The administration resources are intended for tightly controlled workspace-management services. They do not expose a generic permission bypass.
| Resource | Operations | Base scopes |
|---|---|---|
| Members | List, get, change role, remove | members:read, members:write |
| Invitations | List, get, create, resend, cancel | invitations:read, invitations:write |
| Roles | List, get, create, update, delete | roles:read, roles:write |
| Groups | List, get, create, update, delete | groups:read, groups:write |
Safe workspace defaults are a separate revisioned resource. They expose only workspace name,
currency, default language, planned-time default, productivity default, and scheduling visibility.
Read and update them with workspace-settings:read and workspace-settings:write; provider,
billing, storage, role, feature-gate, and integration configuration is never part of this resource.
See platform discovery and settings.
PII is a separate grant
Member and invitation responses omit names, email addresses, positions, and contact identifiers by
default. A caller needs the relevant base read scope and members:pii:read to request those
fields. The PII overlay does not grant member or invitation access on its own.
Use separate credentials for administration and operational data access. Administration scopes are
marked sensitive in the canonical scope contract. The 1.2.2 MCP server exposes reviewed
administration operations in admin-write and full; sensitive CLI/OAuth consent requires a
passkey. Review invitations and role changes before authorizing their effects.
Safe mutations
Invitation, role, and group creates accept Idempotency-Key; invitation resend also uses a stable
idempotency key. Member-role changes and role or group updates require the latest strong adm1
revision in If-Match. A 412 means the authorization state changed and must be reviewed before a
retry.
Removing a member or deleting a role or group is an explicit destructive operation. The API still applies workspace permissions and invariants such as valid role references; possession of a scope is not a substitute for those checks.