Permission templates

List permission presets

members.presets.list

Lists the organization's permission presets by name: named configurations of per-module permissions (module_permissions for the organization and, in a workspace, child_module_permissions for the member's assigned Accounts; module id → hidden, view_only or full_access) that an owner or admin applies to members and viewers with members.presets.apply. Requires view access to Members.

Scope

members:read

Permission

View the module

MCP tool

members_presets_listOn the full surface; on the compact one, mb_execute_operation with id: "members.presets.list".

Declared cost: up to 501 reads and 0 writes per call (they count against the daily quota).

Parameters

No parameters.

Response

Errors

Example

curl "https://api.mb-suite.com/v1/members/presets" \
  -H "Authorization: Bearer $MB_API_KEY"

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl "https://api.mb-suite.com/v1/members/presets" \
  -H "Authorization: Bearer $MB_TEST_KEY"

Get one permission preset

members.presets.get

Returns one permission preset with its name, color, description and the two permission maps (organization and assigned Accounts). 404 permission_preset_not_found if it is not in this organization. Requires view access to Members.

Scope

members:read

Permission

View the module

MCP tool

members_presets_getOn the full surface; on the compact one, mb_execute_operation with id: "members.presets.get".

Declared cost: up to 1 reads and 0 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl "https://api.mb-suite.com/v1/members/presets/{preset_id}" \
  -H "Authorization: Bearer $MB_API_KEY"

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl "https://api.mb-suite.com/v1/members/presets/{preset_id}" \
  -H "Authorization: Bearer $MB_TEST_KEY"

Create a permission preset

members.presets.create

Creates a permission preset: a name (up to 80 characters), an optional color and description, module_permissions (module id → hidden, view_only or full_access for this organization) and, for workspaces, child_module_permissions (the same kind of map applied in every Account assigned to the member). Modules the organization does not have are kept in the preset and skipped when it is applied. Returns the preset. Owner or admin only.

Scope

members:write

Permission

Edit in the module · Only owner, admin

MCP tool

members_presets_createOn the full surface; on the compact one, mb_execute_operation with id: "members.presets.create".

Declared cost: up to 1 reads and 1 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl -X POST "https://api.mb-suite.com/v1/members/presets" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "name": "NAME"
}'

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl -X POST "https://api.mb-suite.com/v1/members/presets" \
  -H "Authorization: Bearer $MB_TEST_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "name": "NAME"
}'

Update a permission preset

members.presets.update

Updates a permission preset: name, color, description (null or empty removes it), module_permissions (replaces the map) and child_module_permissions (replaces the map; null or {} removes it). Unknown fields are rejected. Changing a preset does not change the members it was already applied to: apply it again with members.presets.apply. 404 permission_preset_not_found. Returns the preset. Owner or admin only.

Scope

members:write

Permission

Edit in the module · Only owner, admin

MCP tool

members_presets_updateOn the full surface; on the compact one, mb_execute_operation with id: "members.presets.update".

Declared cost: up to 1 reads and 1 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl -X PATCH "https://api.mb-suite.com/v1/members/presets/{preset_id}" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "updates": {}
}'

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl -X PATCH "https://api.mb-suite.com/v1/members/presets/{preset_id}" \
  -H "Authorization: Bearer $MB_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "updates": {}
}'

Delete a permission preset

members.presets.delete

Deletes a permission preset. The permissions of the members it was applied to do not change (they keep the preset id as their origin until edited). It stays 30 days in the trash, where an owner or admin can restore it with its id (platform.trash.restore). Outside the app it needs a dry run and a confirm_token, except a REST DELETE with a key allowed to delete. 404 permission_preset_not_found. Owner or admin only.

With an API key, this DELETE runs directly: the record stays 30 days in the trash and the response carries its trash_item_id. With an OAuth token, and through the MCP, it needs dry_run → confirm_token.

Scope

members:write and “Allow deletions” (members:delete in OAuth)

Permission

Edit in the module · Only owner, admin

MCP tool

members_presets_deleteOn the full surface; on the compact one, mb_execute_operation with id: "members.presets.delete".

Declared cost: up to 2 reads and 1 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl -X DELETE "https://api.mb-suite.com/v1/members/presets/{preset_id}" \
  -H "Authorization: Bearer $MB_API_KEY"

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl -X DELETE "https://api.mb-suite.com/v1/members/presets/{preset_id}" \
  -H "Authorization: Bearer $MB_TEST_KEY"

Apply a permission preset to members

members.presets.apply

Applies a permission preset to up to 500 members in one write: each member's per-module permissions are replaced by the preset's (only the modules the organization has active; the rest are counted in dropped_module_count) and the preset is recorded as their origin (applied_preset_id). Owners and admins are skipped (skipped_roles): they always have full access. In a workspace of an agency the preset's child_module_permissions apply to the member's assigned Accounts too. Members not found are returned in not_found. Fires members.member.permissions_changed once per member changed. Outside the app it requires a dry run (which lists who changes) and a confirm_token. Owner or admin only.

Needs confirmation: first dry_run: true (preview and confirm_token, valid 10 minutes and for one run), then the same body with confirm_token. In a few operations only with certain data: the description says when. Why and how: Dry run and confirm_token.

Scope

members:write

Permission

Edit in the module · Only owner, admin

MCP tool

members_presets_applyOn the full surface; on the compact one, mb_execute_operation with id: "members.presets.apply".

Events it can emit

members.member.permissions_changed

Declared cost: up to 502 reads and 1 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl -X POST "https://api.mb-suite.com/v1/members/presets/{preset_id}/apply" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "user_ids": [
    "USER_ID"
  ],
  "dry_run": true
}'

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl -X POST "https://api.mb-suite.com/v1/members/presets/{preset_id}/apply" \
  -H "Authorization: Bearer $MB_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "user_ids": [
    "USER_ID"
  ],
  "dry_run": true
}'