put_v1_channels_allowlist

Edits the caller org's access policy for one channel and answers the policy as GET would, so both verbs return ONE shape. It requires ORG ADMIN.

Edits the caller org's access policy for one channel and answers the policy as GET would, so both verbs return ONE shape. It requires ORG ADMIN. Every field but channel is optional and applied only when provided: an empty policy string leaves that policy alone, an absent or null list leaves that list alone, and an EMPTY list clears it. It writes only CONFIG-sourced allow entries — senders approved through pairing belong to the approval flow, so a policy edit can never revoke one. An unknown channel is a 404.


Tool	`put_v1_channels_allowlist`
Door	`https://api.hanzo.ai/v1/mcp`
Method	`tools/call` (JSON-RPC 2.0)
Arguments	6
Operation	`PUT /v1/channels/allowlist`
Product	channels

Arguments

Field	Type	Required	Default	Values	Description
`accessGroups`	`object`	—	—	—	AccessGroups REPLACES the org's named access groups, as group name -> channel -> entries. Absent or null leaves them alone.
`channel`	`string`	—	—	—	Channel is the transport to edit: discord, slack, teams or telegram. Required; an unknown value is a 404.
`dm`	`string[]`	—	—	—	DM REPLACES the config-managed DM allow entries. Absent or null leaves them alone; an empty list clears them. It never touches senders approved through pairing — a policy edit cannot revoke an approved pairing.
`dmPolicy`	`string`	—	—	—	DMPolicy sets how direct messages are admitted: "pairing" (a person must be approved first), "allowlist" (only listed senders) or "open". Empty leaves it unchanged.
`group`	`string[]`	—	—	—	Group REPLACES the config-managed group allow entries. Absent or null leaves them alone; an empty list clears them.
`groupPolicy`	`string`	—	—	—	GroupPolicy sets how group and thread rooms are admitted: "open", "allowlist" or "disabled". Empty leaves it unchanged.

tools/list declares a type and a description for each field and nothing further. A — means neither the door nor that operation constrains the field.

Call it

A tools/call carries every argument in one flat object — nothing binds to a path or a query string. Nothing above is required, so every declared argument is shown rather than a guess at which matter.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "put_v1_channels_allowlist",
         "arguments": {
           "accessGroups": {},
           "channel": "<channel>",
           "dm": [
             "<dm>"
           ],
           "dmPolicy": "<dmPolicy>",
           "group": [
             "<group>"
           ],
           "groupPolicy": "<groupPolicy>"
         }
       }
     }'

Values are the operation's own defaults and enumerated values where it declares them, and a <placeholder> where neither source declares one. tools/list needs no credential; tools/call does — called without one the door answers HTTP 200 with a JSON-RPC result whose isError is set and whose text says what was missing. How to get a key →

The operation behind it

Operation	Route	Product	Summary
`cloud_put_v1_channels_allowlist`	`PUT /v1/channels/allowlist`	channels	Edits the caller org's access policy for one channel and answers the policy as GET would,…

The same capability over plain HTTP is in the channels API reference, on https://api.hanzo.ai.

All 833 tools · The door · API reference

Generated from tools/list on https://api.hanzo.ai/v1/mcp — 833 tools captured 2026-08-01 (this build read the vendored copy; the door was unreachable).

put_v1_channels_allowlist

Arguments

Call it

The operation behind it

On this page