Lets members of your organization use the shortcut, and stops letting others, in one call. It does not give access to the workflow behind it; share the workflow for that. To open it to the whole organization instead, set visibility to org with Update Shortcut.

Only the shortcut's creator can do this. You, and people in add who already have it, are reported in data.skipped; data.failed lists shares that could not be saved, so retry those. People in remove who did not have it are ignored. Read the current list from Get Shortcut (shared_users).

Check what removed people keep. They can still use the shortcut while it is visible to the whole organization (data.organization_access_remains) or while they can edit its workflow (data.workflow_edit_access_remains lists them). To fully revoke, also set visibility to private or unshare the workflow.

A refusal changes nothing; its code says why, and emails lists any refused addresses.

{
  "add": [
    "sam@acme.com"
  ],
  "remove": [
    "kim@acme.com"
  ]
}