{projectId}/capabilities`

Role, gate state, plan limits and a set of derived booleans — so an agent on a static surface can check before it acts instead of attempting a write and reading the failure.

Descriptive, never authoritative: see the schema.

## Response `200`

The caller's capabilities in this project.

- ProjectCapabilities — What the caller may do in this project, asked BEFORE they try it. **A planning aid, not a gate.** Every enforcement point is unchanged: the write path checks roles and the beta flag inside the platform regardless of what this returned a second earlier. A caller that reads a `true` here and races a flag flip gets the same clean `403` it would have got without asking. Nothing may consult this INSTEAD of its own check. It exists because every agent surface MCPJam ships is static — one MCP tool catalog built with no organization in hand, a CLI command tree fixed at install — so an agent planning a task otherwise has to attempt the write and read the failure. By then it has usually already told a human what it was about to do.
  - `projectId` string, required
  - `organizationId` string, nullable, required
  - `role` string, required — The caller's ORGANIZATION role: `guest`, `member`, `admin` or `owner`. This is what the platform's role checks rank; a project grant does not raise it.
  - `projectRole` string, required — `admin` or `editor`, when the caller holds a project grant.
  - `surface` string, required — Which channel we resolved this request to arrive on. Echoed so an agent can confirm it is labelled the way it expects — a CLI showing up as `rest` means its user agent is not reaching us.
  - `features` object, required
    - `sandboxes` object, required
      - `enabled` boolean, required
      - `mode` 'off' | 'dark' | 'enforce', required — `off` | `dark` | `enforce`. Only `enforce` turns a disabled flag into a refusal; in `dark` the platform logs what it would have blocked and lets the write through.
      - `enforced` boolean, required
      - `reason` string
  - `plan` object, nullable, required
    - `name` string, required
    - `limits` object, required
    - `features` object, required
  - `can` object, required — The booleans to branch on, derived server-side rather than left for each caller to re-derive from `role` plus flag state.
    - `readSwarms` boolean, required
    - `readUserTesting` boolean, required
    - `writeSwarms` boolean, required — Authoring personas, journeys and swarms.
    - `launchJourneyRun` boolean, required
    - `cancelJourneyRun` boolean, required — Stays TRUE for an organization that has lost the beta. Losing the feature is exactly when stopping a run matters most.
    - `publishUserTestingScenario` boolean, required — Project admin, and behind the beta gate.
    - `unpublishUserTestingScenario` boolean, required — Project admin, NOT gated — same reasoning as cancelling a run.
    - `changeUserTestingExposure` boolean, required — Mode changes, member invites and removals, link rotation, renames — the controls an ordinary MEMBER can use, none of them gated. Guest execution is not covered here; it needs admin and has its own key.
    - `manageUserTestingGuestExecution` boolean, required — The guest-execution spend caps. Project admin, ungated.
    - `requestInsights` boolean, required

## Other responses

- `401` — Missing, invalid, revoked, or orphaned key (`UNAUTHORIZED`) — or the **target MCP server** needs an OAuth grant (`OAUTH_REQUIRED`), which is a property of the server, not your key.
- `403` — Key is valid but not allowed to do this.
- `404` — Unknown project, server, or resource.
- `429` — Per-key rate limit exceeded (60 requests/minute sustained, bursts up to 10). Honor `Retry-After` and back off with jitter.
- `500` — Something failed on MCPJam's side.

---

[API](https://skmtc.net/mcpjam/apis/mcpjam-api.md) · [All operations](https://skmtc.net/mcpjam/apis/mcpjam-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mcpjam/mcpjam-api/revisions/d3adfe49fbbf/schema)