---
title: "Change what a grant allows"
method: PATCH
path: "/client/mcp/grants/{id}"
tags: ["Tool gateway"]
---

# Change what a grant allows

`PATCH /client/mcp/grants/{id}`

## Request

- Base URL: `https://api.roar-ai.com`
- URL: `https://api.roar-ai.com/client/mcp/grants/{id}`
- Auth: HTTP bearer

Body `{"access":"read_only"|"ask"|"full"}` and/or `{"callLimit":{"count":100,"per":"day"}|null}`. Its agents get the new setting on their next call; a call over the limit is refused with a tool error saying when it resets. Same rule as giving a bundle. A key can only narrow: `full`, and removing or raising a limit, take a signed-in owner or admin (403 for a key).

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `access` 'read_only' | 'ask' | 'full': `read_only`: tools that change things are hidden. `ask`: each call to one waits for an owner or admin to approve it in the console. `full`: every tool runs. Where several grants serve one tool, the most permissive wins
  - `callLimit` McpCallLimit, nullable: At most `count` calls a minute or a day (UTC) through the grant. Null for no limit
    - `count` integer, required
    - `per` 'minute' | 'day', required

## Response `200`

The grant

- McpGrant
  - `id` string, uuid, required
  - `clientId` string, uuid, required
  - `groupId` string, uuid, required
  - `apiKeyId` string, uuid, nullable, required: Set for a grant to one key
  - `projectId` string, uuid, nullable, required: Set for a grant to every key in a project
  - `access` 'read_only' | 'ask' | 'full', required: `read_only`: tools that change things are hidden. `ask`: each call to one waits for an owner or admin to approve it in the console. `full`: every tool runs. Where several grants serve one tool, the most permissive wins
  - `callLimit` integer, nullable, required: At most this many calls through the grant per `callLimitPer`; null for no limit
  - `callLimitPer` 'minute' | 'day', nullable, required: A day is a UTC day
  - `callsToday` integer, nullable, required: Calls through the grant today (UTC), for a per-day limit only
  - `createdAt` string, date-time, required

## Other responses

- `403`: Not allowed to change that grant
- `404`: No such grant

---

[API](https://skmtc.dev/roar-ai/apis/roar-ai-api.md) · [All operations](https://skmtc.dev/roar-ai/apis/roar-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/roar-ai/apis/roar-ai-api/revisions/37e4d0d5a7fe?raw)