Admin Provisioning MCP Server

Opal’s admin provisioning MCP provides a set of tools that enables admins to use AI agents to manage user access in Opal. They can view user permissions and add or remove access to resources and groups. Use cases include:

Generate an overview of a user’s access across resources and groups
Add or remove users from resources and groups
Update user access levels and durations
Manage group memberships

Installation

OAuth is the recommended way to connect. The OAuth commands below sign you in to Opal in your browser — no stored secret. Find your Client ID under User → Settings → OAuth Grants (app.opal.dev/user/settings/oauth-grants); if your client asks for a resource or audience value, read it from this server’s protected-resource metadata at https://app.opal.dev/.well-known/oauth-protected-resource/mcp/admin-user-provisioning. See Authentication for details. To use an API token instead, create one first.

Self-hosted Opal deployments can host MCP servers as of version v1.1135.0. If you run self-hosted, remember to replace https://app.opal.dev with your own domain.

Claude Code
Cursor
Gemini CLI
Other

OAuth (recommended): add the server with no Authorization header, then sign in.

claude mcp add --transport http opal-admin-user-provisioning https://app.opal.dev/mcp/admin-user-provisioning

claude mcp login opal-admin-user-provisioning

Claude Code also prompts you to sign in the first time it calls a tool from this server. Check server status any time with claude /mcp.API token: pass the token as a header when you add the server.

claude mcp add --transport http opal-admin-user-provisioning https://app.opal.dev/mcp/admin-user-provisioning --header "Authorization: Bearer ${OPAL_API_TOKEN}"

To learn more, see Claude Code documentation.

OAuth (recommended): add the following to your ~/.cursor/mcp.json file, with no Authorization header:

{
  "mcpServers": {
    "opal-admin-user-provisioning": {
      "transport": "http",
      "url": "https://app.opal.dev/mcp/admin-user-provisioning"
    }
  }
}

Open Cursor Settings → MCP, and click Needs login next to the server to sign in through your browser.API token: add an Authorization header instead.

{
  "mcpServers": {
    "opal-admin-user-provisioning": {
      "transport": "http",
      "url": "https://app.opal.dev/mcp/admin-user-provisioning",
      "headers": {
        "Authorization": "Bearer ${env:OPAL_API_TOKEN}"
      }
    }
  }
}

Define your OPAL_API_TOKEN, and make sure you open Cursor from the same shell.

export OPAL_API_TOKEN="secret"

open -a Cursor

To learn more, see Cursor documentation.

OAuth (recommended): add the following to your ~/.gemini/settings.json, with no Authorization header, then follow the sign-in prompt on first use:

{
  "mcpServers": {
    "opal-admin-user-provisioning": {
      "httpUrl": "https://app.opal.dev/mcp/admin-user-provisioning"
    }
  }
} 

API token: add an Authorization header instead.

{
  "mcpServers": {
    "opal-admin-user-provisioning": {
      "httpUrl": "https://app.opal.dev/mcp/admin-user-provisioning",
      "headers": {
        "Authorization": "Bearer ${OPAL_API_TOKEN}"
      }
    }
  }
} 

To learn more, see Gemini documentation.

MCP is an open protocol supported by many other clients, and your specific client documentation can advise you how to connect. Key inputs:

Transport http
Endpoint https://app.opal.dev/mcp/admin-user-provisioning
OAuth (recommended): omit the Authorization header — most clients discover Opal’s OAuth support automatically and prompt you to sign in.
API token: add the header Authorization: Bearer ${OPAL_API_TOKEN}.

Available Tools

Tool	Description
`opal_user`	Retrieves detailed user information from Opal. This endpoint is designed to fetch user details by either user ID (UUID) or email address. The endpoint follows a strict precedence rule where `user_id` takes priority.
`opal_get_user_tags`	Returns all tags applied to the user.
`opal_get_users`	Returns a list of users for your organization.
`opal_update_resource_user`	Updates a user’s access level or duration on this resource.
`opal_delete_resource_user`	Removes a user’s direct access from this resource.
`opal_set_owner_users`	Sets the list of users for this owner. If escalation is enabled, the order of this list is the escalation priority order of the users. If the owner has a source group, adding or removing users from this list won’t be possible.
`opal_get_owner_users`	Gets the list of users for this owner, in escalation priority order if applicable.
`opal_add_group_user`	Adds a user to this group.
`opal_update_group_user`	Updates a user’s access level or duration in this group.
`opal_delete_group_user`	Removes a user’s access from this group.
`opal_get_group_users`	Gets the list of users for this group.
`approve_request`	Approves a user’s request.
`deny_request`	Denies a user’s request.

Tool Parameters

opal_user

Param	Type	Notes
`user_id`	string	UUID of the user
`email`	string	Email address of the user

opal_get_user_tags

Param	Type	Notes
`user_id`	string	required. UUID of the user

opal_get_users

Param	Type	Notes
`cursor`	string	Opaque pagination cursor from a previous response
`page_size`	integer	Maximum number of users to return (default 100)

opal_update_resource_user

Param	Type	Notes
`resource_id`	string	required. UUID of the resource
`user_id`	string	required. UUID of the user
`duration_minutes`	integer	Updated duration in minutes; must be greater than 0. Leave unset and set indefinite=true for permanent access
`indefinite`	boolean	Set true to grant permanent (non-expiring) access instead of a timed duration
`access_level_remote_id`	string	Updated remote ID of the access level

opal_delete_resource_user

Param	Type	Notes
`resource_id`	string	required. UUID of the resource
`user_id`	string	required. UUID of the user to remove
`access_level_remote_id`	string	Remote ID of the access level. If omitted default is assumed

opal_set_owner_users

Param	Type	Notes
`owner_id`	string	required. UUID of the owner
`user_ids`	string[]	required. List of user UUIDs to set as owner users

opal_get_owner_users

Param	Type	Notes
`owner_id`	string	required. UUID of the owner

opal_add_group_user

Param	Type	Notes
`group_id`	string	required. UUID of the group
`user_id`	string	required. UUID of the user to add
`duration_minutes`	integer	Duration of access in minutes; must be greater than 0. Leave unset and set indefinite=true for permanent access
`indefinite`	boolean	Set true to grant permanent (non-expiring) access instead of a timed duration
`access_level_remote_id`	string	Remote ID of the access level to grant

opal_update_group_user

Param	Type	Notes
`group_id`	string	required. UUID of the group
`user_id`	string	required. UUID of the user
`duration_minutes`	integer	Updated duration in minutes; must be greater than 0. Leave unset and set indefinite=true for permanent access
`indefinite`	boolean	Set true to grant permanent (non-expiring) access instead of a timed duration
`access_level_remote_id`	string	Updated remote ID of the access level

opal_delete_group_user

Param	Type	Notes
`group_id`	string	required. UUID of the group
`user_id`	string	required. UUID of the user to remove
`access_level_remote_id`	string	Remote ID of the access level. If omitted default is assumed

opal_get_group_users

Param	Type	Notes
`group_id`	string	required. UUID of the group

approve_request

Param	Type	Notes
`request_id`	string	required. UUID of the access request to approve
`level`	string	Decision level for the approval. Either REGULAR (a normal reviewer approval) or ADMIN (an admin override approval). Defaults to REGULAR
`comment`	string	Optional comment recorded with the approval. Required when level is ADMIN

deny_request

Param	Type	Notes
`request_id`	string	required. UUID of the access request to deny
`level`	string	Decision level for the denial. Either REGULAR (a normal reviewer denial) or ADMIN (an admin override denial). Defaults to REGULAR
`comment`	string	required. Comment explaining why the request is being denied

Welcome

End user

Getting Started

Access Management

AI Agent Governance

OpalScript

Paladin

OpalQuery

Auditing and Security

Custom Integrations

For Developers

Installation

Available Tools

Tool Parameters

​Installation

​Available Tools

​Tool Parameters

Installation

Available Tools

Tool Parameters