> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/human-access/open-api-and-mcp.md). # Open API & MCP - [Introduction](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/introduction.md): Learn what the Cakewalk Open API covers, its base URL and the API key headers required on every request. - [Getting Started](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/getting-started.md): Generate an API key, choose its access level and make your first request to the Cakewalk Open API. - [Authentication](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/authentication.md): Authenticate requests with X-API-KEY and X-API-SECRET headers and choose between read only and read and write API keys. - [Pagination](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/pagination.md): Cursor-Based pagination explained, JSON:API Style. - [Rate Limits](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/rate-limits.md): The Cakewalk API enforces rate limits of 1,000 requests per minute to ensure fair usage and system stability. - [API reference](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference.md): Index of Cakewalk Open API endpoint groups: users, user groups, applications, requests, tasks, policies and access reviews. - [Users](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/users.md): Endpoints for listing users known to Cakewalk and reading a user's app accounts and access details. - [GET /users](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/users/get-users.md): List the users known to Cakewalk with metadata such as email, department and job title, with filtering and pagination. - [GET /users/{id}](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/users/get-users-id.md): Retrieve detailed metadata for a single user by ID, including linked app accounts and access insights. - [User Groups](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/user-groups.md): Endpoints for listing user groups, reading members and default or hidden apps and managing group membership. - [GET /UsersGroups/](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/user-groups/get-usersgroups.md): List all user groups with metadata such as name, external ID and sync source. - [GET /UsersGroups/{usersGroupId}](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/user-groups/get-usersgroups-usersgroupid.md): Retrieve metadata for a single user group by ID, including its name and integration source. - [GET /UsersGroups/{usersGroupId}/DefaultWorkApps](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/user-groups/get-usersgroups-usersgroupid-defaultworkapps.md): List the work apps assigned to users by default through membership in the specified group. - [GET /UsersGroups/{usersGroupId}/HiddenWorkApps](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/user-groups/get-usersgroups-usersgroupid-hiddenworkapps.md): List the work apps associated with the specified group but hidden from end-user views. - [GET /UsersGroups/{usersGroupId}/Users](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/user-groups/get-usersgroups-usersgroupid-users.md): List the users who are members of the specified user group. - [POST /UsersGroups/{usersGroupId}/Users](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/user-groups/post-usersgroups-usersgroupid-users.md): Add one or more users to the specified user group. - [DELETE /UsersGroups/{usersGroupId}/Users/DeleteWithPost](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/user-groups/delete-usersgroups-usersgroupid-users-deletewithpost.md): Remove users from the specified user group using the POST-based DeleteWithPost endpoint. - [Applications](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications.md): Endpoints for listing work apps, reading accesses, permission levels and custom fields and updating access policies. - [GET /WorkApps](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications/get-workapps.md): List all work apps visible to Cakewalk, including metadata such as name, source and sync status. - [GET /WorkApps/{workAppId}](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications/get-workapps-workappid.md): Retrieve detailed metadata for a single work app, including its status, source system and settings. - [GET /WorkApps/{workAppId}/Accesses](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications/get-workapps-workappid-accesses.md): List user-level access records for a work app, including user IDs and assigned permission levels. - [GET /WorkApps/{workAppId}/PermissionLevels](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications/get-workapps-workappid-permissionlevels.md): List the permission levels defined for a work app, such as Viewer, Editor or Admin. - [POST /WorkApps/Accesses](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications/post-workapps-accesses.md): Bulk create or update user access records to grant or sync app access programmatically. - [PUT /WorkApps/{workAppId}/Policies/{requestType}](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications/put-workapps-workappid-policies-requesttype.md): Update the app-wide policy that governs a specific request type, such as grant or remove access. - [PUT /WorkApps/{workAppId}/PermissionLevels/{permissionLevelId}/Policies/{requestType}](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications/put-workapps-workappid-permissionlevels-permissionlevelid-policies-requesttype.md): Update the policy for a specific permission level within an app for a given request type. - [GET /WorkApps/{workAppId}/CustomFields](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications/get-workapps-workappid-customfields.md): Read the custom field values set on a specific work app. - [PATCH /WorkApps/{workAppId}/CustomFields](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/applications/patch-workapps-workappid-customfields.md): Bulk update the custom field values on a specific work app. - [Requests](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/requests.md): Endpoints for listing access requests and creating grant, change permission and remove access requests. - [GET /Requests](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/requests/get-requests.md): List access requests with pagination, optionally filtered by status, type and last-updated time. - [POST /Requests/GrantAccess](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/requests/post-requests-grantaccess.md): Create a grant access request for a user or group, routed through the configured approval workflow. - [POST /Requests/RemoveAccess](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/requests/post-requests-removeaccess.md): Create a request to revoke a user's or group's access to an app. - [POST /Requests/ChangePermission](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/requests/post-requests-changepermission.md): Create a request to change a user's existing permission level on an app. - [Tasks](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/tasks.md): Endpoints for reading workflow tasks and approving or declining them programmatically. - [GET /Tasks?userId={userId}](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/tasks/get-tasks-userid-userid.md): List the tasks assigned to a user with pagination, optionally filtered by task status. - [GET /Tasks/{taskId}](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/tasks/get-tasks-taskid.md): Retrieve details for a specific task, including its status, type, target and metadata. - [POST /Tasks/{taskId}/Approve](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/tasks/post-tasks-taskid-approve.md): Approve the specified task, typically an access request or entitlement review step. - [POST /Tasks/{taskId}/Decline](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/tasks/post-tasks-taskid-decline.md): Decline the specified task, optionally including a reason for the rejection. - [Policies](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/policies.md): Endpoint for listing the access request policy templates compatible with a given request type. - [GET /Policies/CompatiblePolicies/{requestType}](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/policies/get-policies-compatiblepolicies-requesttype.md): List the access request policy templates compatible with the specified request type. - [Access Reviews](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/access-reviews.md): Endpoint for creating access review campaigns with a defined scope, assignees and completion deadline. - [POST /AccessReviews](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference/access-reviews/access-reviews.md): Use Cakewalk's Access Reviews to streamline access control for apps. Replace spreadsheets with structured campaigns, dashboards and audit trails. - [MCP](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/introduction-to-mcp.md): Connect AI assistants like Claude Desktop, Cursor and ChatGPT directly to your Cakewalk workspace using the Model Context Protocol (MCP). - [Connect an MCP Client](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/introduction-to-mcp/connect-an-mcp-client.md): Step by step instructions to connect Claude, Cursor, ChatGPT, Codex or any MCP client to Cakewalk's MCP server. - [MCP Tool Reference](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/introduction-to-mcp/mcp-tool-reference.md): Complete reference for all tools available through Cakewalk's MCP server, including required scopes and parameters. - [Webhooks](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/webhooks.md): Register a webhook to receive Cakewalk events and handle the test and action\_task.actionable payloads. - [Webhook's signature verification](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/webhooks/webhooks-signature-verification.md): Verify the X-SIGNATURE header on each webhook payload with Cakewalk's public key before trusting the request. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.cakewalk.security/docs/human-access/open-api-and-mcp.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.