MCP reference · v1
set_service_permissions
Assign exact service rights to a company member. Exact environment grants replace the all-environments default. An empty actions array denies access. Only the designated global administrator may change grants.
Changes saved state Can replace or revoke state
Company permissions
Required scopes: orchesphere.read, orchesphere.manage. Current identity, company and service/portal rights are checked for every call. Scopes do not create access.
Designated global access administrator only, for an existing active/invited company member. Exact production/sandbox grant overrides the * default; empty actions deny access. Does not assign company membership. Equivalent REST operation.
Input schema
| Field | Type | Required | Description / bounds |
|---|---|---|---|
workspaceId | string | Yes | An assigned company workspace ID. |
email | string | Yes | — |
provider | string | Yes | — |
environment | "*" | "production" | "sandbox" | Yes | — |
actions | array | Yes | maxItems: 5 |
Complete MCP input schema
{
"type": "object",
"properties": {
"workspaceId": {
"type": "string",
"description": "An assigned company workspace ID."
},
"email": {
"type": "string"
},
"provider": {
"type": "string"
},
"environment": {
"type": "string",
"enum": [
"*",
"production",
"sandbox"
]
},
"actions": {
"type": "array",
"items": {
"type": "string",
"enum": [
"read",
"verify",
"configure",
"jobs_read_all",
"jobs_cancel_all"
]
},
"maxItems": 5
}
},
"required": [
"workspaceId",
"email",
"provider",
"environment",
"actions"
],
"additionalProperties": false
}Tool call
{
"jsonrpc": "2.0",
"id": 2,
"method": "tools/call",
"params": {
"name": "set_service_permissions",
"arguments": {
"workspaceId": "11111111-1111-4111-8111-111111111111",
"email": "member@example.com",
"provider": "stripe",
"environment": "*",
"actions": []
}
}
}POST to https://orchesphere.ai/mcp with a Bearer token approved for the MCP resource. Initialize the connection first. Examples use fictional identifiers.
Response handling
A successful tool result includes text content and structuredContent. Inspect isError before treating a tool result as successful. Authentication and scope failures may use HTTP 401/403 with WWW-Authenticate. This tool does not publish a separate MCP output schema; use its returned structure rather than assuming a provider business-record response.