---
title: "Replace who can use an External MCP Connection"
method: PUT
path: "/v1/mcp-connections/{connectionId}/access"
tags: ["Capability Sources"]
---

# Replace who can use an External MCP Connection

`PUT /v1/mcp-connections/{connectionId}/access`

Admin-only. Full-replace semantics: send the complete desired access set (orgWide, or memberIds + teamIds). Team and member ids come from GET /v1/org.

## Path parameters

- `connectionId` string, typeid, required

## Request body

- object
  - `access` ExternalMcpConnectionAccessInput, required
    - `orgWide` boolean
    - `memberIds` string[]
    - `teamIds` string[]

## Response `200`

Access updated.

- ExternalMcpConnectionResponse
  - `id` string, required
  - `name` string, required
  - `url` string, required
  - `authType` 'oauth' | 'apikey' | 'none', required
  - `credentialMode` 'shared' | 'per_member', required
  - `connected` boolean, required
  - `connectedAt` string, nullable, required
  - `createdByName` string, nullable
  - `updatedAt` string, date-time
  - `connectedForMe` boolean, required
  - `needsReconnect` boolean
  - `credentialHealth` 'unknown' | 'ready' | 'reconnect_required'
  - `credentialHealthReason` 'authorization_rejected' | 'credential_expired' | 'post_authorization_validation_failed', nullable
  - `credentialHealthCheckedAt` string, date-time, nullable
  - `issuerReviewRequired` boolean
  - `reconnectActionOwner` 'member' | 'organization_admin', nullable
  - `missingFeatures` string[]
  - `externalAccountId` string, nullable
  - `grantedScopes` string[]
  - `tenantId` string, nullable
  - `requiredBy` ExternalMcpConnectionRequiredBy[], required
    - `pluginId` string, required
    - `name` string, required
  - `identityManagedBy` ExternalMcpConnectionRequiredBy[]
    - `pluginId` string, required
    - `name` string, required
  - `requiredAuthType` 'oauth' | 'apikey' | 'none', nullable
  - `authPolicyConfirmed` boolean
  - `authTypeMismatch` boolean
  - `oauthClientConfigured` boolean
  - `oauthClientRequired` boolean
  - `setupRequired` boolean
  - `access` ExternalMcpConnectionAccessSummary, required
    - `orgWide` boolean, required
    - `memberIds` string[], required
    - `teamIds` string[], required
  - `oauthClientId` string, nullable
  - `oauthCallbackUrl` string, nullable
  - `oauthSharedCallbackUrl` string, nullable
  - `oauthClientMetadataUrl` string, nullable
  - `oauthCallbackMode` 'shared-v1' | 'isolated-v1' | 'legacy-v1', nullable
  - `oauthRegistrationSource` 'pre-registered' | 'client-metadata' | 'dynamic', nullable
  - `authorizationServerIssuer` string, nullable
  - `requestedScopes` string[]

## Other responses

- `400` — Invalid request.
- `401` — The caller must be signed in.
- `403` — Only workspace owners and admins can change connection access.
- `404` — Unknown connection.

---

[API](https://skmtc.net/openworklabs/apis/den-api.md) · [All operations](https://skmtc.net/openworklabs/apis/den-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openworklabs/den-api/versions/073bc652adfb/schema)