Minute recovers continuously. Other intervals reset on their rolling or calendar schedule. Omit for calendar month; legacy per-minute types imply minute.
mcp_server_name
string
No
MCP server name. Required for mcp_server_calls and tool_calls limits.
tool_name
string
No
Tool name. Required for tool_calls limits.
behavior
"hard" | "soft"
No
Hard blocks exhausted requests; soft continues and records Prometheus observations. Only for token_cost, tokens and requests limits. Defaults to hard.
reason
string | null
No
Optional note on why the limit was set, shown with custom per-user limits. Null clears it.
Link an identity provider group to a team for Team Sync: on each sign-in, people in the group join the team with the link's team role, and leave it once they leave the group.
Optional new team description. Pass null to clear an existing description.
roles
string[]
No
Replace the team’s organization role identifiers. Members of this team and its descendants inherit their permissions. Pass [] to clear; omit to leave unchanged.
parent_id
string | null
No
Move the team under this parent. Pass null to move it to the root; omit to leave the hierarchy unchanged.
labels
object[]
No
Replace the team's labels with this set. Pass an empty array to remove all labels. Omit to leave labels unchanged.
labels[].key
string
Yes
labels[].value
string
Yes
Output
Field
Type
Required
Description
team
object
Yes
team.id
string
Yes
The team ID.
team.name
string
Yes
The team name.
team.description
string | null
Yes
The team description, if any.
team.roles
string[]
Yes
Organization role identifiers assigned to the team and inherited by members of this team and its descendants.
team.parentId
string | null
Yes
The parent team ID, or null when this is a root team.
Additional access requirement: Beyond team:read, the caller must be an organization-level team manager (a role granting team:update) or an admin of the target team.
Input
Parameter
Type
Required
Description
team_id
string
Yes
The ID of the team to add the member to.
user
string
Yes
The user to add, identified by their user ID or email address. The user must already belong to the organization.
role
"admin" | "member"
No
The role to assign within the team. Defaults to 'member'.
Output
Field
Type
Required
Description
member
object
Yes
member.id
string
Yes
The team membership row ID.
member.teamId
string
Yes
The team the membership belongs to.
member.userId
string
Yes
The ID of the member user.
member.role
"admin" | "member"
Yes
The member's role within the team (admin or member).
member.syncedFromSso
boolean
Yes
Whether this membership is managed by SSO group sync.
Additional access requirement: Beyond team:read, the caller must be an organization-level team manager (a role granting team:update) or an admin of the target team.
Input
Parameter
Type
Required
Description
team_id
string
Yes
The ID of the team.
user_id
string
Yes
The ID of the member user to update.
role
"admin" | "member"
Yes
The new role for the member (admin or member).
Output
Field
Type
Required
Description
member
object
Yes
member.id
string
Yes
The team membership row ID.
member.teamId
string
Yes
The team the membership belongs to.
member.userId
string
Yes
The ID of the member user.
member.role
"admin" | "member"
Yes
The member's role within the team (admin or member).
member.syncedFromSso
boolean
Yes
Whether this membership is managed by SSO group sync.
Additional access requirement: Beyond team:read, the caller must be an organization-level team manager (a role granting team:update) or an admin of the target team.
Input
Parameter
Type
Required
Description
team_id
string
Yes
The ID of the team.
user_id
string
Yes
The ID of the member user to remove from the team.
The external identity provider group identifier. Format varies by provider: LDAP Distinguished Name (e.g. cn=admins,ou=groups,dc=example,dc=com), OAuth/OIDC group name from the groups claim, SAML group attribute value, or Azure AD group object ID (GUID). Matched case-insensitively.
identity_provider_id
string
No
The ID of the identity provider to match the group for. Omit to match the group from any provider.
role
"admin" | "member"
No
The team role members of this group receive: member (default) or admin.
Output
Field
Type
Required
Description
externalGroup
object
Yes
externalGroup.id
string
Yes
The Team Sync group link ID.
externalGroup.teamId
string
Yes
The team the mapping belongs to.
externalGroup.groupIdentifier
string
Yes
The external identity provider group identifier.
externalGroup.identityProviderId
string | null
Yes
The identity provider the group is matched for, or null to match it from any provider.
Only return items the caller reaches in one of these ways: mine (created by the caller), shared (shared with the caller or one of their teams), org (shared with the whole organization), others (not shared with the caller; visible only through admin access). Omit for everything the caller can read. Use ["mine"] for "my plugins".
shared_with
string[]
No
Only return items whose own permissions grant read to one of these subjects: org (the whole organization), role:, team:, user:, serviceAccount:. Omit for no filtering.
owner_ids
string[]
No
Only return items created by one of these user IDs. Omit for no filtering.
The client the payload targets: claude-code, claude-desktop, codex, copilot-cli, or cursor.
supportedPlatforms
string[]
No
Operating systems the payload supports.
files
object[]
Yes
The plugin's files as { path, content, encoding?, mode? }. Hook configuration bytes are stored verbatim — review them as code, they execute on developer machines.
Disabled plugins are left out of future setup commands; already-installed copies are unaffected.
supportedPlatforms
string[]
No
Operating systems the payload supports.
baseContentHash
string
No
Required when files is provided. Use the current contentHash from get_plugin; the replacement is rejected if newer bytes landed first.
files
object[]
No
WHEN PROVIDED, REPLACES THE PLUGIN'S ENTIRE file set. Omit it to edit only metadata/visibility. Manual plugins only — GitHub-sourced files are read-only. For a small change to one file, prefer edit_plugin over resending every file.
The plugin's current contentHash, as returned by get_plugin. The edit is rejected when the plugin's bytes have moved past it.
path
string
Yes
The plugin file to edit, from the file list returned by get_plugin. Only text (utf8) files are editable — binary files are not.
edits
object[]
No
str_replace edits applied in order to the target file; the whole edit is atomic (any failure leaves the plugin unchanged). Pass either edits or replacementContent, never both.
edits[].old_str
string
Yes
Exact text to replace; must occur exactly once in the target (add surrounding context to disambiguate).
edits[].new_str
string
Yes
Replacement text (may be empty to delete).
replacementContent
string
No
The complete new content of the target file, replacing it outright with no old_str matching. Pass either edits or replacementContent, never both.
