# Organization API

The Organization area publishes 71 REST endpoints. Paths are relative to `https://api.lessly.com`; see [Authentication](/reference/openapi#authentication) for the required header.

### `GET` `/governance/api/v1/auth/me`

Returns the current identity: identity ID, email, and identity type (e.g. "service" for a service token, which has no email)

MCP tool: `organization_auth_me`

**Parameters**

No parameters.

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| email | string | • | — |
| identityId | string | • | — |
| displayName | string | • | — |
| identityType | string | • | — |

### `GET` `/governance/api/v1/billing/budgets`

Reads the active product's billing budget: the spending ceiling, the per-product caps and the current consumption against them.

MCP tool: `organization_billing_budgets_get`

**Parameters**

No parameters.

### `PUT` `/governance/api/v1/billing/budgets`

Sets the spending ceiling of the active product's budget, in integer minor units of the currency the organization's ledger already pinned. Zero means 'spend nothing beyond what is included'.

MCP tool: `organization_billing_budgets_set`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| ceiling_minor | body | integer | • | — |

### `DELETE` `/governance/api/v1/billing/budgets/cap`

Clears the spending cap of one product in the caller’s organization, leaving only the organization-wide ceiling. The product must belong to the same organization as the active product.

MCP tool: `organization_billing_caps_clear`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | body | string | • | — |

### `PUT` `/governance/api/v1/billing/budgets/cap`

Sets the spending cap of one product in the caller’s organization, in integer minor units. The product must belong to the same organization as the active product; any other is refused.

MCP tool: `organization_billing_caps_set`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | body | string | • | — |
| cap_minor | body | integer | • | — |

### `DELETE` `/governance/api/v1/connectors/:id`

Detaches the current product from a connector

MCP tool: `organization_connectors_remove`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `GET` `/governance/api/v1/connectors/:id/attachments`

Lists the products a connector is attached to (org owner/admin)

MCP tool: `organization_connectors_list-attachments`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| attachments | array | • | — |
| connectorId | string | • | — |

### `POST` `/governance/api/v1/connectors/:id/attachments`

Attaches products to a connector (batch, idempotent; org owner/admin)

MCP tool: `organization_connectors_attach`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| productIds | body | array | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| attachments | array | • | — |
| connectorId | string | • | — |

### `DELETE` `/governance/api/v1/connectors/:id/attachments/:productId`

Detaches one product from a connector (org owner/admin). Last detach → dormant.

MCP tool: `organization_connectors_detach`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| productId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `DELETE` `/governance/api/v1/connectors/:id/org`

Deletes a connector org-wide: soft-delete, remove all attachments, tear down routing (org owner/admin)

MCP tool: `organization_connectors_delete`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `POST` `/governance/api/v1/connectors/:id/requests`

Requests access to an org connector for a product (any product member)

MCP tool: `organization_connectors_request`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | query | string | • | — |
| id | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| status | string | • | — |

### `POST` `/governance/api/v1/connectors/:id/requests/:requestId/approve`

Approves a connector access request, attaching the product (org owner/admin)

MCP tool: `organization_connectors_approve-request`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| requestId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `POST` `/governance/api/v1/connectors/:id/requests/:requestId/deny`

Denies a connector access request (org owner/admin)

MCP tool: `organization_connectors_deny-request`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| requestId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| success | boolean | • | — |

### `GET` `/governance/api/v1/connectors/available`

Lists org connectors not yet attached to a product, with this product's request status

MCP tool: `organization_connectors_list-available`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | query | string | • | — |

### `GET` `/governance/api/v1/connectors/clickup/install`

Starts the ClickUp OAuth connect flow for a product and returns the install URL

MCP tool: `organization_clickup_install`

**Parameters**

No parameters.

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/clickup/installations`

Lists the ClickUp installations connected to a product

MCP tool: `organization_clickup_list-installations`

**Parameters**

No parameters.

### `GET` `/governance/api/v1/connectors/cloudflare/install`

Starts the Cloudflare OAuth connect flow for a product and returns the consent URL

MCP tool: `organization_cloudflare_install`

**Parameters**

No parameters.

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/gdrive/install`

Starts the Google Drive OAuth connect flow for a product and returns the consent URL

MCP tool: `organization_gdrive_install`

**Parameters**

No parameters.

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/github/install`

Starts the GitHub app installation flow for a product. When the product's organization already has GitHub connections, returns them so one can be reused (attached) instead of dead-ending on GitHub's already-installed settings page. `url` is always returned — connecting an additional, different GitHub org stays possible.

MCP tool: `organization_github_install`

**Parameters**

No parameters.

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |
| status | string | • | — |
| canAttach | boolean | • | — |
| connectors | array | • | — |

### `GET` `/governance/api/v1/connectors/github/installations`

Lists the GitHub app installations connected to a product

MCP tool: `organization_github_list-installations`

**Parameters**

No parameters.

### `GET` `/governance/api/v1/connectors/googleads/install`

Starts the Google Ads OAuth connect flow for an organization and returns the consent URL

MCP tool: `organization_googleads_install`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | query | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |

### `GET` `/governance/api/v1/connectors/list`

Lists active connectors in a product

MCP tool: `organization_connectors_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | query | string | • | — |

### `POST` `/governance/api/v1/feedback`

Submit product feedback — opens a GitHub issue in the Lessly feedback repo. Use when the user wants to report a bug, request a feature, or leave feedback about the platform.

MCP tool: `organization_feedback_submit`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| title | body | string | • | — |
| details | body | string | • | — |
| page | body | string | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| url | string | • | — |
| number | number | • | — |
| supportThreadId | string | — | — |

### `GET` `/governance/api/v1/organizations`

Lists the organizations the current user belongs to (owned or via membership).

MCP tool: `organization_list`

**Parameters**

No parameters.

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| organizations | array | • | — |

### `POST` `/governance/api/v1/organizations`

Creates a new organization owned by the current user and sets it as the active organization for the session.

MCP tool: `organization_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| name | body | string | • | — |
| legalName | body | string | — | — |
| ownerName | body | string | — | — |
| countryOfIncorporation | body | string | — | — |
| residencyCountry | body | string | — | — |
| beneficialOwners | body | array | — | — |
| ownershipConfirmed | body | boolean | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |

### `GET` `/governance/api/v1/organizations/:organizationId/connectors`

Lists an organization's connectors with their product attachments (org owner/admin)

MCP tool: `organization_connectors_list-org`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |

### `GET` `/governance/api/v1/organizations/:organizationId/connectors/requests`

Lists connector access requests for an organization (org owner/admin)

MCP tool: `organization_connectors_list-requests`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |
| status | query | string | — | — |

### `GET` `/governance/api/v1/organizations/:organizationId/invitations`

Lists invitations for an organization

MCP tool: `organization_member_list-invitations`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| invitations | array | • | — |

### `POST` `/governance/api/v1/organizations/:organizationId/invitations`

Invites a user to an organization by email, optionally sharing products

MCP tool: `organization_member_invite`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |
| email | body | string | • | — |
| role | body | string | • | — |
| productShares | body | array | — | — |

### `DELETE` `/governance/api/v1/organizations/:organizationId/invitations/:invitationId`

Revokes a pending organization invitation

MCP tool: `organization_member_revoke-invitation`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |
| invitationId | path | string | • | — |

### `GET` `/governance/api/v1/organizations/:organizationId/members`

Lists the stored members of an organization with their roles and product grants

MCP tool: `organization_member_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| members | array | • | — |

### `DELETE` `/governance/api/v1/organizations/:organizationId/members/:userId`

Removes a member from an organization

MCP tool: `organization_member_remove`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |
| userId | path | string | • | — |

### `GET` `/governance/api/v1/organizations/:organizationId/members/:userId/products`

Lists the products in an organization a member can access, with role, grant source, and expiry (management view; expired grants are shown with expiresAt).

MCP tool: `organization_member_list-product-access`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |
| userId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| products | array | • | — |

### `POST` `/governance/api/v1/organizations/:organizationId/members/:userId/products`

Grants an organization member explicit access to a product

MCP tool: `organization_member_share-product`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |
| userId | path | string | • | — |
| productId | body | string | • | — |
| role | body | string | — | — |
| expiresAt | body | string | — | — |
| permissions | body | object | — | — |
| roleId | body | string | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| role | string | • | — |
| userId | string | • | — |
| expiresAt | string | • | — |
| productId | string | • | — |

### `DELETE` `/governance/api/v1/organizations/:organizationId/members/:userId/products/:productId`

Revokes an explicit product share from an organization member

MCP tool: `organization_member_unshare-product`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |
| userId | path | string | • | — |
| productId | path | string | • | — |

### `PATCH` `/governance/api/v1/organizations/:organizationId/members/:userId/role`

Changes an organization member's role (owner only)

MCP tool: `organization_member_set-role`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |
| userId | path | string | • | — |
| role | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| role | string | • | — |
| userId | string | • | — |

### `POST` `/governance/api/v1/organizations/:organizationId/security/mfa/enable`

Turns ON organization-wide multi-factor authentication (2FA) enforcement for an organization. Owner-only: only the owner of the organization may call it. This is deliberately one-way — disabling MFA enforcement is not available over MCP; use the organization security settings in the Product App instead. The policy is strictest-wins across all of a member’s organizations, so enabling it here forces MFA enrollment for every member of this organization at their next sign-in or token refresh.

MCP tool: `organization_security_mfa_enable`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| mfaRequired | boolean | • | — |
| trustedDeviceAllowed | boolean | • | — |

### `GET` `/governance/api/v1/organizations/:orgId/roles`

Lists the reusable custom roles defined in an organization

MCP tool: `organization_roles_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| roles | array | • | — |

### `POST` `/governance/api/v1/organizations/:orgId/roles`

Creates a reusable organization role with allow/deny permission patterns (owner/admin)

MCP tool: `organization_roles_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string | • | — |
| name | body | string | • | — |
| allow | body | array | — | — |
| deny | body | array | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| deny | array | • | — |
| name | string | • | — |
| type | string | • | — |
| allow | array | • | — |
| createdAt | string | • | — |
| updatedAt | string | • | — |
| organizationId | string | • | — |

### `DELETE` `/governance/api/v1/organizations/:orgId/roles/:roleId`

Deletes an organization role (owner/admin). Already-materialized product grants are unaffected.

MCP tool: `organization_roles_delete`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string | • | — |
| roleId | path | string | • | — |

### `GET` `/governance/api/v1/organizations/:orgId/roles/:roleId`

Gets a single organization role by id

MCP tool: `organization_roles_get`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string | • | — |
| roleId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| deny | array | • | — |
| name | string | • | — |
| type | string | • | — |
| allow | array | • | — |
| createdAt | string | • | — |
| updatedAt | string | • | — |
| organizationId | string | • | — |

### `PATCH` `/governance/api/v1/organizations/:orgId/roles/:roleId`

Updates an organization role's name or allow/deny patterns (owner/admin)

MCP tool: `organization_roles_update`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| orgId | path | string | • | — |
| roleId | path | string | • | — |
| name | body | string | — | — |
| allow | body | array | — | — |
| deny | body | array | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| deny | array | • | — |
| name | string | • | — |
| type | string | • | — |
| allow | array | • | — |
| createdAt | string | • | — |
| updatedAt | string | • | — |
| organizationId | string | • | — |

### `POST` `/governance/api/v1/organizations/invitations/accept`

Accepts an organization invitation using the invitation token

MCP tool: `organization_member_accept-invite`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| token | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| name | string | • | — |
| role | string | • | — |
| products | array | • | — |
| organizationId | string | • | — |

### `GET` `/governance/api/v1/organizations/permission-catalog`

Lists the full permission catalog (key, display_name, group, level, scope) derived from @McpTool handlers. Only scope="product" entries are grantable in role/point-rights pickers; scope="user" entries are informational.

MCP tool: `organization_permission_catalog`

**Parameters**

No parameters.

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| catalog | array | • | — |

### `POST` `/governance/api/v1/organizations/select`

Sets the active organization for the current session and returns the resolved active product. Session state: the switch also rewrites the session product selection — the current product survives only when it belongs to the new organization, otherwise the caller's first product in that organization is selected, or the selection is cleared when there is none.

MCP tool: `organization_select`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| organization | object | • | — |
| activeProductId | string | • | — |

### `GET` `/governance/api/v1/products`

Lists all products the current user has access to

MCP tool: `organization_product_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| organizationId | query | string | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| products | array | • | — |

### `POST` `/governance/api/v1/products`

Creates a new product with the given name

MCP tool: `organization_product_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| name | body | string | • | — |
| organizationId | body | string | — | — |
| region | body | string | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| role | string | • | — |
| slug | string | • | — |
| demoAt | string | • | — |
| status | string | • | — |
| logoUrl | string | • | — |
| blockedAt | string | • | — |
| createdAt | string | • | — |
| archivedAt | string | • | — |
| description | string | • | — |
| organizationId | string | • | — |

### `PATCH` `/governance/api/v1/products/:productId`

Updates an existing product's name and/or description

MCP tool: `organization_product_update`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| name | body | string | — | — |
| description | body | string | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| role | string | • | — |
| slug | string | • | — |
| demoAt | string | • | — |
| status | string | • | — |
| logoUrl | string | • | — |
| blockedAt | string | • | — |
| createdAt | string | • | — |
| archivedAt | string | • | — |
| description | string | • | — |
| organizationId | string | • | — |

### `GET` `/governance/api/v1/products/:productId/access`

Lists who can work in a product: the explicit grants and their roles, the organization owners and admins who inherit full access (read-only here), the organization members holding no access yet, and the organization's named roles a grant can be handed at. `canManage` states whether the caller may change any of it.

MCP tool: `organization_product_list-access`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| members | array | • | — |
| orgRoles | array | • | — |
| canManage | boolean | • | — |
| inherited | array | • | — |
| candidates | array | • | — |

### `DELETE` `/governance/api/v1/products/:productId/access/:userId`

Revokes a product grant from an organization member. Access inherited from an organization role is lifted in the organization, and the product owner is removed by transferring ownership.

MCP tool: `organization_product_revoke-access`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| userId | path | string | • | — |

### `PUT` `/governance/api/v1/products/:productId/access/:userId`

Grants an organization member access to a product, or changes the role they already hold, at a standard role (admin, member, viewer) or one of the organization's named roles. The target must already be an active member of the product's organization; owner is transfer-only, and access inherited from an organization role is changed in the organization.

MCP tool: `organization_product_set-access`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| userId | path | string | • | — |
| role | body | string | — | — |
| roleId | body | string | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| role | string | • | — |
| userId | string | • | — |
| productId | string | • | — |

### `GET` `/governance/api/v1/products/:productId/domains`

Lists the custom domains configured in a product

MCP tool: `organization_domains_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| domains | array | • | — |

### `POST` `/governance/api/v1/products/:productId/domains`

Adds a custom domain to a product. The domain always starts in external (self-managed DNS) mode; when the product has an active Cloudflare connector that can write DNS, the response carries a managedDns hint naming the connector and the tool that switches the domain to managed mode.

MCP tool: `organization_domains_add`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domain | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| mode | string | • | — |
| domain | string | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| productId | string | • | — |
| managedDns | object | • | — |
| providerConnectorId | string | • | — |

### `DELETE` `/governance/api/v1/products/:productId/domains/:domainId`

Removes a custom domain from a product

MCP tool: `organization_domains_remove`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domainId | path | string | • | — |

### `GET` `/governance/api/v1/products/:productId/domains/:domainId`

Gets a single custom domain in a product by id

MCP tool: `organization_domains_get`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domainId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| mode | string | • | — |
| domain | string | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| productId | string | • | — |
| providerConnectorId | string | • | — |

### `GET` `/governance/api/v1/products/:productId/domains/:domainId/bindings`

Lists the extension bindings attached to a domain in a product

MCP tool: `organization_bindings_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domainId | path | string | • | — |

### `PUT` `/governance/api/v1/products/:productId/domains/:domainId/mode`

Switches a custom domain between external (self-managed DNS) and managed mode. Managed mode requires providerConnectorId — the id of an active Cloudflare connector attached to the product — and hands the domain's records to the platform reconciler.

MCP tool: `organization_domains_set-mode`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| domainId | path | string | • | — |
| mode | body | string | • | — |
| providerConnectorId | body | string | — | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| mode | string | • | — |
| domain | string | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| productId | string | • | — |
| providerConnectorId | string | • | — |

### `GET` `/governance/api/v1/products/:productId/extensions`

Lists extensions available to the current product

MCP tool: `organization_extensions_list-installed`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| extensions | array | • | — |

### `GET` `/governance/api/v1/products/:productId/members`

Lists all active members of a product with their roles

MCP tool: `organization_product_list-members`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| members | array | • | — |

### `PUT` `/governance/api/v1/products/:productId/members/:memberId/role`

Assigns a role to a member of a product

MCP tool: `organization_members_assign-role`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| memberId | path | string | • | — |
| roleId | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| role | string | • | — |
| roleId | string | • | — |
| status | string | • | — |
| userId | string | • | — |
| agentId | string | • | — |
| joinedAt | string | • | — |
| expiresAt | string | • | — |
| invitedAt | string | • | — |
| invitedBy | string | • | — |
| productId | string | • | — |
| grantSource | string | • | — |
| permissions | object | • | — |

### `GET` `/governance/api/v1/products/:productId/public-keys`

Lists a product's public keys. Never returns key material.

MCP tool: `organization_public-keys_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| keys | array | • | — |

### `POST` `/governance/api/v1/products/:productId/public-keys`

Creates a public key for a product. The plaintext key is returned only in this response and cannot be retrieved again.

MCP tool: `organization_public-keys_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| name | body | string | • | — |
| scope | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| key | string | • | — |
| name | string | • | — |
| scope | string | • | — |
| imported | boolean | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| keyPrefix | string | • | — |
| revokedAt | string | • | — |

### `POST` `/governance/api/v1/products/:productId/public-keys/:id/revoke`

Revokes a public key. Idempotent; revocation is permanent.

MCP tool: `organization_public-keys_revoke`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| id | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| scope | string | • | — |
| imported | boolean | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| keyPrefix | string | • | — |
| revokedAt | string | • | — |

### `PUT` `/governance/api/v1/products/:productId/public-keys/:id/scope`

Replaces the scope of an active public key.

MCP tool: `organization_public-keys_update-scope`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |
| id | path | string | • | — |
| scope | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| scope | string | • | — |
| imported | boolean | • | — |
| createdAt | string | • | — |
| createdBy | string | • | — |
| keyPrefix | string | • | — |
| revokedAt | string | • | — |

### `GET` `/governance/api/v1/products/:productId/public-routes`

Lists the public routes declared by the product's toolkits, with each route's access mode and public URL.

MCP tool: `organization_public-routes_list`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| routes | array | • | — |

### `GET` `/governance/api/v1/products/:productId/roles`

Lists the roles assignable to a product member (system templates + product custom roles)

MCP tool: `organization_product_list-roles`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| roles | array | • | — |

### `POST` `/governance/api/v1/products/select`

Sets the active product for the current session and reconciles the active organization to that product's organization. Session state: the selection persists for the whole MCP session and every product-scoped tool call resolves against it until changed. Without an explicit selection the session resolves an active product implicitly, so results can belong to a product other than the intended one.

MCP tool: `organization_product_select`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| productId | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| name | string | • | — |
| slug | string | • | — |

### `GET` `/governance/api/v1/support/threads`

List the caller's own support threads, most recently updated first. Use when the user asks about their support requests or tickets.

MCP tool: `organization_support_threads_list`

**Parameters**

No parameters.

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| threads | array | • | — |

### `POST` `/governance/api/v1/support/threads`

Open a support thread on the caller's behalf — the body becomes the first message. Use when the user wants to contact Lessly support.

MCP tool: `organization_support_thread_create`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| title | body | string | • | — |
| body | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| title | string | • | — |
| status | string | • | — |
| category | string | • | — |
| messages | array | • | — |
| createdAt | string | • | — |
| lastMessageAt | string | • | — |
| lastMessagePreview | string | • | — |

### `GET` `/governance/api/v1/support/threads/:id`

Read one of the caller's own support threads with its full conversation. A thread that belongs to somebody else is reported as not found.

MCP tool: `organization_support_thread_get`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| title | string | • | — |
| status | string | • | — |
| category | string | • | — |
| messages | array | • | — |
| createdAt | string | • | — |
| lastMessageAt | string | • | — |
| lastMessagePreview | string | • | — |

### `POST` `/governance/api/v1/support/threads/:id/messages`

Reply in one of the caller's own support threads. A thread that belongs to somebody else is reported as not found.

MCP tool: `organization_support_thread_reply`

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| id | path | string | • | — |
| body | body | string | • | — |

**Response**

| Field | Type | Always | Description |
| --- | --- | --- | --- |
| id | string | • | — |
| title | string | • | — |
| status | string | • | — |
| category | string | • | — |
| messages | array | • | — |
| createdAt | string | • | — |
| lastMessageAt | string | • | — |
| lastMessagePreview | string | • | — |