Lists the access requests (Request access: a one-time link where a client enters the credentials the agency needs), newest first, paginated by cursor (limit up to 200), of the chosen scope: open (default; pending) or closed (fulfilled, revoked or expired). Each request: the client account (assigned_child_org_id) and the name written on the request (child_org_name: what the client sees), the slots asked for (id, type, title), message, the recipient written down, status, expires_at, who created it and when, and once fulfilled, fulfilled_at, fulfilled_item_ids (the credentials it created, see vault.items.get) and the name and email the client left. It never returns the link or its code. A request past its expiry is reported (and saved) as expired, and the page is completed reading up to 400 requests. Requires view access to the Vault.
Alcance
vault:read
Permiso
Ver el módulo
Tool del MCP
vault_requests_listEn la superficie completa; en la compacta, mb_execute_operation con id: "vault.requests.list".
Costo declarado: hasta 501 lecturas y 0 escrituras por llamada (cuentan en el cupo diario).
Parámetros
limitintegerqueryopcional
How many items this page brings at most (see the maximum and the default in the schema).
Por defecto: 50
cursorstringqueryopcional
The next_cursor of the previous page, exactly as it came (only for the same list and filters); without it, the first page.
scopeenumqueryopcional
open (default; pending) or closed (fulfilled, revoked or expired).
Ask a client for credentials through a one-time link
vault.requests.create
EscrituraDesde 2026-11-01
Creates an access request: a one-time link (expires_in_ms: 86400000 for 24 h, 604800000 for 7 d or 2592000000 for 30 d) where the client enters the credentials asked for in slots (1 to 10; type ftp, login, hosting_panel, database, ssh, api_key or note for «other access», each with a title such as «acme.com — FTP»). What the client submits is encrypted on arrival and stored in the Vault assigned to the client account, and the creator gets an in-app and email notice (vault.access.fulfilled fires). In a workspace, assigned_child_org_id is required and must be one of its accounts (vault_request_account_required, vault_account_invalid); elsewhere it is ignored. Optional message, recipient (name, email) and locale (es, en, pt-BR) of the public page and of the email. Through an API key, an OAuth app or any other credential the response does NOT include the link (a bearer URL): to get it to the client, write down recipient.email here and call vault.requests.send_email (MB Suite emails the link to that address), or the person copies it from the app (Vault → Requests → Copy link). Requires edit access to the Vault.
Instrucciones para agentes
Tell the person the request was created; to deliver it, MB Suite can email it to the recipient written down (vault.requests.send_email), or they copy the link from Vault → Requests in MB Suite. Never ask for or paste credentials in the chat.
Alcance
vault:write
Permiso
Editar en el módulo
Tool del MCP
vault_requests_createEn la superficie completa; en la compacta, mb_execute_operation con id: "vault.requests.create".
Closes a pending access request at once: its link shows the neutral «not available» page and the client can no longer submit. Only its creator, an owner or an admin (vault_link_not_owner, 403). Idempotent: on a request that is no longer pending (fulfilled, revoked or expired) nothing changes (changed=false). Credentials already received stay in the Vault. Returns the request. Requires edit access to the Vault.
Alcance
vault:write
Permiso
Editar en el módulo
Tool del MCP
vault_requests_revokeEn la superficie completa; en la compacta, mb_execute_operation con id: "vault.requests.revoke".
Costo declarado: hasta 1 lecturas y 1 escrituras por llamada (cuentan en el cupo diario).
Parámetros
request_idstringrutarequerido
The access request's id (from vault.requests.list).
curl-X POST "https://api.mb-suite.com/v1/vault/requests/{request_id}/revoke" \
-H"Authorization: Bearer $MB_API_KEY"
Probar con tu API key de prueba
Con una API key de prueba el pedido va siempre a tu organización de práctica: datos de ejemplo que puedes reiniciar.
curl-X POST "https://api.mb-suite.com/v1/vault/requests/{request_id}/revoke" \
-H"Authorization: Bearer $MB_TEST_KEY"
POST/v1/vault/requests/{request_id}/send-email
Email a pending access request to its recipient
vault.requests.send_email
EscrituraDesde 2026-11-01
MB Suite emails a pending access request to the recipient written down when it was created (recipient.email): the email, in the request's language, says who asks for which client account, lists what is asked for, shows the message and carries the one-time secure link, with its expiry. It is sent through MB Suite's email (from the organization's own verified sending domain when it has one). The link only travels inside that email: the response says who it was sent to (sent_to, sent_at, send_count) and never returns the link; the email log keeps it masked. It goes only to the address on the request: to send it elsewhere, create a new request with that recipient. Only its creator, an owner or an admin (vault_link_not_owner, 403); the request must be pending (vault_request_not_pending, 409) and have a recipient email (vault_request_recipient_email_required, 400), which cannot be the person behind the API key or app (400 vault_request_recipient_is_self; compared without case, +tags and, in Gmail, dots). At most once a minute (429 cooldown_active), 5 times per request (409 limit_reached) and 50 emails per UTC day per organization and per API key or app, a workspace key counting once across its accounts (429 daily_limit_reached, details.scope organization or credential, retry_after until 00:00 UTC); 409 vault_request_email_unavailable while emailing requests is not available. Outside the app it always takes two steps: dry_run=true says who it would go to and when the link expires, without sending, and returns the confirm_token that sends it. If the email provider does not send it (details.platform ses): 503 external_unavailable or 429 external_rate_limited, retry later; 409 external_rejected when it refuses the address; 409 external_outcome_unknown when it may have gone out (check before sending again). Requires edit access to the Vault.
Instrucciones para agentes
Tell the person the request was emailed to the recipient; never ask for or paste credentials in the chat.
Pide confirmación: primero dry_run: true (vista previa y confirm_token, que vale 10 minutos y una sola vez), después el mismo cuerpo con confirm_token. En unas pocas, solo con ciertos datos: la descripción dice cuándo. Por qué y cómo: Vista previa y confirmación.
Alcance
vault:write
Permiso
Editar en el módulo
Tool del MCP
vault_requests_send_emailEn la superficie completa; en la compacta, mb_execute_operation con id: "vault.requests.send_email".
Costo declarado: hasta 6 lecturas y 3 escrituras por llamada (cuentan en el cupo diario). Toca una plataforma externa (ses): cuenta en el cupo de operaciones externas.
Parámetros
request_idstringrutarequerido
The access request's id (from vault.requests.list).
time_zonestringcuerpoopcional
IANA time zone for the expiry date written in the email (default: the account's, then the workspace's, then UTC).
Con una API key de prueba el pedido va siempre a tu organización de práctica: datos de ejemplo que puedes reiniciar.En la práctica esta operación no se simula (toca otra plataforma): responde 409 sandbox_external_unavailable.
