> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin Provisioning MCP Server

> Let admins manage access with Opal using our Admin Provisioning MCP server.

Opal's admin provisioning MCP provides a set of tools that enables admins to use AI agents to manage user access in Opal. They can view user permissions and add or remove access to resources and groups. Use cases include:

* Generate an overview of a user's access across resources and groups
* Add or remove users from resources and groups
* Update user access levels and durations
* Manage group memberships

## Installation

<Info>
  **OAuth is the recommended way to connect.** The OAuth commands below sign you in to Opal in your browser — no stored secret. Find your Client ID under **User → Settings → OAuth Grants** (`app.opal.dev/user/settings/oauth-grants`); if your client asks for a resource or audience value, read it from this server's protected-resource metadata at `https://app.opal.dev/.well-known/oauth-protected-resource/mcp/admin-user-provisioning`. See [Authentication](/docs/mcp/overview#authentication) for details. To use an API token instead, [create one](/reference/authentication#using-the-api-with-personal-access-tokens) first.
</Info>

<Info>
  Self-hosted Opal deployments can host MCP servers as of version v1.1135.0. If
  you run self-hosted, remember to replace [https://app.opal.dev](https://app.opal.dev) with your own
  domain.
</Info>

<Tabs>
  <Tab title="Claude Code">
    **OAuth (recommended):** add the server with no `Authorization` header, then sign in.

    ```
    claude mcp add --transport http opal-admin-user-provisioning https://app.opal.dev/mcp/admin-user-provisioning
    ```

    ```
    claude mcp login opal-admin-user-provisioning
    ```

    Claude Code also prompts you to sign in the first time it calls a tool from this server. Check server status any time with `claude /mcp`.

    **API token:** pass the token as a header when you add the server.

    ```
    claude mcp add --transport http opal-admin-user-provisioning https://app.opal.dev/mcp/admin-user-provisioning --header "Authorization: Bearer ${OPAL_API_TOKEN}"
    ```

    To learn more, see Claude Code [documentation](https://code.claude.com/docs/en/mcp).
  </Tab>

  <Tab title="Cursor">
    **OAuth (recommended):** add the following to your `~/.cursor/mcp.json` file, with no `Authorization` header:

    ```
    {
      "mcpServers": {
        "opal-admin-user-provisioning": {
          "transport": "http",
          "url": "https://app.opal.dev/mcp/admin-user-provisioning"
        }
      }
    }
    ```

    Open **Cursor Settings → MCP**, and click **Needs login** next to the server to sign in through your browser.

    **API token:** add an `Authorization` header instead.

    ```
    {
      "mcpServers": {
        "opal-admin-user-provisioning": {
          "transport": "http",
          "url": "https://app.opal.dev/mcp/admin-user-provisioning",
          "headers": {
            "Authorization": "Bearer ${env:OPAL_API_TOKEN}"
          }
        }
      }
    }
    ```

    Define your `OPAL_API_TOKEN`, and make sure you open Cursor from the same shell.

    ```
    export OPAL_API_TOKEN="secret"
    ```

    ```
    open -a Cursor
    ```

    To learn more, see Cursor [documentation](https://cursor.com/docs/mcp).
  </Tab>

  <Tab title="Gemini CLI">
    **OAuth (recommended):** add the following to your `~/.gemini/settings.json`, with no `Authorization` header, then follow the sign-in prompt on first use:

    ```
    {
      "mcpServers": {
        "opal-admin-user-provisioning": {
          "httpUrl": "https://app.opal.dev/mcp/admin-user-provisioning"
        }
      }
    } 
    ```

    **API token:** add an `Authorization` header instead.

    ```
    {
      "mcpServers": {
        "opal-admin-user-provisioning": {
          "httpUrl": "https://app.opal.dev/mcp/admin-user-provisioning",
          "headers": {
            "Authorization": "Bearer ${OPAL_API_TOKEN}"
          }
        }
      }
    } 
    ```

    To learn more, see Gemini [documentation](https://geminicli.com/docs/tools/mcp-server/).
  </Tab>

  <Tab title="Other">
    MCP is an open protocol supported by many other clients, and your specific client documentation can advise you how to connect. Key inputs:

    * Transport `http`
    * Endpoint `https://app.opal.dev/mcp/admin-user-provisioning`
    * **OAuth (recommended):** omit the `Authorization` header — most clients discover Opal's OAuth support automatically and prompt you to sign in.
    * **API token:** add the header `Authorization: Bearer ${OPAL_API_TOKEN}`.
  </Tab>
</Tabs>

## Available Tools

| Tool | Description | |
| - | - | - |
| `opal_user` | Retrieves detailed user information from Opal. This endpoint is designed to fetch user details by either user ID (UUID) or email address. The endpoint follows a strict precedence rule where `user_id` takes priority. | |
| `opal_get_user_tags` | Returns all tags applied to the user. | |
| `opal_get_users` | Returns a list of users for your organization. | |
| `opal_update_resource_user` | Updates a user's access level or duration on this resource. | |
| `opal_delete_resource_user` | Removes a user's direct access from this resource. | |
| `opal_set_owner_users` | Sets the list of users for this owner. If escalation is enabled, the order of this list is the escalation priority order of the users. If the owner has a source group, adding or removing users from this list won't be possible. | |
| `opal_get_owner_users` | Gets the list of users for this owner, in escalation priority order if applicable. | |
| `opal_add_group_user` | Adds a user to this group. | |
| `opal_update_group_user` | Updates a user's access level or duration in this group. | |
| `opal_delete_group_user` | Removes a user's access from this group. | |
| `opal_get_group_users` | Gets the list of users for this group. | |
| `approve_request` | Approves a user's request. | |
| `deny_request` | Denies a user's request. | |

## Tool Parameters

<AccordionGroup>
  <Accordion title="opal_user">
    | Param | Type | Notes |
    | - | - | - |
    | `user_id` | string | UUID of the user |
    | `email` | string | Email address of the user |
  </Accordion>

  <Accordion title="opal_get_user_tags">
    | Param | Type | Notes |
    | - | - | - |
    | `user_id` | string | required. UUID of the user |
  </Accordion>

  <Accordion title="opal_get_users">
    | Param | Type | Notes |
    | - | - | - |
    | `cursor` | string | Opaque pagination cursor from a previous response |
    | `page_size` | integer | Maximum number of users to return (default 100) |
  </Accordion>

  <Accordion title="opal_update_resource_user">
    | Param | Type | Notes |
    | - | - | - |
    | `resource_id` | string | required. UUID of the resource |
    | `user_id` | string | required. UUID of the user |
    | `duration_minutes` | integer | Updated duration in minutes; must be greater than 0. Leave unset and set indefinite=true for permanent access |
    | `indefinite` | boolean | Set true to grant permanent (non-expiring) access instead of a timed duration |
    | `access_level_remote_id` | string | Updated remote ID of the access level |
  </Accordion>

  <Accordion title="opal_delete_resource_user">
    | Param | Type | Notes |
    | - | - | - |
    | `resource_id` | string | required. UUID of the resource |
    | `user_id` | string | required. UUID of the user to remove |
    | `access_level_remote_id` | string | Remote ID of the access level. If omitted default is assumed |
  </Accordion>

  <Accordion title="opal_set_owner_users">
    | Param | Type | Notes |
    | - | - | - |
    | `owner_id` | string | required. UUID of the owner |
    | `user_ids` | string\[] | required. List of user UUIDs to set as owner users |
  </Accordion>

  <Accordion title="opal_get_owner_users">
    | Param | Type | Notes |
    | - | - | - |
    | `owner_id` | string | required. UUID of the owner |
  </Accordion>

  <Accordion title="opal_add_group_user">
    | Param | Type | Notes |
    | - | - | - |
    | `group_id` | string | required. UUID of the group |
    | `user_id` | string | required. UUID of the user to add |
    | `duration_minutes` | integer | Duration of access in minutes; must be greater than 0. Leave unset and set indefinite=true for permanent access |
    | `indefinite` | boolean | Set true to grant permanent (non-expiring) access instead of a timed duration |
    | `access_level_remote_id` | string | Remote ID of the access level to grant |
  </Accordion>

  <Accordion title="opal_update_group_user">
    | Param | Type | Notes |
    | - | - | - |
    | `group_id` | string | required. UUID of the group |
    | `user_id` | string | required. UUID of the user |
    | `duration_minutes` | integer | Updated duration in minutes; must be greater than 0. Leave unset and set indefinite=true for permanent access |
    | `indefinite` | boolean | Set true to grant permanent (non-expiring) access instead of a timed duration |
    | `access_level_remote_id` | string | Updated remote ID of the access level |
  </Accordion>

  <Accordion title="opal_delete_group_user">
    | Param | Type | Notes |
    | - | - | - |
    | `group_id` | string | required. UUID of the group |
    | `user_id` | string | required. UUID of the user to remove |
    | `access_level_remote_id` | string | Remote ID of the access level. If omitted default is assumed |
  </Accordion>

  <Accordion title="opal_get_group_users">
    | Param | Type | Notes |
    | - | - | - |
    | `group_id` | string | required. UUID of the group |
  </Accordion>

  <Accordion title="approve_request">
    | Param | Type | Notes |
    | - | - | - |
    | `request_id` | string | required. UUID of the access request to approve |
    | `level` | string | Decision level for the approval. Either REGULAR (a normal reviewer approval) or ADMIN (an admin override approval). Defaults to REGULAR |
    | `comment` | string | Optional comment recorded with the approval. Required when level is ADMIN |
  </Accordion>

  <Accordion title="deny_request">
    | Param | Type | Notes |
    | - | - | - |
    | `request_id` | string | required. UUID of the access request to deny |
    | `level` | string | Decision level for the denial. Either REGULAR (a normal reviewer denial) or ADMIN (an admin override denial). Defaults to REGULAR |
    | `comment` | string | required. Comment explaining why the request is being denied |
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.