---
title: "Replace server-side entity access policy"
method: POST
path: "/api/mcp/tools/set_entity_policy"
tags: ["tools"]
---

# Replace server-side entity access policy

`POST /api/mcp/tools/set_entity_policy`

## Request

- Base URL: `https://finestructure.ai`
- URL: `https://finestructure.ai/api/mcp/tools/set_entity_policy`
- Auth: HTTP bearer

Replace server-side entity access policy. Optional action rules override read/write roles and can allow public create without public read, update, or delete. Omitting rules replaces any existing action rules with read/write role behavior.

## Request body

- object
  - `app_id` string, required: The app ID
  - `entity` string, required: Entity name, e.g. Booking
  - `read` string[], required: Roles allowed to read when rules are omitted
  - `write` string[], required: Roles allowed to write when rules are omitted
  - `rules` object: Nonempty unconditional action/role rules. No matching rule denies access. Include owner/admin actions explicitly. Record conditions are not supported by this MCP input.
    - `version` 1
    - `rules` object[], required
      - `id` string
      - `name` string
      - `description` string
      - `actions` string[], required
      - `subject` object, required
        - `roles` string[], required

## Response `200`

Tool executed successfully

- ToolResult
  - `ok` boolean, required
  - `tool` string, required
  - `result` object, required

## Other responses

- `400`: Invalid arguments for this tool
- `401`: Missing or invalid bearer token
- `402`: Not enough credits on the account
- `403`: Token scope does not permit this tool
- `404`: Unknown tool name
- `429`: Rate limit exceeded, retry after the indicated delay
- `500`: Internal error while executing the tool

---

[API](https://skmtc.dev/finestructure/apis/fine-structure-api.md) · [All operations](https://skmtc.dev/finestructure/apis/fine-structure-api/llms.txt) · [OpenAPI document](https://skmtc.dev/finestructure/apis/fine-structure-api/revisions/02c50ed5fd70?raw)