Access

The users who sign in to the portal — each with the tenant ID of the records they see — and the team that uses the organization dashboard.

Families on this page

Family	Tools	read	write	destructive
portal-users — Portal users	11	4	2	5
users — Dashboard users	10	4	2	4
roles — Team roles	6	2	3	1

portal-users

Tool	Kind	Permission	Endpoint	What it does
dashboards_portal_users_list	read	portal-users.list	GET /v1/portal_users	List the portal users of the workspace.
dashboards_portal_users_get	read	portal-users.show	GET /v1/portal_users/:id	Fetch one portal user by id or external_id.
dashboards_portal_users_create	destructive	portal-users.create	POST /v1/portal_users	Create a portal user in the workspace as pending_invitation and send the invitation e-mail.
dashboards_portal_users_invite	destructive	portal-users.create	POST /v1/portal_users/invite	Invite a portal user — same as dashboards_portal_users_create, through the verb route: creates the user and sends the invitation e-mail.
dashboards_portal_users_update	write	portal-users.update	PATCH /v1/portal_users/:id	Update a portal user — e-mail, tenant_id, external_id, sso_only, custom_metadata, or status (active ↔ suspended only).
dashboards_portal_users_delete	destructive	portal-users.delete	DELETE /v1/portal_users/:id	Remove a portal user: a pending invitation is deleted, anyone else is suspended and loses portal access immediately.
dashboards_portal_users_resend_invite	destructive	portal-users.update	POST /v1/portal_users/:id/resend	Re-send the invitation e-mail (pending invitation, rotating the link) or the verification e-mail (pending verification).
dashboards_portal_users_email_preview	read	portal-users.show	GET /v1/portal_users/:id/email-preview	Render the invitation or verification e-mail of a pending portal user without sending it — subject and message, as the recipient would see it.
dashboards_portal_user_mappings_get	read	portal-users.list	GET /v1/portal_user_mappings	Show which entity feeds the workspace portal users (mapping, null when none, with the last sync outcome) and the entities that could, with their fields.
dashboards_portal_user_mappings_update	write	portal-users.create	PUT /v1/portal_user_mappings	Map an entity to the workspace portal users — one user per e-mail of its records, tenant ID from a field — and sync now.
dashboards_portal_user_mappings_delete	destructive	portal-users.create	DELETE /v1/portal_user_mappings	Stop syncing portal users from the mapped entity.

users

Tool	Kind	Permission	Endpoint	What it does
dashboards_dashboard_users_list	read	users.list	GET /v1/dashboard_users	List the dashboard (team) users of the organization.
dashboards_dashboard_users_get	read	users.show	GET /v1/dashboard_users/:id	Fetch one dashboard user with the roles they hold.
dashboards_dashboard_users_create	destructive	users.create	POST /v1/dashboard_users	Add a dashboard user to the organization and assign a role.
dashboards_dashboard_users_upsert	destructive	users.create	PUT /v1/dashboard_users	Create or update a dashboard user matched on id → external_id → email.
dashboards_dashboard_users_update	write	users.update	PATCH /v1/dashboard_users/:id	Update a dashboard user — name, role or status.
dashboards_dashboard_users_delete	destructive	users.delete	DELETE /v1/dashboard_users/:id	Remove a dashboard user.
dashboards_dashboard_users_workspaces_get	read	users.grant	GET /v1/dashboard_users/:id/workspaces	List every workspace of the organization flagged with whether a team member holds a grant on it (granted) and their role there.
dashboards_dashboard_users_workspaces_set	write	users.grant	PUT /v1/dashboard_users/:id/workspaces	Replace the set of workspaces a team member can open: workspace_ids is the final set, removed grants are paused.
dashboards_dashboard_users_resend_invite	destructive	users.create	POST /v1/dashboard_users/:id/resend	Re-send the invitation e-mail, with a fresh sign-in link, to a team member whose invitation is still pending.
dashboards_permissions_list	read	users.permissions	GET /v1/permissions	List the dashboard permissions a team member or role can carry, grouped by resource, with a label and description for each key.

roles

Tool	Kind	Permission	Endpoint	What it does
dashboards_team_roles_list	read	roles.list	GET /v1/team_roles	List the roles a dashboard user can hold, with their permission sets.
dashboards_team_roles_get	read	roles.show	GET /v1/team_roles/:id	Fetch one role with its permissions.
dashboards_team_roles_create	write	roles.create	POST /v1/team_roles	Create a custom role with an explicit permission list.
dashboards_team_roles_upsert	write	roles.create	PUT /v1/team_roles	Create or update a role matched on id → external_id → slug.
dashboards_team_roles_update	write	roles.update	PATCH /v1/team_roles/:id	Update a custom role.
dashboards_team_roles_delete	destructive	roles.delete	DELETE /v1/team_roles/:id	Delete a custom role.

---

The fields of each resource are in the API reference and in dashboards_schemas_get.

A tool you cannot run is not listed by tools/list at all. If one from this page is missing, see Authentication.