Deny or restore enterprise-managed MCP client access

curl --request PUT \
  --url https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Notion-Version: <notion-version>' \
  --data '
{
  "user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
'

import requests

url = "https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access"

payload = {
    "user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
headers = {
    "Notion-Version": "<notion-version>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {
    'Notion-Version': '<notion-version>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    user_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    workspace_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a'
  })
};

fetch('https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'user_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    'workspace_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "Notion-Version: <notion-version>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access"

	payload := strings.NewReader("{\n  \"user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"workspace_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Notion-Version", "<notion-version>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access")
  .header("Notion-Version", "<notion-version>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"workspace_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Notion-Version"] = '<notion-version>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"workspace_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}"

response = http.request(request)
puts response.read_body

{
  "access": "allowed",
  "revoked_token_count": 123
}

{
  "type": "error",
  "code": "validation_error",
  "status": 400,
  "message": "The request body is invalid."
}

{
  "type": "error",
  "code": "unauthorized",
  "status": 401,
  "message": "Unauthorized."
}

{
  "type": "error",
  "code": "forbidden",
  "status": 403,
  "message": "Forbidden."
}

{
  "type": "error",
  "code": "not_found",
  "status": 404,
  "message": "Not found."
}

{
  "type": "error",
  "code": "rate_limited",
  "status": 429,
  "message": "Rate limited."
}

{
  "type": "error",
  "code": "internal_server_error",
  "status": 500,
  "message": "An unexpected error occurred."
}

PUT

mcp_client_connections

enterprise_managed_access

Deny or restore enterprise-managed MCP client access

curl --request PUT \
  --url https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Notion-Version: <notion-version>' \
  --data '
{
  "user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
'

import requests

url = "https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access"

payload = {
    "user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
headers = {
    "Notion-Version": "<notion-version>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {
    'Notion-Version': '<notion-version>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    user_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    workspace_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a'
  })
};

fetch('https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'user_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    'workspace_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "Notion-Version: <notion-version>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access"

	payload := strings.NewReader("{\n  \"user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"workspace_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Notion-Version", "<notion-version>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access")
  .header("Notion-Version", "<notion-version>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"workspace_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.notion.com/admin/v1/mcp_client_connections/enterprise_managed_access")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Notion-Version"] = '<notion-version>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"workspace_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}"

response = http.request(request)
puts response.read_body

{
  "access": "allowed",
  "revoked_token_count": 123
}

{
  "type": "error",
  "code": "validation_error",
  "status": 400,
  "message": "The request body is invalid."
}

{
  "type": "error",
  "code": "unauthorized",
  "status": 401,
  "message": "Unauthorized."
}

{
  "type": "error",
  "code": "forbidden",
  "status": 403,
  "message": "Forbidden."
}

{
  "type": "error",
  "code": "not_found",
  "status": 404,
  "message": "Not found."
}

{
  "type": "error",
  "code": "rate_limited",
  "status": 429,
  "message": "Rate limited."
}

{
  "type": "error",
  "code": "internal_server_error",
  "status": 500,
  "message": "An unexpected error occurred."
}

The organization bot token must have the following scopes:

mcp-client-connection:write-high-impact

Use this endpoint only for enterprise-managed connections. It controls one member’s enterprise-managed MCP access in one workspace. It does not apply to MCP client connections that members authorize themselves. Set access to denied to block future connections and revoke the member’s current tokens. Set it to allowed to remove the block. You can repeat the same request safely. Repeating a deny keeps access blocked and revokes any new tokens. Repeating a restore keeps access allowed. You can restore access only when enterprise-managed connections are available for the workspace. The workspace and member must belong to the organization that owns the token. The endpoint returns the same not-found response for invalid targets and targets outside the organization.

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

Notion-Version

enum<string>

required

The Admin API version to use for this request.

Available options:

2026-06-01

Body

application/json

access

enum<string>

required

'denied' blocks access; 'allowed' restores access.

Available options:

allowed,

denied

user_id

string<uuid>

required

workspace_id

string<uuid>

required

Response

access

enum<string>

required

Access state applied to the member.

Available options:

allowed,

denied

revoked_token_count

number

required

Number of active tokens revoked. Always zero when restoring access.

⌘I