# access — gitlab

> 48 actions
> This page as plain markdown. Index: https://mcp.jmrp.io/llms.txt

Canonical: https://mcp.jmrp.io/servers/gitlab/actions/access/
Language: en
Alternate: https://mcp.jmrp.io/es/servers/gitlab/actions/access/index.md
Updated: 2026-09-11T09:56:41+02:00
License: https://mcp.jmrp.io/license/

Counted with a Free-tier token against gitlab.com, which is the only host this endpoint talks to: to use it against a self-managed instance, run the server yourself — its documentation covers that. The catalog is scoped to the token that asks, so the count moves with both its tier and its permissions: higher tiers expose more actions, and administration domains only appear to tokens allowed to use them. That is why the figures differ elsewhere: the upstream project catalogues 1,006 actions across 162 domains, and 851 on the Free/CE surface, while this deployment publishes 747 because it is OAuth-only and acts with your token, so the administration domains a non-admin account cannot call never appear. All three describe the same catalog, counted from three vantage points.

## Actions

### `access.approve_group` — Access Request Approve Group

Approve a pending group access request, granting the user membership. Returns: the approved access request with id, username, name, granted access level, and approved state. See also: access.request_list_group, access.deny_group, group.members.

**Required parameters:** `group_id (string)`, `user_id (integer)`

### `access.approve_project` — Access Request Approve Project

Approve a pending project access request, granting the user membership. Returns: the approved access request with id, username, name, granted access level, and approved state. See also: access.request_list_project, access.deny_project, project.members.

**Required parameters:** `project_id (string)`, `user_id (integer)`

### `access.deny_group` — Access Request Deny Group

_destructive_

Deny a pending group access request, removing it without granting membership. Returns: a success status and confirmation message. See also: access.request_list_group, access.approve_group, group.members.

**Required parameters:** `group_id (string)`, `user_id (integer)`

### `access.deny_project` — Access Request Deny Project

_destructive_

Deny a pending project access request, removing it without granting membership. Returns: a success status and confirmation message. See also: access.request_list_project, access.approve_project, project.members.

**Required parameters:** `project_id (string)`, `user_id (integer)`

### `access.deploy_key_add` — Deploy Key Add

Add a new SSH deploy key to a project. Returns: the created deploy key with id, title, fingerprint, can_push, and expiry. See also: access.deploy_key_get, access.deploy_key_list_project, access.deploy_key_enable.

**Required parameters:** `key (string)`, `project_id (string)`, `title (string)`

### `access.deploy_key_add_instance` — Deploy Key Add Instance

Create an instance-level deploy key (admin only). Returns: the created instance deploy key with id, title, fingerprint, expiry, and project access arrays. See also: access.deploy_key_list_all, access.deploy_key_enable.

**Required parameters:** `key (string)`, `title (string)`

### `access.deploy_key_delete` — Deploy Key Delete

_destructive_

Delete a deploy key from a project (removes it from all projects where it is enabled). Returns: a success confirmation. See also: access.deploy_key_get, access.deploy_key_list_project.

**Required parameters:** `deploy_key_id (integer)`, `project_id (string)`

### `access.deploy_key_enable` — Deploy Key Enable

Enable an existing deploy key for a project. Returns: the enabled deploy key with id, title, fingerprint, and can_push. See also: access.deploy_key_list_all, access.deploy_key_list_project, access.deploy_key_get.

**Required parameters:** `deploy_key_id (integer)`, `project_id (string)`

### `access.deploy_key_get` — Deploy Key Get

_read-only_

Get a single project deploy key by id. Returns: the deploy key with title, key, fingerprint, fingerprint_sha256, can_push, created_at, and expires_at. See also: access.deploy_key_list_project, access.deploy_key_update, access.deploy_key_delete.

**Required parameters:** `deploy_key_id (integer)`, `project_id (string)`

### `access.deploy_key_list_all` — Deploy Key List All

_read-only_

List ALL instance-level SSH deploy keys in one call (admin only). Use this instead of gitlab_deploy_key_list_project when you need every key on the instance. Returns: instance deploy keys with id, title, fingerprint, expiry, projects_with_write_access, projects_with_readonly_access, and pagination metadata. See also: access.deploy_key_add_instance, access.deploy_key_enable, access.deploy_key_list_project.

### `access.deploy_key_list_project` — Deploy Key List Project

_read-only_

List a project's SSH deploy keys with ordering and pagination. Returns: deploy keys with id, title, fingerprint, can_push, expiry, and pagination metadata. See also: access.deploy_key_get, access.deploy_key_add, access.deploy_key_enable.

**Required parameters:** `project_id (string)`

### `access.deploy_key_list_user_project` — Deploy Key List User Project

_read-only_

List the deploy keys across a user's projects (admin only) with ordering and pagination. Returns: deploy keys with id, title, fingerprint, can_push, expiry, and pagination metadata. See also: access.deploy_key_list_project, access.deploy_key_get, user.get.

**Required parameters:** `user_id (string)`

### `access.deploy_key_update` — Deploy Key Update

Update a project deploy key's title or push permission. Returns: the updated deploy key. See also: access.deploy_key_get, access.deploy_key_list_project, access.deploy_key_delete.

**Required parameters:** `deploy_key_id (integer)`, `project_id (string)`

### `access.deploy_token_create_group` — Deploy Token Create Group

Create a deploy token for a group. Returns: the created deploy token including its one-time secret token value, plus id, name, username, scopes, and expiry. See also: access.deploy_token_list_group, access.deploy_token_get_group, access.deploy_token_delete_group.

**Required parameters:** `group_id (string)`, `name (string)`

### `access.deploy_token_create_project` — Deploy Token Create Project

Create a deploy token for a project. Returns: the created deploy token including its one-time secret token value, plus id, name, username, scopes, and expiry. See also: access.deploy_token_list_project, access.deploy_token_get_project, access.deploy_token_delete_project.

**Required parameters:** `name (string)`, `project_id (string)`

### `access.deploy_token_delete_group` — Deploy Token Delete Group

_destructive_

Permanently delete a group deploy token by ID. Returns: a success confirmation. Deletion is irreversible. See also: access.deploy_token_list_group, access.deploy_token_get_group, access.deploy_token_create_group.

**Required parameters:** `deploy_token_id (integer)`, `group_id (string)`

### `access.deploy_token_delete_project` — Deploy Token Delete Project

_destructive_

Permanently delete a project deploy token by ID. Returns: a success confirmation. Deletion is irreversible. See also: access.deploy_token_list_project, access.deploy_token_get_project, access.deploy_token_create_project.

**Required parameters:** `deploy_token_id (integer)`, `project_id (string)`

### `access.deploy_token_get_group` — Deploy Token Get Group

_read-only_

Get a single group deploy token by ID. Returns: the deploy token with id, name, username, scopes, revoked/expired state, and expiry. See also: access.deploy_token_list_group, access.deploy_token_create_group, access.deploy_token_delete_group.

**Required parameters:** `deploy_token_id (integer)`, `group_id (string)`

### `access.deploy_token_get_project` — Deploy Token Get Project

_read-only_

Get a single project deploy token by ID. Returns: the deploy token with id, name, username, scopes, revoked/expired state, and expiry. See also: access.deploy_token_list_project, access.deploy_token_create_project, access.deploy_token_delete_project.

**Required parameters:** `deploy_token_id (integer)`, `project_id (string)`

### `access.deploy_token_list_all` — Deploy Token List All

_read-only_

List ALL deploy tokens across the GitLab instance in one call (admin only). Use this instead of gitlab_deploy_token_list_project or gitlab_deploy_token_list_group when you need every instance-wide token. Returns: deploy tokens with id, name, username, scopes, revoked/expired state, and pagination metadata. See also: access.deploy_token_list_project, access.deploy_token_list_group, access.deploy_token_create_project.

### `access.deploy_token_list_group` — Deploy Token List Group

_read-only_

List deploy tokens owned by a group. Returns: deploy tokens with id, name, username, scopes, revoked/expired state, expiry, and pagination metadata. See also: access.deploy_token_get_group, access.deploy_token_create_group, access.deploy_token_delete_group.

**Required parameters:** `group_id (string)`

### `access.deploy_token_list_project` — Deploy Token List Project

_read-only_

List deploy tokens owned by a project. Returns: deploy tokens with id, name, username, scopes, revoked/expired state, expiry, and pagination metadata. See also: access.deploy_token_get_project, access.deploy_token_create_project, access.deploy_token_delete_project.

**Required parameters:** `project_id (string)`

### `access.invite_group` — Group Invite

Invite a user to a group by email or user ID with an access level. Returns: an invitation result with status, per-email messages, and any users queued for administrator approval. See also: access.invite_list_group, group.group_member_add, access.request_group.

**Required parameters:** `access_level (integer)`, `group_id (string)`

### `access.invite_list_group` — Group Invite List Pending

_read-only_

List a group's pending invitations. Returns: pending invitations with invite email, access level, creator, creation and expiry dates, plus pagination metadata. See also: access.invite_group, group.members.

**Required parameters:** `group_id (string)`

### `access.invite_list_project` — Project Invite List Pending

_read-only_

List a project's pending invitations. Returns: pending invitations with invite email, access level, creator, creation and expiry dates, plus pagination metadata. See also: access.invite_project, project.members.

**Required parameters:** `project_id (string)`

### `access.invite_project` — Project Invite

Invite a user to a project by email or user ID with an access level. Returns: an invitation result with status, per-email messages, and any users queued for administrator approval. See also: access.invite_list_project, project.member_add, access.request_project.

**Required parameters:** `access_level (integer)`, `project_id (string)`

### `access.request_group` — Access Request Request Group

Request access to a group as the authenticated user. Returns: the created access request with id, username, name, requested state, and requested_at timestamp. See also: access.request_list_group, access.approve_group, access.deny_group.

**Required parameters:** `group_id (string)`

### `access.request_list_group` — Access Request List Group

_read-only_

List pending access requests for a group. Returns: access requests with id, username, name, state, access level, requested/created timestamps, and pagination metadata. See also: access.approve_group, access.deny_group, group.members.

**Required parameters:** `group_id (string)`

### `access.request_list_project` — Access Request List Project

_read-only_

List pending access requests for a project. Returns: access requests with id, username, name, state, access level, requested/created timestamps, and pagination metadata. See also: access.approve_project, access.deny_project, project.members.

**Required parameters:** `project_id (string)`

### `access.request_project` — Access Request Request Project

Request access to a project as the authenticated user. Returns: the created access request with id, username, name, requested state, and requested_at timestamp. See also: access.request_list_project, access.approve_project, access.deny_project.

**Required parameters:** `project_id (string)`

### `access.token_group_create` — Group Access Token Create

Use for GitLab group access tokens: this action creates a group-scoped API token.

**Required parameters:** `group_id (string)`, `name (string)`, `scopes (array)`

### `access.token_group_get` — Group Access Token Get

_read-only_

Use for GitLab group access tokens: this action gets a group-scoped API token.

**Required parameters:** `group_id (string)`, `token_id (integer)`

### `access.token_group_list` — Group Access Token List

_read-only_

Use for GitLab group access tokens: this action lists group-scoped API tokens.

**Required parameters:** `group_id (string)`

### `access.token_group_revoke` — Group Access Token Revoke

_destructive_

Use for GitLab group access tokens: this action revokes a group-scoped API token.

**Required parameters:** `group_id (string)`, `token_id (integer)`

### `access.token_group_rotate` — Group Access Token Rotate

Use for GitLab group access tokens: this action rotates a group-scoped API token.

**Required parameters:** `group_id (string)`, `token_id (integer)`

### `access.token_group_rotate_self` — Group Access Token Rotate Self

Use for GitLab group access tokens: this action rotates the group-scoped token that authenticates this request itself, with no token_id parameter.

**Required parameters:** `group_id (string)`

### `access.token_personal_get` — Personal Access Token Get

_read-only_

Use for GitLab personal access tokens: this action gets a personal-scoped API token.

### `access.token_personal_list` — Personal Access Token List

_read-only_

Use for GitLab personal access tokens: this action lists personal-scoped API tokens.

### `access.token_personal_revoke` — Personal Access Token Revoke

_destructive_

Use for GitLab personal access tokens: this action revokes a personal-scoped API token.

**Required parameters:** `token_id (integer)`

### `access.token_personal_revoke_self` — Personal Access Token Revoke Self

_destructive_

Use for GitLab personal access tokens: this action revokes the personal-scoped token that authenticates this request itself, with no token_id parameter.

### `access.token_personal_rotate` — Personal Access Token Rotate

Use for GitLab personal access tokens: this action rotates a personal-scoped API token.

**Required parameters:** `token_id (integer)`

### `access.token_personal_rotate_self` — Personal Access Token Rotate Self

Use for GitLab personal access tokens: this action rotates the personal-scoped token that authenticates this request itself, with no token_id parameter.

### `access.token_project_create` — Project Access Token Create

Use for GitLab project access tokens: this action creates a project-scoped API token.

**Required parameters:** `name (string)`, `project_id (string)`, `scopes (array)`

### `access.token_project_get` — Project Access Token Get

_read-only_

Use for GitLab project access tokens: this action gets a project-scoped API token.

**Required parameters:** `project_id (string)`, `token_id (integer)`

### `access.token_project_list` — Project Access Token List

_read-only_

Use for GitLab project access tokens: this action lists project-scoped API tokens.

**Required parameters:** `project_id (string)`

### `access.token_project_revoke` — Project Access Token Revoke

_destructive_

Use for GitLab project access tokens: this action revokes a project-scoped API token.

**Required parameters:** `project_id (string)`, `token_id (integer)`

### `access.token_project_rotate` — Project Access Token Rotate

Use for GitLab project access tokens: this action rotates a project-scoped API token.

**Required parameters:** `project_id (string)`, `token_id (integer)`

### `access.token_project_rotate_self` — Project Access Token Rotate Self

Use for GitLab project access tokens: this action rotates the project-scoped token that authenticates this request itself, with no token_id parameter.

**Required parameters:** `project_id (string)`