Pedidos de acesso

List the vault's access requests

vault.requests.list

Lists the access requests (Request access: a one-time link where a client enters the credentials the agency needs), newest first, paginated by cursor (limit up to 200), of the chosen scope: open (default; pending) or closed (fulfilled, revoked or expired). Each request: the client account (assigned_child_org_id) and the name written on the request (child_org_name: what the client sees), the slots asked for (id, type, title), message, the recipient written down, status, expires_at, who created it and when, and once fulfilled, fulfilled_at, fulfilled_item_ids (the credentials it created, see vault.items.get) and the name and email the client left. It never returns the link or its code. A request past its expiry is reported (and saved) as expired, and the page is completed reading up to 400 requests. Requires view access to the Vault.

Escopo

vault:read

Permissão

Ver o módulo

Tool do MCP

vault_requests_listNa superfície completa; na compacta, mb_execute_operation com id: "vault.requests.list".

Custo declarado: até 501 leituras e 0 escritas por chamada (contam na cota diária).

Parâmetros

Resposta

Erros

Exemplo

curl "https://api.mb-suite.com/v1/vault/requests" \
  -H "Authorization: Bearer $MB_API_KEY"

Testar com a sua API key de teste

Com uma API key de teste o pedido vai sempre para a sua organização de prática: dados de exemplo que você pode reiniciar.

curl "https://api.mb-suite.com/v1/vault/requests" \
  -H "Authorization: Bearer $MB_TEST_KEY"

Ask a client for credentials through a one-time link

vault.requests.create

Creates an access request: a one-time link (expires_in_ms: 86400000 for 24 h, 604800000 for 7 d or 2592000000 for 30 d) where the client enters the credentials asked for in slots (1 to 10; type ftp, login, hosting_panel, database, ssh, api_key or note for «other access», each with a title such as «acme.com — FTP»). What the client submits is encrypted on arrival and stored in the Vault assigned to the client account, and the creator gets an in-app and email notice (vault.access.fulfilled fires). In a workspace, assigned_child_org_id is required and must be one of its accounts (vault_request_account_required, vault_account_invalid); elsewhere it is ignored. Optional message, recipient (name, email) and locale (es, en, pt-BR) of the public page and of the email. Through an API key, an OAuth app or any other credential the response does NOT include the link (a bearer URL): to get it to the client, write down recipient.email here and call vault.requests.send_email (MB Suite emails the link to that address), or the person copies it from the app (Vault → Requests → Copy link). Requires edit access to the Vault.

Escopo

vault:write

Permissão

Editar no módulo

Tool do MCP

vault_requests_createNa superfície completa; na compacta, mb_execute_operation com id: "vault.requests.create".

Eventos que pode emitir

vault.access.requested

Custo declarado: até 2 leituras e 2 escritas por chamada (contam na cota diária).

Parâmetros

Resposta

Erros

Exemplo

curl -X POST "https://api.mb-suite.com/v1/vault/requests" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "slots": [],
  "expires_in_ms": "86400000"
}'

Testar com a sua API key de teste

Com uma API key de teste o pedido vai sempre para a sua organização de prática: dados de exemplo que você pode reiniciar.

curl -X POST "https://api.mb-suite.com/v1/vault/requests" \
  -H "Authorization: Bearer $MB_TEST_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "slots": [],
  "expires_in_ms": "86400000"
}'

Revoke a pending access request

vault.requests.revoke

Closes a pending access request at once: its link shows the neutral «not available» page and the client can no longer submit. Only its creator, an owner or an admin (vault_link_not_owner, 403). Idempotent: on a request that is no longer pending (fulfilled, revoked or expired) nothing changes (changed=false). Credentials already received stay in the Vault. Returns the request. Requires edit access to the Vault.

Escopo

vault:write

Permissão

Editar no módulo

Tool do MCP

vault_requests_revokeNa superfície completa; na compacta, mb_execute_operation com id: "vault.requests.revoke".

Custo declarado: até 1 leituras e 1 escritas por chamada (contam na cota diária).

Parâmetros

Resposta

Erros

Exemplo

curl -X POST "https://api.mb-suite.com/v1/vault/requests/{request_id}/revoke" \
  -H "Authorization: Bearer $MB_API_KEY"

Testar com a sua API key de teste

Com uma API key de teste o pedido vai sempre para a sua organização de prática: dados de exemplo que você pode reiniciar.

curl -X POST "https://api.mb-suite.com/v1/vault/requests/{request_id}/revoke" \
  -H "Authorization: Bearer $MB_TEST_KEY"

Email a pending access request to its recipient

vault.requests.send_email

MB Suite emails a pending access request to the recipient written down when it was created (recipient.email): the email, in the request's language, says who asks for which client account, lists what is asked for, shows the message and carries the one-time secure link, with its expiry. It is sent through MB Suite's email (from the organization's own verified sending domain when it has one). The link only travels inside that email: the response says who it was sent to (sent_to, sent_at, send_count) and never returns the link; the email log keeps it masked. It goes only to the address on the request: to send it elsewhere, create a new request with that recipient. Only its creator, an owner or an admin (vault_link_not_owner, 403); the request must be pending (vault_request_not_pending, 409) and have a recipient email (vault_request_recipient_email_required, 400), which cannot be the person behind the API key or app (400 vault_request_recipient_is_self; compared without case, +tags and, in Gmail, dots). At most once a minute (429 cooldown_active), 5 times per request (409 limit_reached) and 50 emails per UTC day per organization and per API key or app, a workspace key counting once across its accounts (429 daily_limit_reached, details.scope organization or credential, retry_after until 00:00 UTC); 409 vault_request_email_unavailable while emailing requests is not available. Outside the app it always takes two steps: dry_run=true says who it would go to and when the link expires, without sending, and returns the confirm_token that sends it. If the email provider does not send it (details.platform ses): 503 external_unavailable or 429 external_rate_limited, retry later; 409 external_rejected when it refuses the address; 409 external_outcome_unknown when it may have gone out (check before sending again). Requires edit access to the Vault.

Pede confirmação: primeiro dry_run: true (prévia e confirm_token, válido por 10 minutos e por uma única execução), depois o mesmo corpo com confirm_token. Em algumas poucas, só com certos dados: a descrição diz quando. Por que e como: Prévia e confirmação.

Escopo

vault:write

Permissão

Editar no módulo

Tool do MCP

vault_requests_send_emailNa superfície completa; na compacta, mb_execute_operation com id: "vault.requests.send_email".

Custo declarado: até 6 leituras e 3 escritas por chamada (contam na cota diária). Usa uma plataforma externa (ses): conta na cota de operações externas.

Parâmetros

Resposta

Erros

Exemplo

curl -X POST "https://api.mb-suite.com/v1/vault/requests/{request_id}/send-email" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "dry_run": true
}'

Testar com a sua API key de teste

Com uma API key de teste o pedido vai sempre para a sua organização de prática: dados de exemplo que você pode reiniciar. Na prática esta operação não é simulada (usa outra plataforma): responde 409 sandbox_external_unavailable.