---
title: "Give a bundle"
method: POST
path: "/client/mcp/grants"
tags: ["Tool gateway"]
---

# Give a bundle

`POST /client/mcp/grants`

## Request

- Base URL: `https://api.roar-ai.com`
- URL: `https://api.roar-ai.com/client/mcp/grants`
- Auth: HTTP bearer

Body `{"groupId", "projectId"}` or `{"groupId", "apiKeyId"}`, with `access` (default `ask`) and optionally `callLimit`. An owner or admin (or a key with `mcp:write`) may give to any project or key; a project manager to the projects they manage. A key can only narrow: `full` takes a signed-in owner or admin; so does giving tools that already reach the same agents through a bundle with a call limit, and giving tools that carry a limit anywhere without a `callLimit` at least as tight (403 for a key).

## Request body

- object
  - `groupId` string, uuid, required
  - `projectId` string, uuid
  - `apiKeyId` string, uuid
  - `access` 'read_only' | 'ask' | 'full': `read_only`: tools that change things are hidden. `ask`: each call to one waits for an owner or admin to approve it in the console. `full`: every tool runs. Where several grants serve one tool, the most permissive wins
  - `callLimit` McpCallLimit, nullable: At most `count` calls a minute or a day (UTC) through the grant. Null for no limit
    - `count` integer, required
    - `per` 'minute' | 'day', required

## Response `201`

The grant

- McpGrant
  - `id` string, uuid, required
  - `clientId` string, uuid, required
  - `groupId` string, uuid, required
  - `apiKeyId` string, uuid, nullable, required: Set for a grant to one key
  - `projectId` string, uuid, nullable, required: Set for a grant to every key in a project
  - `access` 'read_only' | 'ask' | 'full', required: `read_only`: tools that change things are hidden. `ask`: each call to one waits for an owner or admin to approve it in the console. `full`: every tool runs. Where several grants serve one tool, the most permissive wins
  - `callLimit` integer, nullable, required: At most this many calls through the grant per `callLimitPer`; null for no limit
  - `callLimitPer` 'minute' | 'day', nullable, required: A day is a UTC day
  - `callsToday` integer, nullable, required: Calls through the grant today (UTC), for a per-day limit only
  - `createdAt` string, date-time, required

## Other responses

- `403`: Not allowed to give bundles there
- `404`: No such bundle, project or key
- `409`: Already given

---

[API](https://skmtc.dev/roar-ai/apis/roar-ai-api.md) · [All operations](https://skmtc.dev/roar-ai/apis/roar-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/roar-ai/apis/roar-ai-api/revisions/37e4d0d5a7fe?raw)